Edit tour

Windows Analysis Report
Ship Docs_ CI_BL_HBL_.exe

Overview

General Information

Sample name:	Ship Docs_ CI_BL_HBL_.exe
Analysis ID:	1430205
MD5:	6902d6b5857bdcde15b9af8aaf50b407
SHA1:	48acd39a0fd4b11c37e5b06d6d831d1825279f0f
SHA256:	4cf20ea54fb348cc2573628cf6d751faa35d3adf5317970068d28185c5a285c9
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Binary is likely a compiled AutoIt script file

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Installs a global keyboard hook

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Generic Downloader

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Ship Docs_ CI_BL_HBL_.exe (PID: 6576 cmdline: "C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe" MD5: 6902D6B5857BDCDE15B9AF8AAF50B407)

RegSvcs.exe (PID: 6600 cmdline: "C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://asec.ahnlab.com/ko/29133/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.myhydropowered.com", "Username": "antenna@myhydropowered.com", "Password": "jnKkQ2DFtjsDqGZ"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.4095884034.0000000000162000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4095884034.0000000000162000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4097012236.0000000002415000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.4097012236.0000000002415000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.4097012236.0000000002438000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1646045123.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1646045123.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000000.00000002.1646045123.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1646045123.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3415b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x341cd:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34257:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x342e9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34353:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x343c5:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3445b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x344eb:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Process Memory Space: Ship Docs_ CI_BL_HBL_.exe PID: 6576	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Ship Docs_ CI_BL_HBL_.exe PID: 6576	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 6600	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 6600	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.RegSvcs.exe.160000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.160000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.2.RegSvcs.exe.160000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.160000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3415b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x341cd:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34257:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x342e9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34353:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x343c5:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3445b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x344eb:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3415b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x341cd:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x34257:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x342e9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x34353:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x343c5:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3445b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x344eb:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x3235b:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x323cd:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x32457:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x324e9:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x32553:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x325c5:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x3265b:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x326eb:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 131.226.2.60, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 6600, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49732

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://mail.myhydropowered.com

Avira URL Cloud: Label: malware

Found malware configuration

Source: 0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "mail.myhydropowered.com", "Username": "antenna@myhydropowered.com", "Password": "jnKkQ2DFtjsDqGZ"}

Multi AV Scanner detection for domain / URL

Source: mail.myhydropowered.com	Virustotal: Detection: 5%			Perma Link
Source: http://mail.myhydropowered.com	Virustotal: Detection: 5%			Perma Link

Multi AV Scanner detection for submitted file

Source: Ship Docs_ CI_BL_HBL_.exe	Virustotal: Detection: 21%			Perma Link
Source: Ship Docs_ CI_BL_HBL_.exe	ReversingLabs: Detection: 21%

Machine Learning detection for sample

Source: Ship Docs_ CI_BL_HBL_.exe

Joe Sandbox ML: detected

Source: Ship Docs_ CI_BL_HBL_.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49730 version: TLS 1.2

Source:	Binary string: wntdll.pdbUGP source: Ship Docs_ CI_BL_HBL_.exe, 00000000.00000003.1643593577.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, Ship Docs_ CI_BL_HBL_.exe, 00000000.00000003.1643301135.0000000003EA0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Ship Docs_ CI_BL_HBL_.exe, 00000000.00000003.1643593577.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, Ship Docs_ CI_BL_HBL_.exe, 00000000.00000003.1643301135.0000000003EA0000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FE4696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00FE4696
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FEC9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00FEC9C7
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FEC93C FindFirstFileW,FindClose,	0_2_00FEC93C
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FEF200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00FEF200
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FEF35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00FEF35D
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FEF65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00FEF65E
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FE3A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00FE3A2B
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FE3D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00FE3D4E
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FEBF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00FEBF27

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 1.2.RegSvcs.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1646045123.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: global traffic

TCP traffic: 192.168.2.4:49732 -> 131.226.2.60:587

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 104.26.13.205 104.26.13.205
Source: Joe Sandbox View	IP Address: 131.226.2.60 131.226.2.60

Source: Joe Sandbox View

ASN Name: UNASSIGNED UNASSIGNED

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: ip-api.com

Source: global traffic

TCP traffic: 192.168.2.4:49732 -> 131.226.2.60:587

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00FF25E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00FF25E2

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0Host: api.ipify.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: api.ipify.org

Source: RegSvcs.exe, 00000001.00000002.4097012236.0000000002401000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: Ship Docs_ CI_BL_HBL_.exe, 00000000.00000002.1646045123.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002401000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4095884034.0000000000162000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: RegSvcs.exe, 00000001.00000002.4097012236.0000000002502000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.00000000025A3000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002651000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002463000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002438000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002851000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.00000000026D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mail.myhydropowered.com
Source: RegSvcs.exe, 00000001.00000002.4100404014.0000000005730000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002502000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.00000000025A3000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4100404014.0000000005670000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002651000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4100404014.0000000005719000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002463000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002438000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4096669187.00000000007D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.i.lencr.org/0
Source: RegSvcs.exe, 00000001.00000002.4100404014.0000000005730000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002502000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.00000000025A3000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4100404014.0000000005670000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002651000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4100404014.0000000005719000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002463000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002438000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4096669187.00000000007D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: RegSvcs.exe, 00000001.00000002.4097012236.00000000023B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000001.00000002.4100404014.0000000005730000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4100404014.0000000005670000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002438000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4096669187.00000000007D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: RegSvcs.exe, 00000001.00000002.4100404014.0000000005730000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4100404014.0000000005670000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002438000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4096669187.00000000007D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Ship Docs_ CI_BL_HBL_.exe, 00000000.00000002.1646045123.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4095884034.0000000000162000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: Ship Docs_ CI_BL_HBL_.exe, 00000000.00000002.1646045123.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.00000000023B1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4095884034.0000000000162000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://api.ipify.org
Source: RegSvcs.exe, 00000001.00000002.4097012236.00000000023B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/
Source: RegSvcs.exe, 00000001.00000002.4097012236.00000000023B1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.ipify.org/t

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443

Source: unknown

HTTPS traffic detected: 104.26.13.205:443 -> 192.168.2.4:49730 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.raw.unpack, oAKy.cs

.Net Code: jBGXTQhp

Installs a global keyboard hook

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Windows user hook set: 0 keyboard low level C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Jump to behavior

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00FF425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00FF425A

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00FF4458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00FF4458

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

0_2_00FF425A

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00FE0219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00FE0219

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_0100CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0100CDAC

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.RegSvcs.exe.160000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.1646045123.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00F83B4C
Source: Ship Docs_ CI_BL_HBL_.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: Ship Docs_ CI_BL_HBL_.exe, 00000000.00000000.1632616532.0000000001035000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_2026984c-0
Source: Ship Docs_ CI_BL_HBL_.exe, 00000000.00000000.1632616532.0000000001035000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_0b0b9658-f
Source: Ship Docs_ CI_BL_HBL_.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_e4da1ade-e
Source: Ship Docs_ CI_BL_HBL_.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_77867309-a

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00FE40B1: CreateFileW,_memset,DeviceIoControl,CloseHandle,

0_2_00FE40B1

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00FD8858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00FD8858

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00FE545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00FE545F

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00F8E800	0_2_00F8E800
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FADBB5	0_2_00FADBB5
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00F8E060	0_2_00F8E060
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_0100804A	0_2_0100804A
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00F94140	0_2_00F94140
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FA2405	0_2_00FA2405
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FB6522	0_2_00FB6522
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FB267E	0_2_00FB267E
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_01000665	0_2_01000665
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00F96843	0_2_00F96843
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FA283A	0_2_00FA283A
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FB89DF	0_2_00FB89DF
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FB6A94	0_2_00FB6A94
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00F98A0E	0_2_00F98A0E
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_01000AE2	0_2_01000AE2
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FE8B13	0_2_00FE8B13
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FDEB07	0_2_00FDEB07
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FACD61	0_2_00FACD61
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FB7006	0_2_00FB7006
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00F93190	0_2_00F93190
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00F9710E	0_2_00F9710E
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00F81287	0_2_00F81287
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FA33C7	0_2_00FA33C7
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FAF419	0_2_00FAF419
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FA16C4	0_2_00FA16C4
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00F95680	0_2_00F95680
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FA78D3	0_2_00FA78D3
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00F958C0	0_2_00F958C0
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FA1BB8	0_2_00FA1BB8
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FB9D05	0_2_00FB9D05
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00F8FE40	0_2_00F8FE40
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FABFE6	0_2_00FABFE6
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FA1FD0	0_2_00FA1FD0
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00EC3650	0_2_00EC3650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00AB41F0	1_2_00AB41F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00AB4AC0	1_2_00AB4AC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00AB3EA8	1_2_00AB3EA8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0603076B	1_2_0603076B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0603B548	1_2_0603B548
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_060333F0	1_2_060333F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06036818	1_2_06036818
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06038960	1_2_06038960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0603E9E8	1_2_0603E9E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_0603AE68	1_2_0603AE68
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_06035AE2	1_2_06035AE2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_060390AB	1_2_060390AB

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: String function: 00FA0D27 appears 70 times
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: String function: 00F87F41 appears 35 times
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: String function: 00FA8B40 appears 42 times

Source: Ship Docs_ CI_BL_HBL_.exe, 00000000.00000003.1641426481.0000000003FCD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Ship Docs_ CI_BL_HBL_.exe
Source: Ship Docs_ CI_BL_HBL_.exe, 00000000.00000003.1642566100.0000000003E23000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs Ship Docs_ CI_BL_HBL_.exe
Source: Ship Docs_ CI_BL_HBL_.exe, 00000000.00000002.1646045123.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamea0cf1604-b53d-4eee-8f70-62d41cceeafc.exe4 vs Ship Docs_ CI_BL_HBL_.exe

Source: Ship Docs_ CI_BL_HBL_.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 1.2.RegSvcs.exe.160000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.1646045123.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.raw.unpack, ekKu0.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.raw.unpack, vKf1z6NvS.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.raw.unpack, ZNAvlD7qmXc.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.raw.unpack, U2doU2.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.raw.unpack, BgffYko.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.raw.unpack, HrTdA63.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.raw.unpack, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.raw.unpack, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.raw.unpack, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.raw.unpack, Vvp22TrBv9g.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/4@3/3

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00FEA2D5 GetLastError,FormatMessageW,

0_2_00FEA2D5

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FD8713 AdjustTokenPrivileges,CloseHandle,		0_2_00FD8713
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FD8CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00FD8CC3

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00FEB59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00FEB59E

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00FFF121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00FFF121

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00FF86D0 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_00FF86D0

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00F84FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00F84FE9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

File created: C:\Users\user\AppData\Local\Temp\aut7C1F.tmp

Jump to behavior

Source: Ship Docs_ CI_BL_HBL_.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Ship Docs_ CI_BL_HBL_.exe	Virustotal: Detection: 21%
Source: Ship Docs_ CI_BL_HBL_.exe	ReversingLabs: Detection: 21%

Source: unknown	Process created: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe "C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe"
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe"
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: Ship Docs_ CI_BL_HBL_.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Ship Docs_ CI_BL_HBL_.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Ship Docs_ CI_BL_HBL_.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Ship Docs_ CI_BL_HBL_.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Ship Docs_ CI_BL_HBL_.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Ship Docs_ CI_BL_HBL_.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Ship Docs_ CI_BL_HBL_.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: Ship Docs_ CI_BL_HBL_.exe, 00000000.00000003.1643593577.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, Ship Docs_ CI_BL_HBL_.exe, 00000000.00000003.1643301135.0000000003EA0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Ship Docs_ CI_BL_HBL_.exe, 00000000.00000003.1643593577.0000000003D00000.00000004.00001000.00020000.00000000.sdmp, Ship Docs_ CI_BL_HBL_.exe, 00000000.00000003.1643301135.0000000003EA0000.00000004.00001000.00020000.00000000.sdmp

Source: Ship Docs_ CI_BL_HBL_.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Ship Docs_ CI_BL_HBL_.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Ship Docs_ CI_BL_HBL_.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Ship Docs_ CI_BL_HBL_.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Ship Docs_ CI_BL_HBL_.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00FFC304 LoadLibraryA,GetProcAddress,

0_2_00FFC304

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FE8719 push FFFFFF8Bh; iretd	0_2_00FE871B
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FAE94F push edi; ret	0_2_00FAE951
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FAEA68 push esi; ret	0_2_00FAEA6A
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FA8B85 push ecx; ret	0_2_00FA8B98
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FAEC43 push esi; ret	0_2_00FAEC45
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FAED2C push edi; ret	0_2_00FAED2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00AB0B4F push edi; ret	1_2_00AB0CC2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_00AB0C95 push edi; retf	1_2_00AB0C3A

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00F84A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00F84A35
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_010055FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_010055FD

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00FA33C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00FA33C7

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: Ship Docs_ CI_BL_HBL_.exe, 00000000.00000002.1646045123.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4095884034.0000000000162000.00000040.80000000.00040000.00000000.sdmp

Binary or memory string: SBIEDLL.DLLESELECT * FROM WIN32_COMPUTERSYSTEM

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599652	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599420	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599309	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595748	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594437	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7981			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1873			Jump to behavior

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-98648

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

API coverage: 4.8 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FE4696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00FE4696
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FEC9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00FEC9C7
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FEC93C FindFirstFileW,FindClose,	0_2_00FEC93C
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FEF200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00FEF200
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FEF35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00FEF35D
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FEF65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00FEF65E
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FE3A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00FE3A2B
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FE3D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00FE3D4E
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FEBF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00FEBF27

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00F84AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00F84AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599652	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599420	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599309	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99885	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99776	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99666	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99542	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99432	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99323	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99213	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99096	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98964	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98854	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98745	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98635	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98526	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98417	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98307	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98198	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98089	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595859	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595748	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595640	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595531	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595312	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594437	Jump to behavior

Source: RegSvcs.exe, 00000001.00000002.4095884034.0000000000162000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: vmware
Source: RegSvcs.exe, 00000001.00000002.4100404014.0000000005670000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllp
Source: RegSvcs.exe, 00000001.00000002.4095884034.0000000000162000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: VMwareVBox

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	API call chain: ExitProcess graph end node			graph_0-97659
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	API call chain: ExitProcess graph end node			graph_0-97848

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 1_2_00AB7ED0 CheckRemoteDebuggerPresent,

1_2_00AB7ED0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00FF41FD BlockInput,

0_2_00FF41FD

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00F83B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00F83B4C

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00FB5CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00FB5CCC

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00FFC304 LoadLibraryA,GetProcAddress,

0_2_00FFC304

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00EC34E0 mov eax, dword ptr fs:[00000030h]	0_2_00EC34E0
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00EC3540 mov eax, dword ptr fs:[00000030h]	0_2_00EC3540
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00EC1ED0 mov eax, dword ptr fs:[00000030h]	0_2_00EC1ED0

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00FD81F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00FD81F7

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FAA395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_00FAA395
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FAA364 SetUnhandledExceptionFilter,		0_2_00FAA364

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 38D008

Jump to behavior

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00FD8C93 LogonUserW,

0_2_00FD8C93

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00F83B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00F83B4C

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00F84A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00F84A35

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00FE4EF5 mouse_event,

0_2_00FE4EF5

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe"

Jump to behavior

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

0_2_00FD81F7

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00FE4C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00FE4C03

Source: Ship Docs_ CI_BL_HBL_.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Ship Docs_ CI_BL_HBL_.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00FA886B cpuid

0_2_00FA886B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00FB50D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00FB50D7

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00FC2230 GetUserNameW,

0_2_00FC2230

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00FB418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00FB418A

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe

Code function: 0_2_00F84AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00F84AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 1.2.RegSvcs.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4095884034.0000000000162000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4097012236.0000000002415000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4097012236.0000000002438000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1646045123.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ship Docs_ CI_BL_HBL_.exe PID: 6576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6600, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Ship Docs_ CI_BL_HBL_.exe	Binary or memory string: WIN_81
Source: Ship Docs_ CI_BL_HBL_.exe	Binary or memory string: WIN_XP
Source: Ship Docs_ CI_BL_HBL_.exe	Binary or memory string: WIN_XPe
Source: Ship Docs_ CI_BL_HBL_.exe	Binary or memory string: WIN_VISTA
Source: Ship Docs_ CI_BL_HBL_.exe	Binary or memory string: WIN_7
Source: Ship Docs_ CI_BL_HBL_.exe	Binary or memory string: WIN_8
Source: Ship Docs_ CI_BL_HBL_.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 1.2.RegSvcs.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4095884034.0000000000162000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4097012236.0000000002415000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1646045123.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ship Docs_ CI_BL_HBL_.exe PID: 6576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6600, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 1.2.RegSvcs.exe.160000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Ship Docs_ CI_BL_HBL_.exe.ed0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4095884034.0000000000162000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4097012236.0000000002415000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4097012236.0000000002438000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1646045123.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Ship Docs_ CI_BL_HBL_.exe PID: 6576, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6600, type: MEMORYSTR

Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FF6596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00FF6596
Source: C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe	Code function: 0_2_00FF6A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00FF6A5A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	221 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	38 System Information Discovery	Distributed Component Object Model	221 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	451 Security Software Discovery	SSH	3 Clipboard Data	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	131 Virtualization/Sandbox Evasion	Cached Domain Credentials	131 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Ship Docs_ CI_BL_HBL_.exe	21%	Virustotal		Browse
Ship Docs_ CI_BL_HBL_.exe	21%	ReversingLabs	Win32.Trojan.Strab
Ship Docs_ CI_BL_HBL_.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
mail.myhydropowered.com	5%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://x1.c.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://x1.i.lencr.org/0	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe
http://r3.i.lencr.org/0	0%	URL Reputation	safe
http://mail.myhydropowered.com	100%	Avira URL Cloud	malware
http://mail.myhydropowered.com	5%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.myhydropowered.com	131.226.2.60	true	true	5%, Virustotal, Browse	unknown
api.ipify.org	104.26.13.205	true	false		high
ip-api.com	208.95.112.1	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://api.ipify.org/	false		high
http://ip-api.com/line/?fields=hosting	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://r3.o.lencr.org0	RegSvcs.exe, 00000001.00000002.4100404014.0000000005730000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002502000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.00000000025A3000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4100404014.0000000005670000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002651000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4100404014.0000000005719000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002463000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002438000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4096669187.00000000007D1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.ipify.org	Ship Docs_ CI_BL_HBL_.exe, 00000000.00000002.1646045123.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.00000000023B1000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4095884034.0000000000162000.00000040.80000000.00040000.00000000.sdmp	false		high
http://mail.myhydropowered.com	RegSvcs.exe, 00000001.00000002.4097012236.0000000002502000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.00000000025A3000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002651000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002463000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002438000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002851000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.00000000026D6000.00000004.00000800.00020000.00000000.sdmp	false	5%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://account.dyn.com/	Ship Docs_ CI_BL_HBL_.exe, 00000000.00000002.1646045123.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4095884034.0000000000162000.00000040.80000000.00040000.00000000.sdmp	false		high
https://api.ipify.org/t	RegSvcs.exe, 00000001.00000002.4097012236.00000000023B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000001.00000002.4097012236.00000000023B1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	RegSvcs.exe, 00000001.00000002.4100404014.0000000005730000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4100404014.0000000005670000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002438000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4096669187.00000000007D1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://x1.i.lencr.org/0	RegSvcs.exe, 00000001.00000002.4100404014.0000000005730000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4100404014.0000000005670000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002438000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4096669187.00000000007D1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://ip-api.com	RegSvcs.exe, 00000001.00000002.4097012236.0000000002401000.00000004.00000800.00020000.00000000.sdmp	false		high
http://r3.i.lencr.org/0	RegSvcs.exe, 00000001.00000002.4100404014.0000000005730000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002502000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.00000000025A3000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4100404014.0000000005670000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002651000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4100404014.0000000005719000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002463000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4097012236.0000000002438000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.4096669187.00000000007D1000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
104.26.13.205	api.ipify.org	United States	13335	CLOUDFLARENETUS	false
131.226.2.60	mail.myhydropowered.com	United States	16797	UNASSIGNED	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1430205
Start date and time:	2024-04-23 10:14:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Ship Docs_ CI_BL_HBL_.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/4@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 57 Number of non-executed functions: 269
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:14:55	API Interceptor	9678225x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	sZXuT60Q6P.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Comprobante.xlam.xlsx	Get hash	malicious	GuLoader	Browse	ip-api.com/line/?fields=hosting
	dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	TRANSPORT_INSTRUCTION_MR.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	ip-api.com/line/?fields=hosting
	Gesti#U00f3n Pago a Proveedores - Liquidaci#U00f3n anticipo.hta	Get hash	malicious	AgentTesla, GuLoader	Browse	ip-api.com/line/?fields=hosting
	BNP Paribas_RemittanceAdviceNotification106173036326.doc	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	QUOTE RNP002673CC1F68.pdf.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	Unpaid Orders.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	rPayment_AdviceJ001222042024.bat	Get hash	malicious	AgentTesla, GuLoader	Browse	ip-api.com/line/?fields=hosting
104.26.13.205	SecuriteInfo.com.Trojan.DownLoaderNET.960.9931.28151.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/
	Sky-Beta-Setup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	ArenaWarSetup.exe	Get hash	malicious	Stealit	Browse	api.ipify.org/?format=json
	Sky-Beta Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/?format=json
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	E4sbo4F6Sz.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	SecuriteInfo.com.Win64.RATX-gen.31127.4101.exe	Get hash	malicious	PureLog Stealer, Targeted Ransomware	Browse	api.ipify.org/
131.226.2.60	order & specification.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	Order Details and Specifications.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	RFQ-16042024-2_2403872952 .pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	QOUTATION FORMS_220707-400.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	Payment Receipt for Customer-PH00236855_PDF.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	NEW GRACE- RFQ .doc	Get hash	malicious	AgentTesla, GuLoader	Browse
	FACT AZUR TJ .pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	FACT AZUR TJ .pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	RFQ_.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse
	SCO 2024.PDF.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	sZXuT60Q6P.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Comprobante.xlam.xlsx	Get hash	malicious	GuLoader	Browse	208.95.112.1
	dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	TRANSPORT_INSTRUCTION_MR.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	Gesti#U00f3n Pago a Proveedores - Liquidaci#U00f3n anticipo.hta	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	BNP Paribas_RemittanceAdviceNotification106173036326.doc	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	QUOTE RNP002673CC1F68.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Unpaid Orders.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	rPayment_AdviceJ001222042024.bat	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
api.ipify.org	sZXuT60Q6P.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	Urgent PO 18-3081 Confirmation.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	171385176494b902dcff1b37e29676f3c17c0cb0090fe4b0a33f3f6a97431f2344b56a8ec2497.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	PO No. 2430800015.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Texas_Tool_Purchase_Order#T18834-1.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	DHL_RF_20200712_BN_N0095673441.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.12.205
	TRANSPORT_INSTRUCTION_MR.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	gmb.xls	Get hash	malicious	Unknown	Browse	104.26.12.205
	Swift_Message#1234323456.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	172.67.74.152
	QUOTE RNP002673CC1F68.pdf.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
mail.myhydropowered.com	order & specification.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	131.226.2.60
	Order Details and Specifications.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	131.226.2.60
	RFQ-16042024-2_2403872952 .pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	131.226.2.60
	QOUTATION FORMS_220707-400.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	131.226.2.60

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	sZXuT60Q6P.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
	ShadowFury.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	anuwhqTXGt.dll	Get hash	malicious	Unknown	Browse	172.67.207.72
	ShadowFury.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	anuwhqTXGt.dll	Get hash	malicious	Unknown	Browse	104.21.45.11
	Urgent PO 18-3081 Confirmation.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Gam.xls	Get hash	malicious	Unknown	Browse	172.67.180.182
	Quotation.xls	Get hash	malicious	Remcos	Browse	172.67.206.230
	Invoice.doc	Get hash	malicious	Unknown	Browse	172.67.175.222
	171385176494b902dcff1b37e29676f3c17c0cb0090fe4b0a33f3f6a97431f2344b56a8ec2497.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	104.26.12.205
TUT-ASUS	sZXuT60Q6P.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Comprobante.xlam.xlsx	Get hash	malicious	GuLoader	Browse	208.95.112.1
	dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	dekont.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	TRANSPORT_INSTRUCTION_MR.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	Gesti#U00f3n Pago a Proveedores - Liquidaci#U00f3n anticipo.hta	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
	BNP Paribas_RemittanceAdviceNotification106173036326.doc	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	QUOTE RNP002673CC1F68.pdf.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	Unpaid Orders.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	rPayment_AdviceJ001222042024.bat	Get hash	malicious	AgentTesla, GuLoader	Browse	208.95.112.1
UNASSIGNED	Unpaid Orders.exe	Get hash	malicious	AgentTesla	Browse	131.226.4.7
	pGTQLD9ukH.elf	Get hash	malicious	Mirai	Browse	156.134.164.50
	b3astmode.arm7.elf	Get hash	malicious	Mirai	Browse	206.67.215.192
	order & specification.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	131.226.2.60
	Order Details and Specifications.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	131.226.2.60
	RFQ-16042024-2_2403872952 .pdf.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	131.226.2.60
	QOUTATION FORMS_220707-400.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	131.226.2.60
	jwoOaBkH4i.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.72.176.97
	kl7nWo7u71.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.72.188.93
	OPs5j7Yjb8.elf	Get hash	malicious	Gafgyt, Mirai	Browse	156.72.176.97

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	sZXuT60Q6P.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	Urgent PO 18-3081 Confirmation.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	171385176494b902dcff1b37e29676f3c17c0cb0090fe4b0a33f3f6a97431f2344b56a8ec2497.dat-decoded.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	PO No. 2430800015.exe	Get hash	malicious	AgentTesla	Browse	104.26.13.205
	PO 26519PZ F30 59.vbs	Get hash	malicious	FormBook, GuLoader	Browse	104.26.13.205
	Texas_Tool_Purchase_Order#T18834-1.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	DHL_RF_20200712_BN_N0095673441.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	e-dekont_swift-details.vbs	Get hash	malicious	Unknown	Browse	104.26.13.205
	TRANSPORT_INSTRUCTION_MR.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205
	Gesti#U00f3n Pago a Proveedores - Liquidaci#U00f3n anticipo.hta	Get hash	malicious	AgentTesla, GuLoader	Browse	104.26.13.205

Process:	C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe
File Type:	data
Category:	dropped
Size (bytes):	147946
Entropy (8bit):	7.90028433812621
Encrypted:	false
SSDEEP:	3072:ecIb4sw8Ut5EbFSOuZ7W5bfIKR820OsHkEhU02rEOpjCtIQLJHh:OXFUtLwC2pjOIQLJHh
MD5:	F16A434672D61311DBCB22282DB21ACF
SHA1:	8841E8931AC83A9017AF6F629F6BEF05CEF6229C
SHA-256:	A4B57F1820B9458C9DAB0AC665C85FA92C7F7A3F7A7C03135FB1997BCBE4A714
SHA-512:	1AAC778E36561A432BF5F538903486183AF03AD6E6E8FA26D3EE04124DD12E15DA5BBFFB8D0664A2E122AE4FE2E68E8CD3447DB240671E4ACB51DDD7C0D11C44
Malicious:	false
Reputation:	low
Preview:	EA06.....X.....G....6..N..).f.6.Q. .D.Y.T...T...:..E&...V.U.M..U..b..\|.Sg......So.Mf...;...t..O=.B..{..0.]...\t.#0H.Rm..V.V...x.....F.V....N....1..V.T{......J.R,. V(....Fj..Z.......U..N.f.W..i@..~sT...b....'..G..l;..:+A...........%.^j.j...h.f8.I...UA.....`..\|@....#..)...OD..... ..g...b.......k..y6.H.5...v.......E......O.3..$.l.H.Vj3m'F.Z..g.....N..+.@........p..."9:..$.o%..).Q...?..O.B....N.......tns*.F.A..m>.n.....<.>.#.h../.:.$.R+S.=..H.k+\....s.L!./.~u..~._9..m4..V.^s.....[h.Vg...y...VYV...i$.yt.H+.\..F...(...5..}w...1..N.t{..Y..r...m"C..u4.IP.!0..&.....`..l....n..Q.6.h.Q........... .B..HI.....A.....?.V..\.;.WNG...l.kw....0...n...$.....Q..).....u..4..6...P....)..N+..]F.K.V,...}...h...n.W..........j..l,....H..n..G....c.Z..c..R....k\z...<q6...'....R...k+..$..4.OY.Lg..\|V....2....(....1...5...T.W...,v.9.i.t0).W..M....j.E...4...)9.Wo.J..sZ...wE^.g.U+5.[s_...3.Lz.S.L..J.B9J.. u...L.Nf..... ...^.b...lg.-=V9......j.J...<z.?U7.Cn3.=.gz..4H..UX.

C:\Users\user\AppData\Local\Temp\aut7C5F.tmp

Download File

Process:	C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe
File Type:	data
Category:	dropped
Size (bytes):	9870
Entropy (8bit):	7.599104754585102
Encrypted:	false
SSDEEP:	192:C+cKwsF7SQU2a5C/x9x7PKe+MCJAUqLrTCVOLVa:h7wsF7SQUI7PKe+zpqXTCVOLQ
MD5:	6B3A99E7DECE4DCF5432F2F3B6182C02
SHA1:	D16C41168D815013650EFCCBB7210965FC79EB74
SHA-256:	B723D4B1DA299B4DB151C7F394EA9972A7E3BBAEF6741DF6C82E03635DFFE95A
SHA-512:	6C0F928576560A27544D6A1D1107AF8CB8D06419EBB3BC60004E1DE96BCC186A7DB49CA90166C4E7B2C2FAFDA014D9BF627193C6476D56C16E27D24140E69BB5
Malicious:	false
Reputation:	low
Preview:	EA06..p0.M'.)..e4.N'.).......T9..l.0L.s.5..3..s.4.8.......k8.Yls....c..&S...k6...S....1.L&.i..i5.M,S....K.@...7...p. ....P.o...m.X.V........9....3...f....s2.Xf@.]..g3@..h.m.M.......8.l..6.....a........i4........g3Y...c ._..k4...d....H, ......Ac.H..g...(.F..=d....>....C`....@02..N@...u......Y..ab.M.]>.$....M.x>;$....N.j.;%....X.j.;%......j.;,....P'.b.5... .^..f./Z..@F.6.z..G......`......i..G../Z...zqd...l.;.........\|......7...}3{(........;^..l =..p.........3p.o....,.......x.....H<.lX.:...b.....,. ...2...f.[...K.)....b..i\|v F......X......`....,.9....5...._..l......>K.....ir.e....[4..d..f.y.....,.....S >..p...........s9.... !..Y....f...ja4....ea.h,.p.....,.a8.,..3........f.....f ....,j.0..&...J......f ....6K%.ke..f....L..;2.X...4.Y.V@.Fn.....f@....l..05.....!;3.X...c )D.g6... ...'&`....,f.6..&....r...Brh.....l...i2...B....@.......d.L.`!.....P...@X5d..lSK...9...!;5.X...cVY......'.B...,vl.!..>.a..l...M..@...X...b.M&.X..B.a.Q...sp..X..9..o5..f.!...,vn......d...

C:\Users\user\AppData\Local\Temp\cerecloths

Download File

Process:	C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe
File Type:	ASCII text, with very long lines (28720), with no line terminators
Category:	dropped
Size (bytes):	28720
Entropy (8bit):	3.5944300830265745
Encrypted:	false
SSDEEP:	768:wiTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbBE+Ii6m34vfF3if6gy8:wiTZ+2QoioGRk6ZklputwjpjBkCiw2RJ
MD5:	2932EA311C40745C8C322DB4CA4C8DC2
SHA1:	D0EDB2A4B5D550DAA68504E76EA0D76A6C1F525B
SHA-256:	C7BD4A6EF67FA983620F273BD6914594BF72AFD183CDA04BC32E9807B37D70DB
SHA-512:	A1ABBBAC8C893AD6DA7E333C8C0D9C9C9C383358B1BDB05DA821F1EEA701918976B165EF373E43F8000526AB63B68D98399C9C814CF4718A36F46B595FF60725
Malicious:	false
Reputation:	low
Preview:	048B4C24088B008B093BC8760483C8FFC31BC0F7D8C38B0x558bec81eccc0200005657b86b00000066894584b96500000066894d86ba7200000066895588b86e0000006689458ab96500000066894d8cba6c0000006689558eb83300000066894590b93200000066894d92ba2e00000066895594b86400000066894596b96c00000066894d98ba6c0000006689559a33c06689459cb96e00000066898d44ffffffba7400000066899546ffffffb86400000066898548ffffffb96c00000066898d4affffffba6c0000006689954cffffffb82e0000006689854effffffb96400000066898d50ffffffba6c00000066899552ffffffb86c00000066898554ffffff33c966898d56ffffffba75000000668955d0b873000000668945d2b96500000066894dd4ba72000000668955d6b833000000668945d8b93200000066894ddaba2e000000668955dcb864000000668945deb96c00000066894de0ba6c000000668955e233c0668945e4b96100000066898d68ffffffba640000006689956affffffb8760000006689856cffffffb96100000066898d6effffffba7000000066899570ffffffb86900000066898572ffffffb93300000066898d74ffffffba3200000066899576ffffffb82e00000066898578ffffffb96400000066898d7affffffba6c0000006689957cffffffb86c00000066

C:\Users\user\AppData\Local\Temp\nouses

Download File

Process:	C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe
File Type:	data
Category:	dropped
Size (bytes):	243200
Entropy (8bit):	6.544012199447945
Encrypted:	false
SSDEEP:	6144:KgaYD1hdH9/pzLUX20fvk77iBP2AUWreniJvI3QhQALjZUoQa5V4g5ZKV0I78ZAg:F1hdH9/psX20fvk77KPIWrnJvI36QA3v
MD5:	2D6EFFFCD0A59B7582BA7DA5892179C1
SHA1:	8CCA792B41B046590309E03D1E06D106FC1D3C09
SHA-256:	8C31F41F2FC53753F56C616D3083AEC076C8B4237EE41598F1C503F55EEFF854
SHA-512:	C60E07EA1066FCB64610026D0C796A17E1635A5648B0CCC048EE414E244AE232FD1EC3E2DFFD3DEACF6DB8A268D3539CA884890A4C81913E68632A8B6EF59407
Malicious:	false
Reputation:	low
Preview:	.c.YW6TG]ZGA.YN.DO9TYT6.GYZGA9ZYNSDO9TYT6TGYZGA9ZYNSDO9TYT6.GYZI^.TY.Z.n.U..../0)g1K5><2)oZ57:Y g;?g3L4y'=d.v.y9Y0"wWJK.ZYNSDO9..T6.FZZh.=<YNSDO9TY.6VFR[LA9.ZNSLO9TYT6..ZZGa9ZY.PDO9.YT.TGYXGA=ZYNSDO9PYT6TGYZGa=ZYLSDO9TYV6..YZWA9JYNSD_9TIT6TGYZWA9ZYNSDO9TY..WG.ZGA9.ZN.AO9TYT6TGYZGA9ZYNSDO9PYX6TGYZGA9ZYNSDO9TYT6TGYZGA9ZYNSDO9TYT6TGYZGA9ZYNSDO9TyT6\GYZGA9ZYNSDG.TY.6TGYZGA9ZYN}0A YT6..ZZGa9ZY.PDO;TYT6TGYZGA9ZYNsDOYz+'D7GYZ.D9ZY.PDO?TYT.WGYZGA9ZYNSDO9.YTvz5<6("9ZUNSDO9PYT4TGY.DA9ZYNSDO9TYT6.GY.GA9ZYNSDO9TYT6TG..DA9ZYN.DO9VYQ6..[Z.u8ZZNSDN9T_T6TGYZGA9ZYNSDO9TYT6TGYZGA9ZYNSDO9TYT6TGYZGA9ZYNN........:gP%F.\|.).G..G..O..V.R.BN...B....s2_..A.Ui..F....C.O\#F.....k$DHZ1.A{H8.Z...sr0.r._:.....9s.4_j.m...w...U3.a..:..,V9w5F$+<t. _;+'.F.8TYT6........06..b:[G`$,.....H!....YT60GYZ5A9Z8NSD.9TY;6TG7ZGAGZYN-DO9.YT6.GYZpA9Z\|NSD"9TYp6TG'ZGA.'VA...P'..6TGYZr..j.#...f.n..q(.9.[b... .r..Qe.H1.0.u...].R..Cd?Az..F8\]KQCK:XdZ}...{EE=_[IWGC.Z...f.\|...."....#.JTGYZGA.ZY.SDO..Y.6TG.Z.A..YNS.9.Y.6...Z

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.934705332372938
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Ship Docs_ CI_BL_HBL_.exe
File size:	1'036'800 bytes
MD5:	6902d6b5857bdcde15b9af8aaf50b407
SHA1:	48acd39a0fd4b11c37e5b06d6d831d1825279f0f
SHA256:	4cf20ea54fb348cc2573628cf6d751faa35d3adf5317970068d28185c5a285c9
SHA512:	9cc8c63db4ebd12fe35cec61d586445d64b184e111ac258b04159c202f05bdb010f83101b5f2ae645b9b96e4f2d694542ae58a7db594a060b2629330fde5decc
SSDEEP:	24576:CAHnh+eWsN3skA4RV1Hom2KXMmHarkCe0UbtW5:Fh+ZkldoPK8Yarhmm
TLSH:	15259C0273D1D036FFAB92739B6AB2015ABD79254133852F13981DB9BD701B2273E663
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x42800a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66273027 [Tue Apr 23 03:51:03 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007F932C8EE26Dh
jmp 00007F932C8E1024h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F932C8E11AAh
cmp edi, eax
jc 00007F932C8E150Eh
bt dword ptr [004C41FCh], 01h
jnc 00007F932C8E11A9h
rep movsb
jmp 00007F932C8E14BCh
cmp ecx, 00000080h
jc 00007F932C8E1374h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F932C8E11B0h
bt dword ptr [004BF324h], 01h
jc 00007F932C8E1680h
bt dword ptr [004C41FCh], 00000000h
jnc 00007F932C8E134Dh
test edi, 00000003h
jne 00007F932C8E135Eh
test esi, 00000003h
jne 00007F932C8E133Dh
bt edi, 02h
jnc 00007F932C8E11AFh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F932C8E11B3h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F932C8E1205h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbc0cc	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x32aec	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xfb000	0x7134	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4b50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dfdd	0x8e000	310e36668512d53489c005622bb1b4a9	False	0.5735602580325704	data	6.675248351711057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2fd8e	0x2fe00	748cf1ab2605ce1fd72d53d912abb68f	False	0.32828818537859006	data	5.763244005758284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbf000	0x8f74	0x5200	aae9601d920f07080bdfadf43dfeff12	False	0.1017530487804878	data	1.1963819235530628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc8000	0x32aec	0x32c00	1e39a95faeff58f877358bb9bed2aff5	False	0.8701123768472906	data	7.750350731278561	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xfb000	0x7134	0x7200	f04128ad0f87f42830e4a6cdbc38c719	False	0.7617530153508771	data	6.783955557128661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc85a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc86d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc87f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc8920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc8c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc8d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc9bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xca480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xca9e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xccf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xce038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xce4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xce4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcea84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcf110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcf5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcfb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xd01f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xd0660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xd07b8	0x29d84	data			1.0003559009545147
RT_GROUP_ICON	0xfa53c	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xfa5b4	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xfa5c8	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xfa5dc	0x14	data	English	Great Britain	1.25
RT_VERSION	0xfa5f0	0x10c	data	English	Great Britain	0.5932835820895522
RT_MANIFEST	0xfa6fc	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2024 10:14:55.657406092 CEST	49730	443	192.168.2.4	104.26.13.205
Apr 23, 2024 10:14:55.657447100 CEST	443	49730	104.26.13.205	192.168.2.4
Apr 23, 2024 10:14:55.657531977 CEST	49730	443	192.168.2.4	104.26.13.205
Apr 23, 2024 10:14:55.675019026 CEST	49730	443	192.168.2.4	104.26.13.205
Apr 23, 2024 10:14:55.675036907 CEST	443	49730	104.26.13.205	192.168.2.4
Apr 23, 2024 10:14:55.908538103 CEST	443	49730	104.26.13.205	192.168.2.4
Apr 23, 2024 10:14:55.908699036 CEST	49730	443	192.168.2.4	104.26.13.205
Apr 23, 2024 10:14:55.911886930 CEST	49730	443	192.168.2.4	104.26.13.205
Apr 23, 2024 10:14:55.911906004 CEST	443	49730	104.26.13.205	192.168.2.4
Apr 23, 2024 10:14:55.912411928 CEST	443	49730	104.26.13.205	192.168.2.4
Apr 23, 2024 10:14:55.954858065 CEST	49730	443	192.168.2.4	104.26.13.205
Apr 23, 2024 10:14:55.964992046 CEST	49730	443	192.168.2.4	104.26.13.205
Apr 23, 2024 10:14:56.012114048 CEST	443	49730	104.26.13.205	192.168.2.4
Apr 23, 2024 10:14:56.199364901 CEST	443	49730	104.26.13.205	192.168.2.4
Apr 23, 2024 10:14:56.199505091 CEST	443	49730	104.26.13.205	192.168.2.4
Apr 23, 2024 10:14:56.199771881 CEST	49730	443	192.168.2.4	104.26.13.205
Apr 23, 2024 10:14:56.229422092 CEST	49730	443	192.168.2.4	104.26.13.205
Apr 23, 2024 10:14:56.342142105 CEST	49731	80	192.168.2.4	208.95.112.1
Apr 23, 2024 10:14:56.458482027 CEST	80	49731	208.95.112.1	192.168.2.4
Apr 23, 2024 10:14:56.458725929 CEST	49731	80	192.168.2.4	208.95.112.1
Apr 23, 2024 10:14:56.458827972 CEST	49731	80	192.168.2.4	208.95.112.1
Apr 23, 2024 10:14:56.577374935 CEST	80	49731	208.95.112.1	192.168.2.4
Apr 23, 2024 10:14:56.626703024 CEST	49731	80	192.168.2.4	208.95.112.1
Apr 23, 2024 10:14:57.095056057 CEST	49731	80	192.168.2.4	208.95.112.1
Apr 23, 2024 10:14:57.211493015 CEST	80	49731	208.95.112.1	192.168.2.4
Apr 23, 2024 10:14:57.211594105 CEST	49731	80	192.168.2.4	208.95.112.1
Apr 23, 2024 10:14:57.255294085 CEST	49732	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:14:57.375114918 CEST	587	49732	131.226.2.60	192.168.2.4
Apr 23, 2024 10:14:57.375225067 CEST	49732	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:14:57.635200024 CEST	587	49732	131.226.2.60	192.168.2.4
Apr 23, 2024 10:14:57.635468006 CEST	49732	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:14:57.755332947 CEST	587	49732	131.226.2.60	192.168.2.4
Apr 23, 2024 10:14:57.755359888 CEST	587	49732	131.226.2.60	192.168.2.4
Apr 23, 2024 10:14:57.755593061 CEST	49732	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:14:57.875395060 CEST	587	49732	131.226.2.60	192.168.2.4
Apr 23, 2024 10:14:57.875422001 CEST	587	49732	131.226.2.60	192.168.2.4
Apr 23, 2024 10:14:57.875916958 CEST	49732	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:14:57.995692015 CEST	587	49732	131.226.2.60	192.168.2.4
Apr 23, 2024 10:14:57.997101068 CEST	587	49732	131.226.2.60	192.168.2.4
Apr 23, 2024 10:14:57.997145891 CEST	587	49732	131.226.2.60	192.168.2.4
Apr 23, 2024 10:14:57.997164965 CEST	587	49732	131.226.2.60	192.168.2.4
Apr 23, 2024 10:14:57.997200966 CEST	49732	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:14:58.027627945 CEST	49732	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:14:58.147663116 CEST	587	49732	131.226.2.60	192.168.2.4
Apr 23, 2024 10:14:58.150826931 CEST	49732	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:14:58.270859003 CEST	587	49732	131.226.2.60	192.168.2.4
Apr 23, 2024 10:14:58.272005081 CEST	49732	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:14:58.392038107 CEST	587	49732	131.226.2.60	192.168.2.4
Apr 23, 2024 10:14:58.392535925 CEST	49732	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:14:58.512911081 CEST	587	49732	131.226.2.60	192.168.2.4
Apr 23, 2024 10:14:58.513235092 CEST	49732	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:14:58.633353949 CEST	587	49732	131.226.2.60	192.168.2.4
Apr 23, 2024 10:14:58.643183947 CEST	49732	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:14:58.764132023 CEST	587	49732	131.226.2.60	192.168.2.4
Apr 23, 2024 10:14:58.764372110 CEST	49732	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:14:58.884521961 CEST	587	49732	131.226.2.60	192.168.2.4
Apr 23, 2024 10:14:58.885426044 CEST	49732	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:14:58.885514021 CEST	49732	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:14:58.885514021 CEST	49732	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:14:58.885514021 CEST	49732	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:14:59.005388975 CEST	587	49732	131.226.2.60	192.168.2.4
Apr 23, 2024 10:14:59.009530067 CEST	587	49732	131.226.2.60	192.168.2.4
Apr 23, 2024 10:14:59.064230919 CEST	49732	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:37.126604080 CEST	49732	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:37.246879101 CEST	587	49732	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:37.247381926 CEST	587	49732	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:37.249905109 CEST	49732	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:37.249979019 CEST	49732	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:37.369952917 CEST	587	49732	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:37.370177984 CEST	49732	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:49.914360046 CEST	49740	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:50.034446955 CEST	587	49740	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:50.034732103 CEST	49740	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:50.294544935 CEST	587	49740	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:50.294764996 CEST	49740	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:50.414814949 CEST	587	49740	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:50.414832115 CEST	587	49740	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:50.415069103 CEST	49740	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:50.535114050 CEST	587	49740	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:50.535130978 CEST	587	49740	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:50.535662889 CEST	49740	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:50.655714035 CEST	587	49740	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:50.655925989 CEST	587	49740	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:50.657404900 CEST	49740	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:50.670633078 CEST	49740	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:50.790719986 CEST	587	49740	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:50.790746927 CEST	587	49740	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:50.791218996 CEST	49740	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:50.911343098 CEST	587	49740	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:50.911621094 CEST	49740	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:51.031779051 CEST	587	49740	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:51.032059908 CEST	49740	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:51.152143002 CEST	587	49740	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:51.152322054 CEST	49740	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:51.273581028 CEST	587	49740	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:51.273895025 CEST	49740	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:51.394125938 CEST	587	49740	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:51.395723104 CEST	49740	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:51.395912886 CEST	49740	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:51.395984888 CEST	49740	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:51.396035910 CEST	49740	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:51.397424936 CEST	49740	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:51.515887022 CEST	587	49740	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:51.515943050 CEST	49740	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:51.517560005 CEST	587	49740	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:51.517654896 CEST	49740	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:51.640721083 CEST	587	49740	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:51.640856028 CEST	49740	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:51.761303902 CEST	587	49740	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:51.761327982 CEST	587	49740	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:51.761419058 CEST	49740	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:51.881700993 CEST	587	49740	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:51.881720066 CEST	587	49740	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:51.886652946 CEST	587	49740	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:51.938858032 CEST	49740	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:57.089382887 CEST	49740	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:57.209547997 CEST	587	49740	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:57.209578037 CEST	587	49740	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:57.209621906 CEST	49740	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:57.211405039 CEST	49740	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:57.214799881 CEST	49741	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:57.337795019 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:57.337877035 CEST	49741	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:57.600476980 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:57.600703955 CEST	49741	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:57.721813917 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:57.721829891 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:57.722070932 CEST	49741	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:57.843395948 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:57.843533039 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:57.843873978 CEST	49741	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:57.963773012 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:57.964088917 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:57.964853048 CEST	49741	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:57.965162039 CEST	49741	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:58.085052013 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:58.085067987 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:58.085256100 CEST	49741	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:58.205343962 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:58.205926895 CEST	49741	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:58.326246977 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:58.326452017 CEST	49741	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:58.446695089 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:58.447205067 CEST	49741	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:58.567795992 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:58.568399906 CEST	49741	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:58.688519001 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:58.688895941 CEST	49741	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:58.688896894 CEST	49741	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:58.689062119 CEST	49741	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:58.689095020 CEST	49741	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:58.690716028 CEST	49741	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:58.808953047 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:58.808969975 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:58.809139967 CEST	49741	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:58.810899973 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:58.811430931 CEST	49741	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:58.929445982 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:58.931668997 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:58.931745052 CEST	49741	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:58.933115959 CEST	49741	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:59.052062035 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:59.052175045 CEST	49741	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:59.053354979 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:59.053440094 CEST	49741	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:16:59.053519964 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:59.172357082 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:59.173432112 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:59.178788900 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:16:59.220087051 CEST	49741	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:00.044019938 CEST	49741	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:00.164159060 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:00.165307999 CEST	587	49741	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:00.165436029 CEST	49741	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:00.166557074 CEST	49741	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:00.166567087 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:00.287051916 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:00.291109085 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:00.452563047 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:00.452702999 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:00.573880911 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:00.573904037 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:00.574126959 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:00.694173098 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:00.694380999 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:00.694777012 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:00.815676928 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:00.815953016 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:00.817136049 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:00.817136049 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:00.937247038 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:00.937263012 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:00.937452078 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:01.057559967 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:01.057864904 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:01.179452896 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:01.179727077 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:01.299891949 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:01.300048113 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:01.421149015 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:01.421336889 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:01.541596889 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:01.541996002 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:01.542114973 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:01.542222977 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:01.542222977 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:01.543884039 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:01.662134886 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:01.662158012 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:01.662197113 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:01.662236929 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:01.664009094 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:01.664119005 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:01.783437014 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:01.783497095 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:01.785044909 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:01.785119057 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:01.785615921 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:01.785707951 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:01.903784990 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:01.903852940 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:01.905244112 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:01.905853033 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:01.905864954 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:02.024012089 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:02.028558969 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:02.079616070 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:23.913958073 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:24.034248114 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:24.034337044 CEST	587	49742	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:24.034411907 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:24.035049915 CEST	49742	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:24.036173105 CEST	49743	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:24.155980110 CEST	587	49743	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:24.156058073 CEST	49743	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:24.288780928 CEST	587	49743	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:24.288960934 CEST	49743	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:24.408869028 CEST	587	49743	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:24.408912897 CEST	587	49743	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:24.409136057 CEST	49743	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:24.528994083 CEST	587	49743	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:24.529032946 CEST	587	49743	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:24.529402971 CEST	49743	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:24.649246931 CEST	587	49743	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:24.649492025 CEST	587	49743	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:24.650568008 CEST	49743	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:24.650568008 CEST	49743	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:24.770426989 CEST	587	49743	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:24.770447016 CEST	587	49743	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:24.770664930 CEST	49743	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:24.890407085 CEST	587	49743	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:24.890775919 CEST	49743	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:25.010732889 CEST	587	49743	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:25.010976076 CEST	49743	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:25.130985022 CEST	587	49743	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:25.131174088 CEST	49743	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:25.220711946 CEST	49743	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:25.251715899 CEST	587	49743	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:25.251790047 CEST	49743	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:25.302289009 CEST	49744	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:25.340887070 CEST	587	49743	131.226.2.60	192.168.2.4
Apr 23, 2024 10:17:25.340933084 CEST	49743	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:26.315277100 CEST	49744	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:28.329919100 CEST	49744	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:32.329395056 CEST	49744	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:35.975544930 CEST	49745	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:36.985605955 CEST	49745	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:39.002033949 CEST	49745	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:40.329384089 CEST	49744	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:43.001234055 CEST	49745	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:46.440706968 CEST	49744	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:47.460486889 CEST	49744	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:49.469970942 CEST	49744	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:51.001209974 CEST	49745	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:53.469990969 CEST	49744	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:57.002351046 CEST	49745	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:17:58.001199961 CEST	49745	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:00.001207113 CEST	49745	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:01.469939947 CEST	49744	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:04.001647949 CEST	49745	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:07.480562925 CEST	49746	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:08.485539913 CEST	49746	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:10.504558086 CEST	49746	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:12.016872883 CEST	49745	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:14.501238108 CEST	49746	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:18.018635035 CEST	49747	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:19.033142090 CEST	49747	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:21.035098076 CEST	49747	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:22.519130945 CEST	49746	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:25.048006058 CEST	49747	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:28.517714024 CEST	49746	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:29.532361031 CEST	49746	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:31.547988892 CEST	49746	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:33.048059940 CEST	49747	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:35.563694954 CEST	49746	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:39.048728943 CEST	49747	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:40.065639973 CEST	49747	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:42.079221010 CEST	49747	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:43.563613892 CEST	49746	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:46.081521988 CEST	49747	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:49.580486059 CEST	49748	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:50.594866037 CEST	49748	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:52.594908953 CEST	49748	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:54.079185963 CEST	49747	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:18:56.594881058 CEST	49748	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:19:00.080193996 CEST	49749	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:19:01.079173088 CEST	49749	587	192.168.2.4	131.226.2.60
Apr 23, 2024 10:19:03.079186916 CEST	49749	587	192.168.2.4	131.226.2.60

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 23, 2024 10:14:55.535900116 CEST	50079	53	192.168.2.4	1.1.1.1
Apr 23, 2024 10:14:55.640722036 CEST	53	50079	1.1.1.1	192.168.2.4
Apr 23, 2024 10:14:56.236350060 CEST	62740	53	192.168.2.4	1.1.1.1
Apr 23, 2024 10:14:56.341161013 CEST	53	62740	1.1.1.1	192.168.2.4
Apr 23, 2024 10:14:57.096049070 CEST	61275	53	192.168.2.4	1.1.1.1
Apr 23, 2024 10:14:57.248893976 CEST	53	61275	1.1.1.1	192.168.2.4

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 23, 2024 10:17:25.424313068 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:17:26.437304020 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:17:28.451765060 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:17:32.451273918 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:17:36.097404957 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:17:37.107408047 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:17:39.124114990 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:17:40.451246023 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:17:43.123092890 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:17:46.562863111 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:17:47.582416058 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:17:49.591912985 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:17:51.123277903 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:17:53.592086077 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:17:57.124361992 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:17:58.123826981 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:00.123250008 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:01.591933012 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:04.123554945 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:07.603430033 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:08.607639074 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:10.628448009 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:12.138900995 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:14.623322964 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:18.140573978 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:19.155770063 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:21.157052040 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:22.641298056 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:25.170039892 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:28.642997026 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:29.654243946 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:31.669783115 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:33.169972897 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:35.685575962 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:39.170350075 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:40.187479019 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:42.201061964 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:43.685503960 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:46.203435898 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:49.700409889 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:50.714812994 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:52.715064049 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:54.201340914 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:18:56.714999914 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:19:00.200566053 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:19:01.198990107 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable
Apr 23, 2024 10:19:03.199173927 CEST	131.226.2.60	192.168.2.4	45ee	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 23, 2024 10:14:55.535900116 CEST	192.168.2.4	1.1.1.1	0xcea	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Apr 23, 2024 10:14:56.236350060 CEST	192.168.2.4	1.1.1.1	0x50e0	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Apr 23, 2024 10:14:57.096049070 CEST	192.168.2.4	1.1.1.1	0x406c	Standard query (0)	mail.myhydropowered.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Apr 23, 2024 10:14:55.640722036 CEST	1.1.1.1	192.168.2.4	0xcea	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Apr 23, 2024 10:14:55.640722036 CEST	1.1.1.1	192.168.2.4	0xcea	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Apr 23, 2024 10:14:55.640722036 CEST	1.1.1.1	192.168.2.4	0xcea	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Apr 23, 2024 10:14:56.341161013 CEST	1.1.1.1	192.168.2.4	0x50e0	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Apr 23, 2024 10:14:57.248893976 CEST	1.1.1.1	192.168.2.4	0x406c	No error (0)	mail.myhydropowered.com	131.226.2.60	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.ipify.org

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	208.95.112.1	80	6600	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Apr 23, 2024 10:14:56.458827972 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Apr 23, 2024 10:14:56.577374935 CEST	174	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 08:14:55 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 5 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 74 72 75 65 0a Data Ascii: true

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	104.26.13.205	443	6600	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2024-04-23 08:14:55 UTC	155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0 Host: api.ipify.org Connection: Keep-Alive
2024-04-23 08:14:56 UTC	211	IN	HTTP/1.1 200 OK Date: Tue, 23 Apr 2024 08:14:56 GMT Content-Type: text/plain Content-Length: 14 Connection: close Vary: Origin CF-Cache-Status: DYNAMIC Server: cloudflare CF-RAY: 878c67209c7cb03e-ATL
2024-04-23 08:14:56 UTC	14	IN	Data Raw: 38 39 2e 31 38 37 2e 31 37 31 2e 31 33 32 Data Ascii: 89.187.171.132

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Apr 23, 2024 10:14:57.635200024 CEST	587	49732	131.226.2.60	192.168.2.4	220 ns1.myhydropowered.com ESMTP Postfix (Ubuntu)
Apr 23, 2024 10:14:57.635468006 CEST	49732	587	192.168.2.4	131.226.2.60	EHLO 910646
Apr 23, 2024 10:14:57.755359888 CEST	587	49732	131.226.2.60	192.168.2.4	250-ns1.myhydropowered.com 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING
Apr 23, 2024 10:14:57.755593061 CEST	49732	587	192.168.2.4	131.226.2.60	STARTTLS
Apr 23, 2024 10:14:57.875422001 CEST	587	49732	131.226.2.60	192.168.2.4	220 2.0.0 Ready to start TLS
Apr 23, 2024 10:16:50.294544935 CEST	587	49740	131.226.2.60	192.168.2.4	220 ns1.myhydropowered.com ESMTP Postfix (Ubuntu)
Apr 23, 2024 10:16:50.294764996 CEST	49740	587	192.168.2.4	131.226.2.60	EHLO 910646
Apr 23, 2024 10:16:50.414832115 CEST	587	49740	131.226.2.60	192.168.2.4	250-ns1.myhydropowered.com 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING
Apr 23, 2024 10:16:50.415069103 CEST	49740	587	192.168.2.4	131.226.2.60	STARTTLS
Apr 23, 2024 10:16:50.535130978 CEST	587	49740	131.226.2.60	192.168.2.4	220 2.0.0 Ready to start TLS
Apr 23, 2024 10:16:57.600476980 CEST	587	49741	131.226.2.60	192.168.2.4	220 ns1.myhydropowered.com ESMTP Postfix (Ubuntu)
Apr 23, 2024 10:16:57.600703955 CEST	49741	587	192.168.2.4	131.226.2.60	EHLO 910646
Apr 23, 2024 10:16:57.721829891 CEST	587	49741	131.226.2.60	192.168.2.4	250-ns1.myhydropowered.com 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING
Apr 23, 2024 10:16:57.722070932 CEST	49741	587	192.168.2.4	131.226.2.60	STARTTLS
Apr 23, 2024 10:16:57.843533039 CEST	587	49741	131.226.2.60	192.168.2.4	220 2.0.0 Ready to start TLS
Apr 23, 2024 10:17:00.452563047 CEST	587	49742	131.226.2.60	192.168.2.4	220 ns1.myhydropowered.com ESMTP Postfix (Ubuntu)
Apr 23, 2024 10:17:00.452702999 CEST	49742	587	192.168.2.4	131.226.2.60	EHLO 910646
Apr 23, 2024 10:17:00.573904037 CEST	587	49742	131.226.2.60	192.168.2.4	250-ns1.myhydropowered.com 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING
Apr 23, 2024 10:17:00.574126959 CEST	49742	587	192.168.2.4	131.226.2.60	STARTTLS
Apr 23, 2024 10:17:00.694380999 CEST	587	49742	131.226.2.60	192.168.2.4	220 2.0.0 Ready to start TLS
Apr 23, 2024 10:17:24.288780928 CEST	587	49743	131.226.2.60	192.168.2.4	220 ns1.myhydropowered.com ESMTP Postfix (Ubuntu)
Apr 23, 2024 10:17:24.288960934 CEST	49743	587	192.168.2.4	131.226.2.60	EHLO 910646
Apr 23, 2024 10:17:24.408912897 CEST	587	49743	131.226.2.60	192.168.2.4	250-ns1.myhydropowered.com 250-PIPELINING 250-SIZE 10240000 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250-SMTPUTF8 250 CHUNKING
Apr 23, 2024 10:17:24.409136057 CEST	49743	587	192.168.2.4	131.226.2.60	STARTTLS
Apr 23, 2024 10:17:24.529032946 CEST	587	49743	131.226.2.60	192.168.2.4	220 2.0.0 Ready to start TLS

Target ID:	0
Start time:	10:14:53
Start date:	23/04/2024
Path:	C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe"
Imagebase:	0xf80000
File size:	1'036'800 bytes
MD5 hash:	6902D6B5857BDCDE15B9AF8AAF50B407
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1646045123.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000000.00000002.1646045123.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1646045123.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000000.00000002.1646045123.0000000000ED0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:14:54
Start date:	23/04/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Ship Docs_ CI_BL_HBL_.exe"
Imagebase:	0x90000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4095884034.0000000000162000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4095884034.0000000000162000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.4097012236.0000000002415000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4097012236.0000000002415000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.4097012236.0000000002438000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	1.3%
Signature Coverage:	5.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	154

Executed Functions

Function 00F83B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00F83B7A
IsDebuggerPresent.KERNEL32 ref: 00F83B8C
GetFullPathNameW.KERNEL32(00007FFF,?,?,010462F8,010462E0,?,?), ref: 00F83BFD

Part of subcall function 00F87D2C: _memmove.LIBCMT ref: 00F87D66

Part of subcall function 00F90A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00F83C26,010462F8,?,?,?), ref: 00F90ACE

SetCurrentDirectoryW.KERNEL32(?), ref: 00F83C81
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,010393F0,00000010), ref: 00FBD4BC
SetCurrentDirectoryW.KERNEL32(?,010462F8,?,?,?), ref: 00FBD4F4
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,01035D40,010462F8,?,?,?), ref: 00FBD57A
ShellExecuteW.SHELL32(00000000,?,?), ref: 00FBD581

Part of subcall function 00F83A58: GetSysColorBrush.USER32(0000000F), ref: 00F83A62
Part of subcall function 00F83A58: LoadCursorW.USER32(00000000,00007F00), ref: 00F83A71
Part of subcall function 00F83A58: LoadIconW.USER32(00000063), ref: 00F83A88
Part of subcall function 00F83A58: LoadIconW.USER32(000000A4), ref: 00F83A9A
Part of subcall function 00F83A58: LoadIconW.USER32(000000A2), ref: 00F83AAC
Part of subcall function 00F83A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00F83AD2
Part of subcall function 00F83A58: RegisterClassExW.USER32(?), ref: 00F83B28

Part of subcall function 00F839E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00F83A15
Part of subcall function 00F839E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00F83A36
Part of subcall function 00F839E7: ShowWindow.USER32(00000000,?,?), ref: 00F83A4A
Part of subcall function 00F839E7: ShowWindow.USER32(00000000,?,?), ref: 00F83A53

Part of subcall function 00F843DB: _memset.LIBCMT ref: 00F84401
Part of subcall function 00F843DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00F844A6

Strings

runas, xrefs: 00FBD575
This is a third-party compiled AutoIt script., xrefs: 00FBD4B4

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: 84d6faedec4d6c9962cff78439ecb2824715736756dc6254336708a8327caeec
Instruction ID: 2f0805ec5fa5c053f21cc3db7161443dd3a4b10b8253dcd53a6dab9203bf9d9f
Opcode Fuzzy Hash: 84d6faedec4d6c9962cff78439ecb2824715736756dc6254336708a8327caeec
Instruction Fuzzy Hash: 7D5146B5E04249BBCF21FBB5DD85EED7BB8AB06700F004069F491A2151EA7E9605FB21

Uniqueness

Uniqueness Score: -1.00%

Function 00F84AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00F84B2B

Part of subcall function 00F87D2C: _memmove.LIBCMT ref: 00F87D66

GetCurrentProcess.KERNEL32(?,0100FAEC,00000000,00000000,?), ref: 00F84BF8
IsWow64Process.KERNEL32(00000000), ref: 00F84BFF
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00F84C45
FreeLibrary.KERNEL32(00000000), ref: 00F84C50
GetSystemInfo.KERNEL32(00000000), ref: 00F84C81
GetSystemInfo.KERNEL32(00000000), ref: 00F84C8D

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 0464a1145e7b4ac34553081c9e5be7e7fb8ee3461a4cb3a3037165270735e53e
Instruction ID: 30a33559eadbadbf2b9c8ff22cc54bc63a02305eafaecefa26fa523d3fb0c490
Opcode Fuzzy Hash: 0464a1145e7b4ac34553081c9e5be7e7fb8ee3461a4cb3a3037165270735e53e
Instruction Fuzzy Hash: DF91D67194A7C1DEC731EB7884512EAFFE4AF66310B584D5ED0CB83A41D224F948EB1A

Uniqueness

Uniqueness Score: -1.00%

Function 00F84FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00F84EEE,?,?,00000000,00000000), ref: 00F84FF9
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00F84EEE,?,?,00000000,00000000), ref: 00F85010
LoadResource.KERNEL32(?,00000000,?,?,00F84EEE,?,?,00000000,00000000,?,?,?,?,?,?,00F84F8F), ref: 00FBDD60
SizeofResource.KERNEL32(?,00000000,?,?,00F84EEE,?,?,00000000,00000000,?,?,?,?,?,?,00F84F8F), ref: 00FBDD75
LockResource.KERNEL32(00F84EEE,?,?,00F84EEE,?,?,00000000,00000000,?,?,?,?,?,?,00F84F8F,00000000), ref: 00FBDD88

Strings

SCRIPT, xrefs: 00F85006

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: eff73b7b84c92daa6c287a43a3a13118541996a16a5f7ef787d2cb10eb9529f8
Instruction ID: bae96c2c1859e767113030cd5b91ab87106cf9e492492bba9bb1799ee8447075
Opcode Fuzzy Hash: eff73b7b84c92daa6c287a43a3a13118541996a16a5f7ef787d2cb10eb9529f8
Instruction Fuzzy Hash: 0B115A75600B02AFE7329B65DC58FA77BB9EBC9B51F20416CF44696250DB62E800AB60

Uniqueness

Uniqueness Score: -1.00%

Function 00FE4696 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00FBE7C1), ref: 00FE46A6
FindFirstFileW.KERNELBASE(?,?), ref: 00FE46B7
FindClose.KERNEL32(00000000), ref: 00FE46C7

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 9ada58c725e0ae16bd2afafe39050fd083b1ab25c228348603100e2290fb2d69
Instruction ID: 00398bfc6536823b953f552d1db166ec284043ece0082277beba18bf749bcc37
Opcode Fuzzy Hash: 9ada58c725e0ae16bd2afafe39050fd083b1ab25c228348603100e2290fb2d69
Instruction Fuzzy Hash: 4DE026328104016B8230B738EC4D8EAB7ACDE06335F10071AF975C20D0EBB4BD60A7DA

Uniqueness

Uniqueness Score: -1.00%

Function 00F8E800 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00FC428C

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: cff34930cad697b755b4aacf2b489b5b8a85f1f181f8c0786f109f91c08c6fbd
Instruction ID: 0f98d11ceefa24ff9e9c96c2ab4dacdf396e146d21d849b1e96548d8690673dc
Opcode Fuzzy Hash: cff34930cad697b755b4aacf2b489b5b8a85f1f181f8c0786f109f91c08c6fbd
Instruction Fuzzy Hash: C3A28975E00206CFCB24EF58C981BEAB7B1FF49310F248069E956AB351D735AC46EB81

Uniqueness

Uniqueness Score: -1.00%

Function 00F90B30 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F90BBB
timeGetTime.WINMM ref: 00F90E76
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F90FB3
TranslateMessage.USER32(?), ref: 00F90FC7
DispatchMessageW.USER32(?), ref: 00F90FD5
Sleep.KERNEL32(0000000A), ref: 00F90FDF
LockWindowUpdate.USER32(00000000,?,?), ref: 00F9105A
DestroyWindow.USER32 ref: 00F91066
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00F91080
Sleep.KERNEL32(0000000A,?,?), ref: 00FC52AD
TranslateMessage.USER32(?), ref: 00FC608A
DispatchMessageW.USER32(?), ref: 00FC6098
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00FC60AC

Strings

@COM_EVENTOBJ, xrefs: 00FC591A
@TRAY_ID, xrefs: 00FC5BB9
@GUI_CTRLID, xrefs: 00FC5364
@GUI_CTRLHANDLE, xrefs: 00FC540E
@GUI_WINHANDLE, xrefs: 00FC53B9

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Message$DispatchPeekSleepTranslateWindow$DestroyLockTimeUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4003667617-3242690629
Opcode ID: 93d361ee6c9b088e91f85ffad18c5bdcd2c4a9ddc2cb2a43b806c51733a6fdac
Instruction ID: 6f34aa9e322acbe50396e9c536d8465097e93edf453cd59c8f55f6654dd86006
Opcode Fuzzy Hash: 93d361ee6c9b088e91f85ffad18c5bdcd2c4a9ddc2cb2a43b806c51733a6fdac
Instruction Fuzzy Hash: 97B2F570A08742DFDB24DF24C985FAAB7E4FF84714F14491DE48987291DB79E884EB82

Uniqueness

Uniqueness Score: -1.00%

Function 00FE93DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FE91E9: __time64.LIBCMT ref: 00FE91F3

Part of subcall function 00F85045: _fseek.LIBCMT ref: 00F8505D

__wsplitpath.LIBCMT ref: 00FE94BE

Part of subcall function 00FA432E: __wsplitpath_helper.LIBCMT ref: 00FA436E

_wcscpy.LIBCMT ref: 00FE94D1
_wcscat.LIBCMT ref: 00FE94E4
__wsplitpath.LIBCMT ref: 00FE9509
_wcscat.LIBCMT ref: 00FE951F
_wcscat.LIBCMT ref: 00FE9532

Part of subcall function 00FE922F: _memmove.LIBCMT ref: 00FE9268
Part of subcall function 00FE922F: _memmove.LIBCMT ref: 00FE9277

_wcscmp.LIBCMT ref: 00FE9479

Part of subcall function 00FE99BE: _wcscmp.LIBCMT ref: 00FE9AAE
Part of subcall function 00FE99BE: _wcscmp.LIBCMT ref: 00FE9AC1

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00FE96DC
_wcsncpy.LIBCMT ref: 00FE974F
DeleteFileW.KERNEL32(?,?), ref: 00FE9785
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00FE979B
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00FE97AC
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00FE97BE

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: f5f12b2c5516b243e6fbd5d0e707995b9d3c1e6ad01d7e8cdce256e71c78dd14
Instruction ID: 25589de312ba3bb731f26f2a3b4eaca6da250d71f85b5cc86a9482b1c1436e29
Opcode Fuzzy Hash: f5f12b2c5516b243e6fbd5d0e707995b9d3c1e6ad01d7e8cdce256e71c78dd14
Instruction Fuzzy Hash: E9C13BB1E00219AFDF21DF95CC85ADEB7BDEF45310F0040AAF609E6141EB749A849F65

Uniqueness

Uniqueness Score: -1.00%

Function 00F83015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00F83074
RegisterClassExW.USER32(00000030), ref: 00F8309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F830AF
InitCommonControlsEx.COMCTL32(?), ref: 00F830CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00F830DC
LoadIconW.USER32(000000A9), ref: 00F830F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00F83101

Strings

0, xrefs: 00F83056
AutoIt v3 GUI, xrefs: 00F83090
+, xrefs: 00F8305D
TaskbarCreated, xrefs: 00F830A4

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 79b9f84cea3dd8776154c16776b6fc1c08532976efb6920f1de87f99406debde
Instruction ID: e054fba3b49bdf8d97eff1ce1c2d270012dc2418c46d1128eed0a4f45ccaf482
Opcode Fuzzy Hash: 79b9f84cea3dd8776154c16776b6fc1c08532976efb6920f1de87f99406debde
Instruction Fuzzy Hash: 79317AB584130AEFEB61CFA4D985AC9BBF0FB09310F14411EE5C0E6284E7BA0585DF51

Uniqueness

Uniqueness Score: -1.00%

Function 00F83041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00F83074
RegisterClassExW.USER32(00000030), ref: 00F8309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F830AF
InitCommonControlsEx.COMCTL32(?), ref: 00F830CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00F830DC
LoadIconW.USER32(000000A9), ref: 00F830F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00F83101

Strings

0, xrefs: 00F83056
AutoIt v3 GUI, xrefs: 00F83090
+, xrefs: 00F8305D
TaskbarCreated, xrefs: 00F830A4

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 7b3e48646341db8de15bea431d02ac0a1ef794b807e7615ae83feb6d621101de
Instruction ID: 8821825841a457b4336e7df541ae414832088dddb54b73fa359d0d7c23133568
Opcode Fuzzy Hash: 7b3e48646341db8de15bea431d02ac0a1ef794b807e7615ae83feb6d621101de
Instruction Fuzzy Hash: FC21E5F5900309AFEB21DFA4E988A9DBBF4FB09700F00421AF591E6284E7BB45449F91

Uniqueness

Uniqueness Score: -1.00%

Function 00F871EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F84864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,010462F8,?,00F837C0,?), ref: 00F84882

Part of subcall function 00FA074F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00F872C5), ref: 00FA0771

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00F87308
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00FBECF1
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00FBED32
RegCloseKey.ADVAPI32(?), ref: 00FBED70
_wcscat.LIBCMT ref: 00FBEDC9

Strings

\Include\, xrefs: 00F872C5
Include, xrefs: 00FBECE8, 00FBED29
\, xrefs: 00FBEDEC
Software\AutoIt v3\AutoIt, xrefs: 00F872FE

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: a86000b448896c44b43f2f6e25be9c95e35cf1a2895e81be3cfe398a29e1e49f
Instruction ID: 32d61e60a20c61d82c7f2955100e1468adcc611afa86308c3233417fe2c76642
Opcode Fuzzy Hash: a86000b448896c44b43f2f6e25be9c95e35cf1a2895e81be3cfe398a29e1e49f
Instruction Fuzzy Hash: 1A719EB15083019FC324EF25EE8199BB7E8FF89750F40482EF485871A4DB79D948EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F83A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00F83A62
LoadCursorW.USER32(00000000,00007F00), ref: 00F83A71
LoadIconW.USER32(00000063), ref: 00F83A88
LoadIconW.USER32(000000A4), ref: 00F83A9A
LoadIconW.USER32(000000A2), ref: 00F83AAC
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00F83AD2
RegisterClassExW.USER32(?), ref: 00F83B28

Part of subcall function 00F83041: GetSysColorBrush.USER32(0000000F), ref: 00F83074
Part of subcall function 00F83041: RegisterClassExW.USER32(00000030), ref: 00F8309E
Part of subcall function 00F83041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F830AF
Part of subcall function 00F83041: InitCommonControlsEx.COMCTL32(?), ref: 00F830CC
Part of subcall function 00F83041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00F830DC
Part of subcall function 00F83041: LoadIconW.USER32(000000A9), ref: 00F830F2
Part of subcall function 00F83041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00F83101

Strings

#, xrefs: 00F83B0D
AutoIt v3, xrefs: 00F83B17
0, xrefs: 00F83B06

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: dc1ea0f23a1aa73be96aea04746c9a39e666aec54040a51088ae446d2b3be6b5
Instruction ID: 07bc5992b77cffea45337afa287f508fd73ccbe8fc34e4f3b7eac6c29b9a3118
Opcode Fuzzy Hash: dc1ea0f23a1aa73be96aea04746c9a39e666aec54040a51088ae446d2b3be6b5
Instruction Fuzzy Hash: D7216DB4D00305BFEB21DFA4EA89B9D7BB4FB09711F000119F584A6294E3BF56449F41

Uniqueness

Uniqueness Score: -1.00%

Function 00F83633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00F836D2
KillTimer.USER32(?,00000001), ref: 00F836FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00F8371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00F8372A
CreatePopupMenu.USER32 ref: 00F8373E
PostQuitMessage.USER32(00000000), ref: 00F8375F

Strings

TaskbarCreated, xrefs: 00F83725

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: ff939c40bc95fdc9dc2610ba4f7320a3614fbce3a640bf477a8db5101b5094f9
Instruction ID: 5e166381c3bd6659872c6633c4805a70b311ae8d3aab8de88fb598b3cc6006a2
Opcode Fuzzy Hash: ff939c40bc95fdc9dc2610ba4f7320a3614fbce3a640bf477a8db5101b5094f9
Instruction Fuzzy Hash: 634116F2604106BBDB307B68DD89BFD3754F701B10F140629F542C62A6FA6BAE44B762

Uniqueness

Uniqueness Score: -1.00%

Function 00F83778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/AutoIt3OutputDebug, xrefs: 00F838A4
CMDLINE, xrefs: 00F83834
/AutoIt3ExecuteScript, xrefs: 00F838CE
CMDLINERAW, xrefs: 00F8380D
/ErrorStdOut, xrefs: 00F8388F
/AutoIt3ExecuteLine, xrefs: 00F838B9
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 00F837C0

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-3513169116
Opcode ID: 57cba33ee447e228dc2eca1d78cadeef5d3519395d965a41b4b697a4d884a87c
Instruction ID: 7b3f8eed8488f008675520245a1469269dd2a1fbc492cf2cc91832e00d68c3de
Opcode Fuzzy Hash: 57cba33ee447e228dc2eca1d78cadeef5d3519395d965a41b4b697a4d884a87c
Instruction Fuzzy Hash: F0A181B2D14219ABDB14FBA1CC81AEEB778BF15700F040429F452A7191EF799A09EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00EC2630 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 00EC2701
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00EC2927

Memory Dump Source

Source File: 00000000.00000002.1646018115.0000000000EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: 640a513b0a1dc75cf27b9d1dcd7263df352c7e5bc7e4f1208c2f85c57f315c64
Instruction ID: f83f3df2cad1291fe41d6d3eb3dfd876bad983d62803427552419ef557a16d35
Opcode Fuzzy Hash: 640a513b0a1dc75cf27b9d1dcd7263df352c7e5bc7e4f1208c2f85c57f315c64
Instruction Fuzzy Hash: 4CA11675E00209EBDB18CFA4C994FEEB7B5BF48304F20915DE611BB280D7769A42DB64

Uniqueness

Uniqueness Score: -1.00%

Function 00F839E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00F83A15
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00F83A36
ShowWindow.USER32(00000000,?,?), ref: 00F83A4A
ShowWindow.USER32(00000000,?,?), ref: 00F83A53

Strings

edit, xrefs: 00F83A30
AutoIt v3, xrefs: 00F83A0D, 00F83A12, 00F83A13

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: cf3f0a4b4a19ba00a3fbf9135f2663997e514cf63ffe64c3687821099239ca1b
Instruction ID: 6d17026e4cd31400d8caafa0c5075b7d3894b39e0da8b35041bd78fe62525b6b
Opcode Fuzzy Hash: cf3f0a4b4a19ba00a3fbf9135f2663997e514cf63ffe64c3687821099239ca1b
Instruction Fuzzy Hash: 6BF03AB46402907FEA321667AE88E273E7DE7C7F50F00001EB984E2194D2AB0840DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00EC2410 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 140
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EC2300: Sleep.KERNELBASE(000001F4), ref: 00EC2311

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00EC251E

Strings

O9TYT6TGYZGA9ZYNSD, xrefs: 00EC2581, 00EC2584

Memory Dump Source

Source File: 00000000.00000002.1646018115.0000000000EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: CreateFileSleep
String ID: O9TYT6TGYZGA9ZYNSD
API String ID: 2694422964-3501351274
Opcode ID: f240e10b097cacf65bab4b5193c70450155d0655e000c262abf5cc56929dff22
Instruction ID: 7865a2499be2e3f454ee572ead0c1b317d8e3d32c7f3a17989a7bf8aea518a96
Opcode Fuzzy Hash: f240e10b097cacf65bab4b5193c70450155d0655e000c262abf5cc56929dff22
Instruction Fuzzy Hash: 63517230D04249DAEF11DBE4C914BEFBBB4AF04304F00419DE6187B2C1D67A1B49CB66

Uniqueness

Uniqueness Score: -1.00%

Function 00F8410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00FBD5EC

Part of subcall function 00F87D2C: _memmove.LIBCMT ref: 00F87D66

_memset.LIBCMT ref: 00F8418D
_wcscpy.LIBCMT ref: 00F841E1
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00F841F1

Strings

Line: , xrefs: 00FBD615

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 527bb9fe79e9ebb45f6e5406b0a277d139ab5cd0c7282e2764115d93f72660ea
Instruction ID: 228e65bc91399320dee72f58adda56f97e5d06f5158a1fe9963ee35bcea9a000
Opcode Fuzzy Hash: 527bb9fe79e9ebb45f6e5406b0a277d139ab5cd0c7282e2764115d93f72660ea
Instruction Fuzzy Hash: B531C1B1508705ABD731FB60DD86BDB77E8AF45310F10451EB1C493091EF79A648EB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FA564D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00FA56AB
_memcpy_s.LIBCMT ref: 00FA571D
__read_nolock.LIBCMT ref: 00FA577B
__filbuf.LIBCMT ref: 00FA579E
_memset.LIBCMT ref: 00FA57E2

Part of subcall function 00FA8D68: __getptd_noexit.LIBCMT ref: 00FA8D68

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction ID: 782e4bf777c4668492ea2acb89a1107b804a9d087310db7fd1091c46e158aa6b
Opcode Fuzzy Hash: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction Fuzzy Hash: 6251C4B1E00B09DFDB248FB9C88066E77B5AF42B30F648729F835A62D0D7749D51AB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F869CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00F84F3D: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,010462F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00F84F6F

_free.LIBCMT ref: 00FBE68C
_free.LIBCMT ref: 00FBE6D3

Part of subcall function 00F86BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00F86D0D

Strings

Bad directive syntax error, xrefs: 00FBE6BB
>>>AUTOIT SCRIPT<<<, xrefs: 00FBE462

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: da21946535d9413bae97d177d5375893b590c9e9520c19f75cc5a900dd66691c
Instruction ID: 035818d71384c8b5fecd602127a35b724fe2909d72e8bb6e89be2407b79a62f7
Opcode Fuzzy Hash: da21946535d9413bae97d177d5375893b590c9e9520c19f75cc5a900dd66691c
Instruction Fuzzy Hash: 6C917A71910219EFCF14EFA5CC919EDB7B5BF19314F14442AF816AB291EB38A904EF60

Uniqueness

Uniqueness Score: -1.00%

Function 00F835B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00F835A1,SwapMouseButtons,00000004,?), ref: 00F835D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,00F835A1,SwapMouseButtons,00000004,?,?,?,?,00F82754), ref: 00F835F5
RegCloseKey.KERNELBASE(00000000,?,?,00F835A1,SwapMouseButtons,00000004,?,?,?,?,00F82754), ref: 00F83617

Strings

Control Panel\Mouse, xrefs: 00F835D2

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 58f0f0b7e54908b99a741557de8a256e6c08155e91418cb76a294e985c864f1e
Instruction ID: d2d41da5cc5d713ad8a88e72091f381c0c5bd2bfd0570f1d34def8ed8a641992
Opcode Fuzzy Hash: 58f0f0b7e54908b99a741557de8a256e6c08155e91418cb76a294e985c864f1e
Instruction Fuzzy Hash: 30115A71910208BFDB21DF68D844EEEB7B8EF04B50F008459F805D7224E2719F40A760

Uniqueness

Uniqueness Score: -1.00%

Function 00EC1300 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 00EC1B2D
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00EC1B51
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00EC1B73

Memory Dump Source

Source File: 00000000.00000002.1646018115.0000000000EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: a5f8eca76df1c4d60a387bf050efe929c827b8bdc82418feca4108ede207e1c1
Instruction ID: ded72ea255bad08b1d98e49ab7c00e62ac352a04bc351a9f1be34bd3d1d465d3
Opcode Fuzzy Hash: a5f8eca76df1c4d60a387bf050efe929c827b8bdc82418feca4108ede207e1c1
Instruction Fuzzy Hash: CB620930A14258DBEB24CBA4C950BDEB372EF58304F1091A9E50DEB391E7769E81CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00FA493A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FA49D0
__flush.LIBCMT ref: 00FA49F0
__write.LIBCMT ref: 00FA4A23
__flsbuf.LIBCMT ref: 00FA4A51

Part of subcall function 00FA8D68: __getptd_noexit.LIBCMT ref: 00FA8D68

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction ID: 039fce6a853a72ebfe3a709d1a989355f67659163cbfdbde658f1b018bbd52fa
Opcode Fuzzy Hash: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction Fuzzy Hash: 8E41D8F5A007059BDF18CE69C88056F77A6EFC6370B24813DE855C7640D7B8BD51AB44

Uniqueness

Uniqueness Score: -1.00%

Function 00F873E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FBEE62
GetOpenFileNameW.COMDLG32(?), ref: 00FBEEAC

Part of subcall function 00F848AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F848A1,?,?,00F837C0,?), ref: 00F848CE

Part of subcall function 00FA09D5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00FA09F4

Strings

X, xrefs: 00FBEE7A

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 491ce59dbc506e1245679d3e39d527482b4882d5f3abd541a5c2e16c02a17b98
Instruction ID: 0e7fbfe7e44e64aa662c5db8fb523297e40198d16a58f43e11676f23454b2444
Opcode Fuzzy Hash: 491ce59dbc506e1245679d3e39d527482b4882d5f3abd541a5c2e16c02a17b98
Instruction Fuzzy Hash: C521D571A002589BCF15EF94CC45BEE7BFC9F49314F10801AF408A7281DBB899899FA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FE901B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FE9036
__fread_nolock.LIBCMT ref: 00FE904B

Strings

EA06, xrefs: 00FE907D

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: d0fe6c2a4c317e70588231f722b26f006bf9b7cb5770c37ac3b442a94e52afc4
Instruction ID: 868a0e71d95cc8200432b62ed263fa0cb60e9d1bd7f5194edc5d5db3d9426a97
Opcode Fuzzy Hash: d0fe6c2a4c317e70588231f722b26f006bf9b7cb5770c37ac3b442a94e52afc4
Instruction Fuzzy Hash: 9101F9B2904258AEDB28C7A9CC16FEE7BFC9B01301F00419EF592D2181E5B9A604D760

Uniqueness

Uniqueness Score: -1.00%

Function 00FE9B6D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00FE9B82
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00FE9B99

Strings

aut, xrefs: 00FE9B93

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 0b57f299aaf52c66788e1e04b1c7185e9e0e070fc22f61ebac58d0b54e64b825
Instruction ID: adb946420b26208e773cc44a6973e9ebe517043dd1246a704ecfd170cf9729bf
Opcode Fuzzy Hash: 0b57f299aaf52c66788e1e04b1c7185e9e0e070fc22f61ebac58d0b54e64b825
Instruction Fuzzy Hash: 69D05E7954030EABDB309B90EC0EF9A772CE744700F0042A1BED4D6091DEB565989B91

Uniqueness

Uniqueness Score: -1.00%

Function 00FFCDF1 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8bbd8f1afc71d07cf98ae98269a870e925fc979fb6fdafc37c9633ce080d20c
Instruction ID: 9fdf64bfe3bd1dec68fc072df9ebe39d78a942348c2a2daa2882cd67a682b423
Opcode Fuzzy Hash: d8bbd8f1afc71d07cf98ae98269a870e925fc979fb6fdafc37c9633ce080d20c
Instruction Fuzzy Hash: 8DF18B719083059FC714DF28C880A6ABBE5FF88314F04892EF9999B351DB75E906DF82

Uniqueness

Uniqueness Score: -1.00%

Function 00F8F8CF Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA03A2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00FA03D3
Part of subcall function 00FA03A2: MapVirtualKeyW.USER32(00000010,00000000), ref: 00FA03DB
Part of subcall function 00FA03A2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00FA03E6
Part of subcall function 00FA03A2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00FA03F1
Part of subcall function 00FA03A2: MapVirtualKeyW.USER32(00000011,00000000), ref: 00FA03F9
Part of subcall function 00FA03A2: MapVirtualKeyW.USER32(00000012,00000000), ref: 00FA0401

Part of subcall function 00F96259: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00F8FA90), ref: 00F962B4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00F8FB2D
OleInitialize.OLE32(00000000), ref: 00F8FBAA
CloseHandle.KERNEL32(00000000), ref: 00FC49F2

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: d5804b85c7f271316788d59c8228ed6f6241e6cf57a6a9e7f7561f4a39d0614c
Instruction ID: 126139649d5f44e2554ab4cd055161f4b02e588798434b24bb185fb97b2a164d
Opcode Fuzzy Hash: d5804b85c7f271316788d59c8228ed6f6241e6cf57a6a9e7f7561f4a39d0614c
Instruction Fuzzy Hash: F481BBF89013808FCBA8EF39E6D46557AE6BB8A714710812A9199C724AFB3F4408DF50

Uniqueness

Uniqueness Score: -1.00%

Function 00F843DB Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F84401
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00F844A6
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00F844C3

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 8c362179c956de4e0bbcc2137ceed96c128b1a3e6636ef215f8b9b3150760e09
Instruction ID: 553cfaa17e0038031980730d2d1a894992a53111adbe85951188c691f6dd1fdf
Opcode Fuzzy Hash: 8c362179c956de4e0bbcc2137ceed96c128b1a3e6636ef215f8b9b3150760e09
Instruction Fuzzy Hash: 523182B19047029FD731EF24D9847DBBBE4BB49314F00092EE9DA83240E776A944DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00FA594C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00FA5963

Part of subcall function 00FAA3AB: __NMSG_WRITE.LIBCMT ref: 00FAA3D2
Part of subcall function 00FAA3AB: __NMSG_WRITE.LIBCMT ref: 00FAA3DC

__NMSG_WRITE.LIBCMT ref: 00FA596A

Part of subcall function 00FAA408: GetModuleFileNameW.KERNEL32(00000000,010443BA,00000104,?,00000001,00000000), ref: 00FAA49A
Part of subcall function 00FAA408: ___crtMessageBoxW.LIBCMT ref: 00FAA548

Part of subcall function 00FA32DF: ___crtCorExitProcess.LIBCMT ref: 00FA32E5
Part of subcall function 00FA32DF: ExitProcess.KERNEL32 ref: 00FA32EE

Part of subcall function 00FA8D68: __getptd_noexit.LIBCMT ref: 00FA8D68

RtlAllocateHeap.NTDLL(014B0000,00000000,00000001,00000000,?,?,?,00FA1013,?), ref: 00FA598F

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 54ca34253c04ac01bc26d8a9da11e4bbe15251a3cebb2199dd4fe73281746ecf
Instruction ID: 8c3debd4edcc273dee953f7ba155118fceb960341139c2c110810096e1277e86
Opcode Fuzzy Hash: 54ca34253c04ac01bc26d8a9da11e4bbe15251a3cebb2199dd4fe73281746ecf
Instruction Fuzzy Hash: 7201D2F6A00B16DFE6212B24ED42B6F72988F47B70F50002AF500AE181DBB99D01B360

Uniqueness

Uniqueness Score: -1.00%

Function 00FE9B2C Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00FE97D2,?,?,?,?,?,00000004), ref: 00FE9B45
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00FE97D2,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00FE9B5B
CloseHandle.KERNEL32(00000000,?,00FE97D2,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00FE9B62

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 040529922342997cdf5405c8970e8622950f08dadfd717b2c8024fb2c6880d55
Instruction ID: cd5486b75f9af831fa6f622eb3c815798464455f22e36a8d98080b8b56f01ba7
Opcode Fuzzy Hash: 040529922342997cdf5405c8970e8622950f08dadfd717b2c8024fb2c6880d55
Instruction Fuzzy Hash: C0E08632580315B7D7321B54EC09FCA7B18AB06B71F108110FB64690D087B62611A798

Uniqueness

Uniqueness Score: -1.00%

Function 00FE8F97 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00FE8FA5

Part of subcall function 00FA2F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00FA9C64), ref: 00FA2FA9
Part of subcall function 00FA2F95: GetLastError.KERNEL32(00000000,?,00FA9C64), ref: 00FA2FBB

_free.LIBCMT ref: 00FE8FB6
_free.LIBCMT ref: 00FE8FC8

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: efa5cfa9b1b2f41bce9affd07bef402890ef9bb67adc050918c04926c1923072
Instruction ID: 068a26a8944e70cdd604506ccfd76a3ca2037a1ff9a4154264b96f37f718fbcf
Opcode Fuzzy Hash: efa5cfa9b1b2f41bce9affd07bef402890ef9bb67adc050918c04926c1923072
Instruction Fuzzy Hash: 91E012E1B097814ECA64B57DAD40A9367EE5F493A0718081DB40DDB146DE28E842A128

Uniqueness

Uniqueness Score: -1.00%

Function 00F8AB23 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 00FC002B

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 5499a9786616c734f27a2ee7fc7e855e738672a55e3f771fbbe0dd657ab1b080
Instruction ID: e8568b1b18b029f99ba6e1c412edb647e1087273f67bfa5f7ab38e7bbb01d2d1
Opcode Fuzzy Hash: 5499a9786616c734f27a2ee7fc7e855e738672a55e3f771fbbe0dd657ab1b080
Instruction Fuzzy Hash: 89226971908201CFDB24EF14C895BAAB7E1FF85310F15895DE8968B362DB35EC45EB82

Uniqueness

Uniqueness Score: -1.00%

Function 00F84DD0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F84E1A

Strings

EA06, xrefs: 00FBDCF5

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: 73c16c81f4078f51bf038531063efa4b4ec98e4cbedc9a0a034d40cd26d2c3bf
Instruction ID: ef3f0d02ffdf2c041777bb740e730e8958bfdbb796c11af1fe40f100255e50ce
Opcode Fuzzy Hash: 73c16c81f4078f51bf038531063efa4b4ec98e4cbedc9a0a034d40cd26d2c3bf
Instruction Fuzzy Hash: D4417C72E0425A5BCF21BB64CC517FE7FA6AB05310F284075FC82DB282D625AD40B7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00F8492E Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00F84992

Part of subcall function 00FA35AC: __lock.LIBCMT ref: 00FA35B2
Part of subcall function 00FA35AC: DecodePointer.KERNEL32(00000001,?,00F849A7,00FD81BC), ref: 00FA35BE
Part of subcall function 00FA35AC: EncodePointer.KERNEL32(?,?,00F849A7,00FD81BC), ref: 00FA35C9

Part of subcall function 00F84A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00F84A73
Part of subcall function 00F84A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00F84A88

Part of subcall function 00F83B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00F83B7A
Part of subcall function 00F83B4C: IsDebuggerPresent.KERNEL32 ref: 00F83B8C
Part of subcall function 00F83B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?,010462F8,010462E0,?,?), ref: 00F83BFD
Part of subcall function 00F83B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 00F83C81

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00F849D2

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 39d0914b5f7aee9d011179c72b3edfb74caa825f843cc1961060757372dc7074
Instruction ID: 304a82a824f9b758bfa2636d017bf9fe2cdeeaaaab71bfd3bfbfefe96ddb279c
Opcode Fuzzy Hash: 39d0914b5f7aee9d011179c72b3edfb74caa825f843cc1961060757372dc7074
Instruction Fuzzy Hash: 1611C0B1904301AFC320EF68DA8595AFBE8EF95750F00451EF085832A1DBBA9544DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F85DF9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,00F85981,?,?,?,?), ref: 00F85E27
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,00F85981,?,?,?,?), ref: 00FBE19C

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 58c82cb3939508a9394a34465846331a17a8f300af21d28ad8553d34c0d26008
Instruction ID: 2a25dca83c0329835a6cc98550a517ed05968906941391c0fec11ea27b76354b
Opcode Fuzzy Hash: 58c82cb3939508a9394a34465846331a17a8f300af21d28ad8553d34c0d26008
Instruction Fuzzy Hash: 59019271644708BFF7355E28CC8AFE63A9CAB01B7CF108318BAE55A1D0C6B41E49AF50

Uniqueness

Uniqueness Score: -1.00%

Function 00FA0FF6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FA594C: __FF_MSGBANNER.LIBCMT ref: 00FA5963
Part of subcall function 00FA594C: __NMSG_WRITE.LIBCMT ref: 00FA596A
Part of subcall function 00FA594C: RtlAllocateHeap.NTDLL(014B0000,00000000,00000001,00000000,?,?,?,00FA1013,?), ref: 00FA598F

std::exception::exception.LIBCMT ref: 00FA102C
__CxxThrowException@8.LIBCMT ref: 00FA1041

Part of subcall function 00FA87DB: RaiseException.KERNEL32(?,?,?,0103BAF8,00000000,?,?,?,?,00FA1046,?,0103BAF8,?,00000001), ref: 00FA8830

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: c428c071d3a5eb50d86272fd23823374ae0e0ad92f986eba568343e58db25c29
Instruction ID: d1b2bb6b450576e1891497c27544b22cc82362c972a66df62b2a8af04fcfdf40
Opcode Fuzzy Hash: c428c071d3a5eb50d86272fd23823374ae0e0ad92f986eba568343e58db25c29
Instruction Fuzzy Hash: 18F028B590020DA6CB24BA58EC019DF7BACAF023A4F204025F844A6151DFB88AC1A2E0

Uniqueness

Uniqueness Score: -1.00%

Function 00FA582D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FA585C
__lock_file.LIBCMT ref: 00FA587D

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 95e8882a4ca49ce607d5c24ae1c3dd95c5e15f560b181847a118053747a57a77
Instruction ID: 5ada7d5d1e83bdcf9517c349e6f9cc24e93df215171274800b64011adc036022
Opcode Fuzzy Hash: 95e8882a4ca49ce607d5c24ae1c3dd95c5e15f560b181847a118053747a57a77
Instruction Fuzzy Hash: 72016CF1C40609EBCF11AF65CC0559F7B71AF82BA0F144215F8145B161DB7D8A12FB51

Uniqueness

Uniqueness Score: -1.00%

Function 00FA55D6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FA8D68: __getptd_noexit.LIBCMT ref: 00FA8D68

__lock_file.LIBCMT ref: 00FA561B

Part of subcall function 00FA6E4E: __lock.LIBCMT ref: 00FA6E71

__fclose_nolock.LIBCMT ref: 00FA5626

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 518bafebc0439abb3586d5846849e728c8f0d232a646cdfe1edad621090d0783
Instruction ID: 86f67499241dcb2fd05fced6b77d945132f590aa3bf7ead1359d43d1588c0bbb
Opcode Fuzzy Hash: 518bafebc0439abb3586d5846849e728c8f0d232a646cdfe1edad621090d0783
Instruction Fuzzy Hash: 5DF0BBF1C00A059AD720AF758C0275E77A16F43B74F558109E414AB2C1CFBC8902BB55

Uniqueness

Uniqueness Score: -1.00%

Function 00EC12FD Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 00EC1B2D
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00EC1B51
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00EC1B73

Memory Dump Source

Source File: 00000000.00000002.1646018115.0000000000EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
Instruction ID: 09047d23c7f9c1adb139773983accaf357c5cb6ba905069697fb01dac76114a3
Opcode Fuzzy Hash: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
Instruction Fuzzy Hash: 0B12DD24E14658C6EB24DF64D8507DEB232EF69300F10A0ED910DEB7A5E77A4E81CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00F92123 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c18c6d1cea44f6f154ff51f7e2f128089aace02f7166391da0d1160025474644
Instruction ID: 8f9ed95709d20644e1e2dd913c023e9b43894aa453d716e75bfe2e0ad5b65647
Opcode Fuzzy Hash: c18c6d1cea44f6f154ff51f7e2f128089aace02f7166391da0d1160025474644
Instruction Fuzzy Hash: 9151A235A04605AFDF14FB54CD92FAD77A6AF45720F148068F806AB382CB38ED00E751

Uniqueness

Uniqueness Score: -1.00%

Function 00F85C4E Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 00F85CF6

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: a03f6c909d2010ce59f2e10a4c9e9f3c7dcb6710192d59f69b37374207cad6ae
Instruction ID: 3492baabc0703da53c0bffdf7c2a8e19e1ca517815716cf625fd74a5a1ea80f5
Opcode Fuzzy Hash: a03f6c909d2010ce59f2e10a4c9e9f3c7dcb6710192d59f69b37374207cad6ae
Instruction Fuzzy Hash: 80311C72A00B1AAFCB18EF6DC48469DB7B5FF48720F148619D81993710D771A950EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FC00D6 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00FC00E1

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 2b1595714de56b866f6851f8315ce0ebf9122192ce87161aac96809e2cca5376
Instruction ID: f14af291bf2eb30903f6eccebbaa0eff080b02e67faa37c8c04aa491bfd8a7f7
Opcode Fuzzy Hash: 2b1595714de56b866f6851f8315ce0ebf9122192ce87161aac96809e2cca5376
Instruction Fuzzy Hash: 34412774908341CFDB24DF14C484B5ABBE0BF45318F09889CE8998B762C776EC46DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00F85B19 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F85B61

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 6a1ba2fb48a11429166a2dfca28482d5b4f00adfa4ac1558c65b790c17acae50
Instruction ID: 59bf503c9f0229716091285df84aae31b7d6e2e7ed51da52655352684f4a883f
Opcode Fuzzy Hash: 6a1ba2fb48a11429166a2dfca28482d5b4f00adfa4ac1558c65b790c17acae50
Instruction Fuzzy Hash: 46212171A00A08EBCB206F12E8807EA7FB8FF60380F21846AE485C1005EB7695E0EB41

Uniqueness

Uniqueness Score: -1.00%

Function 00F84F3D Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F84D13: FreeLibrary.KERNEL32(00000000,?), ref: 00F84D4D

Part of subcall function 00FA548B: __wfsopen.LIBCMT ref: 00FA5496

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,010462F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00F84F6F

Part of subcall function 00F84CC8: FreeLibrary.KERNEL32(00000000), ref: 00F84D02

Part of subcall function 00F84DD0: _memmove.LIBCMT ref: 00F84E1A

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: aa33c0dffda92e24890a41a101377f2c55daa804280c3840588a483afefc8aaf
Instruction ID: c9ca172ba587b46974361446732f73d08a7bb4ae7c549f936c5f138131c3c315
Opcode Fuzzy Hash: aa33c0dffda92e24890a41a101377f2c55daa804280c3840588a483afefc8aaf
Instruction Fuzzy Hash: F011C432600707ABCB21FF71CC12FEE77A99F44710F10842DF981A7181DA79AA05BB60

Uniqueness

Uniqueness Score: -1.00%

Function 00FC01AF Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00FC01BB

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: f016e94229b84d0f88846f549ec09b7b075ceefd157d1836a04309a2a0062f2e
Instruction ID: 1f8a1fd3184ee511890eb5863733844ad4f22368a79cf014bfb845bbc4dd7d24
Opcode Fuzzy Hash: f016e94229b84d0f88846f549ec09b7b075ceefd157d1836a04309a2a0062f2e
Instruction Fuzzy Hash: 0A2144B4908342CFDB24EF24C844B5ABBE0FF84314F05896CE89A47761D775E845EB52

Uniqueness

Uniqueness Score: -1.00%

Function 00F85D20 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,00F85807,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00F85D76

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: dfae98376fd2d9e002738f6419418862f4072a566ae4c81d289ea4251b622465
Instruction ID: 7846daa86e69b75c1c1db994aadb1023ffcbbc3a50c615ae12677d72031270b3
Opcode Fuzzy Hash: dfae98376fd2d9e002738f6419418862f4072a566ae4c81d289ea4251b622465
Instruction Fuzzy Hash: 01113D32604B019FD3319F15C844BA6B7E5EF45B60F10C91DE8AA86650D771F945DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00F85BDA Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FBE141

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 9b54afcf07a23b9ff4e0bf05bec20c5cd47f57aecc711df460a32f44145caaaf
Instruction ID: 8868a46f82d3ed92ed240366cd9da430a67c3f7ec9781f3b9603ea4386c87d4d
Opcode Fuzzy Hash: 9b54afcf07a23b9ff4e0bf05bec20c5cd47f57aecc711df460a32f44145caaaf
Instruction Fuzzy Hash: 1F01A2B9600542AFC305EB29D851D66FBAAFF9A3147148159F819C7702DB34FC21DBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00FA4A93 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00FA4AD6

Part of subcall function 00FA8D68: __getptd_noexit.LIBCMT ref: 00FA8D68

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: b1d19309049f81359a8546fb1214b02116825cf76375e6c2944af999e6792c5e
Instruction ID: 80afa48f168fa932b3afb3f3a9eb6fa7ba8d5632893d094c7cbc693412599cd4
Opcode Fuzzy Hash: b1d19309049f81359a8546fb1214b02116825cf76375e6c2944af999e6792c5e
Instruction Fuzzy Hash: 85F0A4B19402099BDF61AFA48C0639F3661AF82365F044518B424AA1D1CBFC9961FF55

Uniqueness

Uniqueness Score: -1.00%

Function 00F84FAA Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,010462F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00F84FDE

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 03d603d3df0ee4f639b79b69a854a26f098ec731aed8a8fe8d8d2cad5c145e47
Instruction ID: 461daf828b269fb728e9413a5d4dbc90f3c064799c54b2ae63857d0e95181d75
Opcode Fuzzy Hash: 03d603d3df0ee4f639b79b69a854a26f098ec731aed8a8fe8d8d2cad5c145e47
Instruction Fuzzy Hash: 96F03072505713CFCB34AF64E494992BBE1BF153293248A3EE2D683610C775A840EF40

Uniqueness

Uniqueness Score: -1.00%

Function 00FA09D5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00FA09F4

Part of subcall function 00F87D2C: _memmove.LIBCMT ref: 00F87D66

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 54374a6a63b8872c15801d39066a8e32b204043cfc0af9f35c39d136d5fbdead
Instruction ID: 0ed3d15804e86fd0e1f3e37838e9c35fa6ed0821133eb3b250376c7bfed587bc
Opcode Fuzzy Hash: 54374a6a63b8872c15801d39066a8e32b204043cfc0af9f35c39d136d5fbdead
Instruction Fuzzy Hash: 05E0863690422857C721E6589C05FFA77ADDF88790F0441B5FC4CD7209D965AC819690

Uniqueness

Uniqueness Score: -1.00%

Function 00FE9129 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00FE914B

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction ID: 9972761dc0a72d24c071eb43ff72cb8bf8cbfd15337e7e7e7f7ee5fec10bd68d
Opcode Fuzzy Hash: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction Fuzzy Hash: B0E092B0508B405FDB348A24D8107E373E0BB06315F00081CF29A83341EBA67841D759

Uniqueness

Uniqueness Score: -1.00%

Function 00F85DAE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,00FBE16B,?,?,00000000), ref: 00F85DBF

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ca3e0c294b1dbcee10d1b1761b1af77b9c532dcbdbc0f94e315f707675f749c6
Instruction ID: a576d4e555d59e6746d056de040d6d1acf73edfae4c8418f333e68eef7abdbab
Opcode Fuzzy Hash: ca3e0c294b1dbcee10d1b1761b1af77b9c532dcbdbc0f94e315f707675f749c6
Instruction Fuzzy Hash: E3D0C77464020CBFE710DB80DC46FA9777CD705710F100194FD0456290D6B27D509795

Uniqueness

Uniqueness Score: -1.00%

Function 00FA548B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00FA5496

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: ebfbeaa45d6c53008cc8c6724e5fcb56196db5339e83fc68bcc3526924edbd8c
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 97B092B684020C7BDE012E82EC02A593F199B45A78F808020FF0C18162A677A6A0A689

Uniqueness

Uniqueness Score: -1.00%

Function 00FED2E6 Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 00FED46A

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 51010f2b55a87a9b8ad20c8d71373d21053a97ff0d58b07c1ef9725759e01216
Instruction ID: dab34a4da0d5ba797cddd39aa8ca31bacd048fb208d141472c9821482e93002a
Opcode Fuzzy Hash: 51010f2b55a87a9b8ad20c8d71373d21053a97ff0d58b07c1ef9725759e01216
Instruction Fuzzy Hash: 807195346083418FC714FF25C8D1AAEB7E0AF94714F18452DF8969B6A1DB38ED09EB52

Uniqueness

Uniqueness Score: -1.00%

Function 00FA0E48 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00FA0EF7

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: e611eff1314af85b4240898ce8d27586fcf18a8003839dd700fc32160564fffe
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 2131E5B1A00106DFCB18DF58E4C0A69F7A6FF5A310B648AA5E409DB651DB31EDC1EBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00EC22FC Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 00EC2311

Memory Dump Source

Source File: 00000000.00000002.1646018115.0000000000EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction ID: 988cb571063b6f96a48898f5b1b9fa41f55713256eed2819558cc9e2b1c44e13
Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction Fuzzy Hash: 0CE0BF7494020EEFDB00EFB8D6496DE7BB4EF04301F1005A5FD05E7681DB319E548A62

Uniqueness

Uniqueness Score: -1.00%

Function 00EC2300 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 00EC2311

Memory Dump Source

Source File: 00000000.00000002.1646018115.0000000000EC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00EC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ec0000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: c2af7c2c3d42b040da40e8a017f5a9cdd09aa75ccd216de0d9739416cee1097a
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 97E0E67494020EDFDB00EFB8D64969E7FB4EF04301F100565FD01E2281D6319D508A62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0100CDAC Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00F82612: GetWindowLongW.USER32(?,000000EB), ref: 00F82623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0100CE50
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0100CE91
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0100CED6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0100CF00
SendMessageW.USER32 ref: 0100CF29
_wcsncpy.LIBCMT ref: 0100CFA1
GetKeyState.USER32(00000011), ref: 0100CFC2
GetKeyState.USER32(00000009), ref: 0100CFCF
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0100CFE5
GetKeyState.USER32(00000010), ref: 0100CFEF
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0100D018
SendMessageW.USER32 ref: 0100D03F
SendMessageW.USER32(?,00001030,?,0100B602), ref: 0100D145
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0100D15B
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0100D16E
SetCapture.USER32(?), ref: 0100D177
ClientToScreen.USER32(?,?), ref: 0100D1DC
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0100D1E9
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0100D203
ReleaseCapture.USER32 ref: 0100D20E
GetCursorPos.USER32(?), ref: 0100D248
ScreenToClient.USER32(?,?), ref: 0100D255
SendMessageW.USER32(?,00001012,00000000,?), ref: 0100D2B1
SendMessageW.USER32 ref: 0100D2DF
SendMessageW.USER32(?,00001111,00000000,?), ref: 0100D31C
SendMessageW.USER32 ref: 0100D34B
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0100D36C
SendMessageW.USER32(?,0000110B,00000009,?), ref: 0100D37B
GetCursorPos.USER32(?), ref: 0100D39B
ScreenToClient.USER32(?,?), ref: 0100D3A8
GetParent.USER32(?), ref: 0100D3C8
SendMessageW.USER32(?,00001012,00000000,?), ref: 0100D431
SendMessageW.USER32 ref: 0100D462
ClientToScreen.USER32(?,?), ref: 0100D4C0
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0100D4F0
SendMessageW.USER32(?,00001111,00000000,?), ref: 0100D51A
SendMessageW.USER32 ref: 0100D53D
ClientToScreen.USER32(?,?), ref: 0100D58F
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0100D5C3

Part of subcall function 00F825DB: GetWindowLongW.USER32(?,000000EB), ref: 00F825EC

GetWindowLongW.USER32(?,000000F0), ref: 0100D65F

Strings

@GUI_DRAGID, xrefs: 0100D1AA
F, xrefs: 0100D543

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: 59e398b19de72ffbdad28524e1ccb5e1a885292efbb9b226ddc146a61ff93d19
Instruction ID: 469fc233466ac0c470cf787410d52d016b7f94514153e26adf2da5f91509a744
Opcode Fuzzy Hash: 59e398b19de72ffbdad28524e1ccb5e1a885292efbb9b226ddc146a61ff93d19
Instruction Fuzzy Hash: 5142BC74104341AFF726CF68C984AAABBE5FF49314F04069DF6D5872E1DB36A840DB92

Uniqueness

Uniqueness Score: -1.00%

Function 0100804A Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 571windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 0100873F

Strings

%d/%02d/%02d, xrefs: 01008478

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: a89a542106ab2f97be5351b291f1bbb13f59493b4d7ad55da27ecfd8585cd0d0
Instruction ID: 72dc04f3cffa804e69c9c0bf3350ec9e37cdcc82ca3754c19128af43c018c5d2
Opcode Fuzzy Hash: a89a542106ab2f97be5351b291f1bbb13f59493b4d7ad55da27ecfd8585cd0d0
Instruction Fuzzy Hash: B112AC71900205ABFB768F28CC49FAE7BE8FB49350F10815AFA95EA2D5DB758941CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00F9710E Relevance: 48.8, APIs: 19, Strings: 6, Instructions: 5093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F975C2
_memset.LIBCMT ref: 00F976B1
_memmove.LIBCMT ref: 00F97C4B
_memmove.LIBCMT ref: 00F97E4F

Strings

Q\E, xrefs: 00F981C1
DEFINE, xrefs: 00FD25AF
[:<:]], xrefs: 00F975F1
\b(?<=\w), xrefs: 00FD3C41
\b(?=\w), xrefs: 00FD3C34
[:>:]], xrefs: 00F9760A

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: _memmove$_memset
String ID: DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-1798697756
Opcode ID: 1f66ea29d5ee1fbb9f13755ccce0111ef9c30ddc689500791cf73a14a61141e5
Instruction ID: aaa85599c164f69e089aceae5556f3f10c4bc23890ce7d3b3cae632ea245e6c1
Opcode Fuzzy Hash: 1f66ea29d5ee1fbb9f13755ccce0111ef9c30ddc689500791cf73a14a61141e5
Instruction Fuzzy Hash: 61938272E043159BDF24DF58C8817ADB7B2FF58320F29816AE955AB380E7709D81EB40

Uniqueness

Uniqueness Score: -1.00%

Function 00F84A35 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 00F84A3D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00FBDA8E
IsIconic.USER32(?), ref: 00FBDA97
ShowWindow.USER32(?,00000009), ref: 00FBDAA4
SetForegroundWindow.USER32(?), ref: 00FBDAAE
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00FBDAC4
GetCurrentThreadId.KERNEL32 ref: 00FBDACB
GetWindowThreadProcessId.USER32(?,00000000), ref: 00FBDAD7
AttachThreadInput.USER32(?,00000000,00000001), ref: 00FBDAE8
AttachThreadInput.USER32(?,00000000,00000001), ref: 00FBDAF0
AttachThreadInput.USER32(00000000,?,00000001), ref: 00FBDAF8
SetForegroundWindow.USER32(?), ref: 00FBDAFB
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FBDB10
keybd_event.USER32(00000012,00000000), ref: 00FBDB1B
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FBDB25
keybd_event.USER32(00000012,00000000), ref: 00FBDB2A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FBDB33
keybd_event.USER32(00000012,00000000), ref: 00FBDB38
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FBDB42
keybd_event.USER32(00000012,00000000), ref: 00FBDB47
SetForegroundWindow.USER32(?), ref: 00FBDB4A
AttachThreadInput.USER32(?,?,00000000), ref: 00FBDB71

Strings

Shell_TrayWnd, xrefs: 00FBDA89

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 5a732c7ad9f721ca5cd1066f8af8b209ad12b7c452bb1448f4e06e3ced408d0b
Instruction ID: 4c30ec92ad373a8f038e2ff98850fe4171e2d97be53c1c6b28c5d2bb8a659a29
Opcode Fuzzy Hash: 5a732c7ad9f721ca5cd1066f8af8b209ad12b7c452bb1448f4e06e3ced408d0b
Instruction Fuzzy Hash: AD319371A40318BBEB316F629C49FBF7E6CEB44B61F114015FA04EA1C1DAB65900BFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FD8858 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00FD8CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00FD8D0D
Part of subcall function 00FD8CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00FD8D3A
Part of subcall function 00FD8CC3: GetLastError.KERNEL32 ref: 00FD8D47

_memset.LIBCMT ref: 00FD889B
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00FD88ED
CloseHandle.KERNEL32(?), ref: 00FD88FE
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00FD8915
GetProcessWindowStation.USER32 ref: 00FD892E
SetProcessWindowStation.USER32(00000000), ref: 00FD8938
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00FD8952

Part of subcall function 00FD8713: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00FD8851), ref: 00FD8728
Part of subcall function 00FD8713: CloseHandle.KERNEL32(?,?,00FD8851), ref: 00FD873A

Strings

, xrefs: 00FD88AA
default, xrefs: 00FD894D
winsta0, xrefs: 00FD8910

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: cf102f88f7e0b6e44d48c51ad0a1ff8e395c3502ca15614b4e76f26afb1abae3
Instruction ID: 4972292308aba180a49ba19a9b009294a152f2e1a23973798c786722b7ae0f5d
Opcode Fuzzy Hash: cf102f88f7e0b6e44d48c51ad0a1ff8e395c3502ca15614b4e76f26afb1abae3
Instruction Fuzzy Hash: 50816D71D00209BFDF21DFA4CC45AEE7B7AEF04394F08411AF910A6250DB798E16EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00FF425A Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0100F910), ref: 00FF4284
IsClipboardFormatAvailable.USER32(0000000D), ref: 00FF4292
GetClipboardData.USER32(0000000D), ref: 00FF429A
CloseClipboard.USER32 ref: 00FF42A6
GlobalLock.KERNEL32(00000000), ref: 00FF42C2
CloseClipboard.USER32 ref: 00FF42CC
GlobalUnlock.KERNEL32(00000000,00000000), ref: 00FF42E1
IsClipboardFormatAvailable.USER32(00000001), ref: 00FF42EE
GetClipboardData.USER32(00000001), ref: 00FF42F6
GlobalLock.KERNEL32(00000000), ref: 00FF4303
GlobalUnlock.KERNEL32(00000000,00000000,?), ref: 00FF4337
CloseClipboard.USER32 ref: 00FF4447

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: cef4ebc2e91a6381dcdd2ccac5c803bddc5f5aafe68daac63676169b9f3f969c
Instruction ID: f2bd9ae27c4ef04af85928fa65ca6f3db0c4320e23ed80fe887d3553428d7fac
Opcode Fuzzy Hash: cef4ebc2e91a6381dcdd2ccac5c803bddc5f5aafe68daac63676169b9f3f969c
Instruction Fuzzy Hash: D551D535204306ABD321FF60DC85F7F77A8AF84B10F100529FA95D21A5DF79E905AB62

Uniqueness

Uniqueness Score: -1.00%

Function 00FEC9C7 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00FEC9F8
FindClose.KERNEL32(00000000), ref: 00FECA4C
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00FECA71
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00FECA88
FileTimeToSystemTime.KERNEL32(?,?), ref: 00FECAAF
__swprintf.LIBCMT ref: 00FECAFB
__swprintf.LIBCMT ref: 00FECB3E

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

__swprintf.LIBCMT ref: 00FECB92

Part of subcall function 00FA38D8: __woutput_l.LIBCMT ref: 00FA3931

__swprintf.LIBCMT ref: 00FECBE0

Part of subcall function 00FA38D8: __flsbuf.LIBCMT ref: 00FA3953
Part of subcall function 00FA38D8: __flsbuf.LIBCMT ref: 00FA396B

__swprintf.LIBCMT ref: 00FECC2F
__swprintf.LIBCMT ref: 00FECC7E
__swprintf.LIBCMT ref: 00FECCCD

Strings

%02d, xrefs: 00FECB86, 00FECB90, 00FECBDE, 00FECC2D, 00FECC7C, 00FECCCB
%4d, xrefs: 00FECB38
%4d%02d%02d%02d%02d%02d, xrefs: 00FECAF5

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: bcf208531519872e1e9a96283aeba97945bb2d0aae910b048d4cf818e3745c11
Instruction ID: bbafa46f359fb16e1af35012fda50ea6e13578ad163ecafc10237ef93039bd23
Opcode Fuzzy Hash: bcf208531519872e1e9a96283aeba97945bb2d0aae910b048d4cf818e3745c11
Instruction Fuzzy Hash: FBA14DB2508305ABC714FB65CC85DAFB7ECAF94B00F440919B586C3191EB78DA09DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00FEF200 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00FEF221
_wcscmp.LIBCMT ref: 00FEF236
_wcscmp.LIBCMT ref: 00FEF24D
GetFileAttributesW.KERNEL32(?), ref: 00FEF25F
SetFileAttributesW.KERNEL32(?,?), ref: 00FEF279
FindNextFileW.KERNEL32(00000000,?), ref: 00FEF291
FindClose.KERNEL32(00000000), ref: 00FEF29C
FindFirstFileW.KERNEL32(*.*,?), ref: 00FEF2B8
_wcscmp.LIBCMT ref: 00FEF2DF
_wcscmp.LIBCMT ref: 00FEF2F6
SetCurrentDirectoryW.KERNEL32(?), ref: 00FEF308
SetCurrentDirectoryW.KERNEL32(0103A5A0), ref: 00FEF326
FindNextFileW.KERNEL32(00000000,00000010), ref: 00FEF330
FindClose.KERNEL32(00000000), ref: 00FEF33D
FindClose.KERNEL32(00000000), ref: 00FEF34F

Strings

*.*, xrefs: 00FEF2B3

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: df00e19d0d0891c0e9c35a7da8d02fcd812b50d5eb66960c189fc20492fb5b5d
Instruction ID: 9d3e71ab9d022139599e1b1565dadd7e54d40e8f8acb4b1cd6027bc787bb33fb
Opcode Fuzzy Hash: df00e19d0d0891c0e9c35a7da8d02fcd812b50d5eb66960c189fc20492fb5b5d
Instruction Fuzzy Hash: FF31F576A0024A6FDB21DBB1DC48ADE77ACAF49370F104165F954D3090EB35DA49EB50

Uniqueness

Uniqueness Score: -1.00%

Function 01000AE2 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 01000BDE
RegCreateKeyExW.ADVAPI32(?,?,00000000,0100F910,00000000,?,00000000,?,?), ref: 01000C4C
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 01000C94
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 01000D1D
RegCloseKey.ADVAPI32(?), ref: 0100103D
RegCloseKey.ADVAPI32(00000000), ref: 0100104A

Strings

REG_MULTI_SZ, xrefs: 01000E05
REG_EXPAND_SZ, xrefs: 01000CBA
REG_BINARY, xrefs: 01000FD8
REG_QWORD, xrefs: 01000F8B
REG_SZ, xrefs: 01000D5B
REG_DWORD, xrefs: 01000F0E

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 3fe15522aaa5c08ed9e131efb3be5640f4b13718b8beda2eee3c7cf506db3712
Instruction ID: 8b218ff5e106eeee694bb9b04f1971eff700a2df9e8034e209f716c8048e9cd5
Opcode Fuzzy Hash: 3fe15522aaa5c08ed9e131efb3be5640f4b13718b8beda2eee3c7cf506db3712
Instruction Fuzzy Hash: C7029E752046019FDB15EF18C885E6AB7E5FF89714F04885DF88A9B3A2CB78ED01DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00FEF35D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00FEF37E
_wcscmp.LIBCMT ref: 00FEF393
_wcscmp.LIBCMT ref: 00FEF3AA

Part of subcall function 00FE45C1: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00FE45DC

FindNextFileW.KERNEL32(00000000,?), ref: 00FEF3D9
FindClose.KERNEL32(00000000), ref: 00FEF3E4
FindFirstFileW.KERNEL32(*.*,?), ref: 00FEF400
_wcscmp.LIBCMT ref: 00FEF427
_wcscmp.LIBCMT ref: 00FEF43E
SetCurrentDirectoryW.KERNEL32(?), ref: 00FEF450
SetCurrentDirectoryW.KERNEL32(0103A5A0), ref: 00FEF46E
FindNextFileW.KERNEL32(00000000,00000010), ref: 00FEF478
FindClose.KERNEL32(00000000), ref: 00FEF485
FindClose.KERNEL32(00000000), ref: 00FEF497

Strings

*.*, xrefs: 00FEF3FB

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: f4fb80279a39287587498d13f9bd0b4715a45eecac3195dba560805067cea4f0
Instruction ID: e404734b1f1dd87250d9dbbc17e265bbf6948c0d6038d78e56ac8940d909e9ab
Opcode Fuzzy Hash: f4fb80279a39287587498d13f9bd0b4715a45eecac3195dba560805067cea4f0
Instruction Fuzzy Hash: E531D772A0125A6FCB21EB65DC84ADE77AC9F45370F104165F880D30D0DB35DE48EA50

Uniqueness

Uniqueness Score: -1.00%

Function 00FD81F7 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00FD8766
Part of subcall function 00FD874A: GetLastError.KERNEL32(?,00FD822A,?,?,?), ref: 00FD8770
Part of subcall function 00FD874A: GetProcessHeap.KERNEL32(00000008,?,?,00FD822A,?,?,?), ref: 00FD877F
Part of subcall function 00FD874A: HeapAlloc.KERNEL32(00000000,?,00FD822A,?,?,?), ref: 00FD8786
Part of subcall function 00FD874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00FD879D

Part of subcall function 00FD87E7: GetProcessHeap.KERNEL32(00000008,00FD8240,00000000,00000000,?,00FD8240,?), ref: 00FD87F3
Part of subcall function 00FD87E7: HeapAlloc.KERNEL32(00000000,?,00FD8240,?), ref: 00FD87FA
Part of subcall function 00FD87E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00FD8240,?), ref: 00FD880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00FD825B
_memset.LIBCMT ref: 00FD8270
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00FD828F
GetLengthSid.ADVAPI32(?), ref: 00FD82A0
GetAce.ADVAPI32(?,00000000,?), ref: 00FD82DD
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00FD82F9
GetLengthSid.ADVAPI32(?), ref: 00FD8316
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00FD8325
HeapAlloc.KERNEL32(00000000), ref: 00FD832C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00FD834D
CopySid.ADVAPI32(00000000), ref: 00FD8354
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00FD8385
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00FD83AB
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00FD83BF

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: e58f50eb3564cd2411baa3fa52840dea1d90629b21f9cb6b1c3fa12f3f4f866c
Instruction ID: 285d87ea54e6f6154f7f40780adf8797290ff18c0c9061ff38bbe1a15d88e068
Opcode Fuzzy Hash: e58f50eb3564cd2411baa3fa52840dea1d90629b21f9cb6b1c3fa12f3f4f866c
Instruction Fuzzy Hash: D7616F71D0420AAFDF11DF94DC44AEEBB7AFF04750F08811AF915A7280DB359A16EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00F96843 Relevance: 18.4, Strings: 14, Instructions: 883COMMON

Download Yara Rule

Strings

UTF16), xrefs: 00FD1508
CRLF), xrefs: 00FD16FA
BSR_ANYCRLF), xrefs: 00FD1757
UCP), xrefs: 00FD1546
NO_START_OPT), xrefs: 00FD1588
CR), xrefs: 00FD16C0
LF), xrefs: 00FD16DD
LIMIT_RECURSION=, xrefs: 00FD1635
UTF), xrefs: 00FD1533
LIMIT_MATCH=, xrefs: 00FD15A9
BSR_UNICODE), xrefs: 00FD1771
ANYCRLF), xrefs: 00FD1734
ANY), xrefs: 00FD1717
NO_AUTO_POSSESS), xrefs: 00FD1567

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-4052911093
Opcode ID: 1ac258704c3da1a4119ad62f3ce919be012005744caa6611f25196d0f3416a0f
Instruction ID: d649e200bc1ca8e2b2a36bc0f0b2cb27b461f5b4719aef5069acbcbe52a9cc0c
Opcode Fuzzy Hash: 1ac258704c3da1a4119ad62f3ce919be012005744caa6611f25196d0f3416a0f
Instruction Fuzzy Hash: CF726F75E002199BEF24CF59C8907AEB7B6FF48320F14816BE859EB390D7749941EB90

Uniqueness

Uniqueness Score: -1.00%

Function 01000665 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 010010A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,01000038,?,?), ref: 010010BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 01000737

Part of subcall function 00F89997: __itow.LIBCMT ref: 00F899C2
Part of subcall function 00F89997: __swprintf.LIBCMT ref: 00F89A0C

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 010007D6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 0100086E
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 01000AAD
RegCloseKey.ADVAPI32(00000000), ref: 01000ABA

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 927951b665f02dce4117e0b4a9a6c28b9c881df77c78b37120d676786545b430
Instruction ID: c82f60c896331dc71658324847cbd847a54d36266e79df9e63ab259fc0d9f106
Opcode Fuzzy Hash: 927951b665f02dce4117e0b4a9a6c28b9c881df77c78b37120d676786545b430
Instruction Fuzzy Hash: 8DE18F31604201AFDB15DF28C884E6EBBE8FF89754F08856DF48ADB2A5DB34E901CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00FE0219 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00FE0241
GetAsyncKeyState.USER32(000000A0), ref: 00FE02C2
GetKeyState.USER32(000000A0), ref: 00FE02DD
GetAsyncKeyState.USER32(000000A1), ref: 00FE02F7
GetKeyState.USER32(000000A1), ref: 00FE030C
GetAsyncKeyState.USER32(00000011), ref: 00FE0324
GetKeyState.USER32(00000011), ref: 00FE0336
GetAsyncKeyState.USER32(00000012), ref: 00FE034E
GetKeyState.USER32(00000012), ref: 00FE0360
GetAsyncKeyState.USER32(0000005B), ref: 00FE0378
GetKeyState.USER32(0000005B), ref: 00FE038A

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 87667775e6546767a0eab20fbc7ad9247ebc14fd39bdea4ec5a033ec7ac74ca2
Instruction ID: 17084ff9d8668bf294e421f20b5fa04866b0c025a99b13a744348434164953bb
Opcode Fuzzy Hash: 87667775e6546767a0eab20fbc7ad9247ebc14fd39bdea4ec5a033ec7ac74ca2
Instruction Fuzzy Hash: 0341CA34D047CA6FFF319B6694083B5BEE06F12360F4840ADD6C6561C2EFE559C8A7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00FF86D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00F89997: __itow.LIBCMT ref: 00F899C2
Part of subcall function 00F89997: __swprintf.LIBCMT ref: 00F89A0C

CoInitialize.OLE32 ref: 00FF8718
CoUninitialize.OLE32 ref: 00FF8723
CoCreateInstance.OLE32(?,00000000,00000017,01012BEC,?), ref: 00FF8783
IIDFromString.OLE32(?,?), ref: 00FF87F6
VariantInit.OLEAUT32(?), ref: 00FF8890
VariantClear.OLEAUT32(?), ref: 00FF88F1

Strings

Invalid parameter, xrefs: 00FF880F
Failed to create object, xrefs: 00FF878E, 00FF8844
NULL Pointer assignment, xrefs: 00FF87C8

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: a7f9f7fd85d71d136d1b7120ddaaea16f612bbf599067d1e8d179e1a1a78ea98
Instruction ID: 93ce4476c125252a8ff892188e51ab6823d24c03b8b455d1cff5542cd79ba473
Opcode Fuzzy Hash: a7f9f7fd85d71d136d1b7120ddaaea16f612bbf599067d1e8d179e1a1a78ea98
Instruction Fuzzy Hash: DD61C272608305DFC710EF24C849B6EBBE8AF44794F14480DFA859B2A1DB74ED45EB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FF4458 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00FF447F
EmptyClipboard.USER32 ref: 00FF4485
GlobalAlloc.KERNEL32(00000002,?), ref: 00FF449A
CloseClipboard.USER32 ref: 00FF4539

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 609d1beb287a97ff08c6eff18e57c698bbed096b76e83d9cc774cd9afb0f72c0
Instruction ID: 0399edad85c596a81486370a11a54ccfd16fc508fee75768d0f676746b37d1ef
Opcode Fuzzy Hash: 609d1beb287a97ff08c6eff18e57c698bbed096b76e83d9cc774cd9afb0f72c0
Instruction Fuzzy Hash: BA21D3357002159FDB21EF60EC49B7A77A8EF08320F148006F986DB261DB79AC01EB94

Uniqueness

Uniqueness Score: -1.00%

Function 00FE3A2B Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F848AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F848A1,?,?,00F837C0,?), ref: 00F848CE

Part of subcall function 00FE4CD3: GetFileAttributesW.KERNEL32(?,00FE3947), ref: 00FE4CD4

FindFirstFileW.KERNEL32(?,?), ref: 00FE3ADF
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00FE3B87
MoveFileW.KERNEL32(?,?), ref: 00FE3B9A
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00FE3BB7
FindNextFileW.KERNEL32(00000000,00000010), ref: 00FE3BD9
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00FE3BF5

Strings

\*.*, xrefs: 00FE3A8A, 00FE3A93, 00FE3AA8

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 3b19b32c41aa9e2269676c895601d7d45ac58bd1844ee77923765771b286be68
Instruction ID: 65d35bf16b5b57c347af7b09cb933280de02854f7571e7615de412bd29fbc367
Opcode Fuzzy Hash: 3b19b32c41aa9e2269676c895601d7d45ac58bd1844ee77923765771b286be68
Instruction Fuzzy Hash: AB51923180128D9BCF15FBA1CD9A9EDB7B8AF54700F6441A9E44277091DF39AF09EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00FEF65E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00FEF6AB
Sleep.KERNEL32(0000000A), ref: 00FEF6DB
_wcscmp.LIBCMT ref: 00FEF6EF
_wcscmp.LIBCMT ref: 00FEF70A
FindNextFileW.KERNEL32(?,?), ref: 00FEF7A8
FindClose.KERNEL32(00000000), ref: 00FEF7BE

Strings

*.*, xrefs: 00FEF690

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 9b5e5dbcb0b53dc32982db72f0a1e8bcb96314b28ee6d0427f1bb2cced287891
Instruction ID: 5b6862241e067b5f8456b54f6cedb2a8f75ea7e1d5bd1dad02c9e523fa57f411
Opcode Fuzzy Hash: 9b5e5dbcb0b53dc32982db72f0a1e8bcb96314b28ee6d0427f1bb2cced287891
Instruction Fuzzy Hash: 3541917290024A9FDF21EF65CC85AEEBBB4FF05310F14456AE855A71A0DB349E48EF90

Uniqueness

Uniqueness Score: -1.00%

Function 00F94140 Relevance: 11.6, APIs: 1, Strings: 5, Instructions: 1132COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00F944DB
VUUU, xrefs: 00F944ED
VUUU, xrefs: 00F94520
VUUU, xrefs: 00FC7B0C
ERCP, xrefs: 00F9421F

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: eb1a80f52948915e02727f7b38a84ff04ccf521f971bee9da81a7f8036fa0e55
Instruction ID: f657c1ddf15716a4ad6b47b0e18f698efc7743176e56c51d6884fd8b7f437d00
Opcode Fuzzy Hash: eb1a80f52948915e02727f7b38a84ff04ccf521f971bee9da81a7f8036fa0e55
Instruction Fuzzy Hash: DBA29471E0421ACBEF24DF58C981FADB7B1BF64324F1481A9D856A7280D734AD86EF50

Uniqueness

Uniqueness Score: -1.00%

Function 00F958C0 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F95A05
_memmove.LIBCMT ref: 00F95A55
_memmove.LIBCMT ref: 00F95ABB

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: a612a66a8bfa36a6f585bb2cd2a8402ae7f50e9c19059211860906d8cefe3214
Instruction ID: 705c4c8fea08a17ed4479a2d07f9c266a3178f64300ea42e05e0253c9e5d6021
Opcode Fuzzy Hash: a612a66a8bfa36a6f585bb2cd2a8402ae7f50e9c19059211860906d8cefe3214
Instruction Fuzzy Hash: A3128B71A00A09DFDF14DFA4D981AEEB7B6FF48700F14412AE406E7251EB3AAD15EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FE545F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD8CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00FD8D0D
Part of subcall function 00FD8CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00FD8D3A
Part of subcall function 00FD8CC3: GetLastError.KERNEL32 ref: 00FD8D47

ExitWindowsEx.USER32(?,00000000), ref: 00FE549B

Strings

, xrefs: 00FE5489
SeShutdownPrivilege, xrefs: 00FE546B
@, xrefs: 00FE548E

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 96c51f2ed0ee279628b850a082cc8882aa8e1692e89b383a0f9cb0ca0da417d5
Instruction ID: e8de00a249552ea13bf945132f6572779d3c6e19454bace36912a29e978b84ff
Opcode Fuzzy Hash: 96c51f2ed0ee279628b850a082cc8882aa8e1692e89b383a0f9cb0ca0da417d5
Instruction Fuzzy Hash: 14014C72A54A456BF738D676DC5ABBA7258EB00F67F340025FC46D60C3D9950C806291

Uniqueness

Uniqueness Score: -1.00%

Function 00FF6596 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006), ref: 00FF65EF
WSAGetLastError.WSOCK32(00000000), ref: 00FF65FE
bind.WSOCK32(00000000,?,00000010), ref: 00FF661A
listen.WSOCK32(00000000,00000005), ref: 00FF6629
WSAGetLastError.WSOCK32(00000000), ref: 00FF6643
closesocket.WSOCK32(00000000), ref: 00FF6657

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: d2670836ba16708bb743d1c3155ff8e2febf470d3d2c7ec3cf8da8842b2a99c3
Instruction ID: 2ffc8fd4183cd8bb9e39f8ef1d1e7ff7a0185f00cb4cb5b6489fc7df7270335a
Opcode Fuzzy Hash: d2670836ba16708bb743d1c3155ff8e2febf470d3d2c7ec3cf8da8842b2a99c3
Instruction Fuzzy Hash: E021D2316002159FCB20EF64CC89B7EB7A9EF44720F148159EA5AEB3D1CB78AD05EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F95680 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00FA0FF6: std::exception::exception.LIBCMT ref: 00FA102C
Part of subcall function 00FA0FF6: __CxxThrowException@8.LIBCMT ref: 00FA1041

_memmove.LIBCMT ref: 00FD062F
_memmove.LIBCMT ref: 00FD0744
_memmove.LIBCMT ref: 00FD07EB

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: f86d9a082b68a1a78f08449d192917e7d392576645ece130341152090849157c
Instruction ID: 412d1f797c60f9007e5eb203a9761b4cf0c4011fa1570f0a22e1dcf58d41898f
Opcode Fuzzy Hash: f86d9a082b68a1a78f08449d192917e7d392576645ece130341152090849157c
Instruction Fuzzy Hash: B1028EB1E00209DFDF04DF64D981AAEBBB5EF44310F18806AE806DB355EB35DA51EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F81287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00F82612: GetWindowLongW.USER32(?,000000EB), ref: 00F82623

DefDlgProcW.USER32(?,?,?,?,?), ref: 00F819FA
GetSysColor.USER32(0000000F), ref: 00F81A4E
SetBkColor.GDI32(?,00000000), ref: 00F81A61

Part of subcall function 00F81290: DefDlgProcW.USER32(?,00000020,?), ref: 00F812D8

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: f8467549b3a5c6137ffb17c25f24af483796326176ac60e8f36202facb84bcf9
Instruction ID: ee778d245b11af4ceceb759a90b8807204b1181a68e1a48dc43455250c57c41f
Opcode Fuzzy Hash: f8467549b3a5c6137ffb17c25f24af483796326176ac60e8f36202facb84bcf9
Instruction Fuzzy Hash: 91A127B2505546BAEA3DBA29CC84EFB369CFB82361F14030AF442D61C5DA5E9D03B771

Uniqueness

Uniqueness Score: -1.00%

Function 00FF6A5A Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF80A0: inet_addr.WSOCK32(00000000), ref: 00FF80CB

socket.WSOCK32(00000002,00000002,00000011), ref: 00FF6AB1
WSAGetLastError.WSOCK32(00000000), ref: 00FF6ADA
bind.WSOCK32(00000000,?,00000010), ref: 00FF6B13
WSAGetLastError.WSOCK32(00000000), ref: 00FF6B20
closesocket.WSOCK32(00000000), ref: 00FF6B34

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 5ccaea86de31b1ba9aaafd040ec80a4ccea83c5c6847c7925230402b28578ade
Instruction ID: 6ff5f113a59c9195da5f35c81f9efc7de29c231b7af6b409e49a04f30aec4957
Opcode Fuzzy Hash: 5ccaea86de31b1ba9aaafd040ec80a4ccea83c5c6847c7925230402b28578ade
Instruction Fuzzy Hash: 5E41E635700214AFEB10BF64DC86FBE77A59F44710F448058FA5AEB3D2DA785D01A791

Uniqueness

Uniqueness Score: -1.00%

Function 010055FD Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 0100564C
IsWindowEnabled.USER32 ref: 0100565A
GetForegroundWindow.USER32(?,?,00000001), ref: 01005667
IsIconic.USER32 ref: 01005675
IsZoomed.USER32 ref: 01005683

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: bfe15b582aa618d2f301b17f9b0b9221b74b4ad3bd62df779989e14dafb6442f
Instruction ID: 74a79d4ce1d5996c24b3c32a30336c9a573c2ef4384fde577f2413131ea9bb8e
Opcode Fuzzy Hash: bfe15b582aa618d2f301b17f9b0b9221b74b4ad3bd62df779989e14dafb6442f
Instruction Fuzzy Hash: 3E11BF313006116FF7336F2AEC44A6FBB9DEF48721F044429E986D7281CB7999029FA5

Uniqueness

Uniqueness Score: -1.00%

Function 00FFC304 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00FC1D88,?), ref: 00FFC312
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00FFC324

Strings

GetSystemWow64DirectoryW, xrefs: 00FFC31E
kernel32.dll, xrefs: 00FFC30D

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 809dd5ea2524d1edac4d2b6c90fb836cc43ca98eab96bb30a9a59a07f2d5210b
Instruction ID: fbf338788ff76f4d5689a71aa6fe8e308b643e30219c75afa007aed0ba661202
Opcode Fuzzy Hash: 809dd5ea2524d1edac4d2b6c90fb836cc43ca98eab96bb30a9a59a07f2d5210b
Instruction Fuzzy Hash: 47E08C74A0072B8FDB314B2AC414AD676D8EF093A4F808429E9C5D6220E7B4D840EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F93190 Relevance: 6.6, APIs: 4, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 82b8a568ddea6c7478deac13b50b0f7ea0de0b7c37f8da89f880b4603a0cf632
Instruction ID: 39f7f50d54b673eb8631dd7e026ef667fc0df2727479ca9e5d4dada3e03c256a
Opcode Fuzzy Hash: 82b8a568ddea6c7478deac13b50b0f7ea0de0b7c37f8da89f880b4603a0cf632
Instruction Fuzzy Hash: 0122AD715083029FDB24EF24C881BAFB7E4BF88714F14491DF49A97291DB75EA04EB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FFF121 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00FFF151
Process32FirstW.KERNEL32(00000000,?), ref: 00FFF15F

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

Process32NextW.KERNEL32(00000000,?), ref: 00FFF21F
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00FFF22E

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 1b3837e46e6b24b1e4ae1ec61e795fa58ec4690c7cc842fc2b18f68048bb219b
Instruction ID: 698e364cb70938b2a30caff639c9d38b583345349b2ffb69c7cc8069ff711c24
Opcode Fuzzy Hash: 1b3837e46e6b24b1e4ae1ec61e795fa58ec4690c7cc842fc2b18f68048bb219b
Instruction Fuzzy Hash: 92518E715083019FD320EF20DC85AABB7E8FF94B10F54482DF596972A1EB74E908DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FE40B1 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00FE40D1
_memset.LIBCMT ref: 00FE40F2
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00FE4144
CloseHandle.KERNEL32(00000000), ref: 00FE414D

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: ff0e8d735a07c4d9581fd6d23e00a2c5b4a5771e4419b89372d258e1d2e375d5
Instruction ID: 0c248a3602ce1896c95342fd082d96adb3cbe60137cd7c3f9bf4ea378cfd50b5
Opcode Fuzzy Hash: ff0e8d735a07c4d9581fd6d23e00a2c5b4a5771e4419b89372d258e1d2e375d5
Instruction Fuzzy Hash: 0511A775D012287AD7309BA5AC4DFABBB7CEF45760F10419AF908D7180D6745E809BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00FDEB07 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00FDEB19

Strings

|, xrefs: 00FDEB49
(, xrefs: 00FDEB5F

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 0ee6f56faa97113cb98f41415656638a4c47176a3c4c25e8f83f23ad6bfb2173
Instruction ID: a44aac6b10d5bf8650585d625ef11da65376b1f3bc8e550e06e19c5730aa7329
Opcode Fuzzy Hash: 0ee6f56faa97113cb98f41415656638a4c47176a3c4c25e8f83f23ad6bfb2173
Instruction Fuzzy Hash: 29323675A007059FDB28DF19C481A6AB7F1FF48320B15C56EE89ADB3A1EB70E941DB40

Uniqueness

Uniqueness Score: -1.00%

Function 00FF25E2 Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000), ref: 00FF26D5
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00FF270C

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 7d3c99971f0ce1e8a7c7b1fcb8d32186981bcbbcb06884773768adfe9d26efd2
Instruction ID: f8751045c910bfc4563bbc65d7b2b16b8e0ea391cf809fa7d87b512fb3d5acef
Opcode Fuzzy Hash: 7d3c99971f0ce1e8a7c7b1fcb8d32186981bcbbcb06884773768adfe9d26efd2
Instruction Fuzzy Hash: E341D27290020DBFEB60EE54CC85EBBB7ACEF40724F10406AFB05E6150EA75AE41B665

Uniqueness

Uniqueness Score: -1.00%

Function 00FEB59E Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00FEB5AE
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00FEB608
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00FEB655

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 1a300a175d647e48cff515d71215476f78ce200ff3639947e516dc25f3eda6f3
Instruction ID: bdd5ff0406bff7bf24c02515b762b415292b0336e2429d45f53868b167026a18
Opcode Fuzzy Hash: 1a300a175d647e48cff515d71215476f78ce200ff3639947e516dc25f3eda6f3
Instruction Fuzzy Hash: 2D216035A00518EFCB00EFA5D884AEEBBB8FF49310F148099E845AB351DB35A916DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00FD8CC3 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00FA0FF6: std::exception::exception.LIBCMT ref: 00FA102C
Part of subcall function 00FA0FF6: __CxxThrowException@8.LIBCMT ref: 00FA1041

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00FD8D0D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00FD8D3A
GetLastError.KERNEL32 ref: 00FD8D47

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 465dcf6cec95cccd3dc74458de9349515681b7427282ac03677ea8865bd14fa4
Instruction ID: 637ea1fd2b814daf6c2faef1e7831267daa3e5cb287394f5f4923ea9596daa5c
Opcode Fuzzy Hash: 465dcf6cec95cccd3dc74458de9349515681b7427282ac03677ea8865bd14fa4
Instruction Fuzzy Hash: 5111C1B1814209AFE728EF54EC85D6BB7BDFB04760B24852EF45693240EF30BC419B20

Uniqueness

Uniqueness Score: -1.00%

Function 00FE4C03 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00FE4C2C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00FE4C43
FreeSid.ADVAPI32(?), ref: 00FE4C53

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 1da4f322106c95918c34a558b86b60f29f86fa13a572a211e6e9f89f78be1f26
Instruction ID: 7769be18b6ffa438d19b3a43c0f1f27741a81d47bbb59243641a2114f89076fb
Opcode Fuzzy Hash: 1da4f322106c95918c34a558b86b60f29f86fa13a572a211e6e9f89f78be1f26
Instruction Fuzzy Hash: F6F04975A1130DBFDF14DFF4D889AAEBBBCEF08211F1044A9A901E2180E6756A049B50

Uniqueness

Uniqueness Score: -1.00%

Function 00F8E060 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c4d79771bfa0c214926622cc9741a25ccdf6a1ee9845484909c3a2a6a44838
Instruction ID: 036d5e17c881e387091cef9b945c8caf8e554097597f9632846888efd1680f2c
Opcode Fuzzy Hash: 14c4d79771bfa0c214926622cc9741a25ccdf6a1ee9845484909c3a2a6a44838
Instruction Fuzzy Hash: 47229B75E00216CFDB24EF54C985BEABBB0FF09310F148069E856AB341E774AD85EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FEC93C Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00FEC966
FindClose.KERNEL32(00000000), ref: 00FEC996

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: f2082c615700d8f2f64d14a82a245053b3ad7f0f2ea64d41feed7c6f608bef40
Instruction ID: a4c489cf8c0c8fa24b4faa610d084d97f894341465dd463fbe38adef887dd515
Opcode Fuzzy Hash: f2082c615700d8f2f64d14a82a245053b3ad7f0f2ea64d41feed7c6f608bef40
Instruction Fuzzy Hash: 0511A1326042009FD710EF29C845A6AF7E9FF84320F04851EF8AAD7291DB78AC01DB81

Uniqueness

Uniqueness Score: -1.00%

Function 00FEA2D5 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00FF977D,?,0100FB84,?), ref: 00FEA302
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00FF977D,?,0100FB84,?), ref: 00FEA314

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: e7c50294ed428a59233532d64fddcd0c0ff736fc57fa09e15a4c0e9aa7dc8f4b
Instruction ID: 192a5cc718b205b5b67954da875fd93a94748222d2598860bd13da9d29d9f46e
Opcode Fuzzy Hash: e7c50294ed428a59233532d64fddcd0c0ff736fc57fa09e15a4c0e9aa7dc8f4b
Instruction Fuzzy Hash: C3F0E23150422DABDB21AFA5CC48FEA736DBF08361F008156B908D2180DA30A900DBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00FD8713 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00FD8851), ref: 00FD8728
CloseHandle.KERNEL32(?,?,00FD8851), ref: 00FD873A

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: fcdcdba28b643c54207612f976263c0f6106d988f59c17227f73ddb0117aadff
Instruction ID: 9d7930eb78ef8826bd6a4a312a0c85c7d74a9b899b8c8ddad85227c5444d184e
Opcode Fuzzy Hash: fcdcdba28b643c54207612f976263c0f6106d988f59c17227f73ddb0117aadff
Instruction Fuzzy Hash: B8E0B6B6010611EFE7362B60EC09D777BA9FB047A0B25C829B4A680474DB66AC91EB10

Uniqueness

Uniqueness Score: -1.00%

Function 00FAA395 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00FA8F97,?,?,?,00000001), ref: 00FAA39A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00FAA3A3

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 24ac1b1fe2deba4a713710893888f6c4748d3154f028e21336111b0813d9435c
Instruction ID: ba911ee3f23f9caee27f7313bd55e44b60a8e859c6b05a48578a50b6a603392c
Opcode Fuzzy Hash: 24ac1b1fe2deba4a713710893888f6c4748d3154f028e21336111b0813d9435c
Instruction Fuzzy Hash: 87B0923105820AABCA222B91E809B883F68EB45AB2F408010F64D84054CBE75450AB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FAF419 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e83661307f15068a5705f6cc669f9401f2e70963b77f0f4d97bb64865c02e17
Instruction ID: f48c6d3048a0e4cd4365bb35fa2aa23d35ca057165c014ddd266d170975b4e8b
Opcode Fuzzy Hash: 9e83661307f15068a5705f6cc669f9401f2e70963b77f0f4d97bb64865c02e17
Instruction Fuzzy Hash: 42323472D69F014DD7239534D872336A299AFB73D4F14D737E81AB9A9AEB2DC4831200

Uniqueness

Uniqueness Score: -1.00%

Function 00FB267E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75e986ec55450f1a498abf52368ed95ce91be60856fb1174165bc768d38c5b78
Instruction ID: 120dc247da06cbba426579a9501132091d13bbdc62cf1252de0d087ba36f4edc
Opcode Fuzzy Hash: 75e986ec55450f1a498abf52368ed95ce91be60856fb1174165bc768d38c5b78
Instruction Fuzzy Hash: 58B1F130E2AF818DD72396398831336B64CAFBB2D5F51D71BFC6675D16EB2A85834240

Uniqueness

Uniqueness Score: -1.00%

Function 00FE8B13 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00FE8B25

Part of subcall function 00FA543A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00FE91F8,00000000,?,?,?,?,00FE93A9,00000000,?), ref: 00FA5443
Part of subcall function 00FA543A: __aulldiv.LIBCMT ref: 00FA5463

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: f8f628e5c28b482c7050e02d694f2d508b4405fc952fd6f88006ad913a7e79b4
Instruction ID: 1d373550d99fb5b6dfc18bc0c093da42ab374448a19c929e098fe7028d4b332a
Opcode Fuzzy Hash: f8f628e5c28b482c7050e02d694f2d508b4405fc952fd6f88006ad913a7e79b4
Instruction Fuzzy Hash: 8F21E7B26355508FC329CF25D441B52B3E1EBA5321B288E2CD4E9CF2D0CA75B905DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00FF41FD Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00FF4218

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 8bfa793727673ad3b2b731e5aaac998f1d4013ed6eb5eb9e89d037c88b91712d
Instruction ID: 0d508a2aa155353e0db5a7582059d2f9075a79b6404e97dd073e47fb6c0da7a2
Opcode Fuzzy Hash: 8bfa793727673ad3b2b731e5aaac998f1d4013ed6eb5eb9e89d037c88b91712d
Instruction Fuzzy Hash: 86E048312441155FC710EF59D844AABF7D8AF94760F048025FD49C7351DAB5F840DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FE4EF5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00FE4F18

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 752488138c2c016f4a426f774342d9b67ceb2ecf0b1e6bce443a9f72359056a3
Instruction ID: 417b67595b489cbd514049f7aa9b6e2f35721e5d969d344cc86357e4a4070276
Opcode Fuzzy Hash: 752488138c2c016f4a426f774342d9b67ceb2ecf0b1e6bce443a9f72359056a3
Instruction Fuzzy Hash: E2D05EB15682C579FC284B22AC1FF76110AE380FA1F84498E3201875C299E6B800B434

Uniqueness

Uniqueness Score: -1.00%

Function 00FD8C93 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00FD88D1), ref: 00FD8CB3

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: d964a5787d7df9de172d9475a189f8da83195656b52cbc5850138eabfed1e787
Instruction ID: d5db774f1666c6f62323c3dd4bfd4c7f6edbeb51ab8a456ad5ae6c28cd0376f8
Opcode Fuzzy Hash: d964a5787d7df9de172d9475a189f8da83195656b52cbc5850138eabfed1e787
Instruction Fuzzy Hash: 97D05E3226090EABEF11CEA4DC01EAF3B69EB04B01F408111FE15C5090C776D835AF60

Uniqueness

Uniqueness Score: -1.00%

Function 00FC2230 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00FC2242

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: eb883db5c9132404f2134f76db4975176c8c7fc340ac8cb8086e3562b44bc098
Instruction ID: 9325b60004722a3b399077e7ddaf7d83d79c834dfdf1ca033e80cb70c8e5a52f
Opcode Fuzzy Hash: eb883db5c9132404f2134f76db4975176c8c7fc340ac8cb8086e3562b44bc098
Instruction Fuzzy Hash: B6C04CF1C0410ADBDB15DB90D688EEE77BCBB04304F104155A141F2100D7749B449F71

Uniqueness

Uniqueness Score: -1.00%

Function 00FAA364 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00FAA36A

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 29b366e9a2baf8db97771b80f0dfee44381b0d12c8223fb105980d763c575f73
Instruction ID: 4fc1d08d65833745488d82020a48d1e715a3b5c71e5db6a99c1634bf9c5daa6f
Opcode Fuzzy Hash: 29b366e9a2baf8db97771b80f0dfee44381b0d12c8223fb105980d763c575f73
Instruction Fuzzy Hash: 75A0123000410DA78A111B41E8044447F5CD6001A0B008010F40C4001187B354105680

Uniqueness

Uniqueness Score: -1.00%

Function 00F98A0E Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc7f12e797d8d0fb7829acdcb8c7cc3a331b62008f65109ac57188ec0a7610dd
Instruction ID: 0b7a2070e47533eb0efad570c3a2d25762d96f41fa9f995a19f56512c7287acf
Opcode Fuzzy Hash: bc7f12e797d8d0fb7829acdcb8c7cc3a331b62008f65109ac57188ec0a7610dd
Instruction Fuzzy Hash: D922F571D01616CBEF288F24C49477D77A2EB427A4F6C486BD8429B291DB34DD82FB60

Uniqueness

Uniqueness Score: -1.00%

Function 00FA2405 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 3073a19d66832d3b845137c6c2771659f0b41a0acc86610b4a1c00ebf98181a6
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 04C170B26051A30DDBAD863D943413EBAE16EA37B131A075DE8B2CB5C5EF20D564F620

Uniqueness

Uniqueness Score: -1.00%

Function 00FA283A Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: bc50eb1e19ec0a41c371aa16dd41bb87a29142b60ee8c4f3ac83735601a5fe0d
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: C6C1A4B26051A30ADFAD463DD43413EBBE16AA37B131A076DE4B2DB4D4EF20D524F620

Uniqueness

Uniqueness Score: -1.00%

Function 00FA1BB8 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 0a8019ad923a721179e600434ae80fe32ddb881f8649980f4f9206179ddfddfc
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 45C1A1B26051A30DDF6D463A947413EBAE17AA37B171B076DE4B2CB5C4EF20D524F620

Uniqueness

Uniqueness Score: -1.00%

Function 00FF7B1B Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00FF7B70
DeleteObject.GDI32(00000000), ref: 00FF7B82
DestroyWindow.USER32 ref: 00FF7B90
GetDesktopWindow.USER32 ref: 00FF7BAA
GetWindowRect.USER32(00000000), ref: 00FF7BB1
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00FF7CF2
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00FF7D02
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FF7D4A
GetClientRect.USER32(00000000,?), ref: 00FF7D56
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00FF7D90
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FF7DB2
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FF7DC5
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FF7DD0
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FF7DD9
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FF7DE8
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FF7DF1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FF7DF8
GlobalFree.KERNEL32(00000000), ref: 00FF7E03
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FF7E15
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,01012CAC,00000000), ref: 00FF7E2B
GlobalFree.KERNEL32(00000000), ref: 00FF7E3B
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00FF7E61
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00FF7E80
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FF7EA2
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00FF808F

Strings

DISPLAY, xrefs: 00FF7EF2
static, xrefs: 00FF7D8A, 00FF7EE1
AutoIt v3, xrefs: 00FF7D42
, xrefs: 00FF8015

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 268abff640c59fbdcc5eb172ca34a1e8cc36320d2f3680ce922fd633ee79b5b4
Instruction ID: 0ec41d1e7c0798b34f84176e6a952f098d2ec1404cf48f0f1f672d35d097a7ae
Opcode Fuzzy Hash: 268abff640c59fbdcc5eb172ca34a1e8cc36320d2f3680ce922fd633ee79b5b4
Instruction Fuzzy Hash: FD02A071900209AFDB25DFA4CD89EBEBBB9FF49310F048158F905AB2A4DB759D01DB60

Uniqueness

Uniqueness Score: -1.00%

Function 010037F3 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,0100F910), ref: 010038AF
IsWindowVisible.USER32(?), ref: 010038D3

Strings

ISVISIBLE, xrefs: 010038BF
EDITPASTE, xrefs: 01003BE7
SHOWDROPDOWN, xrefs: 01003968
ADDSTRING, xrefs: 0100399E
TABLEFT, xrefs: 0100390F
TABRIGHT, xrefs: 01003925
GETCURRENTCOL, xrefs: 01003BB0
SENDCOMMANDID, xrefs: 01003C62
ISCHECKED, xrefs: 01003AC1
GETLINECOUNT, xrefs: 01003B4E
ISENABLED, xrefs: 010038F3
CURRENTTAB, xrefs: 01003945
GETCURRENTLINE, xrefs: 01003B75
GETLINE, xrefs: 01003C23
GETCURRENTSELECTION, xrefs: 01003A6B
CHECK, xrefs: 01003AF5
FINDSTRING, xrefs: 010039FE
UNCHECK, xrefs: 01003B0B
SETCURRENTSELECTION, xrefs: 01003A3E
SELECTSTRING, xrefs: 01003A8E
HIDEDROPDOWN, xrefs: 01003988
DELSTRING, xrefs: 010039D1
GETSELECTED, xrefs: 01003B2B

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: e349b85258b27e42dfd08fe255d95b3548629dde68fe69e18fa23720fa16be64
Instruction ID: c8cf2964e6cf4f3e5b09332c7c394216191544922bc3195ae3f8079b0c9b7c54
Opcode Fuzzy Hash: e349b85258b27e42dfd08fe255d95b3548629dde68fe69e18fa23720fa16be64
Instruction Fuzzy Hash: F4D180702083069FDB16EF14C895AAE7BE5BF95344F044459B8C69F3E2CF29E90ADB41

Uniqueness

Uniqueness Score: -1.00%

Function 0100A849 Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0100A89F
GetSysColorBrush.USER32(0000000F), ref: 0100A8D0
GetSysColor.USER32(0000000F), ref: 0100A8DC
SetBkColor.GDI32(?,000000FF), ref: 0100A8F6
SelectObject.GDI32(?,?), ref: 0100A905
InflateRect.USER32(?,000000FF,000000FF), ref: 0100A930
GetSysColor.USER32(00000010), ref: 0100A938
CreateSolidBrush.GDI32(00000000), ref: 0100A93F
FrameRect.USER32(?,?,00000000), ref: 0100A94E
DeleteObject.GDI32(00000000), ref: 0100A955
InflateRect.USER32(?,000000FE,000000FE), ref: 0100A9A0
FillRect.USER32(?,?,?), ref: 0100A9D2
GetWindowLongW.USER32(?,000000F0), ref: 0100A9FD

Part of subcall function 0100AB60: GetSysColor.USER32(00000012), ref: 0100AB99
Part of subcall function 0100AB60: SetTextColor.GDI32(?,?), ref: 0100AB9D
Part of subcall function 0100AB60: GetSysColorBrush.USER32(0000000F), ref: 0100ABB3
Part of subcall function 0100AB60: GetSysColor.USER32(0000000F), ref: 0100ABBE
Part of subcall function 0100AB60: GetSysColor.USER32(00000011), ref: 0100ABDB
Part of subcall function 0100AB60: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0100ABE9
Part of subcall function 0100AB60: SelectObject.GDI32(?,00000000), ref: 0100ABFA
Part of subcall function 0100AB60: SetBkColor.GDI32(?,00000000), ref: 0100AC03
Part of subcall function 0100AB60: SelectObject.GDI32(?,?), ref: 0100AC10
Part of subcall function 0100AB60: InflateRect.USER32(?,000000FF,000000FF), ref: 0100AC2F
Part of subcall function 0100AB60: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0100AC46
Part of subcall function 0100AB60: GetWindowLongW.USER32(00000000,000000F0), ref: 0100AC5B

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 537d59af56d907e2373055341191534601b5f9075b0d3e3a890a1df4e605cc5b
Instruction ID: 0bad95d40ad5e8b8062bbda951e04d443373f2794240d0b5d3998952adf34107
Opcode Fuzzy Hash: 537d59af56d907e2373055341191534601b5f9075b0d3e3a890a1df4e605cc5b
Instruction Fuzzy Hash: 20A1A072108302EFE7629F64DC08A5B7BE9FF89321F004A19FAA2971D0D73AD944DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F82C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00F82CA2
DeleteObject.GDI32(00000000), ref: 00F82CE8
DeleteObject.GDI32(00000000), ref: 00F82CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00F82CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00F82D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 00FBC68B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00FBC6C4
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00FBCAED

Part of subcall function 00F81B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00F82036,?,00000000,?,?,?,?,00F816CB,00000000,?), ref: 00F81B9A

SendMessageW.USER32(?,00001053), ref: 00FBCB2A
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00FBCB41
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00FBCB57
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00FBCB62

Strings

0, xrefs: 00FBC981

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 399fc97ba45cfba055e65edaa5ffa2bc25a89639dfc0efd958809dc013281883
Instruction ID: 3c687586b0f12ef1c80416537ff35c15057f398edcc403831470f34be59f621c
Opcode Fuzzy Hash: 399fc97ba45cfba055e65edaa5ffa2bc25a89639dfc0efd958809dc013281883
Instruction Fuzzy Hash: CF12AF30A04202EFDB21DF25C885BEABBE5BF45320F544569F586DB252CB35E842EF90

Uniqueness

Uniqueness Score: -1.00%

Function 00FF77BE Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00FF77F1
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00FF78B0
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00FF78EE
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00FF7900
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00FF7946
GetClientRect.USER32(00000000,?), ref: 00FF7952
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00FF7996
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00FF79A5
GetStockObject.GDI32(00000011), ref: 00FF79B5
SelectObject.GDI32(00000000,00000000), ref: 00FF79B9
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00FF79C9
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00FF79D2
DeleteDC.GDI32(00000000), ref: 00FF79DB
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00FF7A07
SendMessageW.USER32(00000030,00000000,00000001), ref: 00FF7A1E
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00FF7A59
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00FF7A6D
SendMessageW.USER32(00000404,00000001,00000000), ref: 00FF7A7E
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00FF7AAE
GetStockObject.GDI32(00000011), ref: 00FF7AB9
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00FF7AC4
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00FF7ACE

Strings

DISPLAY, xrefs: 00FF799B
msctls_progress32, xrefs: 00FF7A4F
static, xrefs: 00FF7990, 00FF7AA8
AutoIt v3, xrefs: 00FF793E

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: df42614a058fb0b5ba3ed7e08213c531a038b35d1cb624063eccd3dade65a952
Instruction ID: 3c352b341659126c3e703e2d2f41c65a53875e9f92185cee9776eece1418c63b
Opcode Fuzzy Hash: df42614a058fb0b5ba3ed7e08213c531a038b35d1cb624063eccd3dade65a952
Instruction Fuzzy Hash: 25A192B1A40609BFEB24DBA4DD8AFAEBBB9EF45710F104104FA54A71D0D779AD00DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00FEAF7B Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00FEAF89
GetDriveTypeW.KERNEL32(?,0100FAC0,?,\\.\,0100F910), ref: 00FEB066
SetErrorMode.KERNEL32(00000000,0100FAC0,?,\\.\,0100F910), ref: 00FEB1C4

Strings

1394, xrefs: 00FEB146
USB, xrefs: 00FEB15B
FileBackedVirtual, xrefs: 00FEB193
Unknown, xrefs: 00FEB086, 00FEB12A
Virtual, xrefs: 00FEB18C
ATA, xrefs: 00FEB13F
RAID, xrefs: 00FEB162
iSCSI, xrefs: 00FEB169
SSD, xrefs: 00FEB0F1
PhysicalDrive, xrefs: 00FEB012
RAMDisk, xrefs: 00FEB090
SATA, xrefs: 00FEB177
Removable, xrefs: 00FEB0B8
Network, xrefs: 00FEB0A4
Fixed, xrefs: 00FEB0AE
SAS, xrefs: 00FEB170
MMC, xrefs: 00FEB185
CDROM, xrefs: 00FEB09A
SCSI, xrefs: 00FEB131
\\.\, xrefs: 00FEAFDB
ATAPI, xrefs: 00FEB138
Fibre, xrefs: 00FEB154
SSA, xrefs: 00FEB14D

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: c39ddcd52c84a7ef5695745ea8e9b2f437f2b73a31e258d1acffc3b73c10504e
Instruction ID: 590189b23793f4f74090a3ac8950f129407eade0b45da4fe463b3d32b62282bc
Opcode Fuzzy Hash: c39ddcd52c84a7ef5695745ea8e9b2f437f2b73a31e258d1acffc3b73c10504e
Instruction Fuzzy Hash: DB519431B84386EB8B15EB13CD92ABE73B4BB947657204019E487EB260C77DAD41FB41

Uniqueness

Uniqueness Score: -1.00%

Function 00F86A3C Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00F86A91
__wcsnicmp.LIBCMT ref: 00F86AA9
__wcsnicmp.LIBCMT ref: 00F86AC1
__wcsnicmp.LIBCMT ref: 00F86AD9
__wcsnicmp.LIBCMT ref: 00F86AF1
__wcsnicmp.LIBCMT ref: 00F86B09
__wcsnicmp.LIBCMT ref: 00F86B21
__wcsnicmp.LIBCMT ref: 00F86B35
__wcsnicmp.LIBCMT ref: 00F86B76
__wcsnicmp.LIBCMT ref: 00F86B8A
__wcsnicmp.LIBCMT ref: 00F86B9E
__wcsnicmp.LIBCMT ref: 00F86BB2

Strings

#comments-end, xrefs: 00F86B98
#pragma compile, xrefs: 00F86A8B
#notrayicon, xrefs: 00F86AA3
Cannot parse #include, xrefs: 00FBE819
#OnAutoItStartRegister, xrefs: 00F86AD3
#cs, xrefs: 00F86B2F, 00F86B84
#comments-start, xrefs: 00F86B1B, 00F86B70
#include, xrefs: 00F86B03
Bad directive syntax error, xrefs: 00FBE743
#include-once, xrefs: 00F86AEB
Unterminated group of comments, xrefs: 00FBE82C
#requireadmin, xrefs: 00F86ABB
#ce, xrefs: 00F86BAC

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 4da49fc9bbe4661ea14b8462badeb832ace4b43577cdf0f5c7404c25fdf9fdef
Instruction ID: 7492dc1f82b73c6a36fc969dbca439259fbe38f500466de4fbe9ee7daa474c92
Opcode Fuzzy Hash: 4da49fc9bbe4661ea14b8462badeb832ace4b43577cdf0f5c7404c25fdf9fdef
Instruction Fuzzy Hash: BF8127B1A00316BBCB25BB61CC83FEE7768AF16710F144024F941EA186EB68DA45F791

Uniqueness

Uniqueness Score: -1.00%

Function 0100AB60 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0100AB99
SetTextColor.GDI32(?,?), ref: 0100AB9D
GetSysColorBrush.USER32(0000000F), ref: 0100ABB3
GetSysColor.USER32(0000000F), ref: 0100ABBE
CreateSolidBrush.GDI32(?), ref: 0100ABC3
GetSysColor.USER32(00000011), ref: 0100ABDB
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0100ABE9
SelectObject.GDI32(?,00000000), ref: 0100ABFA
SetBkColor.GDI32(?,00000000), ref: 0100AC03
SelectObject.GDI32(?,?), ref: 0100AC10
InflateRect.USER32(?,000000FF,000000FF), ref: 0100AC2F
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0100AC46
GetWindowLongW.USER32(00000000,000000F0), ref: 0100AC5B
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0100ACA7
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0100ACCE
InflateRect.USER32(?,000000FD,000000FD), ref: 0100ACEC
DrawFocusRect.USER32(?,?), ref: 0100ACF7
GetSysColor.USER32(00000011), ref: 0100AD05
SetTextColor.GDI32(?,00000000), ref: 0100AD0D
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0100AD21
SelectObject.GDI32(?,0100A869), ref: 0100AD38
DeleteObject.GDI32(?), ref: 0100AD43
SelectObject.GDI32(?,?), ref: 0100AD49
DeleteObject.GDI32(?), ref: 0100AD4E
SetTextColor.GDI32(?,?), ref: 0100AD54
SetBkColor.GDI32(?,?), ref: 0100AD5E

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: f954ac2e4aef4c66073c3a58349bfe2197746ae3c77eb8c643b4749c7a18e126
Instruction ID: c57425853eb83f34d5923260b2085922758ebcc018dec225c80f914018bd43a8
Opcode Fuzzy Hash: f954ac2e4aef4c66073c3a58349bfe2197746ae3c77eb8c643b4749c7a18e126
Instruction Fuzzy Hash: 26617F71900219EFEB229FA8DC48EAE7BB9FB08320F114515FA51AB2D1D6769940DB90

Uniqueness

Uniqueness Score: -1.00%

Function 01008C44 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 01008D34
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 01008D45
CharNextW.USER32(0000014E), ref: 01008D74
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 01008DB5
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 01008DCB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 01008DDC
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 01008DF9
SetWindowTextW.USER32(?,0000014E), ref: 01008E45
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 01008E5B
SendMessageW.USER32(?,00001002,00000000,?), ref: 01008E8C
_memset.LIBCMT ref: 01008EB1
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 01008EFA
_memset.LIBCMT ref: 01008F59
SendMessageW.USER32(?,00001053,000000FF,?), ref: 01008F83
SendMessageW.USER32(?,00001074,?,00000001), ref: 01008FDB
SendMessageW.USER32(?,0000133D,?,?), ref: 01009088
InvalidateRect.USER32(?,00000000,00000001), ref: 010090AA
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 010090F4
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 01009121
DrawMenuBar.USER32(?), ref: 01009130
SetWindowTextW.USER32(?,0000014E), ref: 01009158

Strings

0, xrefs: 010090C2

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 6184fdebc6df22f12fee6c29bdc876800973ec85ef7f512d509ae16c45015b23
Instruction ID: 40b7f14fbf3e1642440097ed63bbdd741a793d1a0c82f1b47cda59095c11ee1b
Opcode Fuzzy Hash: 6184fdebc6df22f12fee6c29bdc876800973ec85ef7f512d509ae16c45015b23
Instruction Fuzzy Hash: 41E18470904209ABEF22DF64CC84EEE7BB9FF05714F00819AFA99961D1DB758A41DF50

Uniqueness

Uniqueness Score: -1.00%

Function 01004B16 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 01004C51
GetDesktopWindow.USER32 ref: 01004C66
GetWindowRect.USER32(00000000), ref: 01004C6D
GetWindowLongW.USER32(?,000000F0), ref: 01004CCF
DestroyWindow.USER32(?), ref: 01004CFB
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 01004D24
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 01004D42
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 01004D68
SendMessageW.USER32(?,00000421,?,?), ref: 01004D7D
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 01004D90
IsWindowVisible.USER32(?), ref: 01004DB0
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 01004DCB
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 01004DDF
GetWindowRect.USER32(?,?), ref: 01004DF7
MonitorFromPoint.USER32(?,?,00000002), ref: 01004E1D
GetMonitorInfoW.USER32(00000000,?), ref: 01004E37
CopyRect.USER32(?,?), ref: 01004E4E
SendMessageW.USER32(?,00000412,00000000), ref: 01004EB9

Strings

tooltips_class32, xrefs: 01004D1D
0, xrefs: 01004BFC
(, xrefs: 01004E2A

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 1a9bdd0ce436dfc8f702aa21b08ef5d9fdd7dbccd1f04ed9faae6f21bc861b93
Instruction ID: f2d29199f18b5a4223f9926daa616bc0a61b0b8e09f23786bf12aef36955ffdc
Opcode Fuzzy Hash: 1a9bdd0ce436dfc8f702aa21b08ef5d9fdd7dbccd1f04ed9faae6f21bc861b93
Instruction Fuzzy Hash: 8FB18C71608341AFEB55DF28C848B6ABBE4BF88310F04891DF6C9DB291DB75E805CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00F827D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00F828BC
GetSystemMetrics.USER32(00000007), ref: 00F828C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00F828EF
GetSystemMetrics.USER32(00000008), ref: 00F828F7
GetSystemMetrics.USER32(00000004), ref: 00F8291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00F82939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00F82949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00F8297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00F82990
GetClientRect.USER32(00000000,000000FF), ref: 00F829AE
GetStockObject.GDI32(00000011), ref: 00F829CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 00F829D5

Part of subcall function 00F82344: GetCursorPos.USER32(?), ref: 00F82357
Part of subcall function 00F82344: ScreenToClient.USER32(010467B0,?), ref: 00F82374
Part of subcall function 00F82344: GetAsyncKeyState.USER32(00000001), ref: 00F82399
Part of subcall function 00F82344: GetAsyncKeyState.USER32(00000002), ref: 00F823A7

SetTimer.USER32(00000000,00000000,00000028,00F81256), ref: 00F829FC

Strings

AutoIt v3 GUI, xrefs: 00F82974

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 34ca9364ff4a2cf753a7adaa554d3b495ee3639a6b78a45a2e4520f08fcab6d6
Instruction ID: 7797bd188dc6ad0b7eceb440cb863445d29a210bf2310d99fed3b5f36a52a26b
Opcode Fuzzy Hash: 34ca9364ff4a2cf753a7adaa554d3b495ee3639a6b78a45a2e4520f08fcab6d6
Instruction Fuzzy Hash: 4EB181B1A0020A9FDB25DF68DC85BEE7BB4FB08711F104229FA55D7284DB79A841EF50

Uniqueness

Uniqueness Score: -1.00%

Function 01004069 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 010040F6
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 010041B6

Strings

GETTEXT, xrefs: 0100415F
SELECTINVERT, xrefs: 01004286
SELECTCLEAR, xrefs: 01004235
SELECTALL, xrefs: 0100421D
FINDITEM, xrefs: 01004329
DESELECT, xrefs: 010042A4
GETITEMCOUNT, xrefs: 01004128
GETSELECTEDCOUNT, xrefs: 01004199
SELECT, xrefs: 01004250
ISSELECTED, xrefs: 010041C1
GETSELECTED, xrefs: 010042E4
VIEWCHANGE, xrefs: 01004375
GETSUBITEMCOUNT, xrefs: 01004141

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 9c80455838dd3388791b744b5132397ec51e8dc2577178ad91aaddc8b6db7a56
Instruction ID: c1068f5d962173acfef5e0bea57dce615761470a53efb01e8ce35f2f246dcc76
Opcode Fuzzy Hash: 9c80455838dd3388791b744b5132397ec51e8dc2577178ad91aaddc8b6db7a56
Instruction Fuzzy Hash: E8A19C702182029BDB14EF24CC81AAAB7E5BF85314F088958B9D69B3D2DF79E805DB41

Uniqueness

Uniqueness Score: -1.00%

Function 00FF52F0 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00FF5309
LoadCursorW.USER32(00000000,00007F8A), ref: 00FF5314
LoadCursorW.USER32(00000000,00007F00), ref: 00FF531F
LoadCursorW.USER32(00000000,00007F03), ref: 00FF532A
LoadCursorW.USER32(00000000,00007F8B), ref: 00FF5335
LoadCursorW.USER32(00000000,00007F01), ref: 00FF5340
LoadCursorW.USER32(00000000,00007F81), ref: 00FF534B
LoadCursorW.USER32(00000000,00007F88), ref: 00FF5356
LoadCursorW.USER32(00000000,00007F80), ref: 00FF5361
LoadCursorW.USER32(00000000,00007F86), ref: 00FF536C
LoadCursorW.USER32(00000000,00007F83), ref: 00FF5377
LoadCursorW.USER32(00000000,00007F85), ref: 00FF5382
LoadCursorW.USER32(00000000,00007F82), ref: 00FF538D
LoadCursorW.USER32(00000000,00007F84), ref: 00FF5398
LoadCursorW.USER32(00000000,00007F04), ref: 00FF53A3
LoadCursorW.USER32(00000000,00007F02), ref: 00FF53AE
GetCursorInfo.USER32(?), ref: 00FF53BE
GetLastError.KERNEL32(00000001,00000000), ref: 00FF53E9

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: a86da5b3488aa1359f7ea7a1645d973de54e94393e1635c94cb968d41028f4f4
Instruction ID: e34b457c90c4f029e064f6472000665e18b9606d710584e1432b715e3e27dfdb
Opcode Fuzzy Hash: a86da5b3488aa1359f7ea7a1645d973de54e94393e1635c94cb968d41028f4f4
Instruction Fuzzy Hash: 2C416770E043196ADB109FB68C4996EFFF8EF51B60F10452FE609E7290DAB89401DF51

Uniqueness

Uniqueness Score: -1.00%

Function 00FDAA64 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00FDAAA5
__swprintf.LIBCMT ref: 00FDAB46
_wcscmp.LIBCMT ref: 00FDAB59
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00FDABAE
_wcscmp.LIBCMT ref: 00FDABEA
GetClassNameW.USER32(?,?,00000400), ref: 00FDAC21
GetDlgCtrlID.USER32(?), ref: 00FDAC73
GetWindowRect.USER32(?,?), ref: 00FDACA9
GetParent.USER32(?), ref: 00FDACC7
ScreenToClient.USER32(00000000), ref: 00FDACCE
GetClassNameW.USER32(?,?,00000100), ref: 00FDAD48
_wcscmp.LIBCMT ref: 00FDAD5C
GetWindowTextW.USER32(?,?,00000400), ref: 00FDAD82
_wcscmp.LIBCMT ref: 00FDAD96

Part of subcall function 00FA386C: _iswctype.LIBCMT ref: 00FA3874

Strings

%s%u, xrefs: 00FDAB40

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 4ecc8b89dbb94f9011abff3c5150dcbdf6818036df98a9e4388e54d0db46226e
Instruction ID: ec78449604c0ea19fe026e9bb9d1d20be132ab66ad174136c151eca15b937e4b
Opcode Fuzzy Hash: 4ecc8b89dbb94f9011abff3c5150dcbdf6818036df98a9e4388e54d0db46226e
Instruction Fuzzy Hash: 4FA1F671604706AFD715DF20C884BAAF7EAFF04325F08461AF999C3250D734E945EB96

Uniqueness

Uniqueness Score: -1.00%

Function 00FDB397 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00FDB3DB
_wcscmp.LIBCMT ref: 00FDB3EC
GetWindowTextW.USER32(00000001,?,00000400), ref: 00FDB414
CharUpperBuffW.USER32(?,00000000), ref: 00FDB431
_wcscmp.LIBCMT ref: 00FDB44F
_wcsstr.LIBCMT ref: 00FDB460
GetClassNameW.USER32(00000018,?,00000400), ref: 00FDB498
_wcscmp.LIBCMT ref: 00FDB4A8
GetWindowTextW.USER32(00000002,?,00000400), ref: 00FDB4CF
GetClassNameW.USER32(00000018,?,00000400), ref: 00FDB518
_wcscmp.LIBCMT ref: 00FDB528
GetClassNameW.USER32(00000010,?,00000400), ref: 00FDB550
GetWindowRect.USER32(00000004,?), ref: 00FDB5B9

Strings

@, xrefs: 00FDB3BC
ThumbnailClass, xrefs: 00FDB4A3, 00FDB523

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 9ab97df11ff38979d335b9aef7b4feb3bef621a989e588ea4e80b239b72ef36b
Instruction ID: 2c47f070a67f2cb96538ae75a26743d5004471f95ccd4ccc240948aa1cd227c7
Opcode Fuzzy Hash: 9ab97df11ff38979d335b9aef7b4feb3bef621a989e588ea4e80b239b72ef36b
Instruction Fuzzy Hash: 9581D071408205DBDB11DF10D881FAA7BE9FF44724F0C816AFD858A296DB34DD45EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00FDB1E0 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00FDB23F

Strings

REGEXP=, xrefs: 00FDB254
CLASSNAME=, xrefs: 00FDB27C
[REGEXPTITLE:, xrefs: 00FDB267
ALL, xrefs: 00FDB2D3
[LAST, xrefs: 00FDB2EC
[ACTIVE, xrefs: 00FDB22C
[HANDLE:, xrefs: 00FDB24B
[ALL, xrefs: 00FDB2E5
ACTIVE, xrefs: 00FDB21A
LAST, xrefs: 00FDB204
HANDLE=, xrefs: 00FDB238
[CLASS:, xrefs: 00FDB28F

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: f3b2f46199c340a9b30369894c8ed3f4112421c139e47f9465eeb079ac7736c0
Instruction ID: c89e73fade58e2c4109d7a47b224293a7509359b633d51db92d6d5a0288c1c8e
Opcode Fuzzy Hash: f3b2f46199c340a9b30369894c8ed3f4112421c139e47f9465eeb079ac7736c0
Instruction Fuzzy Hash: 5C310332A04305E6CB01FE62CD83FEE77A9AF15B51F64001AB481751D1EFA9AE04F650

Uniqueness

Uniqueness Score: -1.00%

Function 00FDC4C1 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00FDC4D4
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00FDC4E6
SetWindowTextW.USER32(?,?), ref: 00FDC4FD
GetDlgItem.USER32(?,000003EA), ref: 00FDC512
SetWindowTextW.USER32(00000000,?), ref: 00FDC518
GetDlgItem.USER32(?,000003E9), ref: 00FDC528
SetWindowTextW.USER32(00000000,?), ref: 00FDC52E
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00FDC54F
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00FDC569
GetWindowRect.USER32(?,?), ref: 00FDC572
SetWindowTextW.USER32(?,?), ref: 00FDC5DD
GetDesktopWindow.USER32 ref: 00FDC5E3
GetWindowRect.USER32(00000000), ref: 00FDC5EA
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00FDC636
GetClientRect.USER32(?,?), ref: 00FDC643
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00FDC668
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00FDC693

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: ca755b196ab6f78dcbc1585d6c5232dff7acfe27c17d776589f314b11875a111
Instruction ID: a24e057d8a342f975edcdcb4c62bf0604a1f76223eb80d3658323c0263781874
Opcode Fuzzy Hash: ca755b196ab6f78dcbc1585d6c5232dff7acfe27c17d776589f314b11875a111
Instruction Fuzzy Hash: 35518F7190070AAFDB31DFA8DD85B6EBBB6FF04704F044519E686A26A0C775A904DB80

Uniqueness

Uniqueness Score: -1.00%

Function 0100A428 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0100A4C8
DestroyWindow.USER32(?,?), ref: 0100A542

Part of subcall function 00F87D2C: _memmove.LIBCMT ref: 00F87D66

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0100A5BC
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0100A5DE
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0100A5F1
DestroyWindow.USER32(00000000), ref: 0100A613
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00F80000,00000000), ref: 0100A64A
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0100A663
GetDesktopWindow.USER32 ref: 0100A67C
GetWindowRect.USER32(00000000), ref: 0100A683
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0100A69B
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0100A6B3

Part of subcall function 00F825DB: GetWindowLongW.USER32(?,000000EB), ref: 00F825EC

Strings

0, xrefs: 0100A4DE
tooltips_class32, xrefs: 0100A5B5, 0100A643

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: d0cdebbd653659fd5511bb5caedb62ad7481d192dea2e2029372530534e8c2f1
Instruction ID: e9698f06d41cc78ce8bd357833f238af7ea6845f197937c6cf08ba447bd0e5bf
Opcode Fuzzy Hash: d0cdebbd653659fd5511bb5caedb62ad7481d192dea2e2029372530534e8c2f1
Instruction Fuzzy Hash: 4F7178B1240305AFE722DF28CC49FAA7BE5FB89344F04455CFA8587291D776A942DB21

Uniqueness

Uniqueness Score: -1.00%

Function 0100C8EE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F82612: GetWindowLongW.USER32(?,000000EB), ref: 00F82623

DragQueryPoint.SHELL32(?,?), ref: 0100C917

Part of subcall function 0100ADF1: ClientToScreen.USER32(?,?), ref: 0100AE1A
Part of subcall function 0100ADF1: GetWindowRect.USER32(?,?), ref: 0100AE90
Part of subcall function 0100ADF1: PtInRect.USER32(?,?,0100C304), ref: 0100AEA0

SendMessageW.USER32(?,000000B0,?,?), ref: 0100C980
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0100C98B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0100C9AE
_wcscat.LIBCMT ref: 0100C9DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0100C9F5
SendMessageW.USER32(?,000000B0,?,?), ref: 0100CA0E
SendMessageW.USER32(?,000000B1,?,?), ref: 0100CA25
SendMessageW.USER32(?,000000B1,?,?), ref: 0100CA47
DragFinish.SHELL32(?), ref: 0100CA4E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0100CB41

Strings

@GUI_DRAGID, xrefs: 0100CAB9
@GUI_DROPID, xrefs: 0100CA6E
@GUI_DRAGFILE, xrefs: 0100CAF0

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: c082adc8d139e5718b87cace0f703e0841a354b177d44e3bd089993704a46b88
Instruction ID: 4b6d968d119c35a1266b67072aa99047aec157cd7b4ba405fc044e24dbeae666
Opcode Fuzzy Hash: c082adc8d139e5718b87cace0f703e0841a354b177d44e3bd089993704a46b88
Instruction Fuzzy Hash: 11618971108301AFD712EF64CC85D9FBBE8EFC9750F000A1EF592961A1DB759A09DB92

Uniqueness

Uniqueness Score: -1.00%

Function 01004619 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 010046AB
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 010046F6

Strings

GETTEXT, xrefs: 01004849
GETITEMCOUNT, xrefs: 010047D8
SELECT, xrefs: 010048A7
CHECK, xrefs: 01004716
UNCHECK, xrefs: 010048D2
EXISTS, xrefs: 0100475F
GETSELECTED, xrefs: 01004806
ISCHECKED, xrefs: 01004879
COLLAPSE, xrefs: 0100473C
GETTOTALCOUNT, xrefs: 010046DD
EXPAND, xrefs: 010047A8

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 32924e97a64a58d2226f17da9030e15be125be232d9fa34e62a4ce88907b6581
Instruction ID: c1d4b82e661247c35281140860d3662cde6fe2a588e2e944ad6bae48ab9524a2
Opcode Fuzzy Hash: 32924e97a64a58d2226f17da9030e15be125be232d9fa34e62a4ce88907b6581
Instruction Fuzzy Hash: 64917D742083029FDB15EF10C891A6DB7E2BF89314F04485DE9D69B3A2DB78ED0ADB45

Uniqueness

Uniqueness Score: -1.00%

Function 0100BAB8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0100BB6E
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,01006D80,?), ref: 0100BBCA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0100BC03
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 0100BC46
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0100BC7D
FreeLibrary.KERNEL32(?), ref: 0100BC89
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0100BC99
DestroyIcon.USER32(?), ref: 0100BCA8
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0100BCC5
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0100BCD1

Part of subcall function 00FA313D: __wcsicmp_l.LIBCMT ref: 00FA31C6

Strings

.icl, xrefs: 0100BAE4
.dll, xrefs: 0100BB27
.exe, xrefs: 0100BB04

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: 3d3f22951c090730139070427c82dc11301d6e95673d74a56b66f5ebf8c29262
Instruction ID: 2b7273721315e80b5fc3047702e832dba298e8bac3b5db1237dc5a822207f234
Opcode Fuzzy Hash: 3d3f22951c090730139070427c82dc11301d6e95673d74a56b66f5ebf8c29262
Instruction Fuzzy Hash: 8F61E271600619BBFB26DF68CC85FBE7BA8FB08710F104149F955D61C1DBB9A980DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00FEA5BD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00F89997: __itow.LIBCMT ref: 00F899C2
Part of subcall function 00F89997: __swprintf.LIBCMT ref: 00F89A0C

CharLowerBuffW.USER32(?,?), ref: 00FEA636
GetDriveTypeW.KERNEL32 ref: 00FEA683
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00FEA6CB
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00FEA702
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00FEA730

Part of subcall function 00F87D2C: _memmove.LIBCMT ref: 00F87D66

Strings

open, xrefs: 00FEA65D
wait, xrefs: 00FEA6ED
open , xrefs: 00FEA692
set cd door , xrefs: 00FEA6D1
closed, xrefs: 00FEA64A, 00FEA653
close, xrefs: 00FEA63C
close cd wait, xrefs: 00FEA71B
type cdaudio alias cd wait, xrefs: 00FEA6AE

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 7b6a891e33450c5fe384219c2bc132935cbbd79582a2302c8fecca9a8b3d4dcd
Instruction ID: b816420652199d1320c7ab09b2ca93695e8b58bd57d4a5dc17483897ce966c18
Opcode Fuzzy Hash: 7b6a891e33450c5fe384219c2bc132935cbbd79582a2302c8fecca9a8b3d4dcd
Instruction Fuzzy Hash: 535149711083059FC700EF21CC819AAB7E8FF98718F14495CF89697261DB39EE0AEB52

Uniqueness

Uniqueness Score: -1.00%

Function 00FEA45A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00FEA47A
__swprintf.LIBCMT ref: 00FEA49C
CreateDirectoryW.KERNEL32(?,00000000), ref: 00FEA4D9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00FEA4FE
_memset.LIBCMT ref: 00FEA51D
_wcsncpy.LIBCMT ref: 00FEA559
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00FEA58E
CloseHandle.KERNEL32(00000000), ref: 00FEA599
RemoveDirectoryW.KERNEL32(?), ref: 00FEA5A2
CloseHandle.KERNEL32(00000000), ref: 00FEA5AC

Strings

:, xrefs: 00FEA4BD
\, xrefs: 00FEA4B2
\??\%s, xrefs: 00FEA496

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: bf808bdf4fc1faeffa43c474464e12412f8cacea5a748d2617de3caf89f3fa11
Instruction ID: 25d5d69f5af26a18a92f470cb6953255995d35c147530d07729a79d42cd63155
Opcode Fuzzy Hash: bf808bdf4fc1faeffa43c474464e12412f8cacea5a748d2617de3caf89f3fa11
Instruction Fuzzy Hash: 2D31D2B290024AABDB31DFA1DC48FEB37BCEF89710F1040A6F908D2054E774A6449B24

Uniqueness

Uniqueness Score: -1.00%

Function 00FBAB1B Relevance: 22.7, APIs: 15, Instructions: 211COMMONLIBRARYCODE

Download Yara Rule

APIs

_copy_environ.LIBCMT ref: 00FBAB7B
___wtomb_environ.LIBCMT ref: 00FBAB9D

Part of subcall function 00FA8D68: __getptd_noexit.LIBCMT ref: 00FA8D68

__malloc_crt.LIBCMT ref: 00FBABC5
__malloc_crt.LIBCMT ref: 00FBABE2
_free.LIBCMT ref: 00FBAC19
__recalloc_crt.LIBCMT ref: 00FBAC52
__recalloc_crt.LIBCMT ref: 00FBAC97
_strlen.LIBCMT ref: 00FBACC3
__calloc_crt.LIBCMT ref: 00FBACCD
_strlen.LIBCMT ref: 00FBACDC
SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000), ref: 00FBAD0A
_free.LIBCMT ref: 00FBAD24
_free.LIBCMT ref: 00FBAD31
_free.LIBCMT ref: 00FBAD43
__invoke_watson.LIBCMT ref: 00FBAD5D

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
String ID:
API String ID: 884005220-0
Opcode ID: 553513f473525e02b2ba28168831e659ae64d51f6f2dd93590fa5464beacc57e
Instruction ID: cff620ccd2bf1be30c8609d15d2201e0cd98fd1f3f597266c4ae46e272f11038
Opcode Fuzzy Hash: 553513f473525e02b2ba28168831e659ae64d51f6f2dd93590fa5464beacc57e
Instruction Fuzzy Hash: A56126B6E00205AFDB209F26DC42BA97BA5FF51331F108129E811DB185DB7DD841EF92

Uniqueness

Uniqueness Score: -1.00%

Function 0100C49C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F82612: GetWindowLongW.USER32(?,000000EB), ref: 00F82623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0100C4EC
GetFocus.USER32 ref: 0100C4FC
GetDlgCtrlID.USER32(00000000), ref: 0100C507
_memset.LIBCMT ref: 0100C632
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0100C65D
GetMenuItemCount.USER32(?), ref: 0100C67D
GetMenuItemID.USER32(?,00000000), ref: 0100C690
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0100C6C4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0100C70C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0100C744
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0100C779

Strings

0, xrefs: 0100C62A

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 6c3a8bd994e79261d3baf871b0046aa25052855c3a803798ef9b41e9ff94b8d0
Instruction ID: aa79177febb0229d88c94f5cb6428b741df85d768060afc0decc52dc5f4ec000
Opcode Fuzzy Hash: 6c3a8bd994e79261d3baf871b0046aa25052855c3a803798ef9b41e9ff94b8d0
Instruction Fuzzy Hash: 2381A2741083019FF722DF18CA84AABBBE4FB88314F00069DF9D993291D772E945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FD83F4 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00FD8766
Part of subcall function 00FD874A: GetLastError.KERNEL32(?,00FD822A,?,?,?), ref: 00FD8770
Part of subcall function 00FD874A: GetProcessHeap.KERNEL32(00000008,?,?,00FD822A,?,?,?), ref: 00FD877F
Part of subcall function 00FD874A: HeapAlloc.KERNEL32(00000000,?,00FD822A,?,?,?), ref: 00FD8786
Part of subcall function 00FD874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00FD879D

Part of subcall function 00FD87E7: GetProcessHeap.KERNEL32(00000008,00FD8240,00000000,00000000,?,00FD8240,?), ref: 00FD87F3
Part of subcall function 00FD87E7: HeapAlloc.KERNEL32(00000000,?,00FD8240,?), ref: 00FD87FA
Part of subcall function 00FD87E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00FD8240,?), ref: 00FD880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00FD8458
_memset.LIBCMT ref: 00FD846D
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00FD848C
GetLengthSid.ADVAPI32(?), ref: 00FD849D
GetAce.ADVAPI32(?,00000000,?), ref: 00FD84DA
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00FD84F6
GetLengthSid.ADVAPI32(?), ref: 00FD8513
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00FD8522
HeapAlloc.KERNEL32(00000000), ref: 00FD8529
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00FD854A
CopySid.ADVAPI32(00000000), ref: 00FD8551
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00FD8582
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00FD85A8
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00FD85BC

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: ecbac443115d7918cafc5f51ffd6e33c21e495623bc677de6157fcd90d6f6502
Instruction ID: ccdf8b4dd03d4b4249885c34b66b0daf2cfcb41093993f6c2f9bbdaa8b940d5d
Opcode Fuzzy Hash: ecbac443115d7918cafc5f51ffd6e33c21e495623bc677de6157fcd90d6f6502
Instruction Fuzzy Hash: 79615F7190020AAFDF11DF95DC45AEEBB7AFF05360F08815AF915A7280DB359A05EF60

Uniqueness

Uniqueness Score: -1.00%

Function 00FF762D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00FF76A2
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00FF76AE
CreateCompatibleDC.GDI32(?), ref: 00FF76BA
SelectObject.GDI32(00000000,?), ref: 00FF76C7
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00FF771B
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00FF7757
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00FF777B
SelectObject.GDI32(00000006,?), ref: 00FF7783
DeleteObject.GDI32(?), ref: 00FF778C
DeleteDC.GDI32(00000006), ref: 00FF7793
ReleaseDC.USER32(00000000,?), ref: 00FF779E

Strings

(, xrefs: 00FF7723

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: d32b83bffe110327f18ceda3823f1bb7b86f2029f17589629683253bf7494bfe
Instruction ID: e9a8d5feadea0053a8dd008c49333e0f41301c600f843919c7a803e7eaba2dea
Opcode Fuzzy Hash: d32b83bffe110327f18ceda3823f1bb7b86f2029f17589629683253bf7494bfe
Instruction Fuzzy Hash: B2515A76904309EFCB25DFA8CC84EAEBBB9EF48310F14851DFA9997210D735A840DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00FEA0B5 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,0100FB78), ref: 00FEA0FC

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

LoadStringW.USER32(?,?,00000FFF,?), ref: 00FEA11E
__swprintf.LIBCMT ref: 00FEA177
__swprintf.LIBCMT ref: 00FEA190
_wprintf.LIBCMT ref: 00FEA246
_wprintf.LIBCMT ref: 00FEA264

Strings

Line %d (File "%s"):, xrefs: 00FEA171, 00FEA18A
Error: , xrefs: 00FEA20E
^ ERROR, xrefs: 00FEA1E8
"%s" (%d) : ==> %s:%s%s, xrefs: 00FEA241
"%s" (%d) : ==> %s:, xrefs: 00FEA25F

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: 1efed6af612c382c187ea2765d1e5a051ed727c88fa17814797da6cdcb160a41
Instruction ID: bd136bfcc1849a352ca19494d5812c0d33ca5610da3f78a6357b48091803c041
Opcode Fuzzy Hash: 1efed6af612c382c187ea2765d1e5a051ed727c88fa17814797da6cdcb160a41
Instruction Fuzzy Hash: A0516F72900209ABCF15FBE1CD86EEEB779AF05700F240165F50572091EB3AAF58EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00F86BEC Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00FA0B9B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00F86C6C,?,00008000), ref: 00FA0BB7

Part of subcall function 00F848AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F848A1,?,?,00F837C0,?), ref: 00F848CE

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00F86D0D
SetCurrentDirectoryW.KERNEL32(?), ref: 00F86E5A

Part of subcall function 00F859CD: _wcscpy.LIBCMT ref: 00F85A05

Part of subcall function 00FA387D: _iswctype.LIBCMT ref: 00FA3885

Strings

Unterminated string, xrefs: 00FBEC0D
Bad directive syntax error, xrefs: 00FBEBC6
EA06, xrefs: 00FBE87B
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00FBE84A
AU3!, xrefs: 00F86CC1
Error opening the file, xrefs: 00FBE866, 00FBE8E1
>>>AUTOIT SCRIPT<<<, xrefs: 00FBE8BF

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: f3b862d4e9a0f853e6e7e2641092d7e0d89b0a444c1f79cf94265d7491e0fd44
Instruction ID: cff05e96114a3f5fa2f78e315aeac9293e83e9706506f734746ca8e8b691ff6e
Opcode Fuzzy Hash: f3b862d4e9a0f853e6e7e2641092d7e0d89b0a444c1f79cf94265d7491e0fd44
Instruction Fuzzy Hash: 7302BA315083419FC724EF25C881AEFBBE5BF89714F14491DF486972A1DB38D949EB42

Uniqueness

Uniqueness Score: -1.00%

Function 00F845DF Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F845F9
GetMenuItemCount.USER32(01046890), ref: 00FBD7CD
GetMenuItemCount.USER32(01046890), ref: 00FBD87D
GetCursorPos.USER32(?), ref: 00FBD8C1
SetForegroundWindow.USER32(00000000), ref: 00FBD8CA
TrackPopupMenuEx.USER32(01046890,00000000,?,00000000,00000000,00000000), ref: 00FBD8DD
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00FBD8E9

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: 098067b83453895ce6c4184b2712f44efc45c3b29a84801c75eb11c7c24455b0
Instruction ID: 8a19ad936b1b9f6d41c8a76de25054064e628b587cd0a77cd537818c48dc3799
Opcode Fuzzy Hash: 098067b83453895ce6c4184b2712f44efc45c3b29a84801c75eb11c7c24455b0
Instruction Fuzzy Hash: 8971D371A01216BBEB319F16DC45FEAFF69FB05364F200216F514661D0EBB66810EB91

Uniqueness

Uniqueness Score: -1.00%

Function 010010A5 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,01000038,?,?), ref: 010010BC

Strings

HKEY_CLASSES_ROOT, xrefs: 0100114F
HKCU, xrefs: 010011AC
HKEY_CURRENT_CONFIG, xrefs: 01001179
HKEY_USERS, xrefs: 010011BD
HKU, xrefs: 010011CE
HKCR, xrefs: 01001164
HKCC, xrefs: 0100118A
HKEY_LOCAL_MACHINE, xrefs: 01001125
HKLM, xrefs: 0100113A
HKEY_CURRENT_USER, xrefs: 0100119B

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: eb9f14a9e46b75084724fcf4c2d6e74c6c1831f3f42fe775a6c4275de3a53d36
Instruction ID: 5ff301f7ea379d9e628becafab7f59fcbc9ad36d4a1fe27f855cf03645fd26ae
Opcode Fuzzy Hash: eb9f14a9e46b75084724fcf4c2d6e74c6c1831f3f42fe775a6c4275de3a53d36
Instruction Fuzzy Hash: 65417CB110024A8BEF16EF94ED81AEE3764BF5A304F504444FCD15B292DF34E92ADBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00FE5569 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00F87D2C: _memmove.LIBCMT ref: 00F87D66

Part of subcall function 00F87A84: _memmove.LIBCMT ref: 00F87B0D

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00FE55D2
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00FE55E8
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00FE55F9
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00FE560B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00FE561C

Strings

alias PlayMe, xrefs: 00FE55AB
open , xrefs: 00FE5581
status PlayMe mode, xrefs: 00FE55CD
play PlayMe, xrefs: 00FE5617
close PlayMe, xrefs: 00FE55E3, 00FE5610
play PlayMe wait, xrefs: 00FE5606

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 3533acb3b485076737537ec6a68f1e4629556db3be289b811b5f78f348f1847c
Instruction ID: 8980fb669a2f7a06e47820734d8af753550230dc060fa88d96d66f7d808f4483
Opcode Fuzzy Hash: 3533acb3b485076737537ec6a68f1e4629556db3be289b811b5f78f348f1847c
Instruction Fuzzy Hash: 8611B221A50269B9DB20B663CC8AEFFBB7CEFD1F04F50041AB485E7091DEA45D05DAA0

Uniqueness

Uniqueness Score: -1.00%

Function 00FE48F3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00FE490E
gethostname.WSOCK32(?,00000100), ref: 00FE4928
gethostbyname.WSOCK32(?), ref: 00FE4935
_wcscpy.LIBCMT ref: 00FE495D
_memmove.LIBCMT ref: 00FE4970
inet_ntoa.WSOCK32(?), ref: 00FE497B
_strcat.LIBCMT ref: 00FE4989
_wcscpy.LIBCMT ref: 00FE49A0
WSACleanup.WSOCK32 ref: 00FE49AE
_wcscpy.LIBCMT ref: 00FE49BC

Strings

0.0.0.0, xrefs: 00FE4957

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: f2b3c339f2c7ad67056fd6cca62fe624e60fee138bd55f67d17a3d6b4ec4861e
Instruction ID: 5d75993e48a9965f0a7940026724a72aa9cc16733f29441405313a923676ea17
Opcode Fuzzy Hash: f2b3c339f2c7ad67056fd6cca62fe624e60fee138bd55f67d17a3d6b4ec4861e
Instruction Fuzzy Hash: 5B110571A04119AFCB31EB259C06EDF77BCAB41720F0401A9F448A6042EFB9AA81B761

Uniqueness

Uniqueness Score: -1.00%

Function 00FE5217 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00FE521C

Part of subcall function 00FA0719: timeGetTime.WINMM(?,75C0B400,00F90FF9), ref: 00FA071D

Sleep.KERNEL32(0000000A), ref: 00FE5248
EnumThreadWindows.USER32(?,Function_000651CA,00000000), ref: 00FE526C
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00FE528E
SetActiveWindow.USER32 ref: 00FE52AD
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00FE52BB
SendMessageW.USER32(00000010,00000000,00000000), ref: 00FE52DA
Sleep.KERNEL32(000000FA), ref: 00FE52E5
IsWindow.USER32 ref: 00FE52F1
EndDialog.USER32(00000000), ref: 00FE5302

Strings

BUTTON, xrefs: 00FE5280

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: b4c682b658192ac3b3ae952c235c4f657e7bb25df2f3e4227990fb510fdd7bf0
Instruction ID: 99e787a1bbccec195713a7360d71d1d549fbc688877c928d7a19ff1d124d6681
Opcode Fuzzy Hash: b4c682b658192ac3b3ae952c235c4f657e7bb25df2f3e4227990fb510fdd7bf0
Instruction Fuzzy Hash: 4121F6B4600785AFE7315F31EEC8B253B6AEB49B9AF400414F18186194DBFF9C04B7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00FED7F8 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00F89997: __itow.LIBCMT ref: 00F899C2
Part of subcall function 00F89997: __swprintf.LIBCMT ref: 00F89A0C

CoInitialize.OLE32(00000000), ref: 00FED855
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00FED8E8
SHGetDesktopFolder.SHELL32(?), ref: 00FED8FC
CoCreateInstance.OLE32(01012D7C,00000000,00000001,0103A89C,?), ref: 00FED948
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00FED9B7
CoTaskMemFree.OLE32(?,?), ref: 00FEDA0F
_memset.LIBCMT ref: 00FEDA4C
SHBrowseForFolderW.SHELL32(?), ref: 00FEDA88
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00FEDAAB
CoTaskMemFree.OLE32(00000000), ref: 00FEDAB2
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00FEDAE9
CoUninitialize.OLE32(00000001,00000000), ref: 00FEDAEB

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: bfe709fdf483a6b0b2ac01b7f3c1d18dc5c485b10debcd314dd24389e664df3d
Instruction ID: 5e8f752c7ca1ffc0a77ae497c42f39049f4aa4df9e8afa1cdb0f706989ee9da7
Opcode Fuzzy Hash: bfe709fdf483a6b0b2ac01b7f3c1d18dc5c485b10debcd314dd24389e664df3d
Instruction Fuzzy Hash: 42B10A75A00109AFDB14DFA5CC88EAEBBB9EF48714B048469F809EB251DB35EE41DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FE052C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00FE05A7
SetKeyboardState.USER32(?), ref: 00FE0612
GetAsyncKeyState.USER32(000000A0), ref: 00FE0632
GetKeyState.USER32(000000A0), ref: 00FE0649
GetAsyncKeyState.USER32(000000A1), ref: 00FE0678
GetKeyState.USER32(000000A1), ref: 00FE0689
GetAsyncKeyState.USER32(00000011), ref: 00FE06B5
GetKeyState.USER32(00000011), ref: 00FE06C3
GetAsyncKeyState.USER32(00000012), ref: 00FE06EC
GetKeyState.USER32(00000012), ref: 00FE06FA
GetAsyncKeyState.USER32(0000005B), ref: 00FE0723
GetKeyState.USER32(0000005B), ref: 00FE0731

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 39934009732a92e584e6f0f5a716aa782012b69d67a6ab313cbb68c88661502f
Instruction ID: 1b997a7b73d8ea6667a8074285cab6dbe300ea27039cfdc263f866bff8fdd05c
Opcode Fuzzy Hash: 39934009732a92e584e6f0f5a716aa782012b69d67a6ab313cbb68c88661502f
Instruction Fuzzy Hash: 7951CA70E047C829FB35DBA288547EABFB49F41390F084599D5C2561C2DEE89BCCEB61

Uniqueness

Uniqueness Score: -1.00%

Function 00FDC72A Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00FDC746
GetWindowRect.USER32(00000000,?), ref: 00FDC758
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00FDC7B6
GetDlgItem.USER32(?,00000002), ref: 00FDC7C1
GetWindowRect.USER32(00000000,?), ref: 00FDC7D3
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00FDC827
GetDlgItem.USER32(?,000003E9), ref: 00FDC835
GetWindowRect.USER32(00000000,?), ref: 00FDC846
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00FDC889
GetDlgItem.USER32(?,000003EA), ref: 00FDC897
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00FDC8B4
InvalidateRect.USER32(?,00000000,00000001), ref: 00FDC8C1

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 6f1c7a528f9f5c349aa7e7f5e4e151bc03c9954ea148d422dc88734c0647c53e
Instruction ID: 1f8b64dceba77728ccd721840dbca74cdc14614eec417bb17101b0ec70866d1b
Opcode Fuzzy Hash: 6f1c7a528f9f5c349aa7e7f5e4e151bc03c9954ea148d422dc88734c0647c53e
Instruction Fuzzy Hash: FC512E71B00206ABDB28CF79DD89AAEBBBAFB88310F14812DF515D7294DB759D00DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F8201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00F81B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00F82036,?,00000000,?,?,?,?,00F816CB,00000000,?), ref: 00F81B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00F820D3
KillTimer.USER32(-00000001,?,?,?,?,00F816CB,00000000,?,?,00F81AE2,?,?), ref: 00F8216E
DestroyAcceleratorTable.USER32(00000000), ref: 00FBBEF6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00F816CB,00000000,?,?,00F81AE2,?,?), ref: 00FBBF27
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00F816CB,00000000,?,?,00F81AE2,?,?), ref: 00FBBF3E
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00F816CB,00000000,?,?,00F81AE2,?,?), ref: 00FBBF5A
DeleteObject.GDI32(00000000), ref: 00FBBF6C

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: a8914645d3fe216695e85a75c89bd1baf088bbdcb6c661ac4ab8ac05d7fd1f34
Instruction ID: 56cf0a545e55ac9c56d9065ec69cad7143d69571e73313ca8c5b78b27da0c283
Opcode Fuzzy Hash: a8914645d3fe216695e85a75c89bd1baf088bbdcb6c661ac4ab8ac05d7fd1f34
Instruction Fuzzy Hash: 1361AB75900611DFDB36AF55DA88BA9B7F1FF41322F10451CE0828A564D77AB881FF50

Uniqueness

Uniqueness Score: -1.00%

Function 00F821A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00F825DB: GetWindowLongW.USER32(?,000000EB), ref: 00F825EC

GetSysColor.USER32(0000000F), ref: 00F821D3

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: e91e348abbe8eb39601f837f968210cf51d7a73230f865f90772e88f87c48f2a
Instruction ID: c3b5dafc81c8f131e3db582a8932e46904170b0e5e12fe72e732c0ac8a952fbc
Opcode Fuzzy Hash: e91e348abbe8eb39601f837f968210cf51d7a73230f865f90772e88f87c48f2a
Instruction Fuzzy Hash: 2041A331500140AFEB726F28D888BF93B65EB06331F144365FEA58A1E6C7369C42FB61

Uniqueness

Uniqueness Score: -1.00%

Function 00FEAB12 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,0100F910), ref: 00FEAB76
GetDriveTypeW.KERNEL32(00000061,0103A620,00000061), ref: 00FEAC40
_wcscpy.LIBCMT ref: 00FEAC6A

Strings

cdrom, xrefs: 00FEAB92
unknown, xrefs: 00FEAC01
ramdisk, xrefs: 00FEABEA
network, xrefs: 00FEABD4
all, xrefs: 00FEAB7C
removable, xrefs: 00FEABA8
fixed, xrefs: 00FEABBE

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 5ff295ff447dc1a4e73902d2dff4cab6b3afe6de32218c0ba2906f9973832215
Instruction ID: 06d91dfe38a4e0fa83947a79e8c1da87495fd80b6a1b774c878d49c01e7d5aa7
Opcode Fuzzy Hash: 5ff295ff447dc1a4e73902d2dff4cab6b3afe6de32218c0ba2906f9973832215
Instruction Fuzzy Hash: AB51DE712083429BC720EF19CC81AAAB7A9FF84710F14481DF4D6972A2DB35E909EB53

Uniqueness

Uniqueness Score: -1.00%

Function 00F89997 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00F899C2
__swprintf.LIBCMT ref: 00F89A0C
__i64tow.LIBCMT ref: 00FBFA0F

Strings

True, xrefs: 00FBF9D0
%.15g, xrefs: 00F89A06
False, xrefs: 00FBF9D7
0x%p, xrefs: 00FBF9F1

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 86a68bb8bf707db54fe6e8f3b6c501c604e37bae114af690d307232b69c00e36
Instruction ID: 4db5fa29815105aa0129c586f5e8bc25213c5a77a818275dd5ec8d52fd41a088
Opcode Fuzzy Hash: 86a68bb8bf707db54fe6e8f3b6c501c604e37bae114af690d307232b69c00e36
Instruction Fuzzy Hash: 47410372A08205AFDB24AB39DC42FBAB3E8EB45310F24446EF549D7281EE759905AB10

Uniqueness

Uniqueness Score: -1.00%

Function 010073C1 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 010073D9
CreateMenu.USER32 ref: 010073F4
SetMenu.USER32(?,00000000), ref: 01007403
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 01007490
IsMenu.USER32(?), ref: 010074A6
CreatePopupMenu.USER32 ref: 010074B0
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 010074DD
DrawMenuBar.USER32 ref: 010074E5

Strings

0, xrefs: 010073CF
F, xrefs: 010074D1

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: cc94a2a13efe0370c83159e0c9be932af28aa3f5f3149fcad9869e046ff8da90
Instruction ID: 41e5da7172199508b65d04106da95028bfb66461a2072ba75710bcc3ca3e4b83
Opcode Fuzzy Hash: cc94a2a13efe0370c83159e0c9be932af28aa3f5f3149fcad9869e046ff8da90
Instruction Fuzzy Hash: D1415E74600205EFEB21DF68D884E9ABBF5FF49300F154069FA9597390DB3AA920DF50

Uniqueness

Uniqueness Score: -1.00%

Function 0100772A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 010077CD
CreateCompatibleDC.GDI32(00000000), ref: 010077D4
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 010077E7
SelectObject.GDI32(00000000,00000000), ref: 010077EF
GetPixel.GDI32(00000000,00000000,00000000), ref: 010077FA
DeleteDC.GDI32(00000000), ref: 01007803
GetWindowLongW.USER32(?,000000EC), ref: 0100780D
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 01007821
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 0100782D

Strings

static, xrefs: 01007765

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 6ed3dfb39780ca675f48fb85fd2c5be146b2c0553fc70ee83174214b3af4e78a
Instruction ID: f16a9d92f95be3028bddb70ccfd55fa1f634bb7fb892bdd0fb6329d769ca6248
Opcode Fuzzy Hash: 6ed3dfb39780ca675f48fb85fd2c5be146b2c0553fc70ee83174214b3af4e78a
Instruction Fuzzy Hash: F3316031101116ABEF239F74DC08FDA3BA9FF09761F114215FA95960D0DB3AE911EBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00FA7040 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FA707B

Part of subcall function 00FA8D68: __getptd_noexit.LIBCMT ref: 00FA8D68

__gmtime64_s.LIBCMT ref: 00FA7114
__gmtime64_s.LIBCMT ref: 00FA714A
__gmtime64_s.LIBCMT ref: 00FA7167
__allrem.LIBCMT ref: 00FA71BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FA71D9
__allrem.LIBCMT ref: 00FA71F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FA720E
__allrem.LIBCMT ref: 00FA7225
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FA7243
__invoke_watson.LIBCMT ref: 00FA72B4

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction ID: 797c4b0759d583cd35e459303184336ac9c8d259f4d873a463a42c9e708e12a5
Opcode Fuzzy Hash: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction Fuzzy Hash: 6071CBF1E44716ABD714AE79CC41F9BB7E8AF12324F14823AF514E7281E774E940AB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FE2A16 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE2A31
GetMenuItemInfoW.USER32(01046890,000000FF,00000000,00000030), ref: 00FE2A92
SetMenuItemInfoW.USER32(01046890,00000004,00000000,00000030), ref: 00FE2AC8
Sleep.KERNEL32(000001F4), ref: 00FE2ADA
GetMenuItemCount.USER32(?), ref: 00FE2B1E
GetMenuItemID.USER32(?,00000000), ref: 00FE2B3A
GetMenuItemID.USER32(?,-00000001), ref: 00FE2B64
GetMenuItemID.USER32(?,?), ref: 00FE2BA9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00FE2BEF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FE2C03
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FE2C24

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: f9a785e6939f467d3a620dcb1ba4ed66b52228cc1300d8d421d54c372aadcc16
Instruction ID: fe3e1fe52f39cd44c99aa04ae1880f4ee08702641a2e1295ecb065e6d95a1985
Opcode Fuzzy Hash: f9a785e6939f467d3a620dcb1ba4ed66b52228cc1300d8d421d54c372aadcc16
Instruction Fuzzy Hash: 9E61C1B190028AAFDB61DF65CD88EBE7BBCFB41324F140559E84193241F736AD45EB21

Uniqueness

Uniqueness Score: -1.00%

Function 01007192 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 01007214
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 01007217
GetWindowLongW.USER32(?,000000F0), ref: 0100723B
_memset.LIBCMT ref: 0100724C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0100725E
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 010072D6

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: f7a01d0c939b279a263235c979bfdb2162ba5f2f8e392e8cc4bb460feee25ae9
Instruction ID: a067e42a84266186157dc7e4b5232260c9bc38b651dadb46c3547b31361350f0
Opcode Fuzzy Hash: f7a01d0c939b279a263235c979bfdb2162ba5f2f8e392e8cc4bb460feee25ae9
Instruction Fuzzy Hash: C3618EB5900208AFEB21DFA8CC81EEE77F8EB09700F144199FA94A72D1D775A941DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00FD710E Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00FD7135
SafeArrayAllocData.OLEAUT32(?), ref: 00FD718E
VariantInit.OLEAUT32(?), ref: 00FD71A0
SafeArrayAccessData.OLEAUT32(?,?), ref: 00FD71C0
VariantCopy.OLEAUT32(?,?), ref: 00FD7213
SafeArrayUnaccessData.OLEAUT32(?), ref: 00FD7227
VariantClear.OLEAUT32(?), ref: 00FD723C
SafeArrayDestroyData.OLEAUT32(?), ref: 00FD7249
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00FD7252
VariantClear.OLEAUT32(?), ref: 00FD7264
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00FD726F

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: f78837781c724d3311571bd177b58739b5141fd56103c3fa2ba48c2163280f6b
Instruction ID: 37e2c3f7435c46172fc51312302aade4c614a7229adb185e99e19c10294bdb33
Opcode Fuzzy Hash: f78837781c724d3311571bd177b58739b5141fd56103c3fa2ba48c2163280f6b
Instruction Fuzzy Hash: DA418031904219AFCF10EFA4D8889ADBBB9FF08354F05806AF945AB351DB35A945EF90

Uniqueness

Uniqueness Score: -1.00%

Function 00FF5A45 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00FF5AA6
inet_addr.WSOCK32(?), ref: 00FF5AEB
gethostbyname.WSOCK32(?), ref: 00FF5AF7
IcmpCreateFile.IPHLPAPI ref: 00FF5B05
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00FF5B75
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00FF5B8B
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00FF5C00
WSACleanup.WSOCK32 ref: 00FF5C06

Strings

Ping, xrefs: 00FF5B29

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: a3a27767e2ebd646c81ce7c3575e0632fef94dc687fcea1d0b1fe5eb6f74f498
Instruction ID: d55964285e1641b53ea9e2de65e339befc56355be7ff6481cb1e9cfeb771c6d0
Opcode Fuzzy Hash: a3a27767e2ebd646c81ce7c3575e0632fef94dc687fcea1d0b1fe5eb6f74f498
Instruction Fuzzy Hash: 495183316047019FD721AF24DC49B7A77E4EF84B20F144529F796DB2A1DB78E800EB41

Uniqueness

Uniqueness Score: -1.00%

Function 00FEB72E Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00FEB73B
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00FEB7B1
GetLastError.KERNEL32 ref: 00FEB7BB
SetErrorMode.KERNEL32(00000000,READY), ref: 00FEB828

Strings

NOTREADY, xrefs: 00FEB7E7
READONLY, xrefs: 00FEB7F3
UNKNOWN, xrefs: 00FEB7E0
READY, xrefs: 00FEB801
INVALID, xrefs: 00FEB7FA

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 47935c4737337137a7d20738ce43dfbd528bb83ef363eb75cd2ef8435563b578
Instruction ID: 482ef718a5f62b4b50e2b1ad4db9bb1d74e9fea234656d3a8b5992f941230321
Opcode Fuzzy Hash: 47935c4737337137a7d20738ce43dfbd528bb83ef363eb75cd2ef8435563b578
Instruction Fuzzy Hash: 2531B235A002459FDB10EF66CC85AFF77B8EF88710F144029E541DB291DB759A42EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00FD9471 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

Part of subcall function 00FDB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00FDB0E7

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00FD94F6
GetDlgCtrlID.USER32 ref: 00FD9501
GetParent.USER32 ref: 00FD951D
SendMessageW.USER32(00000000,?,00000111,?), ref: 00FD9520
GetDlgCtrlID.USER32(?), ref: 00FD9529
GetParent.USER32(?), ref: 00FD9545
SendMessageW.USER32(00000000,?,?,00000111), ref: 00FD9548

Strings

ListBox, xrefs: 00FD94B3
ComboBox, xrefs: 00FD947E

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 1cf5f5fad1b357a9aad02a9a8bf5a447ef9851966c8b700697352daec7df0f4c
Instruction ID: 57e79810cf6a37dc30aae49193af8f5be3ab35a5011ef6350e07d3fba676fb01
Opcode Fuzzy Hash: 1cf5f5fad1b357a9aad02a9a8bf5a447ef9851966c8b700697352daec7df0f4c
Instruction Fuzzy Hash: 0321E274900204ABCF15AFA1CC85EFEBBA9EF49310F14421AB56197292DB799919AB20

Uniqueness

Uniqueness Score: -1.00%

Function 00FD955C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

Part of subcall function 00FDB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00FDB0E7

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00FD95DF
GetDlgCtrlID.USER32 ref: 00FD95EA
GetParent.USER32 ref: 00FD9606
SendMessageW.USER32(00000000,?,00000111,?), ref: 00FD9609
GetDlgCtrlID.USER32(?), ref: 00FD9612
GetParent.USER32(?), ref: 00FD962E
SendMessageW.USER32(00000000,?,?,00000111), ref: 00FD9631

Strings

ListBox, xrefs: 00FD959E
ComboBox, xrefs: 00FD9569

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: d84c30783558be17cfa995d2a4a2bc8e1f8f15a2cd8c6c371fb8a899a2ea8308
Instruction ID: 588ea5f85604dca77a93776a7ce38f3c3b47aa54d8d27293ab5f981c9223da00
Opcode Fuzzy Hash: d84c30783558be17cfa995d2a4a2bc8e1f8f15a2cd8c6c371fb8a899a2ea8308
Instruction Fuzzy Hash: AA21D374900204BBDF15AFB1CCC5EFEBBB9EF48300F14011AB95197295DBB99919AB20

Uniqueness

Uniqueness Score: -1.00%

Function 00FD9645 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00FD9651
GetClassNameW.USER32(00000000,?,00000100), ref: 00FD9666
_wcscmp.LIBCMT ref: 00FD9678
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00FD96F3

Strings

details, xrefs: 00FD96A1
list, xrefs: 00FD96D5
smallicons, xrefs: 00FD96BB
largeicons, xrefs: 00FD9687
SHELLDLL_DefView, xrefs: 00FD9672

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: eee1cf7f9ed9bb6cdadd3c98a2d9eefbf1008c2b1143fec88df23179a8392a8b
Instruction ID: fe28ad49f590d40098eb685a15ba6ae27edc8703d0550e7584bdcbe2a9786206
Opcode Fuzzy Hash: eee1cf7f9ed9bb6cdadd3c98a2d9eefbf1008c2b1143fec88df23179a8392a8b
Instruction Fuzzy Hash: ED11597764C307BAFA102661DC07DA6779D8B05374F20011BF900E51D1FEE6E9417B48

Uniqueness

Uniqueness Score: -1.00%

Function 00FF8BC0 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FF8BEC
CoInitialize.OLE32(00000000), ref: 00FF8C19
CoUninitialize.OLE32 ref: 00FF8C23
GetRunningObjectTable.OLE32(00000000,?), ref: 00FF8D23
SetErrorMode.KERNEL32(00000001,00000029), ref: 00FF8E50
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,01012C0C), ref: 00FF8E84
CoGetObject.OLE32(?,00000000,01012C0C,?), ref: 00FF8EA7
SetErrorMode.KERNEL32(00000000), ref: 00FF8EBA
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00FF8F3A
VariantClear.OLEAUT32(?), ref: 00FF8F4A

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 98805fc9aacf19bf1098e4507dc44289cd3786700ae45e139dc3a6b89d114e52
Instruction ID: 84456bde38fd71809b19f0ece75bc03c80d2af0770110f3a08d068c476d6d921
Opcode Fuzzy Hash: 98805fc9aacf19bf1098e4507dc44289cd3786700ae45e139dc3a6b89d114e52
Instruction Fuzzy Hash: FFC14571608309AFD700EF64C88496ABBE9FF88748F10491DF689DB261DB71ED06DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00FE4189 Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00FE419D
__swprintf.LIBCMT ref: 00FE41AA

Part of subcall function 00FA38D8: __woutput_l.LIBCMT ref: 00FA3931

FindResourceW.KERNEL32(?,?,0000000E), ref: 00FE41D4
LoadResource.KERNEL32(?,00000000), ref: 00FE41E0
LockResource.KERNEL32(00000000), ref: 00FE41ED
FindResourceW.KERNEL32(?,?,00000003), ref: 00FE420D
LoadResource.KERNEL32(?,00000000), ref: 00FE421F
SizeofResource.KERNEL32(?,00000000), ref: 00FE422E
LockResource.KERNEL32(?), ref: 00FE423A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00FE429B

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 73901d142e8b04eee0d67ff8f1c3176e4b03616d8687e5c62f5b0e91b0132657
Instruction ID: dab60093e0935433e2a4fd600720bed85900275ca141d29f5c7a4158533f1982
Opcode Fuzzy Hash: 73901d142e8b04eee0d67ff8f1c3176e4b03616d8687e5c62f5b0e91b0132657
Instruction Fuzzy Hash: 8C31E3B1A0128AAFCB21DF61DC48EBF7BACEF08301F004429F941D6140D779EA11EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00FE16DE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00FE1700
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00FE0778,?,00000001), ref: 00FE1714
GetWindowThreadProcessId.USER32(00000000), ref: 00FE171B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00FE0778,?,00000001), ref: 00FE172A
GetWindowThreadProcessId.USER32(?,00000000), ref: 00FE173C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00FE0778,?,00000001), ref: 00FE1755
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00FE0778,?,00000001), ref: 00FE1767
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00FE0778,?,00000001), ref: 00FE17AC
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00FE0778,?,00000001), ref: 00FE17C1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00FE0778,?,00000001), ref: 00FE17CC

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 3276f130a8c25349cd2689e0249c797582cb3e20496a816a1afbd021256b1851
Instruction ID: a4fb2fd003d30575ca2347293589f42a9d769c104f8dd428e3e77b6fcf3355cf
Opcode Fuzzy Hash: 3276f130a8c25349cd2689e0249c797582cb3e20496a816a1afbd021256b1851
Instruction Fuzzy Hash: A431C3B9A00244BBDB32DF26DD84F7937E9FB19B61F104014F844C6285DB7A9D40EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F8FBBD Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00F8FC06
OleUninitialize.OLE32(?,00000000), ref: 00F8FCA5
UnregisterHotKey.USER32(?), ref: 00F8FDFC
DestroyWindow.USER32(?), ref: 00FC4A00
FreeLibrary.KERNEL32(?), ref: 00FC4A65
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00FC4A92

Strings

close all, xrefs: 00F8FC01

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 3595d6bbdbda19fc7e2ae271781939705879b2ba946b87ce40d7d30d1cf946e1
Instruction ID: 6c3da9d23ca014efb4c832abb3e995732a7523ed2778dca7dbb9e5b01520cdac
Opcode Fuzzy Hash: 3595d6bbdbda19fc7e2ae271781939705879b2ba946b87ce40d7d30d1cf946e1
Instruction Fuzzy Hash: 98A19D71B012138FCB29EF10C9A5FA9F764AF05710F1442ADE90AAB251DB38ED16EF54

Uniqueness

Uniqueness Score: -1.00%

Function 00FDA693 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00FDAA64), ref: 00FDA9A2

Strings

TEXT, xrefs: 00FDA8D9
CLASS, xrefs: 00FDA721
CLASSNN, xrefs: 00FDA744
INSTANCE, xrefs: 00FDA8B0
NAME, xrefs: 00FDA7D4
REGEXPCLASS, xrefs: 00FDA767

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 290a2390c6b9996232f7ba747e7f8ddce76a9feeba99cf6491dfa79feaa8a3fe
Instruction ID: 5bec0f4ce04da2c02d4758bada48307798a9f308ee5a00fe8f60d6bcb18d8cab
Opcode Fuzzy Hash: 290a2390c6b9996232f7ba747e7f8ddce76a9feeba99cf6491dfa79feaa8a3fe
Instruction Fuzzy Hash: B991EB71900606DBDB08EF70C891BEDFB76BF04314F188116E899A7241DF34AA59FB96

Uniqueness

Uniqueness Score: -1.00%

Function 00F82E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00F82EAE

Part of subcall function 00F81DB3: GetClientRect.USER32(?,?), ref: 00F81DDC
Part of subcall function 00F81DB3: GetWindowRect.USER32(?,?), ref: 00F81E1D
Part of subcall function 00F81DB3: ScreenToClient.USER32(?,?), ref: 00F81E45

GetDC.USER32 ref: 00FBCF82
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00FBCF95
SelectObject.GDI32(00000000,00000000), ref: 00FBCFA3
SelectObject.GDI32(00000000,00000000), ref: 00FBCFB8
ReleaseDC.USER32(?,00000000), ref: 00FBCFC0
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00FBD04B

Strings

U, xrefs: 00FBCF20

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 09fd0647643c95be30fe3763294d076fcf16838b540b80283cc47fe2042ba816
Instruction ID: 3a1c0c929fca3524721d20dd5c1e1986d1c6622e453a872572ed7ecde984c274
Opcode Fuzzy Hash: 09fd0647643c95be30fe3763294d076fcf16838b540b80283cc47fe2042ba816
Instruction Fuzzy Hash: 6D71D171800205DFCF21EF65C880AFA3BB6FF49360F1442AAED955A199D7329841FF61

Uniqueness

Uniqueness Score: -1.00%

Function 0100C27C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F82612: GetWindowLongW.USER32(?,000000EB), ref: 00F82623

Part of subcall function 00F82344: GetCursorPos.USER32(?), ref: 00F82357
Part of subcall function 00F82344: ScreenToClient.USER32(010467B0,?), ref: 00F82374
Part of subcall function 00F82344: GetAsyncKeyState.USER32(00000001), ref: 00F82399
Part of subcall function 00F82344: GetAsyncKeyState.USER32(00000002), ref: 00F823A7

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 0100C2E4
ImageList_EndDrag.COMCTL32 ref: 0100C2EA
ReleaseCapture.USER32 ref: 0100C2F0
SetWindowTextW.USER32(?,00000000), ref: 0100C39A
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0100C3AD
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 0100C48F

Strings

@GUI_DROPID, xrefs: 0100C3E1
@GUI_DRAGFILE, xrefs: 0100C424

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 4d5566a3108f475d3a2c1b3b029e4519c0f480af5dfabd5382456771355883e6
Instruction ID: 75b4a302e8f093f0369b8bed4e9acba2ba492afc39afa0e71bb55a544528945a
Opcode Fuzzy Hash: 4d5566a3108f475d3a2c1b3b029e4519c0f480af5dfabd5382456771355883e6
Instruction Fuzzy Hash: 6551CFB4204301AFE715EF24C995FAA7BE0FB88310F00865DF5D18B2E1DB7AA944DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00FF8F5B Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,0100F910), ref: 00FF903D
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0100F910), ref: 00FF9071
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00FF91EB
SysFreeString.OLEAUT32(?), ref: 00FF9215

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: dd01a0ee035ae479c3e96ab9421c9a5a3b3d4a759575ee2e994fa8db6b2dbd4f
Instruction ID: f99b54dff030dadecd0182fa0d5b15a611449c526841b392cadc7d45c270501b
Opcode Fuzzy Hash: dd01a0ee035ae479c3e96ab9421c9a5a3b3d4a759575ee2e994fa8db6b2dbd4f
Instruction Fuzzy Hash: 04F13B71A04109EFDB14DF94C888EBEB7B9FF89314F108099F615AB2A0DB71AE45DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FFF9A8 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FFF9C9
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00FFFB5C
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00FFFB80
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00FFFBC0
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00FFFBE2
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00FFFD5E
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00FFFD90
CloseHandle.KERNEL32(?), ref: 00FFFDBF
CloseHandle.KERNEL32(?), ref: 00FFFE36

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: c04a8718e39b024b2ee359dcd86fa94d9ad3eb72b5c26136c73b4ae55ccd4520
Instruction ID: bceb19a40d197de06341922bd4b2b4a8d7d0e310a91ca98342fa398d85cf8404
Opcode Fuzzy Hash: c04a8718e39b024b2ee359dcd86fa94d9ad3eb72b5c26136c73b4ae55ccd4520
Instruction Fuzzy Hash: E2E1D3316043059FC724EF24C881B7ABBE0AF85364F18846DF9999B2A2CB75DC45EB52

Uniqueness

Uniqueness Score: -1.00%

Function 00FE4F63 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE48AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00FE38D3,?), ref: 00FE48C7

Part of subcall function 00FE48AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00FE38D3,?), ref: 00FE48E0

Part of subcall function 00FE4CD3: GetFileAttributesW.KERNEL32(?,00FE3947), ref: 00FE4CD4

lstrcmpiW.KERNEL32(?,?), ref: 00FE4FE2
_wcscmp.LIBCMT ref: 00FE4FFC
MoveFileW.KERNEL32(?,?), ref: 00FE5017

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 3d938e0bfe0bf89e5d6f8e7489325e76ac7a860c283e1db6c5755b8fe02440a0
Instruction ID: 3055a4fb0fdcc7afa9368c61efd4bd2c0b81199e348a04604c404c4f96174366
Opcode Fuzzy Hash: 3d938e0bfe0bf89e5d6f8e7489325e76ac7a860c283e1db6c5755b8fe02440a0
Instruction Fuzzy Hash: E95193B24087859BC764EB65CC819DFB3ECAF85710F10092EB285C3151EF78E2889766

Uniqueness

Uniqueness Score: -1.00%

Function 010088B4 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0100896E

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: b13e965d23a7db490b90417b1f0900d0f52e1a7afde6c9e8841a0086d03e15b5
Instruction ID: de8fa799cef72537be177c382b87f4fd654b8f1167280790b1fd4dbb05d32704
Opcode Fuzzy Hash: b13e965d23a7db490b90417b1f0900d0f52e1a7afde6c9e8841a0086d03e15b5
Instruction Fuzzy Hash: E751A230D00209BBFF739F28DC85B993BA4BB06310F108153F695E65D1DB76A6809B51

Uniqueness

Uniqueness Score: -1.00%

Function 00F82B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00FBC547
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00FBC569
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00FBC581
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00FBC59F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00FBC5C0
DestroyIcon.USER32(00000000), ref: 00FBC5CF
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00FBC5EC
DestroyIcon.USER32(?), ref: 00FBC5FB

Part of subcall function 0100A71E: DeleteObject.GDI32(00000000), ref: 0100A757

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: ae616ea152624912e7524d594438f69184ed805c158132c320d8552a3de59293
Instruction ID: 20924c1a885bac65493790ae9dddcdc383162325600fed34ad7d2e5cb6d76fcd
Opcode Fuzzy Hash: ae616ea152624912e7524d594438f69184ed805c158132c320d8552a3de59293
Instruction Fuzzy Hash: 765168B5A00209AFDB20EF25CC85FEA37A5FB59760F100518F94697290DB75FD81EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00FD9B50 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FDAE57: GetWindowThreadProcessId.USER32(?,00000000), ref: 00FDAE77
Part of subcall function 00FDAE57: GetCurrentThreadId.KERNEL32 ref: 00FDAE7E
Part of subcall function 00FDAE57: AttachThreadInput.USER32(00000000,?,00FD9B65,?,00000001), ref: 00FDAE85

MapVirtualKeyW.USER32(00000025,00000000), ref: 00FD9B70
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00FD9B8D
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00FD9B90
MapVirtualKeyW.USER32(00000025,00000000), ref: 00FD9B99
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00FD9BB7
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00FD9BBA
MapVirtualKeyW.USER32(00000025,00000000), ref: 00FD9BC3
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00FD9BDA
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00FD9BDD

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 0002fc835e0ce0ef0cbb3d0c088d65907ba3c08d6cf2f77b161cb68693eddb3b
Instruction ID: d4469a869e8af9f64a52698cc82146075de6cc15c27c580a621ed6fbb871a42f
Opcode Fuzzy Hash: 0002fc835e0ce0ef0cbb3d0c088d65907ba3c08d6cf2f77b161cb68693eddb3b
Instruction Fuzzy Hash: 1F11E171554618BFF6216B70DC89FAA3B2DEB4C751F110416F284AB190CAF75C10EBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00FD8E03 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00FD8A84,00000B00,?,?), ref: 00FD8E0C
HeapAlloc.KERNEL32(00000000,?,00FD8A84,00000B00,?,?), ref: 00FD8E13
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00FD8A84,00000B00,?,?), ref: 00FD8E28
GetCurrentProcess.KERNEL32(?,00000000,?,00FD8A84,00000B00,?,?), ref: 00FD8E30
DuplicateHandle.KERNEL32(00000000,?,00FD8A84,00000B00,?,?), ref: 00FD8E33
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00FD8A84,00000B00,?,?), ref: 00FD8E43
GetCurrentProcess.KERNEL32(00FD8A84,00000000,?,00FD8A84,00000B00,?,?), ref: 00FD8E4B
DuplicateHandle.KERNEL32(00000000,?,00FD8A84,00000B00,?,?), ref: 00FD8E4E
CreateThread.KERNEL32(00000000,00000000,00FD8E74,00000000,00000000,00000000), ref: 00FD8E68

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 2768727b7e16f585b966a73f44adea6c0b091c18a793271aac7a7d0e1adb1b06
Instruction ID: 771ad281427d503985938594f11de2bc0ef4a5837e8710635dd93ca35f7af36f
Opcode Fuzzy Hash: 2768727b7e16f585b966a73f44adea6c0b091c18a793271aac7a7d0e1adb1b06
Instruction Fuzzy Hash: 5701B6B5240309BFE731EBA5DC4DFAB3BACEB89711F004411FA45DB295CA759800DB20

Uniqueness

Uniqueness Score: -1.00%

Function 00FF9428 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FF947C
VariantInit.OLEAUT32(?), ref: 00FF954D
VariantInit.OLEAUT32(?), ref: 00FF964E
VariantClear.OLEAUT32(?), ref: 00FF9658
VariantClear.OLEAUT32(?), ref: 00FF96B5

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00FF9631
Null Object assignment in FOR..IN loop, xrefs: 00FF94DD, 00FF960B, 00FF96C3

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 3895d1e8b1f1546a24fd0828cc15a4f1ed534447b11aaddc37e6d3d6c54ffc16
Instruction ID: 985f8f2a2802c991382e026e4da81a7f50d168268ae0b5d9a5ed511502b1728f
Opcode Fuzzy Hash: 3895d1e8b1f1546a24fd0828cc15a4f1ed534447b11aaddc37e6d3d6c54ffc16
Instruction Fuzzy Hash: 0891CF71E04219ABDF24DFA5C844FAEB7B8EF45720F148559F605EB2A0D7B09901DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00FF9A72 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00FD7652: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FD758C,80070057,?,?,?,00FD799D), ref: 00FD766F
Part of subcall function 00FD7652: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FD758C,80070057,?,?), ref: 00FD768A
Part of subcall function 00FD7652: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FD758C,80070057,?,?), ref: 00FD7698
Part of subcall function 00FD7652: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FD758C,80070057,?), ref: 00FD76A8

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00FF9B1B
_memset.LIBCMT ref: 00FF9B28
_memset.LIBCMT ref: 00FF9C6B
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00FF9C97
CoTaskMemFree.OLE32(?), ref: 00FF9CA2

Strings

NULL Pointer assignment, xrefs: 00FF9CF0

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 2495c9c8e746bf9e4d570e3fe979d07260f94e133d9a929ddadd60ac45f53f3c
Instruction ID: 3a6f9e3c33d8a73a8dab88678845bf744c47b0e6b70e25103ec984dac025c77e
Opcode Fuzzy Hash: 2495c9c8e746bf9e4d570e3fe979d07260f94e133d9a929ddadd60ac45f53f3c
Instruction Fuzzy Hash: B8915B71D0021DEBDB10EFA4DC84BEEBBB9AF08710F20415AF519A7291DB759A44DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01006FEF Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 01007093
SendMessageW.USER32(?,00001036,00000000,?), ref: 010070A7
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 010070C1
_wcscat.LIBCMT ref: 0100711C
SendMessageW.USER32(?,00001057,00000000,?), ref: 01007133
SendMessageW.USER32(?,00001061,?,0000000F), ref: 01007161

Strings

SysListView32, xrefs: 01007065

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 56f33a9f99795a7bef71a82ce137849fd195e39220841417dda67fad447e6920
Instruction ID: 349cc0822d37225e71085e9872bab7c54f1daaeb8fb2e9dceabe85766a56762a
Opcode Fuzzy Hash: 56f33a9f99795a7bef71a82ce137849fd195e39220841417dda67fad447e6920
Instruction Fuzzy Hash: 7B41A475A00309EFEB22DF68CC85BEE77E9EF08350F00056AF5C4971D2D676A9859B50

Uniqueness

Uniqueness Score: -1.00%

Function 00FFEC47 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00FE3E91: CreateToolhelp32Snapshot.KERNEL32 ref: 00FE3EB6
Part of subcall function 00FE3E91: Process32FirstW.KERNEL32(00000000,?), ref: 00FE3EC4
Part of subcall function 00FE3E91: CloseHandle.KERNEL32(00000000), ref: 00FE3F8E

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00FFECB8
GetLastError.KERNEL32 ref: 00FFECCB
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00FFECFA
TerminateProcess.KERNEL32(00000000,00000000), ref: 00FFED77
GetLastError.KERNEL32(00000000), ref: 00FFED82
CloseHandle.KERNEL32(00000000), ref: 00FFEDB7

Strings

SeDebugPrivilege, xrefs: 00FFECD6

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 41d20237b25055e61d48a9b4f1857822352a5e64be5ad42406edf79c7af53121
Instruction ID: 5e1de6736811cdeacbed4bb62e41f75859b01d2cc4a64c1754d3aec403b06645
Opcode Fuzzy Hash: 41d20237b25055e61d48a9b4f1857822352a5e64be5ad42406edf79c7af53121
Instruction Fuzzy Hash: E741C0316042059FDB25EF24CC95F7DB7A5AF80714F088059F9829B3E2DBB9A804EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FE3226 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00FE32C5

Strings

question, xrefs: 00FE327E
stop, xrefs: 00FE3296
blank, xrefs: 00FE3247
info, xrefs: 00FE3266
warning, xrefs: 00FE32AE

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 687c744dcd02eb012815cece301531555e2ed4b09ce00876af16699099722788
Instruction ID: 3d35e589db211cd3adfdd0e1c510a13200967e17482fbdce2b4aa83bc5dd802c
Opcode Fuzzy Hash: 687c744dcd02eb012815cece301531555e2ed4b09ce00876af16699099722788
Instruction Fuzzy Hash: 7511EB32B083D6BBD7115A57DC4ED6AB39CDF1A370F10001EFA8097181D7759B4066A5

Uniqueness

Uniqueness Score: -1.00%

Function 00FE4534 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00FE454E
LoadStringW.USER32(00000000), ref: 00FE4555
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00FE456B
LoadStringW.USER32(00000000), ref: 00FE4572
_wprintf.LIBCMT ref: 00FE4598
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00FE45B6

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00FE4593

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 6b751dc06db6270b5bd0b1d8130a70a19be0592c0232bc98041fb387db6d7c88
Instruction ID: a6a7f4782611ee157732b2beba57939d178277f44a61bc168a0a1a9a23ead846
Opcode Fuzzy Hash: 6b751dc06db6270b5bd0b1d8130a70a19be0592c0232bc98041fb387db6d7c88
Instruction Fuzzy Hash: 720162F2900209BFE731EBA1DD89EE7776CEB08301F000595BB85D2041EA799E859B70

Uniqueness

Uniqueness Score: -1.00%

Function 0100D74C Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F82612: GetWindowLongW.USER32(?,000000EB), ref: 00F82623

GetSystemMetrics.USER32(0000000F), ref: 0100D78A
GetSystemMetrics.USER32(0000000F), ref: 0100D7AA
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0100D9E5
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0100DA03
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0100DA24
ShowWindow.USER32(00000003,00000000), ref: 0100DA43
InvalidateRect.USER32(?,00000000,00000001), ref: 0100DA68
DefDlgProcW.USER32(?,00000005,?,?), ref: 0100DA8B

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 46052702310836318c7e03dad1270c128d84b2225fb04d97de92a17d990bc445
Instruction ID: a091ecbbc06e84f8b93d98b66e546c72f242363e5fde1b7dc5f28e0b3042f2fd
Opcode Fuzzy Hash: 46052702310836318c7e03dad1270c128d84b2225fb04d97de92a17d990bc445
Instruction Fuzzy Hash: F8B18C71500216EBEF16CFACC9C57AD7BF2BF45701F0481A9ED889B289D735A990CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00F82A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00FBC417,00000004,00000000,00000000,00000000), ref: 00F82ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00FBC417,00000004,00000000,00000000,00000000,000000FF), ref: 00F82B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00FBC417,00000004,00000000,00000000,00000000), ref: 00FBC46A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00FBC417,00000004,00000000,00000000,00000000), ref: 00FBC4D6

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 6d31351e066f73f25dc4d1ef1bdf70c92dccc8fcfeb3919a9a03ac79120108e9
Instruction ID: 0df96302fa9fc55ff94c61ba2eb20f376e60c058d4f5e09d93112c6150ec6fde
Opcode Fuzzy Hash: 6d31351e066f73f25dc4d1ef1bdf70c92dccc8fcfeb3919a9a03ac79120108e9
Instruction Fuzzy Hash: AB411775A04680ABC7BEBB29CC987FB7B92BF86320F14840DE08786550C63EB941F750

Uniqueness

Uniqueness Score: -1.00%

Function 00FE7368 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00FE737F

Part of subcall function 00FA0FF6: std::exception::exception.LIBCMT ref: 00FA102C
Part of subcall function 00FA0FF6: __CxxThrowException@8.LIBCMT ref: 00FA1041

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00FE73B6
EnterCriticalSection.KERNEL32(?), ref: 00FE73D2
_memmove.LIBCMT ref: 00FE7420
_memmove.LIBCMT ref: 00FE743D
LeaveCriticalSection.KERNEL32(?), ref: 00FE744C
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00FE7461
InterlockedExchange.KERNEL32(?,000001F6), ref: 00FE7480

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: a3105e49ed0becdce563e542b8228658e81f410460b82edd822786908fdfd75b
Instruction ID: 3cc6dfd8ed884cb19a60e5f97bf8a2c8226c85e487d37644f92ae9d7ee30580b
Opcode Fuzzy Hash: a3105e49ed0becdce563e542b8228658e81f410460b82edd822786908fdfd75b
Instruction Fuzzy Hash: 07319E71904205EFCF20EF65DC85AAE7B78FF45310F1540A5F904AB24ADB759A10EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01006442 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 0100645A
GetDC.USER32(00000000), ref: 01006462
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0100646D
ReleaseDC.USER32(00000000,00000000), ref: 01006479
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 010064B5
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 010064C6
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,01009299,?,?,000000FF,00000000,?,000000FF,?), ref: 01006500
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 01006520

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 1fad5e6d80b0711aa5edb1a33e3753751e5ed23a73c15914d64558c08436e059
Instruction ID: 8bccf54edc9ad201a24076bf2066be5e7b10292523ff53e2fa7a9a14d6384570
Opcode Fuzzy Hash: 1fad5e6d80b0711aa5edb1a33e3753751e5ed23a73c15914d64558c08436e059
Instruction Fuzzy Hash: 4431A072200210BFEB228F64CC49FEB3FAAEF0A761F044055FE48DA195C67A9851CB70

Uniqueness

Uniqueness Score: -1.00%

Function 00FDC072 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00FDC087
_memcmp.LIBCMT ref: 00FDC0A9
_memcmp.LIBCMT ref: 00FDC0C1
_memcmp.LIBCMT ref: 00FDC0D4
_memcmp.LIBCMT ref: 00FDC0EE
_memcmp.LIBCMT ref: 00FDC101
_memcmp.LIBCMT ref: 00FDC119
_memcmp.LIBCMT ref: 00FDC134

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 682a93578d8b582de1c75c919844658e49ad29965c0549120fd65d528fd6dfb6
Instruction ID: bc31aea37246d8848aa7d0016a53ff9fbc1e0881417a308c4d948659c23f2f5e
Opcode Fuzzy Hash: 682a93578d8b582de1c75c919844658e49ad29965c0549120fd65d528fd6dfb6
Instruction Fuzzy Hash: EE21D7B2A40217B7D210A5218D46FAB335EAF113A4F1C4026FE05DA352EB59DD11F2E5

Uniqueness

Uniqueness Score: -1.00%

Function 00FEED8E Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00F89997: __itow.LIBCMT ref: 00F899C2
Part of subcall function 00F89997: __swprintf.LIBCMT ref: 00F89A0C

Part of subcall function 00F9FEC6: _wcscpy.LIBCMT ref: 00F9FEE9

_wcstok.LIBCMT ref: 00FEEEFF
_wcscpy.LIBCMT ref: 00FEEF8E
_memset.LIBCMT ref: 00FEEFC1

Strings

X, xrefs: 00FEEFFE

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 66dc1d59e82a7d5a7db053eee3ec1738f4a8ee84e84e8b1bb1267b1bddc5e88a
Instruction ID: a3476cd85c1cf20598880d39b59927841a76635387f8a74c18101b8d8655dfa7
Opcode Fuzzy Hash: 66dc1d59e82a7d5a7db053eee3ec1738f4a8ee84e84e8b1bb1267b1bddc5e88a
Instruction Fuzzy Hash: 89C191715083419FC724FF24CC85A9AB7E4BF85314F14492DF899872A2DB74ED45EB82

Uniqueness

Uniqueness Score: -1.00%

Function 00F81424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 493a6128d64032dd707b32d67927e23b042d9fe5a32a65dec03b52961b86fb0e
Instruction ID: 7da544a80549920ea30074c55ccbd1d764547065dcf967efb33bff2ba3515209
Opcode Fuzzy Hash: 493a6128d64032dd707b32d67927e23b042d9fe5a32a65dec03b52961b86fb0e
Instruction Fuzzy Hash: BB717031900109EFDB15DF59CC49AFEBB79FF86320F248249F915AA251C734AA52EF60

Uniqueness

Uniqueness Score: -1.00%

Function 00FF6E8A Relevance: 10.7, APIs: 7, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec85b9a9f0f2b88847ea85e4dee0421c876e08678fae4cd5f81917df0283df9a
Instruction ID: f64ee9b250695c83c0cd9e052ec1e5479c8a568da8909a721e5252c6cbc4be01
Opcode Fuzzy Hash: ec85b9a9f0f2b88847ea85e4dee0421c876e08678fae4cd5f81917df0283df9a
Instruction Fuzzy Hash: 8461CE72508304ABC720FB24CC86FAFB3E9AF84B10F144919F645972A2DF799D01E792

Uniqueness

Uniqueness Score: -1.00%

Function 0100B60B Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(014CE9E8), ref: 0100B6A5
IsWindowEnabled.USER32(014CE9E8), ref: 0100B6B1
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 0100B795
SendMessageW.USER32(014CE9E8,000000B0,?,?), ref: 0100B7CC
IsDlgButtonChecked.USER32(?,?), ref: 0100B809
GetWindowLongW.USER32(014CE9E8,000000EC), ref: 0100B82B
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0100B843

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: f35b602a12b56171aa8b059fa8cd59cc3a10f7ff9c82ea8f86751338302721ee
Instruction ID: 3bf05f11841abf1d76ce76f85401cf5e6214cf323f11c69c4f49226b09ac2235
Opcode Fuzzy Hash: f35b602a12b56171aa8b059fa8cd59cc3a10f7ff9c82ea8f86751338302721ee
Instruction Fuzzy Hash: 9E718178604205AFFB62DF68C8D4FAA7BF5FF49300F084099E9C597291DB36A941DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FFF732 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FFF75C
_memset.LIBCMT ref: 00FFF825
ShellExecuteExW.SHELL32(?), ref: 00FFF86A

Part of subcall function 00F89997: __itow.LIBCMT ref: 00F899C2
Part of subcall function 00F89997: __swprintf.LIBCMT ref: 00F89A0C

Part of subcall function 00F9FEC6: _wcscpy.LIBCMT ref: 00F9FEE9

GetProcessId.KERNEL32(00000000), ref: 00FFF8E1
CloseHandle.KERNEL32(00000000), ref: 00FFF910

Strings

@, xrefs: 00FFF839

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: a914888f25cc34d7f6ca130f84bb059544bb334f9658384ccf6dba616cf051d4
Instruction ID: 604649b371830046e223fd37ac43f3f13d6d802ae56837f62cc21a60c77d330f
Opcode Fuzzy Hash: a914888f25cc34d7f6ca130f84bb059544bb334f9658384ccf6dba616cf051d4
Instruction Fuzzy Hash: A661AE75E006199FCF14EF54C8849AEBBF4FF48310F148069E856AB361CB74AD45EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FE145D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00FE149C
GetKeyboardState.USER32(?), ref: 00FE14B1
SetKeyboardState.USER32(?), ref: 00FE1512
PostMessageW.USER32(?,00000101,00000010,?), ref: 00FE1540
PostMessageW.USER32(?,00000101,00000011,?), ref: 00FE155F
PostMessageW.USER32(?,00000101,00000012,?), ref: 00FE15A5
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00FE15C8

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 2496702346e08df30cc632cb50f17cfb1e58b9699b2dc3ccc12ae575f815758e
Instruction ID: 11f685f2ed4e8c14bfb78c852d0ed8623986c8d6cf3a875419ebea19e86a8090
Opcode Fuzzy Hash: 2496702346e08df30cc632cb50f17cfb1e58b9699b2dc3ccc12ae575f815758e
Instruction Fuzzy Hash: 8D51E2B0A047D53EFB3282378C45BBABEA97B46314F0C4589E1D6458C2C3F99C94E750

Uniqueness

Uniqueness Score: -1.00%

Function 00FE1276 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00FE12B5
GetKeyboardState.USER32(?), ref: 00FE12CA
SetKeyboardState.USER32(?), ref: 00FE132B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00FE1357
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00FE1374
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00FE13B8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00FE13D9

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 855ece47be971be2f117609a29fc2543c4d4f2257185e32b92cd5ca9d34eac79
Instruction ID: 1360fa1296e5596dcd4a868452773e89b7894b8acdbc426af4b7d2c7a1bfb346
Opcode Fuzzy Hash: 855ece47be971be2f117609a29fc2543c4d4f2257185e32b92cd5ca9d34eac79
Instruction Fuzzy Hash: 3851D2B09046D53DFB3287278C45BBABFA97B06310F088589E1D44A8C2D3A5EC98F760

Uniqueness

Uniqueness Score: -1.00%

Function 00FE589F Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00FE58AC
_wcsncpy.LIBCMT ref: 00FE58E1
_wcsncpy.LIBCMT ref: 00FE5913
_wcsncpy.LIBCMT ref: 00FE5946
_wcsncpy.LIBCMT ref: 00FE5988
_wcsncpy.LIBCMT ref: 00FE59C2
_wcsncpy.LIBCMT ref: 00FE59F1

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 78865b771cd05058cf728c33d32cfe8ff9b50e1aea37608cfc0cbd6d52b643b6
Instruction ID: acced8c927d6d2743956d7ed51548872283904b4abeb26129bf5d662cad9ddc1
Opcode Fuzzy Hash: 78865b771cd05058cf728c33d32cfe8ff9b50e1aea37608cfc0cbd6d52b643b6
Instruction Fuzzy Hash: E741D5E5C2051876CB50EBB5CC86ACFB7A8AF06710F508466F518E3122E738E754E7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00FE38AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FE48AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00FE38D3,?), ref: 00FE48C7

Part of subcall function 00FE48AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00FE38D3,?), ref: 00FE48E0

lstrcmpiW.KERNEL32(?,?), ref: 00FE38F3
_wcscmp.LIBCMT ref: 00FE390F
MoveFileW.KERNEL32(?,?), ref: 00FE3927
_wcscat.LIBCMT ref: 00FE396F
SHFileOperationW.SHELL32(?), ref: 00FE39DB

Strings

\*.*, xrefs: 00FE3969

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: e9c64bf38780c7bb90c39391ccf9ce080988747bcf5b87f5bc5772abd4bff9dd
Instruction ID: 1c6878154e30e41ec503dd48284be277aa6f2020238e0c303fc7268869dff8eb
Opcode Fuzzy Hash: e9c64bf38780c7bb90c39391ccf9ce080988747bcf5b87f5bc5772abd4bff9dd
Instruction Fuzzy Hash: E64182B25083849EC751EF65C889ADFB7E8AF89350F10092EB489C3152EB79D788D752

Uniqueness

Uniqueness Score: -1.00%

Function 01007500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 01007519
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 010075C0
IsMenu.USER32(?), ref: 010075D8
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 01007620
DrawMenuBar.USER32 ref: 01007633

Strings

0, xrefs: 0100750D

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 8bb6c2b1a6a26477e3d460ce01cd9a6df30a2ab67f5aa433becfcf6485c09b2a
Instruction ID: 6442b8d4ec6fb617e44e8fb4b83acb7a41856f273bb16b594be69a1d428581a7
Opcode Fuzzy Hash: 8bb6c2b1a6a26477e3d460ce01cd9a6df30a2ab67f5aa433becfcf6485c09b2a
Instruction Fuzzy Hash: 24413EB5A00209EFEB21DF58D884EDABBF4FF09315F044169FA9697290D735A950CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0100122D Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 0100125C
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 01001286
FreeLibrary.KERNEL32(00000000), ref: 0100133D

Part of subcall function 0100122D: RegCloseKey.ADVAPI32(?), ref: 010012A3
Part of subcall function 0100122D: FreeLibrary.KERNEL32(?), ref: 010012F5
Part of subcall function 0100122D: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 01001318

RegDeleteKeyW.ADVAPI32(?,?), ref: 010012E0

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: c78a1b3b2c6b2b8913be395337fe15103ba1ef712935c60c131d6c76c5194432
Instruction ID: 8923490a7d1829e4744f05257aeb7d46c03c353d79d7bbaf774296e9fba01931
Opcode Fuzzy Hash: c78a1b3b2c6b2b8913be395337fe15103ba1ef712935c60c131d6c76c5194432
Instruction Fuzzy Hash: E13110B1901119BFEB26DB94D885EFFB7BCEF09300F0041A9F591E2180DB759A459BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0100653C Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 0100655B
GetWindowLongW.USER32(014CE9E8,000000F0), ref: 0100658E
GetWindowLongW.USER32(014CE9E8,000000F0), ref: 010065C3
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 010065F5
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 0100661F
GetWindowLongW.USER32(00000000,000000F0), ref: 01006630
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0100664A

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 6dddca6b2153cd8df989d8c473dddcab92a338c362db2456a4acc1fc954a2058
Instruction ID: d60ebea77ea7c45d93e95495edbc9e06808151ce38cff72b9c814f4df45d1411
Opcode Fuzzy Hash: 6dddca6b2153cd8df989d8c473dddcab92a338c362db2456a4acc1fc954a2058
Instruction Fuzzy Hash: 15312A746042119FEB32CF68DC84F553BE2FB4A711F1802A8F5818B2EACB77A850DB41

Uniqueness

Uniqueness Score: -1.00%

Function 00FF6486 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF80A0: inet_addr.WSOCK32(00000000), ref: 00FF80CB

socket.WSOCK32(00000002,00000001,00000006), ref: 00FF64D9
WSAGetLastError.WSOCK32(00000000), ref: 00FF64E8
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00FF6521
connect.WSOCK32(00000000,?,00000010), ref: 00FF652A
WSAGetLastError.WSOCK32 ref: 00FF6534
closesocket.WSOCK32(00000000), ref: 00FF655D
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00FF6576

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 5547ec47598a13cfd009bf21793a6a645337bef9fe0bb15ede8a366b44a70141
Instruction ID: 764a57c0e6c6ff9bc53d670f60373880a3a7a9278524ebcd9e1cba213ea241a9
Opcode Fuzzy Hash: 5547ec47598a13cfd009bf21793a6a645337bef9fe0bb15ede8a366b44a70141
Instruction Fuzzy Hash: C231B531600118AFDB20EF64CC85BBE77A9EF44724F084059FA49E7291DF79AD05EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FDE0B5 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00FDE0FA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00FDE120
SysAllocString.OLEAUT32(00000000), ref: 00FDE123
SysAllocString.OLEAUT32 ref: 00FDE144
SysFreeString.OLEAUT32 ref: 00FDE14D
StringFromGUID2.OLE32(?,?,00000028), ref: 00FDE167
SysAllocString.OLEAUT32(?), ref: 00FDE175

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 9df7f54cdcd16cc60dc22f9e40156888281e73469315e58ba8dddbbb5cbcd5ed
Instruction ID: e2578b7d6b266296d2be55b8fb972e926bc0236be243c08c5677f9edccfe9f20
Opcode Fuzzy Hash: 9df7f54cdcd16cc60dc22f9e40156888281e73469315e58ba8dddbbb5cbcd5ed
Instruction Fuzzy Hash: D221A132604209AFDB20BFA8DC88DAA77EDEB09760B048126F954CB255DA75DC41EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00FDFB6E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00FDFB81
__wcsnicmp.LIBCMT ref: 00FDFBA2
__wcsnicmp.LIBCMT ref: 00FDFBBC

Strings

#notrayicon, xrefs: 00FDFB79
#OnAutoItStartRegister, xrefs: 00FDFBB6
#requireadmin, xrefs: 00FDFB9C

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 16a134df089bbf0feb9ba188f305798f9d43d2925a467c0c02f3904f36256e40
Instruction ID: 2b4d5499f83323ef33cf50d96f47efb7fc0d6a416606d5665f7cc7569071ced5
Opcode Fuzzy Hash: 16a134df089bbf0feb9ba188f305798f9d43d2925a467c0c02f3904f36256e40
Instruction Fuzzy Hash: C7216A7351425266D330B624DC12FA773D9EF56350F184437F88786241EB58AA95F291

Uniqueness

Uniqueness Score: -1.00%

Function 0100783C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F81D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00F81D73
Part of subcall function 00F81D35: GetStockObject.GDI32(00000011), ref: 00F81D87
Part of subcall function 00F81D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00F81D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 010078A1
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 010078AE
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 010078B9
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 010078C8
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 010078D4

Strings

Msctls_Progress32, xrefs: 01007872

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 4774c825c72823cd76c06df730c69a18855f54406546139877957d151cf270c0
Instruction ID: 54fad43b387abaf3f8b4ee8eaf498f00cceee408f5c8cea98b41c6f87bbfc3f0
Opcode Fuzzy Hash: 4774c825c72823cd76c06df730c69a18855f54406546139877957d151cf270c0
Instruction Fuzzy Hash: FC1193B2150119BFFF169E64CC85EE77F5DEF08758F014115F644A6090DA76AC21DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00FA41C9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00FA4292,?), ref: 00FA41E3
GetProcAddress.KERNEL32(00000000), ref: 00FA41EA
EncodePointer.KERNEL32(00000000), ref: 00FA41F6
DecodePointer.KERNEL32(00000001,00FA4292,?), ref: 00FA4213

Strings

combase.dll, xrefs: 00FA41DE
RoInitialize, xrefs: 00FA41D2

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 036ce60f8c390ce44012e441823ddb584d0fc40cd4f2778598c8471559783ba5
Instruction ID: 58bec3698bd54e8dc8b61abbf5c0565b8c87e8431ff78f89984aa20fcbb7f7f1
Opcode Fuzzy Hash: 036ce60f8c390ce44012e441823ddb584d0fc40cd4f2778598c8471559783ba5
Instruction Fuzzy Hash: BAE01AF8A90341AFEB316BB1ED89B043AA4B765716F508428B491E909CDBBF6451AF00

Uniqueness

Uniqueness Score: -1.00%

Function 00FA429E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00FA41B8), ref: 00FA42B8
GetProcAddress.KERNEL32(00000000), ref: 00FA42BF
EncodePointer.KERNEL32(00000000), ref: 00FA42CA
DecodePointer.KERNEL32(00FA41B8), ref: 00FA42E5

Strings

combase.dll, xrefs: 00FA42B3
RoUninitialize, xrefs: 00FA42A7

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 98a78d1ecb965fcb1bec187f6ccae06c91d7ef299421d1d85f3c856d633697c5
Instruction ID: 0a464cd2d7cef763c8ae2bdee9cef55e529f84aa9219f21ad85bd8101e9eface
Opcode Fuzzy Hash: 98a78d1ecb965fcb1bec187f6ccae06c91d7ef299421d1d85f3c856d633697c5
Instruction Fuzzy Hash: 55E0BFBC641301ABDB31AB61EE4EB443AA4B715752F604018F481E505CCBBE5500EB14

Uniqueness

Uniqueness Score: -1.00%

Function 00FE675A Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00FE68AD
_memmove.LIBCMT ref: 00FE67E8

Part of subcall function 00F89997: __itow.LIBCMT ref: 00F899C2
Part of subcall function 00F89997: __swprintf.LIBCMT ref: 00F89A0C

_memmove.LIBCMT ref: 00FE685B
_memmove.LIBCMT ref: 00FE6942
_memmove.LIBCMT ref: 00FE695B
_memmove.LIBCMT ref: 00FE6977

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 2ac74d2e030658137b5ee0dcb8b02025e330d3075783c8fac3e9a08f62e1acb0
Instruction ID: c66f08fd08f553599606132f3bf3b35d4e7c13186cc27759e06ab159f5e0e08f
Opcode Fuzzy Hash: 2ac74d2e030658137b5ee0dcb8b02025e330d3075783c8fac3e9a08f62e1acb0
Instruction Fuzzy Hash: 6A61CB3050428A9BCF11FF21CC82FFE37A4AF45748F094519F8599B292DB78AD01EB50

Uniqueness

Uniqueness Score: -1.00%

Function 0100046F Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

Part of subcall function 010010A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,01000038,?,?), ref: 010010BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 01000548
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 01000588
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 010005AB
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 010005D4
RegCloseKey.ADVAPI32(?,?,00000000), ref: 01000617
RegCloseKey.ADVAPI32(00000000), ref: 01000624

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 2d0f8c122b768ad62b30e0bb79714c6394dfd3af3a04ff2227559205b86a26f1
Instruction ID: bcf35b4472ae34b445b7eff0f0500183f03b5822ac469d048eaccaeaf06c79a0
Opcode Fuzzy Hash: 2d0f8c122b768ad62b30e0bb79714c6394dfd3af3a04ff2227559205b86a26f1
Instruction Fuzzy Hash: 6B516731208200AFEB15EB24CC85EAFBBE9FF88744F04491DF585872A1DB36E905DB52

Uniqueness

Uniqueness Score: -1.00%

Function 01005A20 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 01005A82
GetMenuItemCount.USER32(00000000), ref: 01005AB9
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 01005AE1
GetMenuItemID.USER32(?,?), ref: 01005B50
GetSubMenu.USER32(?,?), ref: 01005B5E
PostMessageW.USER32(?,00000111,?,00000000), ref: 01005BAF

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 8f96a718489c3ad96e61d2e850758d7e85cf15650a7325f95b4130ac51b344a4
Instruction ID: 204dda576fde7fa3fd505bff3bc00a78f87c5e4490d3399fa6cb7beac6466c94
Opcode Fuzzy Hash: 8f96a718489c3ad96e61d2e850758d7e85cf15650a7325f95b4130ac51b344a4
Instruction Fuzzy Hash: AF519E35A00615AFDB12EF64CC45AAEBBB4EF48310F004099E941B7291CB79AE41DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00FDF3DD Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FDF3F7
VariantClear.OLEAUT32(00000013), ref: 00FDF469
VariantClear.OLEAUT32(00000000), ref: 00FDF4C4
_memmove.LIBCMT ref: 00FDF4EE
VariantClear.OLEAUT32(?), ref: 00FDF53B
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00FDF569

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 1c1cbf6e0cade6d3716fed2ca9d10cc5dc039b7b097a10175bd01e4cb548e5a3
Instruction ID: 59e28e2eb480d0c8d3f5284f22eef46408bdeafd0693209b93c86074c33e547b
Opcode Fuzzy Hash: 1c1cbf6e0cade6d3716fed2ca9d10cc5dc039b7b097a10175bd01e4cb548e5a3
Instruction Fuzzy Hash: 7D515BB5A0020A9FCB10DF58D880EAAB7F9FF48314B19816AED59DB305D734E915CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00FE26F9 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE2747
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00FE2792
IsMenu.USER32(00000000), ref: 00FE27B2
CreatePopupMenu.USER32 ref: 00FE27E6
GetMenuItemCount.USER32(000000FF), ref: 00FE2844
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00FE2875

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 019e091c88d8f586e33d039f83ba587a45971a8bb11d2471037e38454b441f9f
Instruction ID: 9bb0c38701bbef31d5c3a92c8d048f34606b8c06d4fe48bfdc1083c710c1a680
Opcode Fuzzy Hash: 019e091c88d8f586e33d039f83ba587a45971a8bb11d2471037e38454b441f9f
Instruction Fuzzy Hash: A751D270E00386DFDF65CF6AC888BAEBBF8BF44324F10415AE4159B291E7758A04EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F81765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00F82612: GetWindowLongW.USER32(?,000000EB), ref: 00F82623

BeginPaint.USER32(?,?,?,?,?,?), ref: 00F8179A
GetWindowRect.USER32(?,?), ref: 00F817FE
ScreenToClient.USER32(?,?), ref: 00F8181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00F8182C
EndPaint.USER32(?,?), ref: 00F81876

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: f381eff10e51d1c7245937bfc94cd3727e7d2d44f81349608156b327602bd2e8
Instruction ID: 91b5cf0f6b48ebbb9539dcdf24aea253295091f614de8d762f3eb1c9b2de1485
Opcode Fuzzy Hash: f381eff10e51d1c7245937bfc94cd3727e7d2d44f81349608156b327602bd2e8
Instruction Fuzzy Hash: EA41CDB1500301AFD721EF25CC84FFA7BE8FB4A724F140728F994861A1D736A806EB61

Uniqueness

Uniqueness Score: -1.00%

Function 0100B958 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(010467B0,00000000,014CE9E8,?,?,010467B0,?,0100B862,?,?), ref: 0100B9CC
EnableWindow.USER32(00000000,00000000), ref: 0100B9F0
ShowWindow.USER32(010467B0,00000000,014CE9E8,?,?,010467B0,?,0100B862,?,?), ref: 0100BA50
ShowWindow.USER32(00000000,00000004,?,0100B862,?,?), ref: 0100BA62
EnableWindow.USER32(00000000,00000001), ref: 0100BA86
SendMessageW.USER32(?,0000130C,?,00000000), ref: 0100BAA9

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 770adce1846c5635300755deb9c75107cd872a55a7981c2df89913d44ab34ea6
Instruction ID: 56dd3969023a705c0a890b0f2b19d394021dac4af7c3ccf07786c3f3b6702f01
Opcode Fuzzy Hash: 770adce1846c5635300755deb9c75107cd872a55a7981c2df89913d44ab34ea6
Instruction Fuzzy Hash: 73413438600141AFEB67CF18C489BA57FE1FB06715F1841F9EA888F6E6C7319445DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00FF73B1 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00FF5134,?,?,00000000,00000001), ref: 00FF73BF

Part of subcall function 00FF3C94: GetWindowRect.USER32(?,?), ref: 00FF3CA7

GetDesktopWindow.USER32 ref: 00FF73E9
GetWindowRect.USER32(00000000), ref: 00FF73F0
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00FF7422

Part of subcall function 00FE54E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00FE555E

GetCursorPos.USER32(?), ref: 00FF744E
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00FF74AC

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 1df167401c91e445f1f54a92a5f98e0166b8ac60c85fc671e5ac8cb8622e62c1
Instruction ID: 62e636f9663c03bad295e73b14b02e568e8f85dede7131ce71c702d3072b8ee4
Opcode Fuzzy Hash: 1df167401c91e445f1f54a92a5f98e0166b8ac60c85fc671e5ac8cb8622e62c1
Instruction Fuzzy Hash: 8531D47250830AABD730DF14D849F6BBBE9FF88314F000919F588A7191CB75E909DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FD8D5B Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD85F1: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00FD8608
Part of subcall function 00FD85F1: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00FD8612
Part of subcall function 00FD85F1: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00FD8621
Part of subcall function 00FD85F1: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00FD8628
Part of subcall function 00FD85F1: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00FD863E

GetLengthSid.ADVAPI32(?,00000000,00FD8977), ref: 00FD8DAC
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00FD8DB8
HeapAlloc.KERNEL32(00000000), ref: 00FD8DBF
CopySid.ADVAPI32(00000000,00000000,?), ref: 00FD8DD8
GetProcessHeap.KERNEL32(00000000,00000000,00FD8977), ref: 00FD8DEC
HeapFree.KERNEL32(00000000), ref: 00FD8DF3

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 86d634eba32655ac63e41cecf89dff0e8e5a84a95c25d7099610eda190d59fc8
Instruction ID: 75e3943965cc8035c5181839fba0b7006a9aa94495cb701765a4e39f43b192bf
Opcode Fuzzy Hash: 86d634eba32655ac63e41cecf89dff0e8e5a84a95c25d7099610eda190d59fc8
Instruction Fuzzy Hash: E411DF31900605FFDB21DF64CC08BAE777BEF553A5F18401AF88593280CB369901EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00FD8AF9 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00FD8B2A
OpenProcessToken.ADVAPI32(00000000), ref: 00FD8B31
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00FD8B40
CloseHandle.KERNEL32(00000004), ref: 00FD8B4B
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00FD8B7A
DestroyEnvironmentBlock.USERENV(00000000), ref: 00FD8B8E

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: d97a005f6ad532a436b14217234d91acfc810a8e544dbc1c6da581471f7e1580
Instruction ID: 7e189817f146259fe03b536cfb3a2973bbe0cb2995a56436f01f7fa4ed8e6d41
Opcode Fuzzy Hash: d97a005f6ad532a436b14217234d91acfc810a8e544dbc1c6da581471f7e1580
Instruction Fuzzy Hash: 51118CB250020AABDF22CFA4DC49FDE7BA9FF48358F084056FE04A2150C7768D61AB61

Uniqueness

Uniqueness Score: -1.00%

Function 0100C19A Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00F812F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00F8134D
Part of subcall function 00F812F3: SelectObject.GDI32(?,00000000), ref: 00F8135C
Part of subcall function 00F812F3: BeginPath.GDI32(?), ref: 00F81373
Part of subcall function 00F812F3: SelectObject.GDI32(?,00000000), ref: 00F8139C

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 0100C1C4
LineTo.GDI32(00000000,00000003,?), ref: 0100C1D8
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0100C1E6
LineTo.GDI32(00000000,00000000,?), ref: 0100C1F6
EndPath.GDI32(00000000), ref: 0100C206
StrokePath.GDI32(00000000), ref: 0100C216

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: c216bc41e54d828f63e84950890a385b280617fce77ef5f3163d1e95d9781cce
Instruction ID: 448c743bef64ba2a40b738c228406efcfb5fc88eb59c35186b60f442c24b29c6
Opcode Fuzzy Hash: c216bc41e54d828f63e84950890a385b280617fce77ef5f3163d1e95d9781cce
Instruction Fuzzy Hash: 25115E7600010DBFEF229F94DC88FDA3FACEB08350F048151BA48461A5D7769D95EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00FA03A2 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00FA03D3
MapVirtualKeyW.USER32(00000010,00000000), ref: 00FA03DB
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00FA03E6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00FA03F1
MapVirtualKeyW.USER32(00000011,00000000), ref: 00FA03F9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00FA0401

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: c2e2a8e205a596f1f0629439e6e323dd62fee0066efa869ad00b16e27ad306b0
Instruction ID: b6e77dd55adf3cbc40442f8eb72ecb0c1450f09a3a826d779fecce4f4c8c6ae8
Opcode Fuzzy Hash: c2e2a8e205a596f1f0629439e6e323dd62fee0066efa869ad00b16e27ad306b0
Instruction Fuzzy Hash: 9D016CB090175A7DE3008F6A8C85B52FFA8FF19354F00411BA15C47941C7F5A864CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00FE568B Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00FE569B
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00FE56B1
GetWindowThreadProcessId.USER32(?,?), ref: 00FE56C0
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00FE56CF
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00FE56D9
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00FE56E0

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 7689ff38643b3cee7d7c1139e7cb1b0dd0c3d91196acb42aae48f7476c49c7cc
Instruction ID: 65eb127f92b2bc3f06ceab05de267f413dc71a45298274786925ba9b4bda23f6
Opcode Fuzzy Hash: 7689ff38643b3cee7d7c1139e7cb1b0dd0c3d91196acb42aae48f7476c49c7cc
Instruction Fuzzy Hash: 59F06D3224115ABBE3325BA29C0DEEB7B7CEBCAB21F000159FA40D10409AA61A01A7B5

Uniqueness

Uniqueness Score: -1.00%

Function 00FE74D2 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00FE74E5
EnterCriticalSection.KERNEL32(?,?,00F91044,?,?), ref: 00FE74F6
TerminateThread.KERNEL32(00000000,000001F6,?,00F91044,?,?), ref: 00FE7503
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00F91044,?,?), ref: 00FE7510

Part of subcall function 00FE6ED7: CloseHandle.KERNEL32(00000000,?,00FE751D,?,00F91044,?,?), ref: 00FE6EE1

InterlockedExchange.KERNEL32(?,000001F6), ref: 00FE7523
LeaveCriticalSection.KERNEL32(?,?,00F91044,?,?), ref: 00FE752A

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: d75ea6610a8a189857e537b0aadfc709aef35f1f253b0cae9a79517841bf0a0d
Instruction ID: d15422e8efc7e49369cc24f1c82401ce153ca92730df2f617fbcac810590c429
Opcode Fuzzy Hash: d75ea6610a8a189857e537b0aadfc709aef35f1f253b0cae9a79517841bf0a0d
Instruction Fuzzy Hash: 18F05E3A544713EBDB323B64FC8C9EB7B2AEF45312F040521F282D10A8CB7A5801EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FD8E74 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00FD8E7F
UnloadUserProfile.USERENV(?,?), ref: 00FD8E8B
CloseHandle.KERNEL32(?), ref: 00FD8E94
CloseHandle.KERNEL32(?), ref: 00FD8E9C
GetProcessHeap.KERNEL32(00000000,?), ref: 00FD8EA5
HeapFree.KERNEL32(00000000), ref: 00FD8EAC

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 27d89349b61a38275d016bb25bcb413a96e2e924f7186123d395bbede39bf002
Instruction ID: d82eeb8144335d3076d5c397a13ba6d18da09fbbc643793b18bfac08ed8f583d
Opcode Fuzzy Hash: 27d89349b61a38275d016bb25bcb413a96e2e924f7186123d395bbede39bf002
Instruction Fuzzy Hash: 12E0ED36004502BBD7226FE1EC0C945BF79FF89722F108220F259C1068CB375460EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FF8902 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FF8928
CharUpperBuffW.USER32(?,?), ref: 00FF8A37
VariantClear.OLEAUT32(?), ref: 00FF8BAF

Part of subcall function 00FE7804: VariantInit.OLEAUT32(00000000), ref: 00FE7844
Part of subcall function 00FE7804: VariantCopy.OLEAUT32(00000000,?), ref: 00FE784D
Part of subcall function 00FE7804: VariantClear.OLEAUT32(00000000), ref: 00FE7859

Strings

AUTOIT.ERROR, xrefs: 00FF8A3D
Incorrect Parameter format, xrefs: 00FF8960, 00FF8B22

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 979c30d5f4b1f9f5361db2d898529485b87a19661dc2a52ddfd2036cc151fd28
Instruction ID: 795c3736f942c6712632e564c48960221cd4a375637afbad47a8a82b9903c1ef
Opcode Fuzzy Hash: 979c30d5f4b1f9f5361db2d898529485b87a19661dc2a52ddfd2036cc151fd28
Instruction Fuzzy Hash: 4B91BD71608305DFC710EF24C88496ABBE4EFC8754F04896EF99A8B361DB35E906DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00FE2F86 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F9FEC6: _wcscpy.LIBCMT ref: 00F9FEE9

_memset.LIBCMT ref: 00FE3077
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00FE30A6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00FE3159
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00FE3187

Strings

0, xrefs: 00FE3063

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: d2346f1537b6b827570d7d233e8c3f33337c9f9265dc53b171f136cec0633e22
Instruction ID: 311d48105bd7091154e3cbddb2c49cf50905dc0da445ec99f7513f6523ca1df8
Opcode Fuzzy Hash: d2346f1537b6b827570d7d233e8c3f33337c9f9265dc53b171f136cec0633e22
Instruction Fuzzy Hash: 18510471E083809BD7259F2AC84D66BBBE4EF85364F040A2DF891D3191DB79CE44A752

Uniqueness

Uniqueness Score: -1.00%

Function 00FDDA5D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00FDDAC5
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00FDDAFB
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00FDDB0C
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00FDDB8E

Strings

DllGetClassObject, xrefs: 00FDDB01

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 80283e0252d29d15f395e6cc56f45ad0cf68476097bfbb012d7f52924611cdee
Instruction ID: 908f845c566a4dec566f3a0b11a49c3db410c358735086087beedd7d94620d30
Opcode Fuzzy Hash: 80283e0252d29d15f395e6cc56f45ad0cf68476097bfbb012d7f52924611cdee
Instruction Fuzzy Hash: D1418FB1600208EFDB15CF54C884A9A7BAAEF84354F1981ABED059F305D7B5DD44EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00FE2C42 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE2CAF
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00FE2CCB
DeleteMenu.USER32(?,00000007,00000000), ref: 00FE2D11
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,01046890,00000000), ref: 00FE2D5A

Strings

0, xrefs: 00FE2CA4

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 75a2748bb678d5e0f917cab47c90a08d082eab6f796ff24866f3c7fd36766f8f
Instruction ID: 8c8acb72a5c46b0552f1ce7978438cb854941860c222e3bc7956df5719d2c60f
Opcode Fuzzy Hash: 75a2748bb678d5e0f917cab47c90a08d082eab6f796ff24866f3c7fd36766f8f
Instruction Fuzzy Hash: 7C41DD306043829FD724EF25DC80B1ABBE8AF85320F14461EFAA197291E774E904DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00FFDAB9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00FFDAD9

Part of subcall function 00F879AB: _memmove.LIBCMT ref: 00F879F9

Strings

stdcall, xrefs: 00FFDB5B
winapi, xrefs: 00FFDB4A
cdecl, xrefs: 00FFDB30
none, xrefs: 00FFDBB4

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 0bc4a12930e5a8f5589ce6c37df74c1734a551777b8ef23e95bcad8b4c85e870
Instruction ID: 0b94b82777c695da5376d7ba8bd58589b7f21ed53ce66b2d9c911fb3f5eddd92
Opcode Fuzzy Hash: 0bc4a12930e5a8f5589ce6c37df74c1734a551777b8ef23e95bcad8b4c85e870
Instruction Fuzzy Hash: 2231D27190061AAFCF10EF54CC819FEB3B5FF45724B108619E965976A1CB35E906DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00FD9372 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

Part of subcall function 00FDB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00FDB0E7

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00FD93F6
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00FD9409
SendMessageW.USER32(?,00000189,?,00000000), ref: 00FD9439

Part of subcall function 00F87D2C: _memmove.LIBCMT ref: 00F87D66

Strings

ListBox, xrefs: 00FD93B5
ComboBox, xrefs: 00FD9380

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 50316ed6eb06364d30755493da1a31daad872edcd8d0610f33bdf5f7dcf0267c
Instruction ID: 55f469bb5fffff0d4b4c58354b1dcf4102c0052876c479d6bed7027098139de1
Opcode Fuzzy Hash: 50316ed6eb06364d30755493da1a31daad872edcd8d0610f33bdf5f7dcf0267c
Instruction Fuzzy Hash: 5B210471904204ABDB24ABB1CC859FFB76DDF06760F14821AF921972E1DB79490AB720

Uniqueness

Uniqueness Score: -1.00%

Function 00FF1B21 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00FF1B40
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FF1B66
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00FF1B96
InternetCloseHandle.WININET(00000000), ref: 00FF1BDD

Part of subcall function 00FF2777: GetLastError.KERNEL32(?,?,00FF1B0B,00000000,00000000,00000001), ref: 00FF278C
Part of subcall function 00FF2777: SetEvent.KERNEL32(?,?,00FF1B0B,00000000,00000000,00000001), ref: 00FF27A1

Strings

, xrefs: 00FF1B87

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: b79d2a7948450f6b33badfdec31b67edd9c82ea4ef8605c2ecb493a544b3490c
Instruction ID: 4422b811a28995f99577a689d1383f8673552078ca9bca9c35d835307c24ca88
Opcode Fuzzy Hash: b79d2a7948450f6b33badfdec31b67edd9c82ea4ef8605c2ecb493a544b3490c
Instruction Fuzzy Hash: 5D21CFB290020CFFEB229F208C85EBF77ECFF89754F10011AF645E2250EA259D05A762

Uniqueness

Uniqueness Score: -1.00%

Function 01006656 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F81D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00F81D73
Part of subcall function 00F81D35: GetStockObject.GDI32(00000011), ref: 00F81D87
Part of subcall function 00F81D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00F81D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 010066D0
LoadLibraryW.KERNEL32(?), ref: 010066D7
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 010066EC
DestroyWindow.USER32(?), ref: 010066F4

Strings

SysAnimate32, xrefs: 010066AB

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: b0388f04517300f3a19c4a481601a4b808a954518dd9f01c6a8155f4234ee6b5
Instruction ID: d339005319e25b8b277c56cb6535e7bc05ba1ab966bbad2c0c47a62face1ce27
Opcode Fuzzy Hash: b0388f04517300f3a19c4a481601a4b808a954518dd9f01c6a8155f4234ee6b5
Instruction Fuzzy Hash: 2A218E71100206AFFF224F68EC80EAB77EEFB49368F104629FA95961D1D77398619760

Uniqueness

Uniqueness Score: -1.00%

Function 00FE703E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00FE705E
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00FE7091
GetStdHandle.KERNEL32(0000000C), ref: 00FE70A3
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00FE70DD

Strings

nul, xrefs: 00FE70D8

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: d56734935a6ce1e791a6bb272a7a10209cca99ad2a5d5d39a08ca25c684c64e9
Instruction ID: 16082d9661327aaa712f9adb4135a786eb6c232d2d28277bcaca11fe18d08282
Opcode Fuzzy Hash: d56734935a6ce1e791a6bb272a7a10209cca99ad2a5d5d39a08ca25c684c64e9
Instruction Fuzzy Hash: 3E21817590434AABDB30AF3ADC05A9A77A8AF54730F204619FEA1D72D0E7719940AB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FE710C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00FE712B
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00FE715D
GetStdHandle.KERNEL32(000000F6), ref: 00FE716E
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00FE71A8

Strings

nul, xrefs: 00FE71A3

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: f2e22b85d3680170441a03ffb57f9d9cffe1a902680109e92350729aeb4d488b
Instruction ID: f878b27c06db3f02d3e17d5b8b1389be2e19df46315cd0c8853ceac70e965ba7
Opcode Fuzzy Hash: f2e22b85d3680170441a03ffb57f9d9cffe1a902680109e92350729aeb4d488b
Instruction Fuzzy Hash: 5E21C875904386ABDB30AF6A9C04A9AB7E8AF55730F200619FCF0D72D0D7749841E750

Uniqueness

Uniqueness Score: -1.00%

Function 00FEAEAB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00FEAEBF
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00FEAF13
__swprintf.LIBCMT ref: 00FEAF2C
SetErrorMode.KERNEL32(00000000,00000001,00000000,0100F910), ref: 00FEAF6A

Strings

%lu, xrefs: 00FEAF26

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: e92debb196e44c29324463976af919bcf0b9765308f01cefe376711e2df5d44c
Instruction ID: 418e0e793a43d93057752411387e68189fa3235c1b8f7eee7823419774daf7e1
Opcode Fuzzy Hash: e92debb196e44c29324463976af919bcf0b9765308f01cefe376711e2df5d44c
Instruction Fuzzy Hash: E7218331A00149AFCB20EF65CC85DEE7BB8EF89704B044069F949EB251DB75EA41EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00FDA52F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F87D2C: _memmove.LIBCMT ref: 00F87D66

Part of subcall function 00FDA37C: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00FDA399
Part of subcall function 00FDA37C: GetWindowThreadProcessId.USER32(?,00000000), ref: 00FDA3AC
Part of subcall function 00FDA37C: GetCurrentThreadId.KERNEL32 ref: 00FDA3B3
Part of subcall function 00FDA37C: AttachThreadInput.USER32(00000000), ref: 00FDA3BA

GetFocus.USER32 ref: 00FDA554

Part of subcall function 00FDA3C5: GetParent.USER32(?), ref: 00FDA3D3

GetClassNameW.USER32(?,?,00000100), ref: 00FDA59D
EnumChildWindows.USER32(?,00FDA615), ref: 00FDA5C5
__swprintf.LIBCMT ref: 00FDA5DF

Strings

%s%d, xrefs: 00FDA5D9

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 5b8ec63d4c019d537561bbbbd527018f40a072b8ed60044371d512208fb8f944
Instruction ID: 79bda910d2b9e44d3d76c39db8fcb1eb6e391f44d202e4ddfe883c72ddd35316
Opcode Fuzzy Hash: 5b8ec63d4c019d537561bbbbd527018f40a072b8ed60044371d512208fb8f944
Instruction Fuzzy Hash: 2011B771600305BBDF217F74DC85FEA377EAF48710F084066B9489A242CA799945BB79

Uniqueness

Uniqueness Score: -1.00%

Function 00FE2017 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00FE2048

Strings

KEYS, xrefs: 00FE205F
EXISTS, xrefs: 00FE2070
APPEND, xrefs: 00FE2081
REMOVE, xrefs: 00FE204E

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 65f7044bc0ed2020147c1debcf4a4fe0ce467e35384208636bff2849fdf91a95
Instruction ID: 0e6170535a076a35177ef9959355bd614eb30575a6870cd6ab4c9a620eaf472d
Opcode Fuzzy Hash: 65f7044bc0ed2020147c1debcf4a4fe0ce467e35384208636bff2849fdf91a95
Instruction Fuzzy Hash: 05116D7190010ACFCF50EFA4DC815FEB7B8FF5A304B108458D995A72A2EB32A906EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FFEE69 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00FFEF1B
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00FFEF4B
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00FFF07E
CloseHandle.KERNEL32(?), ref: 00FFF0FF

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: e9d2dd6d4526e7a04297a74c5eac674581b0e7c317b68193ffe106c4ab12957e
Instruction ID: 81ba0084a5e30efd89ef75a5cfa1fdcb73f852cce4624956de3cbf81211980d7
Opcode Fuzzy Hash: e9d2dd6d4526e7a04297a74c5eac674581b0e7c317b68193ffe106c4ab12957e
Instruction Fuzzy Hash: C28171716043019FD720EF24CC86F6AB7E5AF48720F04881DF69ADB392DBB5AC059B51

Uniqueness

Uniqueness Score: -1.00%

Function 010002C2 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

Part of subcall function 010010A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,01000038,?,?), ref: 010010BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 01000388
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 010003C7
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0100040E
RegCloseKey.ADVAPI32(?,?), ref: 0100043A
RegCloseKey.ADVAPI32(00000000), ref: 01000447

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 5fb9188811f6618ec2e13c807f18277873ed5a47635697475f2c9e57f93472dc
Instruction ID: b279e6a3afccdb0ebb14797ca6e126c030284fbd4793fdd0746ebc808372618a
Opcode Fuzzy Hash: 5fb9188811f6618ec2e13c807f18277873ed5a47635697475f2c9e57f93472dc
Instruction Fuzzy Hash: B6516771208201AFE715EB68CC81FAEB7E8FF88704F04891EB59587291DB39E905DB52

Uniqueness

Uniqueness Score: -1.00%

Function 00FFDBDC Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00F89997: __itow.LIBCMT ref: 00F899C2
Part of subcall function 00F89997: __swprintf.LIBCMT ref: 00F89A0C

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00FFDC3B
GetProcAddress.KERNEL32(00000000,?), ref: 00FFDCBE
GetProcAddress.KERNEL32(00000000,00000000), ref: 00FFDCDA
GetProcAddress.KERNEL32(00000000,?), ref: 00FFDD1B
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00FFDD35

Part of subcall function 00F85B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00FE7B20,?,?,00000000), ref: 00F85B8C
Part of subcall function 00F85B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00FE7B20,?,?,00000000,?,?), ref: 00F85BB0

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: feebeb3909414f1461eeeaef2983b197d7831fcdeb0def2b0fca05b5be0b8b15
Instruction ID: ad37509fa9fcf4233a46399cdbba16e0e9777c3321e31295c32f1568d1ada952
Opcode Fuzzy Hash: feebeb3909414f1461eeeaef2983b197d7831fcdeb0def2b0fca05b5be0b8b15
Instruction Fuzzy Hash: 2F514935A002099FCB10EF68C8849EDB7F5FF59720B088059E915AB321DB79ED45EF91

Uniqueness

Uniqueness Score: -1.00%

Function 00FEE7DC Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00FEE88A
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00FEE8B3
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00FEE8F2

Part of subcall function 00F89997: __itow.LIBCMT ref: 00F899C2
Part of subcall function 00F89997: __swprintf.LIBCMT ref: 00F89A0C

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00FEE917
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00FEE91F

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 2783d2c1c56a2d8a1c520c888e7019a960c59070a90640fc83848230d437b3d4
Instruction ID: e65c65cb84a1eb958606bf46f2f9c5fc3cd95a2c83fb50cade3bf6056c64fe26
Opcode Fuzzy Hash: 2783d2c1c56a2d8a1c520c888e7019a960c59070a90640fc83848230d437b3d4
Instruction Fuzzy Hash: 6B512A35A00205DFCB11EF65C985AAEBBF5EF09310F188099E849AB362CB75ED11EB50

Uniqueness

Uniqueness Score: -1.00%

Function 0100A2C5 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdaa9037a2a3d1a4e6bdba098b738d8d9a45755dddc0e9af395de3f819af49c3
Instruction ID: 1480250164bc08ce810f631d5d7df3a3858071b7941f6b7d4492321b4d81843f
Opcode Fuzzy Hash: fdaa9037a2a3d1a4e6bdba098b738d8d9a45755dddc0e9af395de3f819af49c3
Instruction Fuzzy Hash: 8341C275A00304EBF762DB2CCC44FA9BBA4FB09310F0582A5FA95A72D1DBB5A9419B50

Uniqueness

Uniqueness Score: -1.00%

Function 00F82344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00F82357
ScreenToClient.USER32(010467B0,?), ref: 00F82374
GetAsyncKeyState.USER32(00000001), ref: 00F82399
GetAsyncKeyState.USER32(00000002), ref: 00F823A7

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 8453a2fb31d35165628065898f32a555fa7028906fcd9aead503a95213f84280
Instruction ID: 0301f35bc6cac829817e39c7aaedd8c535e9eb80ea04b342fcc739e7e5085fce
Opcode Fuzzy Hash: 8453a2fb31d35165628065898f32a555fa7028906fcd9aead503a95213f84280
Instruction Fuzzy Hash: FF417F7590411AFBDF299FA9C844AEEBB74FB05320F20431AF868A2290C7356954EFD1

Uniqueness

Uniqueness Score: -1.00%

Function 00FD6920 Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00FD695D
TranslateAcceleratorW.USER32(?,?,?), ref: 00FD69A9
TranslateMessage.USER32(?), ref: 00FD69D2
DispatchMessageW.USER32(?), ref: 00FD69DC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00FD69EB

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: f49a0f6ac76d5a1e526ac76474ff711ae0b28e5c6dbc3dde6648120913fb2226
Instruction ID: d72774a0235a88d788294100756038abc2f19f5e73a6a1291846ded2f1015f58
Opcode Fuzzy Hash: f49a0f6ac76d5a1e526ac76474ff711ae0b28e5c6dbc3dde6648120913fb2226
Instruction Fuzzy Hash: BE31E7B1900206ABDB30DF74DC84BB67BA9AB06320F184167E4A1D3295E73F9845F751

Uniqueness

Uniqueness Score: -1.00%

Function 00FD8F01 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00FD8F12
PostMessageW.USER32(?,00000201,00000001), ref: 00FD8FBC
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00FD8FC4
PostMessageW.USER32(?,00000202,00000000), ref: 00FD8FD2
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00FD8FDA

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: a9390e74661093189f8f8a7f982c9f3dfb0b50399198e9c93290c0295b2caf93
Instruction ID: 3cf388f1bb1afe3900442723c5e05156cec70654024026ecfae3a415a2d8abb9
Opcode Fuzzy Hash: a9390e74661093189f8f8a7f982c9f3dfb0b50399198e9c93290c0295b2caf93
Instruction Fuzzy Hash: 8131E071900219EFDB20CF68D94CA9E7BB6EB04325F14421AF964E72C0C7B49911EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FDB6AF Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00FDB6C7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00FDB6E4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00FDB71C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00FDB742
_wcsstr.LIBCMT ref: 00FDB74C

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 5474f2990c28998564ee8f2c563a6904e48fa368669218bde8185aad6cf8ee8f
Instruction ID: ea435ace71b1954b68250234d1abfd63e151849d68766ff187da7d6d7d48ecb6
Opcode Fuzzy Hash: 5474f2990c28998564ee8f2c563a6904e48fa368669218bde8185aad6cf8ee8f
Instruction Fuzzy Hash: 7F210772604204FBEB255F399C49E7B7B99DF8A760F05406AFC05CA291EF65CC41B360

Uniqueness

Uniqueness Score: -1.00%

Function 0100B405 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00F82612: GetWindowLongW.USER32(?,000000EB), ref: 00F82623

GetWindowLongW.USER32(?,000000F0), ref: 0100B44C
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0100B471
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0100B489
GetSystemMetrics.USER32(00000004), ref: 0100B4B2
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00FF1184,00000000), ref: 0100B4D0

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 8eb7114ea0cbdfe4c70a9b0faf6269cfb2fe4b3915a4bc5a9534720075a94ec6
Instruction ID: 4e34e8d8dc8dc22d66dbf6a90b448405e70ce44c0436d0cd7c750c5673d21af2
Opcode Fuzzy Hash: 8eb7114ea0cbdfe4c70a9b0faf6269cfb2fe4b3915a4bc5a9534720075a94ec6
Instruction Fuzzy Hash: F421B575510216AFEB629F38CC44B6A3BA4FB05721F124768FEA6D31D0EB319A11DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00FD97E9 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00FD9802

Part of subcall function 00F87D2C: _memmove.LIBCMT ref: 00F87D66

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00FD9834
__itow.LIBCMT ref: 00FD984C
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00FD9874
__itow.LIBCMT ref: 00FD9885

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 9f3757d1fb23f2384a0d2d5064dc7291624356d791105970e91d77974e7f4d9d
Instruction ID: 2c5c3b4dddae3a7fa8acc7b0550def7438d3bcea91dd5a6589688bf417549ce3
Opcode Fuzzy Hash: 9f3757d1fb23f2384a0d2d5064dc7291624356d791105970e91d77974e7f4d9d
Instruction Fuzzy Hash: 85210D31B04304ABDB20ABB18C86EEE7BA9EF4AB24F480025FD05DB341D6B4DD41B791

Uniqueness

Uniqueness Score: -1.00%

Function 00F812F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00F8134D
SelectObject.GDI32(?,00000000), ref: 00F8135C
BeginPath.GDI32(?), ref: 00F81373
SelectObject.GDI32(?,00000000), ref: 00F8139C

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: b75a42cc6725ef722e130f2543272468d6204e0462beaee2437ed6e2c4028110
Instruction ID: d5480f0fb0f6479a5488573777df815a5d28dbde3a41879dbc7680c4c62c8906
Opcode Fuzzy Hash: b75a42cc6725ef722e130f2543272468d6204e0462beaee2437ed6e2c4028110
Instruction Fuzzy Hash: 372162F5C00309DFEB319F25D9447A97BB8FB11322F244319F49496194E77B9892EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FDC161 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00FDC176
_memcmp.LIBCMT ref: 00FDC194
_memcmp.LIBCMT ref: 00FDC1A7
_memcmp.LIBCMT ref: 00FDC1BF
_memcmp.LIBCMT ref: 00FDC1D7

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 4f4eb7fb5de6a2567564381782b3479ad57023b22cbde1b4b8f78c855bf0f2dd
Instruction ID: 0ef826ffbe9358f1f66ca12e2e7de83ca5ac71607e16cea4e23ee55eb20ceb50
Opcode Fuzzy Hash: 4f4eb7fb5de6a2567564381782b3479ad57023b22cbde1b4b8f78c855bf0f2dd
Instruction Fuzzy Hash: E001DDB2A0422B7BD204A6215C42FAB735DAF123A4F584116FD04D7343E765DE11E3E0

Uniqueness

Uniqueness Score: -1.00%

Function 00FE4D35 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00FE4D5C
__beginthreadex.LIBCMT ref: 00FE4D7A
MessageBoxW.USER32(?,?,?,?), ref: 00FE4D8F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00FE4DA5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00FE4DAC

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 2c7f18f0daeecfccb331ff6c4f4de93c28ad8af26af301bfaf98cee32971636a
Instruction ID: 66874e34dd4c73cf522e7563d7cedff554d99b731a9f198294040314dc8623c4
Opcode Fuzzy Hash: 2c7f18f0daeecfccb331ff6c4f4de93c28ad8af26af301bfaf98cee32971636a
Instruction Fuzzy Hash: D31144B6904648BBCB318FA89D48ADA7FACEB4A320F144259F954D3240D67A9C0097A1

Uniqueness

Uniqueness Score: -1.00%

Function 00FD874A Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00FD8766
GetLastError.KERNEL32(?,00FD822A,?,?,?), ref: 00FD8770
GetProcessHeap.KERNEL32(00000008,?,?,00FD822A,?,?,?), ref: 00FD877F
HeapAlloc.KERNEL32(00000000,?,00FD822A,?,?,?), ref: 00FD8786
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00FD879D

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 6394a46cd6066510711e72b31c62c52e16e3c82de80d4b703daea778ad8c4d81
Instruction ID: 6e7541f6e628c48db2f4820ea96a9914d22a11374d5c4fd6809278aefac2a918
Opcode Fuzzy Hash: 6394a46cd6066510711e72b31c62c52e16e3c82de80d4b703daea778ad8c4d81
Instruction Fuzzy Hash: D0016271A00205BFDB315FB5DC48D677B6DFF8A3A5B200429F849C2250DB329C01EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00FE54E6 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00FE5502
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00FE5510
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00FE5518
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00FE5522
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00FE555E

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: dfc117bbeba44b80496336abc1f71a2bb69f198f9339f8cdcfb3214a39806057
Instruction ID: cc08a61427a3dbac9a0b9864d311abe3b64d6ee95dca7bae1cebde4d17783ffa
Opcode Fuzzy Hash: dfc117bbeba44b80496336abc1f71a2bb69f198f9339f8cdcfb3214a39806057
Instruction Fuzzy Hash: 78016136D04A19DBCF20EFE5E8486EDBB79FB09B19F440056E841F2144DB355550E7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00FD7652 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FD758C,80070057,?,?,?,00FD799D), ref: 00FD766F
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FD758C,80070057,?,?), ref: 00FD768A
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FD758C,80070057,?,?), ref: 00FD7698
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FD758C,80070057,?), ref: 00FD76A8
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00FD758C,80070057,?,?), ref: 00FD76B4

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: c30238d050091024e5ab900b8c361f9950a23f23ec05146eccc2c6ed47e202ac
Instruction ID: 9caf116822758b5f5228b3ce9411e8fdf0cad722a0ec9260dbfe7b9512619df9
Opcode Fuzzy Hash: c30238d050091024e5ab900b8c361f9950a23f23ec05146eccc2c6ed47e202ac
Instruction Fuzzy Hash: B901B172600715ABDB21AF18DC04BAA7BAEEB44761F18001AFD04D6205F736DE00ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 00FD85F1 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00FD8608
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00FD8612
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00FD8621
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00FD8628
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00FD863E

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 3dbbfbc3dbb43d16f0362b013a828170782e42a87750978d84b7a430a00bb5ef
Instruction ID: a9db39a1f797d3c12e537298bf70f08798efd2ef8f54990fcef1be062df4baa3
Opcode Fuzzy Hash: 3dbbfbc3dbb43d16f0362b013a828170782e42a87750978d84b7a430a00bb5ef
Instruction Fuzzy Hash: DEF04431205305AFD7315FA9DC89E6B3BADEF4A7A4F044416F545C7240CB65DC41EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00FD8652 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00FD8669
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00FD8673
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FD8682
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00FD8689
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FD869F

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: f05af9ff87271f13b1bdf89589c075423c6d09ec546c9d7f01ba6e697ec032e3
Instruction ID: bb584deb9c2315bc7b888afba1eac7a27c3788d28b3cf249b2debc4fe54ea2a3
Opcode Fuzzy Hash: f05af9ff87271f13b1bdf89589c075423c6d09ec546c9d7f01ba6e697ec032e3
Instruction Fuzzy Hash: 84F04471200305BFD7325F65DC88E673BADEF497A4F140016F545C7240CA65DD41EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00FDC6A6 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00FDC6BA
GetWindowTextW.USER32(00000000,?,00000100), ref: 00FDC6D1
MessageBeep.USER32(00000000), ref: 00FDC6E9
KillTimer.USER32(?,0000040A), ref: 00FDC705
EndDialog.USER32(?,00000001), ref: 00FDC71F

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 265a7514dab0a31cac5bd5facf113c1ede32236fa8a179f20d57414f264f2657
Instruction ID: 59449d79d83db8689acc95ffb74e9eabc472f4f4b0ba562eda829d4a89f4b1e4
Opcode Fuzzy Hash: 265a7514dab0a31cac5bd5facf113c1ede32236fa8a179f20d57414f264f2657
Instruction Fuzzy Hash: 1D01A23040030AABEB326B20DC4EF9677B9FF04705F08065AF586A11D0DBE5A954EF80

Uniqueness

Uniqueness Score: -1.00%

Function 00F813B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00F813BF
StrokeAndFillPath.GDI32(?,?,00FBBAD8,00000000,?), ref: 00F813DB
SelectObject.GDI32(?,00000000), ref: 00F813EE
DeleteObject.GDI32 ref: 00F81401
StrokePath.GDI32(?), ref: 00F8141C

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 378874a3e72bf999f1ec5d39de9d8390acb326f220c11b12eae773419e2329c8
Instruction ID: a2d6fb273c3265d5f9d7e150a84ab2e2e06c3fffd68a3a4635a04da644e290e0
Opcode Fuzzy Hash: 378874a3e72bf999f1ec5d39de9d8390acb326f220c11b12eae773419e2329c8
Instruction Fuzzy Hash: DAF0CDF40043099BEB329F56E94C7943BA8B702326F14C318F4A9454E8D73B4596EF50

Uniqueness

Uniqueness Score: -1.00%

Function 00FEC602 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00FEC69D
CoCreateInstance.OLE32(01012D6C,00000000,00000001,01012BDC,?), ref: 00FEC6B5

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

CoUninitialize.OLE32 ref: 00FEC922

Strings

.lnk, xrefs: 00FEC631, 00FEC659, 00FEC663

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: d8febb50b732448c9eca1f6f118777bc9086149d19136602dd940bc0d6e8e8a4
Instruction ID: 99fde1238aeca51bc4663c5d06921d565b61e248d1628e25d6d4078496ce6747
Opcode Fuzzy Hash: d8febb50b732448c9eca1f6f118777bc9086149d19136602dd940bc0d6e8e8a4
Instruction Fuzzy Hash: AAA11871108205AFD304FF64CC81EABB7E8EF84704F14491DF1969B192EBB5EA49DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F92E5B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00FA0FF6: std::exception::exception.LIBCMT ref: 00FA102C
Part of subcall function 00FA0FF6: __CxxThrowException@8.LIBCMT ref: 00FA1041

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

Part of subcall function 00F87BB1: _memmove.LIBCMT ref: 00F87C0B

__swprintf.LIBCMT ref: 00F9302D

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00F92EC6

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: a0492cb3b0800731f537c96057c15ba96d715f95d20a71a06f19f1ff998c46a7
Instruction ID: 8a5638b32bc4859c7f01ce778929dde7bfdaf1fc61b7353b741ed7993144550e
Opcode Fuzzy Hash: a0492cb3b0800731f537c96057c15ba96d715f95d20a71a06f19f1ff998c46a7
Instruction Fuzzy Hash: 23918B715083019FDB18FF24DD86DAEB7A4EF85750F00491DF4829B2A1EB28EE44EB52

Uniqueness

Uniqueness Score: -1.00%

Function 00FEBBA6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00F848AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00F848A1,?,?,00F837C0,?), ref: 00F848CE

CoInitialize.OLE32(00000000), ref: 00FEBC26
CoCreateInstance.OLE32(01012D6C,00000000,00000001,01012BDC,?), ref: 00FEBC3F
CoUninitialize.OLE32 ref: 00FEBC5C

Part of subcall function 00F89997: __itow.LIBCMT ref: 00F899C2
Part of subcall function 00F89997: __swprintf.LIBCMT ref: 00F89A0C

Strings

.lnk, xrefs: 00FEBC08, 00FEBC16

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: f655593abfadbffce2317cde34ee5a72f6bf16dd8e74760850a1ecb1f8735c3e
Instruction ID: 4da29c7a50aedfb8a3f38efb40d66e8782f4e6c4c6fe51613b04c4fac1aa3e90
Opcode Fuzzy Hash: f655593abfadbffce2317cde34ee5a72f6bf16dd8e74760850a1ecb1f8735c3e
Instruction Fuzzy Hash: 4BA178756043419FCB10EF15C884E6ABBE5FF88324F148988F89A9B361CB35ED45DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00FA524D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00FA52DD

Part of subcall function 00FB0340: __87except.LIBCMT ref: 00FB037B

Strings

pow, xrefs: 00FA52B5, 00FA52D2

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 1ebb7cecc3f98379ea4a98cdd3818ab9dbeddd2dcd914012d13f01502ded013a
Instruction ID: 2edfc4ad46a49e2dd8f702213e0e25a5794323462b3fc0860e7a82f7cdd9031e
Opcode Fuzzy Hash: 1ebb7cecc3f98379ea4a98cdd3818ab9dbeddd2dcd914012d13f01502ded013a
Instruction Fuzzy Hash: BF517AB1E08701D7CB20A615CA413AF3BD4AB41B60F244968E4D5822D9EF7D8CD4BF46

Uniqueness

Uniqueness Score: -1.00%

Function 00FA023B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

+, xrefs: 00FA0277
#, xrefs: 00FA0280

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: 5c8d90b145d982d4d7d613a3b818dccd296132d5a3aa261df87d080ab1f2cb54
Instruction ID: ff324859526cf54e7c9b51aeda4167d4469b553008fcae376ad19427b9ba1566
Opcode Fuzzy Hash: 5c8d90b145d982d4d7d613a3b818dccd296132d5a3aa261df87d080ab1f2cb54
Instruction Fuzzy Hash: F65136759083469FCF25AF28D8886F97BA6EF16720F184056EC919B390CB34DC42E771

Uniqueness

Uniqueness Score: -1.00%

Function 00F962F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F963A8
_memmove.LIBCMT ref: 00F96446
_memset.LIBCMT ref: 00F9646A

Strings

ERCP, xrefs: 00F96313

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 3f1fcdfc9957e6bdad64b51c0fcb700ebd8e388c718890987086ffdba84342fd
Instruction ID: 71e0880cff186751283bee0a8e9e7bdaba196a09020eac6650bab1609286bab6
Opcode Fuzzy Hash: 3f1fcdfc9957e6bdad64b51c0fcb700ebd8e388c718890987086ffdba84342fd
Instruction Fuzzy Hash: B151B371D00709DBEB24CFA5C881BAABBF8FF44724F24856EE54AC7241E7359584DB40

Uniqueness

Uniqueness Score: -1.00%

Function 01007BB5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0100F910,00000000,?,?,?,?), ref: 01007C4E
GetWindowLongW.USER32 ref: 01007C6B
SetWindowLongW.USER32(?,000000F0,00000000), ref: 01007C7B

Strings

SysTreeView32, xrefs: 01007C20

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: ccb845863315cf7e0af7be0d2d73c68c59cfacee33c658a3df989edc791e5853
Instruction ID: 33a907b53206b2a8ae16ae35f67a311a84dfbdf240ce545f00beaf7812d1e6ee
Opcode Fuzzy Hash: ccb845863315cf7e0af7be0d2d73c68c59cfacee33c658a3df989edc791e5853
Instruction Fuzzy Hash: 7231923120060AABEB629F38CC41FEA7BA9FB45324F244729F9F5921D1D739F8519B50

Uniqueness

Uniqueness Score: -1.00%

Function 01007648 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 010076D0
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 010076E4
SendMessageW.USER32(?,00001002,00000000,?), ref: 01007708

Strings

SysMonthCal32, xrefs: 0100769B

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: b50529c7eabdfafce77dfaf041a04179f3f775a7585a90bc5a370e38bb9d00c6
Instruction ID: 1c192e9b77cc800e3541b7229f51ad7b504652ea913bc162e6496a4262415056
Opcode Fuzzy Hash: b50529c7eabdfafce77dfaf041a04179f3f775a7585a90bc5a370e38bb9d00c6
Instruction Fuzzy Hash: 7421E432500219ABEF22CE54CC42FEA3BA9FB48714F110254FE956B1D0DA75B8519B90

Uniqueness

Uniqueness Score: -1.00%

Function 01006F1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 01006FAA
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 01006FBA
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 01006FDF

Strings

Listbox, xrefs: 01006F77

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: dfea1ec2695eb41965b721e2716be9c08db770e93e2fc130556773741a542ee3
Instruction ID: 63a979238fd4fe441b4085ff3d52b0116674c9ea42c3ccfe2491874feae64569
Opcode Fuzzy Hash: dfea1ec2695eb41965b721e2716be9c08db770e93e2fc130556773741a542ee3
Instruction Fuzzy Hash: F321B6326101187FEF238F54CC84FBB37AAEF89754F418158F544971D1CA729C6187A0

Uniqueness

Uniqueness Score: -1.00%

Function 0100797D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 010079E1
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 010079F6
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 01007A03

Strings

msctls_trackbar32, xrefs: 010079B8

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: a44b1616b8382384cde655ed151f0642cc9f02d12b09c513e801d332cd45c02b
Instruction ID: ec8c11586498b600b42eb12e165a90373996ac814eb0f6b260c1cf2cc3e1c375
Opcode Fuzzy Hash: a44b1616b8382384cde655ed151f0642cc9f02d12b09c513e801d332cd45c02b
Instruction Fuzzy Hash: 1D11E772240208BBEF229E74CC05FDB77A9EFC9764F010519F681A60D1D676E451DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00F84C95 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00F84C2E), ref: 00F84CA3
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00F84CB5

Strings

GetNativeSystemInfo, xrefs: 00F84CAF
kernel32.dll, xrefs: 00F84C9E

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 2b6fc6d53e0668518204696c74174e1ac9bb8e23f4faed0b3aa323dfc49e5ba4
Instruction ID: af5e986449b2f6826fa7e2cd02dd0346c59e96f3f26550c891c34e35ff91b70f
Opcode Fuzzy Hash: 2b6fc6d53e0668518204696c74174e1ac9bb8e23f4faed0b3aa323dfc49e5ba4
Instruction Fuzzy Hash: D9D01230911723CFD731AF31D91868676D9AF06751F11882D98C5D6540D678D880EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F84D94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00F84CE1,?), ref: 00F84DA2
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00F84DB4

Strings

Wow64RevertWow64FsRedirection, xrefs: 00F84DAE
kernel32.dll, xrefs: 00F84D9D

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 040dea1d0bb59467e655d15d510bdf6c121e2856e2668b10d6ed10a38766c771
Instruction ID: 2e98767aa02d6b068f0a7c0b6ec39668557b2ba9ce1292de11d145eb91788f3c
Opcode Fuzzy Hash: 040dea1d0bb59467e655d15d510bdf6c121e2856e2668b10d6ed10a38766c771
Instruction Fuzzy Hash: C4D01271950713CFD7319F31D41868676D4AF05355F11882DD8C5D6540D774D880DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F84D61 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00F84D2E,?,00F84F4F,?,010462F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00F84D6F
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00F84D81

Strings

Wow64DisableWow64FsRedirection, xrefs: 00F84D7B
kernel32.dll, xrefs: 00F84D6A

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: f9631feeb98991885c84f9b5a2ac7af172cd5efd5e998658e2b28bf1cc5f830f
Instruction ID: abb8b15674b4503182214d0284822494b90df1ec46edfa93a7acb22a54500a19
Opcode Fuzzy Hash: f9631feeb98991885c84f9b5a2ac7af172cd5efd5e998658e2b28bf1cc5f830f
Instruction Fuzzy Hash: 16D01271A10713CFD7319F31D81869676D8BF15361F118C2D98C6D6240D675D880DB50

Uniqueness

Uniqueness Score: -1.00%

Function 01001072 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,010012C1), ref: 01001080
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 01001092

Strings

RegDeleteKeyExW, xrefs: 0100108C
advapi32.dll, xrefs: 0100107B

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 60f098565c48dee64b2e86e8072f1b69f2223a3e908153b3e97040dd6c1c5dbc
Instruction ID: 5dfcacecc3b961a167936f9ffb9f8c81adc0386b20e4644389cdb1a7fb79e942
Opcode Fuzzy Hash: 60f098565c48dee64b2e86e8072f1b69f2223a3e908153b3e97040dd6c1c5dbc
Instruction Fuzzy Hash: FBD012305107138FE7319F35D41855676E8AF45255F118D6DA8C9DA140D6B4C480C750

Uniqueness

Uniqueness Score: -1.00%

Function 00FF93F5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00FF9009,?,0100F910), ref: 00FF9403
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00FF9415

Strings

GetModuleHandleExW, xrefs: 00FF940F
kernel32.dll, xrefs: 00FF93FE

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: f6df9a306d71c481c44268e2c96fe2841c2d0e08e092a0ce7cef925cf0fbf234
Instruction ID: c20ba2e0c8b3b0915f6cbe29c6910a9520a50719703eaf74bcb294fb74fcb7fe
Opcode Fuzzy Hash: f6df9a306d71c481c44268e2c96fe2841c2d0e08e092a0ce7cef925cf0fbf234
Instruction Fuzzy Hash: 88D0C730A1871BCFD7328F32C90824272E8BF16361F00C83EA4C2CA510E6B4C8C0EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FC1B3E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00FC1B42
__swprintf.LIBCMT ref: 00FC1B73

Strings

%.3d, xrefs: 00FC1B4D
WIN_XPe, xrefs: 00FC1BB2

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 50f63737c76c0fba4812f86122a83aea51f52658d1a0268917fbabd194eb27be
Instruction ID: dc9e0b7acb516233ae39bc589fa4d1c83bdbfdf3d365c4264d32c8342bdac1b3
Opcode Fuzzy Hash: 50f63737c76c0fba4812f86122a83aea51f52658d1a0268917fbabd194eb27be
Instruction Fuzzy Hash: A9D012B380411AEBCB14AA908E46FF9737CB745301F100596B542D2001F2399FA4BF21

Uniqueness

Uniqueness Score: -1.00%

Function 00FD76C5 Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5888fae161206850356afb1822751d82fbb3033db3403a0b8aee3195f8ff796
Instruction ID: 1b1d5803f208e85ff4f23e003373c18c112e332d0bace293227aa0989835c98d
Opcode Fuzzy Hash: f5888fae161206850356afb1822751d82fbb3033db3403a0b8aee3195f8ff796
Instruction Fuzzy Hash: 98C16E75A04216EFCB14DF94C884AAEB7B6FF48710B19859AE805EF351E730ED41EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FFE33E Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00FFE3D2
CharLowerBuffW.USER32(?,?), ref: 00FFE415

Part of subcall function 00FFDAB9: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00FFDAD9

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00FFE615
_memmove.LIBCMT ref: 00FFE628

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 2509904fbcb0747e5dd016347b86404824d2d5c89239fd803b168da7d896028b
Instruction ID: 476a1a06fc452807dd671e3b14e4356a862de777e915926873fea9f9b3ffc78c
Opcode Fuzzy Hash: 2509904fbcb0747e5dd016347b86404824d2d5c89239fd803b168da7d896028b
Instruction Fuzzy Hash: 47C18C71A083058FC714DF28C88096ABBE4FF89714F18896DF999DB361D735E906DB82

Uniqueness

Uniqueness Score: -1.00%

Function 00FF83A8 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00FF83D8
CoUninitialize.OLE32 ref: 00FF83E3

Part of subcall function 00FDDA5D: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00FDDAC5

VariantInit.OLEAUT32(?), ref: 00FF83EE
VariantClear.OLEAUT32(?), ref: 00FF86BF

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 7971a6205f8429ccdf81e47543dde6bad469b6c5ef3e5625ef96553432261e9a
Instruction ID: 9b40777cef5e8e58f2cf7c6df755fd405dcc4e927aab1f43c17af4f719638266
Opcode Fuzzy Hash: 7971a6205f8429ccdf81e47543dde6bad469b6c5ef3e5625ef96553432261e9a
Instruction Fuzzy Hash: 45A16D756087059FCB10EF14C885B6AB7E4BF88364F08444DFA9A9B3A1CB74ED05EB41

Uniqueness

Uniqueness Score: -1.00%

Function 00FD7A78 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,01012C7C,?), ref: 00FD7C32
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,01012C7C,?), ref: 00FD7C4A
CLSIDFromProgID.OLE32(?,?,00000000,0100FB80,000000FF,?,00000000,00000800,00000000,?,01012C7C,?), ref: 00FD7C6F
_memcmp.LIBCMT ref: 00FD7C90

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 88624da2a813380e2757760e140ccedc438a8c9619720284a97cd7125c5840b8
Instruction ID: 465407f8ea7647e736218f7d72b1471e89f775c97849ba4cfc6405b2ef75f678
Opcode Fuzzy Hash: 88624da2a813380e2757760e140ccedc438a8c9619720284a97cd7125c5840b8
Instruction Fuzzy Hash: C4812E71A00209EFCB04DF94C984EEEB7BAFF89315F244199F505AB254DB71AE05DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00FD6DF3 Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00FD6E04
SysAllocString.OLEAUT32(00000000), ref: 00FD6EAD
VariantCopy.OLEAUT32 ref: 00FD6EDC
VariantClear.OLEAUT32(?), ref: 00FD6F03

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: d97042446b0e09f789bc3a504a766c6c1c84fd9e8da942cbd72a0901e048184c
Instruction ID: fbff10d11d614161f79afb299c74fd39475bbabc3e04a8ae13f3dd96abfb3e14
Opcode Fuzzy Hash: d97042446b0e09f789bc3a504a766c6c1c84fd9e8da942cbd72a0901e048184c
Instruction Fuzzy Hash: B251BB31A087019ADB30BF65D895B69B3E6AF44310F28881FE995CB3D1EB749840BB55

Uniqueness

Uniqueness Score: -1.00%

Function 00FE97E5 Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00F85045: _fseek.LIBCMT ref: 00F8505D

Part of subcall function 00FE99BE: _wcscmp.LIBCMT ref: 00FE9AAE
Part of subcall function 00FE99BE: _wcscmp.LIBCMT ref: 00FE9AC1

_free.LIBCMT ref: 00FE992C
_free.LIBCMT ref: 00FE9933
_free.LIBCMT ref: 00FE999E

Part of subcall function 00FA2F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00FA9C64), ref: 00FA2FA9
Part of subcall function 00FA2F95: GetLastError.KERNEL32(00000000,?,00FA9C64), ref: 00FA2FBB

_free.LIBCMT ref: 00FE99A6

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: d9ae0c5d453641694606f69828c3ed73b5fd5779769f00272cc49afe01aba135
Instruction ID: cfc9355f998b50afa5b66890ceeb0d63f67d9d0c06cdf8109e0a0cdb583e6c0f
Opcode Fuzzy Hash: d9ae0c5d453641694606f69828c3ed73b5fd5779769f00272cc49afe01aba135
Instruction Fuzzy Hash: B05150F1E04258AFDF249F65CC81A9EBBB9EF48310F1004AEB609A7241DB755E80DF58

Uniqueness

Uniqueness Score: -1.00%

Function 01009A63 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(014CDAC8,?), ref: 01009AD2
ScreenToClient.USER32(00000002,00000002), ref: 01009B05
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 01009B72

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: dbc3ef1320f211ef785efe98b898583916c7be401dd38cf0e4e9c8e60d2820a7
Instruction ID: 490aba998743c83c66f27a6b6bb74dc9883b3f9e4851b5e8c9d0db6c9d2f4129
Opcode Fuzzy Hash: dbc3ef1320f211ef785efe98b898583916c7be401dd38cf0e4e9c8e60d2820a7
Instruction Fuzzy Hash: 26519674900609EFEF22DF58D9809AE7BF5FF45324F108299F899972D2D731A981CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00FF6CBD Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00FF6CE4
WSAGetLastError.WSOCK32(00000000), ref: 00FF6CF4

Part of subcall function 00F89997: __itow.LIBCMT ref: 00F899C2
Part of subcall function 00F89997: __swprintf.LIBCMT ref: 00F89A0C

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00FF6D58
WSAGetLastError.WSOCK32(00000000), ref: 00FF6D64

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 0a2db9131ce44191283c1f788d1510f11a3e9b2b72f0c61f2cebf3c1a39a8cc2
Instruction ID: 26d8d9122faa6acffa760664e9fe0c7cee32df0c5a130987e343322e62006094
Opcode Fuzzy Hash: 0a2db9131ce44191283c1f788d1510f11a3e9b2b72f0c61f2cebf3c1a39a8cc2
Instruction Fuzzy Hash: 6C41A275740200AFEB20BF64DC87F7A77A5AF44B10F488018FA59DB2D2DAB99D01A791

Uniqueness

Uniqueness Score: -1.00%

Function 00FF672D Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,0100F910), ref: 00FF67BA
_strlen.LIBCMT ref: 00FF67EC

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: cc70d6973d2fcd747f252198e713db4cb72cd3f6138ac160ba94db480afccb4f
Instruction ID: 82d3c6bce48d32cbcd759cd6b3b089892ffa6ffb7984e24159fab5128ab78006
Opcode Fuzzy Hash: cc70d6973d2fcd747f252198e713db4cb72cd3f6138ac160ba94db480afccb4f
Instruction Fuzzy Hash: EA41BE31A00109ABCB14FB64DCC5FBEB3A9AF48750F148169F9169B2A2DF78AD00E750

Uniqueness

Uniqueness Score: -1.00%

Function 00FEBA5F Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00FEBB09
GetLastError.KERNEL32(?,00000000), ref: 00FEBB2F
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00FEBB54
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00FEBB80

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 1861580190182afc44b29e7a2acc2bccddaf7f2a967b95fc74d36c871f2381a6
Instruction ID: e4cbda78bf079be24c09c16912ecbc107820bd878c499e1d80ad2d8caba7968b
Opcode Fuzzy Hash: 1861580190182afc44b29e7a2acc2bccddaf7f2a967b95fc74d36c871f2381a6
Instruction Fuzzy Hash: B1413035604551DFCF21EF15C588A6DBBE1EF49320B198488EC4A9B362CB79FD01EB91

Uniqueness

Uniqueness Score: -1.00%

Function 01008AC0 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 01008B4D

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: f590a7e7b9dd68fd50b03c470c4fcd14bb8f754aa5db33b9b1924db3e6c7f1b6
Instruction ID: 164825695b040e5f45d6df1988804b13b647224b88c677d51b902ec051d97b80
Opcode Fuzzy Hash: f590a7e7b9dd68fd50b03c470c4fcd14bb8f754aa5db33b9b1924db3e6c7f1b6
Instruction Fuzzy Hash: B83190B4A04A04BFFB729A2CCC85BA93BA4FB06310F14C657FBD1D62D1DA35A5808751

Uniqueness

Uniqueness Score: -1.00%

Function 0100ADF1 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0100AE1A
GetWindowRect.USER32(?,?), ref: 0100AE90
PtInRect.USER32(?,?,0100C304), ref: 0100AEA0
MessageBeep.USER32(00000000), ref: 0100AF11

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: d1dd05bb342e88a2f347eb5ff3319369b96c3d8bbe564aa7ba9fb0c84c675a8a
Instruction ID: 4b1c2a69bcc9ab2ec088a11a4cc235a7269e22e894f42a13dd56ad940c5108ca
Opcode Fuzzy Hash: d1dd05bb342e88a2f347eb5ff3319369b96c3d8bbe564aa7ba9fb0c84c675a8a
Instruction Fuzzy Hash: D2418EB4700359DFEB23CF58C484BA97BF5FB49340F1481A9E9948B286D732A942CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00FE0FE6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00FE1037
SetKeyboardState.USER32(00000080,?,00000001), ref: 00FE1053
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00FE10B9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00FE110B

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 06b53111499c3791a8508cfd0605be0145e888834fc0d041f0c1e56cad785140
Instruction ID: 67e733367fb41d97708b55939e5bdcd45f549203267027e404730bad5fbcced2
Opcode Fuzzy Hash: 06b53111499c3791a8508cfd0605be0145e888834fc0d041f0c1e56cad785140
Instruction Fuzzy Hash: 77310531E446D8AEFB318A678C05BFABBA9BF45320F08431AE691521D1C37989C5B752

Uniqueness

Uniqueness Score: -1.00%

Function 00FE1121 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00FE1176
SetKeyboardState.USER32(00000080,?,00008000), ref: 00FE1192
PostMessageW.USER32(00000000,00000101,00000000), ref: 00FE11F1
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00FE1243

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 011530dd7f70cefb8cb2a0fda1570a362452fb2e7976c117a5aba9f7f591ee48
Instruction ID: 317f3b2ff5c54405d3272cbb21605d32e8d4250efee2a491d84ea3325b2d3b94
Opcode Fuzzy Hash: 011530dd7f70cefb8cb2a0fda1570a362452fb2e7976c117a5aba9f7f591ee48
Instruction Fuzzy Hash: 4F312830E4068C5AFF358A678C047FA7BAEBB49320F04431BE691921D1C37D4995F751

Uniqueness

Uniqueness Score: -1.00%

Function 00FB6415 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00FB644B
__isleadbyte_l.LIBCMT ref: 00FB6479
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00FB64A7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00FB64DD

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 6bc96badfb199e9edf6847bafb22bdd2c8d053f81b50f9805ec1684fb913bcb8
Instruction ID: 41186d767a3faa09a08dfa12e63b4ed11ca15c73891091090194a77bb4a2284d
Opcode Fuzzy Hash: 6bc96badfb199e9edf6847bafb22bdd2c8d053f81b50f9805ec1684fb913bcb8
Instruction Fuzzy Hash: 8231AA31A00A46EFDB26CF66C845BEA7BA9BF41320F154429F864C7191EB39D851EB90

Uniqueness

Uniqueness Score: -1.00%

Function 01005175 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 01005189

Part of subcall function 00FE387D: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00FE3897
Part of subcall function 00FE387D: GetCurrentThreadId.KERNEL32 ref: 00FE389E
Part of subcall function 00FE387D: AttachThreadInput.USER32(00000000,?,00FE52A7), ref: 00FE38A5

GetCaretPos.USER32(?), ref: 0100519A
ClientToScreen.USER32(00000000,?), ref: 010051D5
GetForegroundWindow.USER32 ref: 010051DB

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 79340acb4bb38b54b41ea84249ee1839effb89b2658c9a70a5d8bf2754491944
Instruction ID: a0ad6b2b8229b8d219508c0b93e660e70deb79c36df87ac360dc57dab92a9a13
Opcode Fuzzy Hash: 79340acb4bb38b54b41ea84249ee1839effb89b2658c9a70a5d8bf2754491944
Instruction Fuzzy Hash: 8F313071900108AFDB14EFB5CC859EFB7F9EF88300F14406AE456E7241EA799E05DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0100C788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F82612: GetWindowLongW.USER32(?,000000EB), ref: 00F82623

GetCursorPos.USER32(?), ref: 0100C7C2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00FBBBFB,?,?,?,?,?), ref: 0100C7D7
GetCursorPos.USER32(?), ref: 0100C824
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00FBBBFB,?,?,?), ref: 0100C85E

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: deac8fbf2f28cb5013d7e129e5a7b075ed10598462d395a331a087d132c5ed03
Instruction ID: 5c585daf47ccbf7f0ef4c93a6e6c18677af0665ebe5d5a46334b18c137c00664
Opcode Fuzzy Hash: deac8fbf2f28cb5013d7e129e5a7b075ed10598462d395a331a087d132c5ed03
Instruction Fuzzy Hash: F631A535500018AFFB26CF58C998EEA7FF5FB0A320F0442D9FA858B291D7365A50DB64

Uniqueness

Uniqueness Score: -1.00%

Function 00FA0BD0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00FA0BF2

Part of subcall function 00F85B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00FE7B20,?,?,00000000), ref: 00F85B8C
Part of subcall function 00F85B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00FE7B20,?,?,00000000,?,?), ref: 00F85BB0

_fprintf.LIBCMT ref: 00FA0C29
OutputDebugStringW.KERNEL32(?), ref: 00FD6331

Part of subcall function 00FA4CDA: _flsall.LIBCMT ref: 00FA4CF3

__setmode.LIBCMT ref: 00FA0C5E

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: b80332dfa19dba61da53ee412aa4fa7c8da7f845ef2c9a70fa440be8a1e68738
Instruction ID: 9469c0448925057d2239b6cae1b260504306fa0f28917fcc5b49af52952835af
Opcode Fuzzy Hash: b80332dfa19dba61da53ee412aa4fa7c8da7f845ef2c9a70fa440be8a1e68738
Instruction Fuzzy Hash: 011136B29042047FCB04B7B4AC879FE7B699F86330F14011AF20497282DFAD6D42B791

Uniqueness

Uniqueness Score: -1.00%

Function 00FD8B9E Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD8652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00FD8669
Part of subcall function 00FD8652: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00FD8673
Part of subcall function 00FD8652: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FD8682
Part of subcall function 00FD8652: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00FD8689
Part of subcall function 00FD8652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00FD869F

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00FD8BEB
_memcmp.LIBCMT ref: 00FD8C0E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00FD8C44
HeapFree.KERNEL32(00000000), ref: 00FD8C4B

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: c0955e5bc5d921209754af0dc6547a19dc33b444be0801ed672ce770b5e77262
Instruction ID: 34881afaa007c0fe44bbc2ea213ea1faba79b39489420ce1a7c637b7919c4951
Opcode Fuzzy Hash: c0955e5bc5d921209754af0dc6547a19dc33b444be0801ed672ce770b5e77262
Instruction Fuzzy Hash: 9421AE71E11209EFDB10DFA4C944BEEB7B9EF40390F08409AE454A7340EB35AE06EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00FF1A5B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00FF1A97

Part of subcall function 00FF1B21: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00FF1B40
Part of subcall function 00FF1B21: InternetCloseHandle.WININET(00000000), ref: 00FF1BDD

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: a00152de32c1a9df24ca91cc6ccb0a1a84630562dd6365b6055ea748182c745c
Instruction ID: e3b34bd3fac96a5f70da9872a0fbedc6a78866545cde01c0cf9494365a7c312e
Opcode Fuzzy Hash: a00152de32c1a9df24ca91cc6ccb0a1a84630562dd6365b6055ea748182c745c
Instruction Fuzzy Hash: A621CF32200609FFEB229F608C00FBAB7A9FF84710F10001AFB45D6660EB759811BBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00FDE1AF Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FDF5AD: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00FDE1C4,?,?,?,00FDEFB7,00000000,000000EF,00000119,?,?), ref: 00FDF5BC
Part of subcall function 00FDF5AD: lstrcpyW.KERNEL32(00000000,?), ref: 00FDF5E2
Part of subcall function 00FDF5AD: lstrcmpiW.KERNEL32(00000000,?,00FDE1C4,?,?,?,00FDEFB7,00000000,000000EF,00000119,?,?), ref: 00FDF613

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00FDEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00FDE1DD
lstrcpyW.KERNEL32(00000000,?), ref: 00FDE203
lstrcmpiW.KERNEL32(00000002,cdecl,?,00FDEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 00FDE237

Strings

cdecl, xrefs: 00FDE22E

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: b037a064858098d5f8140a0fa623bb605fe6e5cdbb94806737b81728f8e8ba7c
Instruction ID: e1853a453836eebc4edc94f9df8a079b187b3b25a86571207e76931e8e00a6a1
Opcode Fuzzy Hash: b037a064858098d5f8140a0fa623bb605fe6e5cdbb94806737b81728f8e8ba7c
Instruction Fuzzy Hash: D611D336500301EFCB25AF64DC45E7A77B9FF85360B48802BF816CB254EB759851E7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00FB5332 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00FB5351

Part of subcall function 00FA594C: __FF_MSGBANNER.LIBCMT ref: 00FA5963
Part of subcall function 00FA594C: __NMSG_WRITE.LIBCMT ref: 00FA596A
Part of subcall function 00FA594C: RtlAllocateHeap.NTDLL(014B0000,00000000,00000001,00000000,?,?,?,00FA1013,?), ref: 00FA598F

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 479a2c86cbdc29079a56d3dbf7468c4907393be378e36e5662ee4c1492e235f1
Instruction ID: 054f3711bc371803952dbb1a9ea1b1b7ebcefc25c61e4c43de044c53a8d8eeea
Opcode Fuzzy Hash: 479a2c86cbdc29079a56d3dbf7468c4907393be378e36e5662ee4c1492e235f1
Instruction Fuzzy Hash: 4A113AB2D04A06AFCB312F75AC4179D37D55F05BF0F284429F9449A281DFBD8941BB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F84531 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F84560

Part of subcall function 00F8410D: _memset.LIBCMT ref: 00F8418D
Part of subcall function 00F8410D: _wcscpy.LIBCMT ref: 00F841E1
Part of subcall function 00F8410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00F841F1

KillTimer.USER32(?,00000001,?,?), ref: 00F845B5
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00F845C4
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00FBD6CE

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: c752f7380336ed9b32d04b2a687cdde129291040abb41d19f204dd9862527bf9
Instruction ID: 8a167d1d725e6f2e008dd8357eacabcfdd12f9414d8d54490f0c3b6ef5c7fc31
Opcode Fuzzy Hash: c752f7380336ed9b32d04b2a687cdde129291040abb41d19f204dd9862527bf9
Instruction Fuzzy Hash: 85213A71904784AFEB339B24C845BEBBBEC9F01314F04009EE28D96145D7752A84AF42

Uniqueness

Uniqueness Score: -1.00%

Function 00FF667C Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00F85B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00FE7B20,?,?,00000000), ref: 00F85B8C
Part of subcall function 00F85B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00FE7B20,?,?,00000000,?,?), ref: 00F85BB0

gethostbyname.WSOCK32(?), ref: 00FF66AC
WSAGetLastError.WSOCK32(00000000), ref: 00FF66B7
_memmove.LIBCMT ref: 00FF66E4
inet_ntoa.WSOCK32(?), ref: 00FF66EF

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 8618f15b25cd72a772b1c1be2e1a19389c83aaa887a1801c0cea33155d8225f7
Instruction ID: ee6c3c40cbf2d3ee5f017011e8b795059f354b28abd62498f877a780e5e52851
Opcode Fuzzy Hash: 8618f15b25cd72a772b1c1be2e1a19389c83aaa887a1801c0cea33155d8225f7
Instruction Fuzzy Hash: 79116D36900509AFCB05FBA4DD86DEEB7B8BF44710B184065F502A7261EF39AF05EB61

Uniqueness

Uniqueness Score: -1.00%

Function 00FD9023 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00FD9043
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00FD9055
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00FD906B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00FD9086

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 92d74f3c659697a9c1300edee1f803a2f31530801cbf4412b3ad90898918b841
Instruction ID: 7fa2f0bef1c04b61b32dc07e6950e16f0cc3c21e068ff89df3857334287ac561
Opcode Fuzzy Hash: 92d74f3c659697a9c1300edee1f803a2f31530801cbf4412b3ad90898918b841
Instruction Fuzzy Hash: 96115E7A900218FFDB11DFA5CC84F9DBB75FB48310F204096E904B7250D6726E11EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F81290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00F82612: GetWindowLongW.USER32(?,000000EB), ref: 00F82623

DefDlgProcW.USER32(?,00000020,?), ref: 00F812D8
GetClientRect.USER32(?,?), ref: 00FBB84B
GetCursorPos.USER32(?), ref: 00FBB855
ScreenToClient.USER32(?,?), ref: 00FBB860

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 1b43a1a9c50f4094c3e8ab09cbea6b38c104967c6e630d6ce786ca9c91a30f7f
Instruction ID: a618137301a79122f794d8a45538f8cd91ba91fb9e9505a046b3865261ae2232
Opcode Fuzzy Hash: 1b43a1a9c50f4094c3e8ab09cbea6b38c104967c6e630d6ce786ca9c91a30f7f
Instruction Fuzzy Hash: BE114C35A0011AEFCB21EFA4D8859FE77BCFB05311F000556FA41E7141D735BA52ABA5

Uniqueness

Uniqueness Score: -1.00%

Function 00FE1652 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00FE01FD,?,00FE1250,?,00008000), ref: 00FE166F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00FE01FD,?,00FE1250,?,00008000), ref: 00FE1694
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00FE01FD,?,00FE1250,?,00008000), ref: 00FE169E
Sleep.KERNEL32(?,?,?,?,?,?,?,00FE01FD,?,00FE1250,?,00008000), ref: 00FE16D1

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: e421d4e5a7a2a75060a97e534b9135bf3accec9f3719c090191055e1c3a3b9f7
Instruction ID: 9ffabda0e95d744f63459923873fd8902b1591b5df98f20b57970ffcc1298bd9
Opcode Fuzzy Hash: e421d4e5a7a2a75060a97e534b9135bf3accec9f3719c090191055e1c3a3b9f7
Instruction Fuzzy Hash: 59117C31C0051DD7CF10AFA7D848AEEBB78FF0A711F044059E980B6240CB355560ABD6

Uniqueness

Uniqueness Score: -1.00%

Function 00FB7207 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00FB722B

Part of subcall function 00FB7912: __fltout2.LIBCMT ref: 00FB793B

__cftog_l.LIBCMT ref: 00FB7251
__cftoe_l.LIBCMT ref: 00FB7283

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 5e6e4a9f460d7ffc39560bf0a0bb50c1bd74bcdd5924254e0332c0e992becc76
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: E501403644824ABBCF126E85CC018EE3F62BF99351F598555FA1868031D237C9B1BF81

Uniqueness

Uniqueness Score: -1.00%

Function 0100B57F Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0100B59E
ScreenToClient.USER32(?,?), ref: 0100B5B6
ScreenToClient.USER32(?,?), ref: 0100B5DA
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0100B5F5

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: d3391d64f0d82ec806f3f31c171d08a3c79579ed12561f84f31342885b060c83
Instruction ID: 1e747bfc92c9febfb178c8c26fc3e839158c042f2237ec873bb727a979eee62e
Opcode Fuzzy Hash: d3391d64f0d82ec806f3f31c171d08a3c79579ed12561f84f31342885b060c83
Instruction Fuzzy Hash: 471166B9D0420AEFDB51DFA9C444AEEFBF9FB08310F104166E954E3210D735AA519F50

Uniqueness

Uniqueness Score: -1.00%

Function 0100B8EF Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0100B8FE
_memset.LIBCMT ref: 0100B90D
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,01047F20,01047F64), ref: 0100B93C
CloseHandle.KERNEL32 ref: 0100B94E

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 0cf67882a572c7d8e0978ee5d0818fbe2a62d46bc2110141285feb2e1e9fa74e
Instruction ID: 6ee3673c040609f4d71f20e37a5776971c163be76bf7c76487320f2d916c4469
Opcode Fuzzy Hash: 0cf67882a572c7d8e0978ee5d0818fbe2a62d46bc2110141285feb2e1e9fa74e
Instruction Fuzzy Hash: 5DF082F65403007BF2312B65AC85FBB7B9CEB09758F004460BF88D5286E77B490097A8

Uniqueness

Uniqueness Score: -1.00%

Function 00FE6E7C Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00FE6E88

Part of subcall function 00FE794E: _memset.LIBCMT ref: 00FE7983

_memmove.LIBCMT ref: 00FE6EAB
_memset.LIBCMT ref: 00FE6EB8
LeaveCriticalSection.KERNEL32(?), ref: 00FE6EC8

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 459415ff6dcf4a5484a9745be8aa7d7e17bc63f697611097308e3097797f3cd1
Instruction ID: ba620b4560f0994749f175a23188896e64898c912432b3044001517b94d3cff2
Opcode Fuzzy Hash: 459415ff6dcf4a5484a9745be8aa7d7e17bc63f697611097308e3097797f3cd1
Instruction Fuzzy Hash: 0BF05E7A200200ABCF116F55DC85A8ABB2AEF45360F04C051FE089E21BC73AE911EBB4

Uniqueness

Uniqueness Score: -1.00%

Function 0100C00C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00F812F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00F8134D
Part of subcall function 00F812F3: SelectObject.GDI32(?,00000000), ref: 00F8135C
Part of subcall function 00F812F3: BeginPath.GDI32(?), ref: 00F81373
Part of subcall function 00F812F3: SelectObject.GDI32(?,00000000), ref: 00F8139C

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0100C030
LineTo.GDI32(00000000,?,?), ref: 0100C03D
EndPath.GDI32(00000000), ref: 0100C04D
StrokePath.GDI32(00000000), ref: 0100C05B

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: b86d95a45dfc3ce6ad7331d86315fa64af6af625a483a84b3836a83d457e1b28
Instruction ID: b87dec685df4e7a28939e159f9a16c8d9678b3a36c60c04b4610315c0d55eac2
Opcode Fuzzy Hash: b86d95a45dfc3ce6ad7331d86315fa64af6af625a483a84b3836a83d457e1b28
Instruction Fuzzy Hash: F4F09A3100021ABBEB33AF54AC09FCA3F98AF06310F048240FA91210C187AA0161EB95

Uniqueness

Uniqueness Score: -1.00%

Function 00FDA37C Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00FDA399
GetWindowThreadProcessId.USER32(?,00000000), ref: 00FDA3AC
GetCurrentThreadId.KERNEL32 ref: 00FDA3B3
AttachThreadInput.USER32(00000000), ref: 00FDA3BA

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: be260b6609f8f4070e06366f6a7f7a6e40bd9bd058b5bf65e62a7324f0bca102
Instruction ID: 7234b66b4236296e00ebccbed803656ee1d9422eacb39e8908906fa8b33a3e06
Opcode Fuzzy Hash: be260b6609f8f4070e06366f6a7f7a6e40bd9bd058b5bf65e62a7324f0bca102
Instruction Fuzzy Hash: 87E03931545328BBDB315BA2DC0CEDB3F1DEF1A7A1F048015F548C4050CA76C540EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F82218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00F82231
SetTextColor.GDI32(?,000000FF), ref: 00F8223B
SetBkMode.GDI32(?,00000001), ref: 00F82250
GetStockObject.GDI32(00000005), ref: 00F82258
GetWindowDC.USER32(?,00000000), ref: 00FBC0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 00FBC0E0
GetPixel.GDI32(00000000,?,00000000), ref: 00FBC0F9
GetPixel.GDI32(00000000,00000000,?), ref: 00FBC112
GetPixel.GDI32(00000000,?,?), ref: 00FBC132
ReleaseDC.USER32(?,00000000), ref: 00FBC13D

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 41ed82c38fdc76ffdbe408543cb7c357bc213274e3296b8b0e1063e5648386ff
Instruction ID: ca7e4148254968f1cf7a0d133789f3dfcd644cf35a0a7716ccd5570195b87ca7
Opcode Fuzzy Hash: 41ed82c38fdc76ffdbe408543cb7c357bc213274e3296b8b0e1063e5648386ff
Instruction Fuzzy Hash: CFE06D32600245ABEB725F68F80D7D83B10EB06332F008366FBA9980E587764990EF51

Uniqueness

Uniqueness Score: -1.00%

Function 00FD8C5A Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00FD8C63
OpenThreadToken.ADVAPI32(00000000,?,?,?,00FD882E), ref: 00FD8C6A
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00FD882E), ref: 00FD8C77
OpenProcessToken.ADVAPI32(00000000,?,?,?,00FD882E), ref: 00FD8C7E

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: f78426746d70450c0e0df9446f0fc34a6070ac52630edcfc4013295363014b07
Instruction ID: 08d766e174245bca2674ea6c681734799f00fbcf6ed754787dc9703c69ade14e
Opcode Fuzzy Hash: f78426746d70450c0e0df9446f0fc34a6070ac52630edcfc4013295363014b07
Instruction Fuzzy Hash: 7BE08636A42212DBD7309FB06D0CB563BBCEF507E2F088818B2C5C9044DA398442EB71

Uniqueness

Uniqueness Score: -1.00%

Function 00FC2187 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00FC2187
GetDC.USER32(00000000), ref: 00FC2191
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00FC21B1
ReleaseDC.USER32(?), ref: 00FC21D2

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: d1652682411a0f7967ffed26e53caa9af4e016b7e898edcff05f5dfc0cdf465d
Instruction ID: abc7425c7d773e1a343061ff3adacfc45fb771b5a328072f2917921361f1bc3d
Opcode Fuzzy Hash: d1652682411a0f7967ffed26e53caa9af4e016b7e898edcff05f5dfc0cdf465d
Instruction Fuzzy Hash: 38E0E575800606EFDB62AFB0C808BAD7BB1EB4C350F108409F99A97210CB7D9141BF40

Uniqueness

Uniqueness Score: -1.00%

Function 00FC219B Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00FC219B
GetDC.USER32(00000000), ref: 00FC21A5
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00FC21B1
ReleaseDC.USER32(?), ref: 00FC21D2

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 3e3aa11aaca5481c2ce51b3176c7ac5a529f9adc6ba859a76ec36427531a3556
Instruction ID: aecbb1659536800bf52c2029073025d3862f3a4dd4e43df65acca79e00ce3c7f
Opcode Fuzzy Hash: 3e3aa11aaca5481c2ce51b3176c7ac5a529f9adc6ba859a76ec36427531a3556
Instruction Fuzzy Hash: 8CE012B5800606AFCB62AFB0C8086AD7BF1EB4C310F108009F99AA7210CB7E9141AF40

Uniqueness

Uniqueness Score: -1.00%

Function 00FDB7B6 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00FDB981

Strings

Container, xrefs: 00FDB8FE
AutoIt3GUI, xrefs: 00FDB8F9

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 897f3e52ac6f062730d6c3595c7e753cb8c4cb6c3cd29da104d0154caac31a9d
Instruction ID: 877f90f83babe9db73a0a1da4b9b8750a4695275fa21ff5acf834d571e415f52
Opcode Fuzzy Hash: 897f3e52ac6f062730d6c3595c7e753cb8c4cb6c3cd29da104d0154caac31a9d
Instruction Fuzzy Hash: CF914971600201DFDB24DF64C884B6AB7E9FF48710F29856EE94ACB391DB70E841DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00FEB217 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00F9FEC6: _wcscpy.LIBCMT ref: 00F9FEE9

Part of subcall function 00F89997: __itow.LIBCMT ref: 00F899C2
Part of subcall function 00F89997: __swprintf.LIBCMT ref: 00F89A0C

__wcsnicmp.LIBCMT ref: 00FEB298
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00FEB361

Strings

LPT, xrefs: 00FEB292

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: a24da4129232add066cc02b91e2086c5130bc41d2c668442e2b02a944265be57
Instruction ID: bd33d800a3157e5603fcb097da823a54171ce5c2063a35f4ea4ba25fd42e6841
Opcode Fuzzy Hash: a24da4129232add066cc02b91e2086c5130bc41d2c668442e2b02a944265be57
Instruction Fuzzy Hash: 1F61A276E00215EFCB14EF95C886EAEB7B4EF08310F15406AF546AB291DB74AE40EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F92AB7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00F92AC8
GlobalMemoryStatusEx.KERNEL32(?), ref: 00F92AE1

Strings

@, xrefs: 00F92AD5

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: ebd257ed64a84c0f0870686b00207c1d083ebcb9b2729c2a17da5918f0ab7bbb
Instruction ID: df7156ca162f46393de28f7eded1eb792f877d7b64d5539b67b71cb079bf157b
Opcode Fuzzy Hash: ebd257ed64a84c0f0870686b00207c1d083ebcb9b2729c2a17da5918f0ab7bbb
Instruction Fuzzy Hash: 7D5165724187449BD320BF60DC86BABBBF8FF84314F56884CF1DA81095DB798429DB26

Uniqueness

Uniqueness Score: -1.00%

Function 00FE99BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00F8506B: __fread_nolock.LIBCMT ref: 00F85089

_wcscmp.LIBCMT ref: 00FE9AAE
_wcscmp.LIBCMT ref: 00FE9AC1

Strings

FILE, xrefs: 00FE99FA

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 07ff3a0994246fd1dc56e248f9540b891d661b9d0e53e4e7fbf8747b885d4c94
Instruction ID: f5cfeb146572fe07bd1a6f47f16a9ebf0a3ed542622a42cadbf192cf7d459e6f
Opcode Fuzzy Hash: 07ff3a0994246fd1dc56e248f9540b891d661b9d0e53e4e7fbf8747b885d4c94
Instruction Fuzzy Hash: 2141D871A0464ABBDF20AAA5DC45FEFBBFDDF45B14F000069B900E7181D6B9AA0497B1

Uniqueness

Uniqueness Score: -1.00%

Function 00FF2882 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FF2892
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00FF28C8

Strings

|, xrefs: 00FF2899

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 1d03a004c211cb274166e213d74ca02c091a5f2891eb0148143faad9925f5380
Instruction ID: ad08420f349a5cba2ac9a7aa59432406795bebae63e4bfd26bc68f0e1b9be020
Opcode Fuzzy Hash: 1d03a004c211cb274166e213d74ca02c091a5f2891eb0148143faad9925f5380
Instruction Fuzzy Hash: 4C315D71801219AFCF11EFA0CC85EEEBFB9FF08350F104029F914A6165DB359A56EB60

Uniqueness

Uniqueness Score: -1.00%

Function 01006CD2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 01006D86
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 01006DC2

Strings

static, xrefs: 01006D22

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: e3e7170d77a89131836e5696be102c28e086b7672650383f320879c0593bc66b
Instruction ID: 8f3ff5fb939b1c1ab67d5cd3a5d7e6b0496b07c2bd8a071084e9189c39f1026e
Opcode Fuzzy Hash: e3e7170d77a89131836e5696be102c28e086b7672650383f320879c0593bc66b
Instruction Fuzzy Hash: E031A471500204AEEB12AF78CC80FFB77B9FF48724F10851AF995D7190DA36A891D760

Uniqueness

Uniqueness Score: -1.00%

Function 00FE2D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE2E00
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00FE2E3B

Strings

0, xrefs: 00FE2DF9

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 40b5580fd9b036142561cefc4bf590a6fdad04e16c1b77206583547fe14b71ed
Instruction ID: 280c27e6d9668a58c5c5740a401420b6019ceb7135c838c5f5858fab1f000bee
Opcode Fuzzy Hash: 40b5580fd9b036142561cefc4bf590a6fdad04e16c1b77206583547fe14b71ed
Instruction Fuzzy Hash: 5631F571A00355ABEB748F4ADC85BAEBBBDFF05360F144069E985961A0FB709940EB10

Uniqueness

Uniqueness Score: -1.00%

Function 01006943 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 010069D0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 010069DB

Strings

Combobox, xrefs: 0100699D

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: ac4461e94a5eeeadc349588e8c54c9c97e8ecdb35b61724e7806bf1d62473f68
Instruction ID: badfbb07f7bcde33d3e3062addc3b6a31e7f0172737a5511b2b5d9fefe827cdb
Opcode Fuzzy Hash: ac4461e94a5eeeadc349588e8c54c9c97e8ecdb35b61724e7806bf1d62473f68
Instruction Fuzzy Hash: A61193716002096FFF639E18CC80EEB37AFEB893A4F110125F998972D1D6769C6197A0

Uniqueness

Uniqueness Score: -1.00%

Function 01006E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00F81D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00F81D73
Part of subcall function 00F81D35: GetStockObject.GDI32(00000011), ref: 00F81D87
Part of subcall function 00F81D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00F81D91

GetWindowRect.USER32(00000000,?), ref: 01006EE0
GetSysColor.USER32(00000012), ref: 01006EFA

Strings

static, xrefs: 01006EBD

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: dc8933491efb70d77cfbae35d7ccfe07560c47c1a30430224139521daf509294
Instruction ID: 25d258f419ee7d9bc7b0abb6bb92e7ce7d5ca46278c2d03a115338b80c69f76d
Opcode Fuzzy Hash: dc8933491efb70d77cfbae35d7ccfe07560c47c1a30430224139521daf509294
Instruction Fuzzy Hash: 7E212C7251020AAFEB15DFA8CD45AFA7BF9FB09314F004619F995D3180E635E861DB50

Uniqueness

Uniqueness Score: -1.00%

Function 01006B8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 01006C11
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 01006C20

Strings

edit, xrefs: 01006BF5

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 98c521ccc79fc5d4cfca6d9ba1a54eedeefabd833ce444c2c622e8f76b5bfc4a
Instruction ID: 85bf99682e3136043bb59c93158e8c070bf7675c4dbcb0dc4ee6daa6681d6b66
Opcode Fuzzy Hash: 98c521ccc79fc5d4cfca6d9ba1a54eedeefabd833ce444c2c622e8f76b5bfc4a
Instruction Fuzzy Hash: AA11BFB1500208ABFB629E68DC41EFB37AAEB05378F104714F9A1971D0C777DCA19B60

Uniqueness

Uniqueness Score: -1.00%

Function 00FE2E9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FE2F11
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00FE2F30

Strings

0, xrefs: 00FE2F07

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: c1691accf92c51486e3c7853f762f46611017c23585d9395901ce56d899b3c41
Instruction ID: 92048f09aedf666ec3d39f09fbf9022792ade98883caa01359fff48e10f3bd39
Opcode Fuzzy Hash: c1691accf92c51486e3c7853f762f46611017c23585d9395901ce56d899b3c41
Instruction Fuzzy Hash: E811E672E012A4ABDB64DA59DC44BAD77BDEB02324F0400A5E844A72A0F7B1AD04E791

Uniqueness

Uniqueness Score: -1.00%

Function 00FF24CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00FF2520
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00FF2549

Strings

<local>, xrefs: 00FF2511

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 2b7694f9183171575817cb4d27db667a7e015fc1a9b606a69c93a47d2983398d
Instruction ID: 0edcc93d81a9a1d2fc8d1553daab3a89b7883b87f641f2fb032f25846c58dcf7
Opcode Fuzzy Hash: 2b7694f9183171575817cb4d27db667a7e015fc1a9b606a69c93a47d2983398d
Instruction Fuzzy Hash: 1E1106B150122ABADB24CF518C99FBBFF6CFF05761F14812AF64587014D2705941E6F0

Uniqueness

Uniqueness Score: -1.00%

Function 00FF80A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00FF830B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00FF80C8,?,00000000,?,?), ref: 00FF8322

inet_addr.WSOCK32(00000000), ref: 00FF80CB
htons.WSOCK32(00000000), ref: 00FF8108

Strings

255.255.255.255, xrefs: 00FF80E3

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: 30bcd9dbd5b4e4a49d9c970ecf3b29b2789894b03194bafb1c2bd8fc765736e4
Instruction ID: 2cc8b8be56accc46a8ccb745dbe56029222de0a82f6656681f0fc3008696c9c7
Opcode Fuzzy Hash: 30bcd9dbd5b4e4a49d9c970ecf3b29b2789894b03194bafb1c2bd8fc765736e4
Instruction Fuzzy Hash: 9011E135600209ABDB20AF64CC86FFDB768FF04760F108617EA11972A1DB76A802E795

Uniqueness

Uniqueness Score: -1.00%

Function 00FD92E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

Part of subcall function 00FDB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00FDB0E7

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00FD9355

Strings

ListBox, xrefs: 00FD931F
ComboBox, xrefs: 00FD92F4

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 7611531da9dcea6e16bb3409bf5314c825cb3db7e035cdfef90a4a947d01d30b
Instruction ID: 59ff8ca46a74baaccaa8e07d07735ccb687356b9d0f5bd121b4f7c9c67d116a6
Opcode Fuzzy Hash: 7611531da9dcea6e16bb3409bf5314c825cb3db7e035cdfef90a4a947d01d30b
Instruction Fuzzy Hash: 5101F171A05214ABCB08FFA1CC959FE73AEBF06720B18060AF972573C1DB799808A750

Uniqueness

Uniqueness Score: -1.00%

Function 00FD91DF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

Part of subcall function 00FDB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00FDB0E7

SendMessageW.USER32(?,00000180,00000000,?), ref: 00FD924D

Strings

ListBox, xrefs: 00FD9217
ComboBox, xrefs: 00FD91EC

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: f068b15055c735019943d79358e1a8df500ab31251ec52ed420b47240082e9d4
Instruction ID: e42b1cece10b56dbc7a65b454f4ea7c7110f93e541d643595dafc8d3fee8d377
Opcode Fuzzy Hash: f068b15055c735019943d79358e1a8df500ab31251ec52ed420b47240082e9d4
Instruction Fuzzy Hash: D001D871A4520477CB14FBE1CC96EFF73AD9F45700F18001A751267281DA599F08A3A1

Uniqueness

Uniqueness Score: -1.00%

Function 00FD9264 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F87F41: _memmove.LIBCMT ref: 00F87F82

Part of subcall function 00FDB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 00FDB0E7

SendMessageW.USER32(?,00000182,?,00000000), ref: 00FD92D0

Strings

ListBox, xrefs: 00FD929C
ComboBox, xrefs: 00FD9271

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 8e262291976091e3917d9b682c8e84d71931c454f7c5693c627dcb0bbab030ce
Instruction ID: 583cc4e3f0d3d8c8025943486a80a6ce25d3ae2c19679341b116d73377ef7be7
Opcode Fuzzy Hash: 8e262291976091e3917d9b682c8e84d71931c454f7c5693c627dcb0bbab030ce
Instruction Fuzzy Hash: 0C01F771A4520477CB04FAE1CC86EFF73AD9F00701F280116790263281DB699E08A3B1

Uniqueness

Uniqueness Score: -1.00%

Function 00FE51CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00FE51E8
_wcscmp.LIBCMT ref: 00FE51FA

Strings

#32770, xrefs: 00FE51F4

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 4ca9c6ee480b3b341965141350161efc9435c9699211bdc991831af63e1d8485
Instruction ID: eb5b78b2d771c7887ad87d7379903f50a54bc6a7ed7ca1d1642205c438320033
Opcode Fuzzy Hash: 4ca9c6ee480b3b341965141350161efc9435c9699211bdc991831af63e1d8485
Instruction Fuzzy Hash: 37E06173E0022D17D3309A9A9C45F97F7ACEB41731F00005BFD54D7000D664A94487D1

Uniqueness

Uniqueness Score: -1.00%

Function 00FD81BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00FD81CA

Part of subcall function 00FA3598: _doexit.LIBCMT ref: 00FA35A2

Strings

AutoIt, xrefs: 00FD81BE
Error allocating memory., xrefs: 00FD81C3

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 7d318d7fbaa8255a552768b53362b91c01e28dac1478dd6bec43458ee8438038
Instruction ID: 43946fa0bc13d588a4bd69868199731516b70cac49c93425d2f203a86b77ff45
Opcode Fuzzy Hash: 7d318d7fbaa8255a552768b53362b91c01e28dac1478dd6bec43458ee8438038
Instruction Fuzzy Hash: F8D05B3638531936D22532F97C07FC6794C4B05B55F044016BB48995C38EDA95D163D9

Uniqueness

Uniqueness Score: -1.00%

Function 00FBB511 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00FBB564: _memset.LIBCMT ref: 00FBB571

Part of subcall function 00FA0B84: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00FBB540,?,?,?,00F8100A), ref: 00FA0B89

IsDebuggerPresent.KERNEL32(?,?,?,00F8100A), ref: 00FBB544
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00F8100A), ref: 00FBB553

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00FBB54E

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 0a13a28aba6e8dcf01d8328c2c2aad43c96015a129e3ff825145ae9850fe6628
Instruction ID: 44b9c7e9017f01986ccc19572f5c0f1d5b0851fdde3edcd67767f71b5a66a254
Opcode Fuzzy Hash: 0a13a28aba6e8dcf01d8328c2c2aad43c96015a129e3ff825145ae9850fe6628
Instruction Fuzzy Hash: D2E092B46007118FD731DF69E9047827BE4AF00754F04892CE4C6C7245EBB9E408EF62

Uniqueness

Uniqueness Score: -1.00%

Function 01005BEB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 01005BF5
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 01005C08

Part of subcall function 00FE54E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00FE555E

Strings

Shell_TrayWnd, xrefs: 01005BEE

Memory Dump Source

Source File: 00000000.00000002.1646114945.0000000000F81000.00000020.00000001.01000000.00000003.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000000.00000002.1646095620.0000000000F80000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.000000000100F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646162651.0000000001035000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646206657.000000000103F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1646224446.0000000001048000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f80000_Ship Docs_ CI_BL_HBL_.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 0f1401ec9c6d0a8e241254b44a3fba8810bd1b793526ba850ae2b09069cb3082
Instruction ID: 0860280fe16c5efc663259d430d17270eaa1893fb1745d565cda6014bc6b91ec
Opcode Fuzzy Hash: 0f1401ec9c6d0a8e241254b44a3fba8810bd1b793526ba850ae2b09069cb3082
Instruction Fuzzy Hash: D8D0C931388312B7E779AB71AC1BF977A18AB54B51F000829B785AA1C4D9E95800D750

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Ship Docs_ CI_BL_HBL_.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\aut7C1F.tmp

C:\Users\user\AppData\Local\Temp\aut7C5F.tmp

C:\Users\user\AppData\Local\Temp\cerecloths

C:\Users\user\AppData\Local\Temp\nouses

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
Ship Docs_ CI_BL_HBL_.exe

Function 00F83B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Function 00F84AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00F84FE9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 00FE93DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 00F83015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Function 00F83041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 00F871EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00F83A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00F83633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 00F83778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Function 00EC2630 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 00F839E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 00EC2410 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 140
fileCOMMON

Function 00F8410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Function 00FA564D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre