Edit tour

Windows Analysis Report
rPurchaseOrder300610-PDF.exe

Overview

General Information

Sample name:	rPurchaseOrder300610-PDF.exe
Analysis ID:	1455405
MD5:	e76975d634d228179adc45cad8f2000d
SHA1:	9e5d85b6a9ce9c4ca3793c7f140e57e9ed024db3
SHA256:	308004785363cf352a7c339d778f301bd25686dc8463190a41f3a5f65eb6c1dc
Tags:	AgentTeslaexe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Contains functionality to log keystrokes (.Net Source)

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

rPurchaseOrder300610-PDF.exe (PID: 7268 cmdline: "C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe" MD5: E76975D634D228179ADC45CAD8F2000D)

RegSvcs.exe (PID: 7284 cmdline: "C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "srv.masternic.net", "Username": "technical2@petropardis.ir", "Password": "-H{2Szxi!%qb"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1737903972.0000000003630000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1737903972.0000000003630000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1737903972.0000000003630000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334c7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33539:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335c3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33655:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336bf:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33731:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337c7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33857:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
00000001.00000002.2983820925.000000000319E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.2983011276.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2983011276.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.2983820925.00000000031C9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000001.00000002.2983820925.0000000003151000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.2983820925.0000000003151000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: rPurchaseOrder300610-PDF.exe PID: 7268	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: rPurchaseOrder300610-PDF.exe PID: 7268	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 7284	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7284	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
1.2.RegSvcs.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334c7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33539:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335c3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33655:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336bf:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33731:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337c7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33857:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.rPurchaseOrder300610-PDF.exe.3630000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.rPurchaseOrder300610-PDF.exe.3630000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.rPurchaseOrder300610-PDF.exe.3630000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x334c7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x33539:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x335c3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x33655:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x336bf:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x33731:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x337c7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x33857:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.rPurchaseOrder300610-PDF.exe.3630000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.rPurchaseOrder300610-PDF.exe.3630000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.rPurchaseOrder300610-PDF.exe.3630000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x316c7:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x31739:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x317c3:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x31855:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x318bf:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x31931:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x319c7:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x31a57:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 4 entries

Sigma Signatures

System Summary

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 174.141.234.138, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 7284, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49731

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 1.2.RegSvcs.exe.400000.0.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "srv.masternic.net", "Username": "technical2@petropardis.ir", "Password": "-H{2Szxi!%qb"}

Multi AV Scanner detection for submitted file

Source: rPurchaseOrder300610-PDF.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.2% probability

Machine Learning detection for sample

Source: rPurchaseOrder300610-PDF.exe

Joe Sandbox ML: detected

Source: rPurchaseOrder300610-PDF.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: wntdll.pdbUGP source: rPurchaseOrder300610-PDF.exe, 00000000.00000003.1734448104.0000000003CB0000.00000004.00001000.00020000.00000000.sdmp, rPurchaseOrder300610-PDF.exe, 00000000.00000003.1734334049.0000000003B10000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: rPurchaseOrder300610-PDF.exe, 00000000.00000003.1734448104.0000000003CB0000.00000004.00001000.00020000.00000000.sdmp, rPurchaseOrder300610-PDF.exe, 00000000.00000003.1734334049.0000000003B10000.00000004.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_00844696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00844696
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_0084C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0084C9C7
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_0084C93C FindFirstFileW,FindClose,	0_2_0084C93C
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_0084F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0084F200
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_0084F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0084F35D
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_0084F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0084F65E
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_00843A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00843A2B
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_00843D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00843D4E
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_0084BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0084BF27

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 174.141.234.138:587

Source: Joe Sandbox View

ASN Name: ASN-GIGENETUS ASN-GIGENETUS

Source: global traffic

TCP traffic: 192.168.2.4:49731 -> 174.141.234.138:587

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_008525E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_008525E2

Source: global traffic

DNS traffic detected: DNS query: srv.masternic.net

Source: RegSvcs.exe, 00000001.00000002.2985758558.000000000641B000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2985758558.0000000006404000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2983820925.000000000319E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: RegSvcs.exe, 00000001.00000002.2985758558.000000000641B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: RegSvcs.exe, 00000001.00000002.2983450730.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2985758558.0000000006404000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2983820925.000000000319E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: RegSvcs.exe, 00000001.00000002.2983450730.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2985758558.0000000006404000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2983820925.000000000319E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/cPanelIncCertificationAuthority.crl0
Source: RegSvcs.exe, 00000001.00000002.2983450730.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2985758558.000000000641B000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2985758558.0000000006404000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2983820925.000000000319E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: RegSvcs.exe, 00000001.00000002.2983820925.000000000319E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://srv.masternic.net
Source: rPurchaseOrder300610-PDF.exe, 00000000.00000002.1737903972.0000000003630000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2983011276.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: RegSvcs.exe, 00000001.00000002.2983450730.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2985758558.0000000006404000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2983820925.000000000319E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.rPurchaseOrder300610-PDF.exe.3630000.1.raw.unpack, 7KG.cs

.Net Code: D3z

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_0085425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_0085425A

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_00854458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00854458

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

0_2_0085425A

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_00840219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00840219

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_0086CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_0086CDAC

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.rPurchaseOrder300610-PDF.exe.3630000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.rPurchaseOrder300610-PDF.exe.3630000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.1737903972.0000000003630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: This is a third-party compiled AutoIt script.	0_2_007E3B4C
Source: rPurchaseOrder300610-PDF.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: rPurchaseOrder300610-PDF.exe, 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_e938e5fb-4
Source: rPurchaseOrder300610-PDF.exe, 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_b7ae6bf8-b
Source: rPurchaseOrder300610-PDF.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_cc7687cc-5
Source: rPurchaseOrder300610-PDF.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_1badaef4-3

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: rPurchaseOrder300610-PDF.exe

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_008440B1: CreateFileW,_memset,DeviceIoControl,CloseHandle,

0_2_008440B1

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_00838858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00838858

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_0084545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_0084545F

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_007EE800	0_2_007EE800
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_0080DBB5	0_2_0080DBB5
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_007EE060	0_2_007EE060
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_0086804A	0_2_0086804A
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_007F4140	0_2_007F4140
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_00802405	0_2_00802405
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_00816522	0_2_00816522
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_00860665	0_2_00860665
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_0081267E	0_2_0081267E
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_007F6843	0_2_007F6843
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_0080283A	0_2_0080283A
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_008189DF	0_2_008189DF
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_00816A94	0_2_00816A94
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_00860AE2	0_2_00860AE2
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_007F8A0E	0_2_007F8A0E
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_0083EB07	0_2_0083EB07
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_00848B13	0_2_00848B13
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_0080CD61	0_2_0080CD61
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_00817006	0_2_00817006
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_007F710E	0_2_007F710E
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_007F3190	0_2_007F3190
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_007E1287	0_2_007E1287
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_008033C7	0_2_008033C7
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_0080F419	0_2_0080F419
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_008016C4	0_2_008016C4
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_007F5680	0_2_007F5680
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_008078D3	0_2_008078D3
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_007F58C0	0_2_007F58C0
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_00801BB8	0_2_00801BB8
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_00819D05	0_2_00819D05
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_007EFE40	0_2_007EFE40
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_00801FD0	0_2_00801FD0
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_0080BFE6	0_2_0080BFE6
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_03623600	0_2_03623600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02F59378	1_2_02F59378
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02F54A98	1_2_02F54A98
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02F59B38	1_2_02F59B38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02F53E80	1_2_02F53E80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02F5CFF0	1_2_02F5CFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_02F541C8	1_2_02F541C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_064F56D0	1_2_064F56D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_064F3F40	1_2_064F3F40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_064FBCE0	1_2_064FBCE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_064FDCF8	1_2_064FDCF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_064F9AD0	1_2_064F9AD0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_064F2AF0	1_2_064F2AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_064F8B88	1_2_064F8B88
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_064F0040	1_2_064F0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_064F4FF0	1_2_064F4FF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 1_2_064F3240	1_2_064F3240

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: String function: 00808B40 appears 42 times
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: String function: 007E7F41 appears 35 times
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: String function: 00800D27 appears 70 times

Source: rPurchaseOrder300610-PDF.exe, 00000000.00000003.1733699895.0000000003DDD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs rPurchaseOrder300610-PDF.exe
Source: rPurchaseOrder300610-PDF.exe, 00000000.00000003.1735044412.0000000003C33000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs rPurchaseOrder300610-PDF.exe
Source: rPurchaseOrder300610-PDF.exe, 00000000.00000002.1737903972.0000000003630000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename64110f8f-1c32-4e24-bcc3-81d4f8370edf.exe4 vs rPurchaseOrder300610-PDF.exe

Source: rPurchaseOrder300610-PDF.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.rPurchaseOrder300610-PDF.exe.3630000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.rPurchaseOrder300610-PDF.exe.3630000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.1737903972.0000000003630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 0.2.rPurchaseOrder300610-PDF.exe.3630000.1.raw.unpack, 1UT6pzc0M.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rPurchaseOrder300610-PDF.exe.3630000.1.raw.unpack, DnQOD3M.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rPurchaseOrder300610-PDF.exe.3630000.1.raw.unpack, 01seU.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.rPurchaseOrder300610-PDF.exe.3630000.1.raw.unpack, iUDwvr7Gz.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rPurchaseOrder300610-PDF.exe.3630000.1.raw.unpack, XUu2qKyuF6.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rPurchaseOrder300610-PDF.exe.3630000.1.raw.unpack, aZathEIgR.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.rPurchaseOrder300610-PDF.exe.3630000.1.raw.unpack, l50VLEll22.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.rPurchaseOrder300610-PDF.exe.3630000.1.raw.unpack, l50VLEll22.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/4@1/1

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_0084A2D5 GetLastError,FormatMessageW,

0_2_0084A2D5

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_00838713 AdjustTokenPrivileges,CloseHandle,		0_2_00838713
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_00838CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00838CC3

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_0084B59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_0084B59E

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_0085F121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_0085F121

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_008586D0 CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_008586D0

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_007E4FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_007E4FE9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

File created: C:\Users\user\AppData\Local\Temp\autCE2F.tmp

Jump to behavior

Source: rPurchaseOrder300610-PDF.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: rPurchaseOrder300610-PDF.exe

ReversingLabs: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe "C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe"
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe"
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe"	Jump to behavior

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: rPurchaseOrder300610-PDF.exe

Static file information: File size 1116160 > 1048576

Source: rPurchaseOrder300610-PDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: rPurchaseOrder300610-PDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: rPurchaseOrder300610-PDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: rPurchaseOrder300610-PDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: rPurchaseOrder300610-PDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: rPurchaseOrder300610-PDF.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: rPurchaseOrder300610-PDF.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: rPurchaseOrder300610-PDF.exe, 00000000.00000003.1734448104.0000000003CB0000.00000004.00001000.00020000.00000000.sdmp, rPurchaseOrder300610-PDF.exe, 00000000.00000003.1734334049.0000000003B10000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: rPurchaseOrder300610-PDF.exe, 00000000.00000003.1734448104.0000000003CB0000.00000004.00001000.00020000.00000000.sdmp, rPurchaseOrder300610-PDF.exe, 00000000.00000003.1734334049.0000000003B10000.00000004.00001000.00020000.00000000.sdmp

Source: rPurchaseOrder300610-PDF.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: rPurchaseOrder300610-PDF.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: rPurchaseOrder300610-PDF.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: rPurchaseOrder300610-PDF.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: rPurchaseOrder300610-PDF.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_0085C304 LoadLibraryA,GetProcAddress,

0_2_0085C304

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_007EC590 push eax; retn 007Eh	0_2_007EC599
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_00848719 push FFFFFF8Bh; iretd	0_2_0084871B
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_0080E94F push edi; ret	0_2_0080E951
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_0080EA68 push esi; ret	0_2_0080EA6A
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_00808B85 push ecx; ret	0_2_00808B98
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_0080EC43 push esi; ret	0_2_0080EC45
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_0080ED2C push edi; ret	0_2_0080ED2E

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_007E4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_007E4A35
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_008655FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_008655FD

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_008033C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_008033C7

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

API/Special instruction interceptor: Address: 3623224

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Window / User API: threadDelayed 4963

Jump to behavior

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-99302

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

API coverage: 4.7 %

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_00844696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00844696
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_0084C9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_0084C9C7
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_0084C93C FindFirstFileW,FindClose,	0_2_0084C93C
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_0084F200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0084F200
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_0084F35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_0084F35D
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_0084F65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0084F65E
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_00843A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00843A2B
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_00843D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00843D4E
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_0084BF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_0084BF27

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_007E4AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_007E4AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98890	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98218	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98109	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97889	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97550	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97422	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: RegSvcs.exe, 00000001.00000002.2985758558.0000000006404000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

API call chain: ExitProcess graph end node

graph_0-98122

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_008541FD BlockInput,

0_2_008541FD

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_007E3B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_007E3B4C

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_00815CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00815CCC

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_0085C304 LoadLibraryA,GetProcAddress,

0_2_0085C304

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_036234F0 mov eax, dword ptr fs:[00000030h]	0_2_036234F0
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_03623490 mov eax, dword ptr fs:[00000030h]	0_2_03623490
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_03621E70 mov eax, dword ptr fs:[00000030h]	0_2_03621E70

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_008381F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_008381F7

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_0080A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0080A395
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_0080A364 SetUnhandledExceptionFilter,		0_2_0080A364

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 1039008

Jump to behavior

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_00838C93 LogonUserW,

0_2_00838C93

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_007E3B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_007E3B4C

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_007E4A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_007E4A35

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_00844EC9 mouse_event,

0_2_00844EC9

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe"

Jump to behavior

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

0_2_008381F7

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_00844C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00844C03

Source: rPurchaseOrder300610-PDF.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: rPurchaseOrder300610-PDF.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_0080886B cpuid

0_2_0080886B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_008150D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_008150D7

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_00822230 GetUserNameW,

0_2_00822230

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_0081418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_0081418A

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe

Code function: 0_2_007E4AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_007E4AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rPurchaseOrder300610-PDF.exe.3630000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rPurchaseOrder300610-PDF.exe.3630000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1737903972.0000000003630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2983820925.000000000319E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2983011276.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2983820925.00000000031C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2983820925.0000000003151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rPurchaseOrder300610-PDF.exe PID: 7268, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7284, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\FTP Navigator\Ftplist.txt

Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: rPurchaseOrder300610-PDF.exe	Binary or memory string: WIN_81
Source: rPurchaseOrder300610-PDF.exe	Binary or memory string: WIN_XP
Source: rPurchaseOrder300610-PDF.exe	Binary or memory string: WIN_XPe
Source: rPurchaseOrder300610-PDF.exe	Binary or memory string: WIN_VISTA
Source: rPurchaseOrder300610-PDF.exe	Binary or memory string: WIN_7
Source: rPurchaseOrder300610-PDF.exe	Binary or memory string: WIN_8
Source: rPurchaseOrder300610-PDF.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rPurchaseOrder300610-PDF.exe.3630000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rPurchaseOrder300610-PDF.exe.3630000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1737903972.0000000003630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2983011276.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2983820925.0000000003151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rPurchaseOrder300610-PDF.exe PID: 7268, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7284, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 1.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rPurchaseOrder300610-PDF.exe.3630000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.rPurchaseOrder300610-PDF.exe.3630000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1737903972.0000000003630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2983820925.000000000319E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2983011276.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2983820925.00000000031C9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.2983820925.0000000003151000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rPurchaseOrder300610-PDF.exe PID: 7268, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7284, type: MEMORYSTR

Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_00856596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_00856596
Source: C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe	Code function: 0_2_00856A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00856A5A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	121 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	121 Input Capture	1 Account Discovery	Remote Desktop Protocol	2 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	1 Credentials in Registry	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	138 System Information Discovery	Distributed Component Object Model	121 Input Capture	1 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	241 Security Software Discovery	SSH	3 Clipboard Data	11 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Virtualization/Sandbox Evasion	Cached Domain Credentials	121 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
rPurchaseOrder300610-PDF.exe	39%	ReversingLabs	Win32.Trojan.AgentTesla
rPurchaseOrder300610-PDF.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://srv.masternic.net	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
srv.masternic.net	174.141.234.138	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://sectigo.com/CPS0	RegSvcs.exe, 00000001.00000002.2983450730.00000000014CD000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2985758558.0000000006404000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2983820925.000000000319E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	rPurchaseOrder300610-PDF.exe, 00000000.00000002.1737903972.0000000003630000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000001.00000002.2983011276.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://srv.masternic.net	RegSvcs.exe, 00000001.00000002.2983820925.000000000319E000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
174.141.234.138	srv.masternic.net	United States		32181	ASN-GIGENETUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1455405
Start date and time:	2024-06-11 19:46:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	rPurchaseOrder300610-PDF.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/4@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 58 Number of non-executed functions: 266
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: rPurchaseOrder300610-PDF.exe

Simulations

Behavior and APIs

Time	Type	Description
13:47:07	API Interceptor	26x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
174.141.234.138	INQ No.KP-20-00-PS-PI-INQ-0018-PDF.exe	Get hash	malicious	AgentTesla	Browse
174.141.234.138	DHL airwaybill # 84940660132-PDF.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
srv.masternic.net	INQ No.KP-20-00-PS-PI-INQ-0018-PDF.exe	Get hash	malicious	AgentTesla	Browse	174.141.234.138
srv.masternic.net	DHL airwaybill # 84940660132-PDF.exe	Get hash	malicious	AgentTesla	Browse	174.141.234.138

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-GIGENETUS	41XX8Kwk8K.elf	Get hash	malicious	Mirai	Browse	216.38.6.174
	INQ No.KP-20-00-PS-PI-INQ-0018-PDF.exe	Get hash	malicious	AgentTesla	Browse	174.141.234.138
	DHL airwaybill # 84940660132-PDF.exe	Get hash	malicious	AgentTesla	Browse	174.141.234.138
	863Oc9fFgF.elf	Get hash	malicious	Mirai	Browse	216.38.6.175
	VxrYNgC0xs.elf	Get hash	malicious	Mirai	Browse	216.38.6.170
	L31owFeEHg.elf	Get hash	malicious	Mirai	Browse	69.65.0.70
	G4nRIeXFFj.elf	Get hash	malicious	Mirai	Browse	216.38.6.143
	JoaD4Dp71E.elf	Get hash	malicious	Mirai	Browse	216.38.6.139
	UksgYUGMnj.elf	Get hash	malicious	Mirai	Browse	69.65.0.56
	DHz0sMSRlg.elf	Get hash	malicious	Mirai	Browse	216.38.6.154

Process:	C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe
File Type:	data
Category:	dropped
Size (bytes):	240128
Entropy (8bit):	6.597966061213347
Encrypted:	false
SSDEEP:	6144:tHCFxwPf3DviuqmZOK9hAhHxWWh4XMlcC:tHY2vDvitAOK9hkHxtacD
MD5:	E0C36B9F8F4768B9EE3394E91C307493
SHA1:	34C05B03D479062EDCEE71A69F226F9C1E6988D0
SHA-256:	F2A58FFEA81C06856CF1AAD6BFBB83A6C217548B2F672589D62BD1090841756A
SHA-512:	CE122DA5C81994123183066CF1CBCB8D10F1A858BC78E5893746801C7124E3FC5BFB7DEA4930F1784F83A05F080077D5D42EBA207590201A1B18609EF7CB8D43
Malicious:	false
Reputation:	low
Preview:	.b.R0SBXP7FK..8R.3SBXT7F.CO8RR3SBXT7FKCO8RR3SBXT7FKCO8RR3SBX.7FKMP.\R.Z.y.6..b.P;!.#073E'&c,Y<<\'b:1.4>-oQ<rw..x9X".mB5Xv3SBXT7F..O8.S0S?.qQFKCO8RR3.BZU<G@CO.QR3[BXT7FKM.;RR.SBX.4FKC.8Rr3SBZT7BKCO8RR3WBXT7FKCO8VR3QBXT7FKAOx.R3CBXD7FKC_8RB3SBXT7VKCO8RR3SBXT..HC.8RR3.AX.2FKCO8RR3SBXT7FKCO8R.0SNXT7FKCO8RR3SBXT7FKCO8RR3SBXT7FKCO8RR3SBXT7FKCO8RR3SBxT7NKCO8RR3SBXT?fKC.8RR3SBXT7FKm;]&3SBL.4FKcO8R.0SBZT7FKCO8RR3SBXT.FK#aJ! PSBX.2FKC.;RR5SBX.4FKCO8RR3SBXT7.KC.. 7_<!XT;FKCO.QR3QBXT.EKCO8RR3SBXT7F.COzRR3SBXT7FKCO8RR3..[T7FKC.8RR1SGX..DK..9RQ3SBYT7@KCO8RR3SBXT7FKCO8RR3SBXT7FKCO8RR3SBXT7FKCO8RR3SBE......../.Y _...,.L..A..;..8.^.4,.x.O....d:>..3.Mh...B...'.[G!U.....2YB].#.I.R....nc,.\|.M-.B..-p.:1b.j..t.....82....&..0-5zV6;/..3U201.5.JCO8R......";.b.Q<MvJ,a....@e...IFKC+8RRASBX57FK.O8R=3SB6T7F5CO8,R3S.XT7.KCO.RR3vBXTZFKCk8RRMSBX.JID...;!..BXT7F~....?........yI.,h1z..."...bW..\.#t....6.X..O.\@h..?ST7V@_P4JvM....QF\Q5AO@C.\...y...z...#.....:KCO8RR.SB.T7F..O.RR3.B.T..KCO..R.S.X..K

C:\Users\user\AppData\Local\Temp\autCE2F.tmp

Download File

Process:	C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe
File Type:	data
Category:	dropped
Size (bytes):	142714
Entropy (8bit):	7.931021827072133
Encrypted:	false
SSDEEP:	3072:png2JxubVV8xbi1Hgf9mC/773Iyvd1XzQEHF+a0IDH9j64MVCan:pGJVoiGR/773Bd1Xz5HAa0IpjEVb
MD5:	EC21EFB1CC5EE45BCEA491BBDB69D070
SHA1:	FF22430DFA285CE7D8C7129F8F1ADCD21A8C019B
SHA-256:	133832B10F9540F0A16570ED19003EC5A1E0F7C57AC32DD8D4DE5A14431ABC66
SHA-512:	CBE8A59B71FAC5C2DC5226836470658EE2DA04E6F651B21A5A26783485E68C854422B93A1D9E1309BCAFE1896B39192FAD7E3C671AAB7D883CC3C9C7CAF268BC
Malicious:	false
Reputation:	low
Preview:	EA06.....X.U).N.X.M....qR.L..J.........ni`..OP.4..0U......&.5.7P..br9..gE..r...y\..S...}-..g.+.r#x..$R.m.kX..'f7...#.9.N...@....V...=..O.TjS:...)...J...42.@.r.8.\..J.RoB.4.\.suj......>..L.t...i..T .\U.4;..R(p...'A.D.@._6.aS...}...e.7...v.f.........0.iL.h.0.s.0......R.v.T.AP...',x.!5..>.@._..."E..z..CX.N....D....(.....^.~=.....N3......Q)z;..Q.'+5I........3.......K......K8T..............K;.{.V...rr..$.}.....G.S..q.....[..j.^.O..L.4..#.Re[Z.....r...M..(^..j[p..6,....]"..f.18.Ec{ML.{..Kf....w/.E.3:..a1..w....g..d?...BE;.X....6.J.X}..f..@.Y..-.f...J.0....5.. .....@..n.P..X..A.[1O..u.`.r..hZ...h...Rh...Bw!.k.Dk.....O._...M....N2Yh....d....X...]rU...!P..m..V#..\|..@.Cb.....@..&...6....U.5r.5....8-r3..e.:x...z....<..I..h.@/8.T.]..S....'...i......mKgS..:...ZCY.O..9...E..%.:t..{...J<.I;.....W..(t...[Q.R.ze..0.T.S}m^.T..&..5.Yi......h.X....B...t..x.4.4.&..._S:....xM.....[Q........;..fu:5.=....tX.J.2..i..CkB..Py.N..fP.q....D...+..l..U..2....w..L6O

C:\Users\user\AppData\Local\Temp\autCE6E.tmp

Download File

Process:	C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe
File Type:	data
Category:	dropped
Size (bytes):	9816
Entropy (8bit):	7.608158950706453
Encrypted:	false
SSDEEP:	192:na0ZsqLUGeKtxWQa8atpLMknw1R9hFg1a6fYHWMMaC3t3fpIEICMOe8uq10ZOJOT:azqLFLtx3a88wknwdh6jYyaC3pRIENMr
MD5:	42CF15BA79D0F28AC2200CB13B961A98
SHA1:	04325141EC2B99F5BC998FB3897A0E830C45AFD9
SHA-256:	6B900D06E95F88562626E0AD072B795AAD835622883BE6C6CDA584A8E1A31062
SHA-512:	73B33D2788FEE9CD9149C914B7BEFD238F2B52A199703845EB90DCB35F56B403AFA174D407ABC6D4268FBD63DD8D30F9B1DC75823B94A321B87B847913B1EAA4
Malicious:	false
Reputation:	low
Preview:	EA06..pD.L&.J...7...sz%..5.M.s...i0.L&....g9..h...g8.Q&4Z5.c3...sY..E........2^&.Y..c.Ll.;..a2....Y..ob.M.@...a6.N'3I..ib....]........K........\|...o..b..`.....8.....9.X.30...,.....2.Z..k9..6.@.o.l..X......g.9...v0..X....N.,.I.........9..&....r.'.Y...c ....Aa.H.......F.3<..Y@.6...$.`....f@...x..j....Br.....Xf.0..l....n...Y&@5_..h....&.5_..p.U.., 5_....U..,.5_..`.U..f@5\..>3...M.^.a.Z..k6.z..o6......@.....3y..G../Z.M. .....jr....n.u....$.`./.o8...f.G_T.......>_.......zk5....i....3 ...................`.M..`... ...c...@..(.'.4.X.{>K...c.MlS@..X..._..p.....>K.#G.b..3\|v9..G.4.X.@8_..kc..i\|v9....c.h.,v..........7.Ml.K5...M..0;..8.Nf.0.L..6i..f..+..ff6)...6.N,....f...E...Y....3.I.....M.......vI.....0.....2p....<d....,vb........N@!+..'& ....,fo2..,.).......r.2.X...c3k$.ef.Y.!...Gf@....,f.9..,.. .#7.....c.0.....y..p.h.s.....,vf......t.L@...40.....f....N&3....4..@.6.-..p..S.-..2...S0.N.@.;5.`..9.M,`...k8.....c.P..Yf3.wx.....vl......@.E....N.y6....p.c3.%..4..b.!....F ....B5c.L.

C:\Users\user\AppData\Local\Temp\turbinate

Download File

Process:	C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe
File Type:	ASCII text, with very long lines (28740), with no line terminators
Category:	dropped
Size (bytes):	28740
Entropy (8bit):	3.5871394699332475
Encrypted:	false
SSDEEP:	768:WiTZ+2QoioGRk6ZklputwjpjBkCiw2RuJ3nXKUrvzjsNbA+IL26cz24vfF3if6gc:WiTZ+2QoioGRk6ZklputwjpjBkCiw2RJ
MD5:	FEDF5187FBFDE806DB839E324F115298
SHA1:	6697A650BDFC2C29823B998B6FDA25FCC98AFF77
SHA-256:	DBE6EE56A9C35A8CF29E9A366365E91B3C976075619A05191754BB002348FCCD
SHA-512:	E4B6351C6A76111FB343DB843DC6992068F1B769861AAEB1DA82B2A40C51F0EC8D1323063A2916CE04DAD142F99C18F9822885C64A80F3EBA84247E671A9C19D
Malicious:	false
Reputation:	low
Preview:	606DABF73C37DFE5B6388B40F071263955F8071380D1EFA13173545CE7671ACF380x558bec81eccc0200005657b86b00000066894584b96500000066894d86ba7200000066895588b86e0000006689458ab96500000066894d8cba6c0000006689558eb83300000066894590b93200000066894d92ba2e00000066895594b86400000066894596b96c00000066894d98ba6c0000006689559a33c06689459cb96e00000066898d44ffffffba7400000066899546ffffffb86400000066898548ffffffb96c00000066898d4affffffba6c0000006689954cffffffb82e0000006689854effffffb96400000066898d50ffffffba6c00000066899552ffffffb86c00000066898554ffffff33c966898d56ffffffba75000000668955d0b873000000668945d2b96500000066894dd4ba72000000668955d6b833000000668945d8b93200000066894ddaba2e000000668955dcb864000000668945deb96c00000066894de0ba6c000000668955e233c0668945e4b96100000066898d68ffffffba640000006689956affffffb8760000006689856cffffffb96100000066898d6effffffba7000000066899570ffffffb86900000066898572ffffffb93300000066898d74ffffffba3200000066899576ffffffb82e00000066898578ffffffb96400000066898d7affffffba6c000000668995

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.051729711184832
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	rPurchaseOrder300610-PDF.exe
File size:	1'116'160 bytes
MD5:	e76975d634d228179adc45cad8f2000d
SHA1:	9e5d85b6a9ce9c4ca3793c7f140e57e9ed024db3
SHA256:	308004785363cf352a7c339d778f301bd25686dc8463190a41f3a5f65eb6c1dc
SHA512:	f11c57d1c92d3ab7542bdc135982533cba6213835a2f0fa38bd3f589b5ce03239de37b1ca42c001dfb9d747e1aca587e14c0366d4467859dd53bec6d407c0d6d
SSDEEP:	24576:cAHnh+eWsN3skA4RV1Hom2KXMmHadZz5CA9RiAPRx5:7h+ZkldoPK8YadZz5CA9rPh
TLSH:	5635AD0273D1C036FFABA2739B6AB64156BC79254133852F13981DB9BC701B2267E763
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x42800a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66678AA2 [Mon Jun 10 23:22:10 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007F0EDCC07DCDh
jmp 00007F0EDCBFAB84h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F0EDCBFAD0Ah
cmp edi, eax
jc 00007F0EDCBFB06Eh
bt dword ptr [004C41FCh], 01h
jnc 00007F0EDCBFAD09h
rep movsb
jmp 00007F0EDCBFB01Ch
cmp ecx, 00000080h
jc 00007F0EDCBFAED4h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F0EDCBFAD10h
bt dword ptr [004BF324h], 01h
jc 00007F0EDCBFB1E0h
bt dword ptr [004C41FCh], 00000000h
jnc 00007F0EDCBFAEADh
test edi, 00000003h
jne 00007F0EDCBFAEBEh
test esi, 00000003h
jne 00007F0EDCBFAE9Dh
bt edi, 02h
jnc 00007F0EDCBFAD0Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F0EDCBFAD13h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F0EDCBFAD65h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbc0cc	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x461b4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10f000	0x7134	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4b50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dfdd	0x8e000	310e36668512d53489c005622bb1b4a9	False	0.5735602580325704	data	6.675248351711057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2fd8e	0x2fe00	748cf1ab2605ce1fd72d53d912abb68f	False	0.32828818537859006	data	5.763244005758284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbf000	0x8f74	0x5200	aae9601d920f07080bdfadf43dfeff12	False	0.1017530487804878	data	1.1963819235530628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc8000	0x461b4	0x46200	fdb05e31f667109b973be9eb66a0d7eb	False	0.9067130403297683	data	7.84390952909338	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x10f000	0x7134	0x7200	f04128ad0f87f42830e4a6cdbc38c719	False	0.7617530153508771	data	6.783955557128661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc85a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc86d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc87f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc8920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc8c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc8d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc9bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xca480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xca9e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xccf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xce038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xce4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xce4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcea84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcf110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcf5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcfb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xd01f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xd0660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xd07b8	0x3d44a	data			1.0003426922862357
RT_GROUP_ICON	0x10dc04	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x10dc7c	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x10dc90	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x10dca4	0x14	data	English	Great Britain	1.25
RT_VERSION	0x10dcb8	0x10c	data	English	Great Britain	0.5932835820895522
RT_MANIFEST	0x10ddc4	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 11, 2024 19:47:09.343044043 CEST	49731	587	192.168.2.4	174.141.234.138
Jun 11, 2024 19:47:09.347832918 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:09.347975016 CEST	49731	587	192.168.2.4	174.141.234.138
Jun 11, 2024 19:47:09.993120909 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:09.993395090 CEST	49731	587	192.168.2.4	174.141.234.138
Jun 11, 2024 19:47:09.998842001 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:10.140547037 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:10.140768051 CEST	49731	587	192.168.2.4	174.141.234.138
Jun 11, 2024 19:47:10.145677090 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:10.289242983 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:10.294877052 CEST	49731	587	192.168.2.4	174.141.234.138
Jun 11, 2024 19:47:10.299652100 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:10.586867094 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:10.586929083 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:10.586966038 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:10.587003946 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:10.587033033 CEST	49731	587	192.168.2.4	174.141.234.138
Jun 11, 2024 19:47:10.587034941 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:10.587070942 CEST	49731	587	192.168.2.4	174.141.234.138
Jun 11, 2024 19:47:10.587169886 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:10.587230921 CEST	49731	587	192.168.2.4	174.141.234.138
Jun 11, 2024 19:47:10.615997076 CEST	49731	587	192.168.2.4	174.141.234.138
Jun 11, 2024 19:47:10.621223927 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:10.761893988 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:10.773132086 CEST	49731	587	192.168.2.4	174.141.234.138
Jun 11, 2024 19:47:10.778145075 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:10.918577909 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:10.919946909 CEST	49731	587	192.168.2.4	174.141.234.138
Jun 11, 2024 19:47:10.924848080 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:11.066915035 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:11.067266941 CEST	49731	587	192.168.2.4	174.141.234.138
Jun 11, 2024 19:47:11.072158098 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:11.381289005 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:11.381786108 CEST	49731	587	192.168.2.4	174.141.234.138
Jun 11, 2024 19:47:11.387473106 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:11.528099060 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:11.528470039 CEST	49731	587	192.168.2.4	174.141.234.138
Jun 11, 2024 19:47:11.533431053 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:11.756761074 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:11.757164001 CEST	49731	587	192.168.2.4	174.141.234.138
Jun 11, 2024 19:47:11.762200117 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:11.902322054 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:11.903738976 CEST	49731	587	192.168.2.4	174.141.234.138
Jun 11, 2024 19:47:11.903774977 CEST	49731	587	192.168.2.4	174.141.234.138
Jun 11, 2024 19:47:11.903827906 CEST	49731	587	192.168.2.4	174.141.234.138
Jun 11, 2024 19:47:11.903827906 CEST	49731	587	192.168.2.4	174.141.234.138
Jun 11, 2024 19:47:11.909957886 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:11.910007954 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:11.910032034 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:11.910054922 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:12.062854052 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:47:12.117336988 CEST	49731	587	192.168.2.4	174.141.234.138
Jun 11, 2024 19:48:49.252794027 CEST	49731	587	192.168.2.4	174.141.234.138
Jun 11, 2024 19:48:49.257730007 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:48:49.399524927 CEST	587	49731	174.141.234.138	192.168.2.4
Jun 11, 2024 19:48:49.405812025 CEST	49731	587	192.168.2.4	174.141.234.138

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 11, 2024 19:47:09.225862026 CEST	63845	53	192.168.2.4	1.1.1.1
Jun 11, 2024 19:47:09.336755991 CEST	53	63845	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 11, 2024 19:47:09.225862026 CEST	192.168.2.4	1.1.1.1	0xad96	Standard query (0)	srv.masternic.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 11, 2024 19:47:09.336755991 CEST	1.1.1.1	192.168.2.4	0xad96	No error (0)	srv.masternic.net		174.141.234.138	A (IP address)	IN (0x0001)	false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jun 11, 2024 19:47:09.993120909 CEST	587	49731	174.141.234.138	192.168.2.4	220-srv.masternic.net ESMTP Exim 4.96.2 #2 Tue, 11 Jun 2024 21:17:09 +0330 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Jun 11, 2024 19:47:09.993395090 CEST	49731	587	192.168.2.4	174.141.234.138	EHLO 936905
Jun 11, 2024 19:47:10.140547037 CEST	587	49731	174.141.234.138	192.168.2.4	250-srv.masternic.net Hello 936905 [173.254.250.91] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-PIPECONNECT 250-STARTTLS 250 HELP
Jun 11, 2024 19:47:10.140768051 CEST	49731	587	192.168.2.4	174.141.234.138	STARTTLS
Jun 11, 2024 19:47:10.289242983 CEST	587	49731	174.141.234.138	192.168.2.4	220 TLS go ahead

Target ID:	0
Start time:	13:47:05
Start date:	11/06/2024
Path:	C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe"
Imagebase:	0x7e0000
File size:	1'116'160 bytes
MD5 hash:	E76975D634D228179ADC45CAD8F2000D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1737903972.0000000003630000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1737903972.0000000003630000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000000.00000002.1737903972.0000000003630000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	13:47:06
Start date:	11/06/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\rPurchaseOrder300610-PDF.exe"
Imagebase:	0xe30000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.2983820925.000000000319E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2983011276.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.2983011276.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.2983820925.00000000031C9000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.2983820925.0000000003151000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000001.00000002.2983820925.0000000003151000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	6%
Total number of Nodes:	2000
Total number of Limit Nodes:	168

Executed Functions

Function 007E3B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 007E3B7A
IsDebuggerPresent.KERNEL32 ref: 007E3B8C
GetFullPathNameW.KERNEL32(00007FFF,?,?,008A62F8,008A62E0,?,?), ref: 007E3BFD

Part of subcall function 007E7D2C: _memmove.LIBCMT ref: 007E7D66

Part of subcall function 007F0A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,007E3C26,008A62F8,?,?,?), ref: 007F0ACE

SetCurrentDirectoryW.KERNEL32(?), ref: 007E3C81
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,008993F0,00000010), ref: 0081D4BC
SetCurrentDirectoryW.KERNEL32(?,008A62F8,?,?,?), ref: 0081D4F4
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00895D40,008A62F8,?,?,?), ref: 0081D57A
ShellExecuteW.SHELL32(00000000,?,?), ref: 0081D581

Part of subcall function 007E3A58: GetSysColorBrush.USER32(0000000F), ref: 007E3A62
Part of subcall function 007E3A58: LoadCursorW.USER32(00000000,00007F00), ref: 007E3A71
Part of subcall function 007E3A58: LoadIconW.USER32(00000063), ref: 007E3A88
Part of subcall function 007E3A58: LoadIconW.USER32(000000A4), ref: 007E3A9A
Part of subcall function 007E3A58: LoadIconW.USER32(000000A2), ref: 007E3AAC
Part of subcall function 007E3A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 007E3AD2
Part of subcall function 007E3A58: RegisterClassExW.USER32(?), ref: 007E3B28

Part of subcall function 007E39E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 007E3A15
Part of subcall function 007E39E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 007E3A36
Part of subcall function 007E39E7: ShowWindow.USER32(00000000,?,?), ref: 007E3A4A
Part of subcall function 007E39E7: ShowWindow.USER32(00000000,?,?), ref: 007E3A53

Part of subcall function 007E43DB: _memset.LIBCMT ref: 007E4401
Part of subcall function 007E43DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 007E44A6

Strings

This is a third-party compiled AutoIt script., xrefs: 0081D4B4
runas, xrefs: 0081D575

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: ff5174126869d02cab68ab12ae5310cba02bfc8d8ecaa983f1c57f1b6bbea14f
Instruction ID: ff1d7d664ff4923aea9e9437835fa3da7d2c619821abc698b0746ca5de31c721
Opcode Fuzzy Hash: ff5174126869d02cab68ab12ae5310cba02bfc8d8ecaa983f1c57f1b6bbea14f
Instruction Fuzzy Hash: 265107319052C8EADF11ABB5DC09BFD7B79FF09300F184165F561A32A2EA788655CB21

Function 007E4FE9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,007E4EEE,?,?,00000000,00000000), ref: 007E4FF9
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,007E4EEE,?,?,00000000,00000000), ref: 007E5010
LoadResource.KERNEL32(?,00000000,?,?,007E4EEE,?,?,00000000,00000000,?,?,?,?,?,?,007E4F8F), ref: 0081DD60
SizeofResource.KERNEL32(?,00000000,?,?,007E4EEE,?,?,00000000,00000000,?,?,?,?,?,?,007E4F8F), ref: 0081DD75
LockResource.KERNEL32(N~,?,?,007E4EEE,?,?,00000000,00000000,?,?,?,?,?,?,007E4F8F,00000000), ref: 0081DD88

Strings

SCRIPT, xrefs: 007E5006
N~, xrefs: 0081DD85

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT$N~
API String ID: 3051347437-1436546599
Opcode ID: 8c5344868b6a182b36ea940c357df5c38e75de53e94aca4e3add81d6dfe6448c
Instruction ID: a72f7478beeb12aff7fe998a0ee3c06e42c9c3d5967d55862e4dac4e1c73f664
Opcode Fuzzy Hash: 8c5344868b6a182b36ea940c357df5c38e75de53e94aca4e3add81d6dfe6448c
Instruction Fuzzy Hash: A9115A75201704AFD7218B66EC58F677BB9FBC9B15F214168F506C6261DBA1E8008A60

Function 007E4AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 007E4B2B

Part of subcall function 007E7D2C: _memmove.LIBCMT ref: 007E7D66

GetCurrentProcess.KERNEL32(?,0086FAEC,00000000,00000000,?), ref: 007E4BF8
IsWow64Process.KERNEL32(00000000), ref: 007E4BFF
GetNativeSystemInfo.KERNELBASE(00000000), ref: 007E4C45
FreeLibrary.KERNEL32(00000000), ref: 007E4C50
GetSystemInfo.KERNEL32(00000000), ref: 007E4C81
GetSystemInfo.KERNEL32(00000000), ref: 007E4C8D

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 55c22b774eec66fde60b809236fc95604808d0b5a53b30820078d99c20e6a639
Instruction ID: 1b200084166dc185dcd7a33295b447d164c4fbe689b411971541b4b4fdcf65c3
Opcode Fuzzy Hash: 55c22b774eec66fde60b809236fc95604808d0b5a53b30820078d99c20e6a639
Instruction Fuzzy Hash: 6291C37154B7C0DEC731CB6994552AABFE4BF2A300B584D9DD0CB83B02D228F948D769

Function 00844696 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,0081E7C1), ref: 008446A6
FindFirstFileW.KERNELBASE(?,?), ref: 008446B7
FindClose.KERNEL32(00000000), ref: 008446C7

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 462aec309ead0072c7228684da09782212c5722a59d6d926044b134f4288cf50
Instruction ID: 66a35691f37ca78d9091d82ba3777666b9a581aaf20e27960753357bcb5fabb7
Opcode Fuzzy Hash: 462aec309ead0072c7228684da09782212c5722a59d6d926044b134f4288cf50
Instruction Fuzzy Hash: 4FE0D8314144045B52106738FC4D4EA775CFE16335F111716F935C12E0E7F099508995

Function 007EE800 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 0082428C

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: 50c9c187daf3a8d2c9fc11d6d24b9d3c949e292d05e1408b5233411c79300425
Instruction ID: 122edb8762fc2b28f1e925c1a5a2ce030282fc12b05923b1cde2b7aea75e6518
Opcode Fuzzy Hash: 50c9c187daf3a8d2c9fc11d6d24b9d3c949e292d05e1408b5233411c79300425
Instruction Fuzzy Hash: 91A2B174A05259CFDB24CF59C880AADB7B1FF5C310F248469E906AB351D739ED82CB91

Function 007F0B30 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 007F0BBB
timeGetTime.WINMM ref: 007F0E76
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 007F0FB3
TranslateMessage.USER32(?), ref: 007F0FC7
DispatchMessageW.USER32(?), ref: 007F0FD5
Sleep.KERNEL32(0000000A), ref: 007F0FDF
LockWindowUpdate.USER32(00000000,?,?), ref: 007F105A
DestroyWindow.USER32 ref: 007F1066
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 007F1080
Sleep.KERNEL32(0000000A,?,?), ref: 008252AD
TranslateMessage.USER32(?), ref: 0082608A
DispatchMessageW.USER32(?), ref: 00826098
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 008260AC

Strings

@GUI_CTRLHANDLE, xrefs: 0082540E
@COM_EVENTOBJ, xrefs: 0082591A
@TRAY_ID, xrefs: 00825BB9
@GUI_WINHANDLE, xrefs: 008253B9
@GUI_CTRLID, xrefs: 00825364

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Message$DispatchPeekSleepTranslateWindow$DestroyLockTimeUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4003667617-3242690629
Opcode ID: 174535b8344f4903343388d6f35aa34e6c69987cd28c796a9daf1004aedd3de6
Instruction ID: 8ff87fc064a69519289302a76a22ad8a8f0c96451801796038f6475e7eb946e7
Opcode Fuzzy Hash: 174535b8344f4903343388d6f35aa34e6c69987cd28c796a9daf1004aedd3de6
Instruction Fuzzy Hash: 18B2AD70608755DFD724DB24D884BAABBE5FF84304F14492DE58AC73A2DB75E884CB82

Function 008493DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008491E9: __time64.LIBCMT ref: 008491F3

Part of subcall function 007E5045: _fseek.LIBCMT ref: 007E505D

__wsplitpath.LIBCMT ref: 008494BE

Part of subcall function 0080432E: __wsplitpath_helper.LIBCMT ref: 0080436E

_wcscpy.LIBCMT ref: 008494D1
_wcscat.LIBCMT ref: 008494E4
__wsplitpath.LIBCMT ref: 00849509
_wcscat.LIBCMT ref: 0084951F
_wcscat.LIBCMT ref: 00849532

Part of subcall function 0084922F: _memmove.LIBCMT ref: 00849268
Part of subcall function 0084922F: _memmove.LIBCMT ref: 00849277

_wcscmp.LIBCMT ref: 00849479

Part of subcall function 008499BE: _wcscmp.LIBCMT ref: 00849AAE
Part of subcall function 008499BE: _wcscmp.LIBCMT ref: 00849AC1

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 008496DC
_wcsncpy.LIBCMT ref: 0084974F
DeleteFileW.KERNEL32(?,?), ref: 00849785
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 0084979B
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 008497AC
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 008497BE

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: a306bc047955e4b881a731ed56a3fcb9c1fd239c9912efc769b7f2a2277d362c
Instruction ID: 2c9daf8599f77cb06c417dbefb70624c333d2e3f6f7c1c239d2e5c95bfa4a094
Opcode Fuzzy Hash: a306bc047955e4b881a731ed56a3fcb9c1fd239c9912efc769b7f2a2277d362c
Instruction Fuzzy Hash: 1CC13BB1A0022DAACF21DFA5CC85ADFB7BDFF59314F0040AAF609E6151DB709A448F65

Function 007E3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 007E3074
RegisterClassExW.USER32(00000030), ref: 007E309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 007E30AF
InitCommonControlsEx.COMCTL32(?), ref: 007E30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 007E30DC
LoadIconW.USER32(000000A9), ref: 007E30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 007E3101

Strings

+, xrefs: 007E305D
TaskbarCreated, xrefs: 007E30A4
AutoIt v3 GUI, xrefs: 007E3090
0, xrefs: 007E3056

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 2c29645d203a6b07fddd9750406245ca6b8318bcb450dd936aaa10fae396b79f
Instruction ID: b2217b18b567d62002eab3e0007f880d6f868bfc1863ff9ef2294bcc6e4574c3
Opcode Fuzzy Hash: 2c29645d203a6b07fddd9750406245ca6b8318bcb450dd936aaa10fae396b79f
Instruction Fuzzy Hash: 3A3158B1800349AFEB00CFA4E889AC9BBF4FB09310F15452AE690E62A1E3B94551CF51

Function 007E3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 007E3074
RegisterClassExW.USER32(00000030), ref: 007E309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 007E30AF
InitCommonControlsEx.COMCTL32(?), ref: 007E30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 007E30DC
LoadIconW.USER32(000000A9), ref: 007E30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 007E3101

Strings

+, xrefs: 007E305D
TaskbarCreated, xrefs: 007E30A4
AutoIt v3 GUI, xrefs: 007E3090
0, xrefs: 007E3056

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 285ad891e123499ab5a3ffc377714119544e012e3f1f4921593682d1d64025e1
Instruction ID: d521ed862a7427358d73235cbcc504d15078532f2792b455809003284619adba
Opcode Fuzzy Hash: 285ad891e123499ab5a3ffc377714119544e012e3f1f4921593682d1d64025e1
Instruction Fuzzy Hash: 7721F7B1901218AFEB00DFA4EC49B9DBBF8FB09700F05512AF610E62A1E7B98554CF91

Function 007E71EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007E4864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,008A62F8,?,007E37C0,?), ref: 007E4882

Part of subcall function 0080074F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,007E72C5), ref: 00800771

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 007E7308
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0081ECF1
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0081ED32
RegCloseKey.ADVAPI32(?), ref: 0081ED70
_wcscat.LIBCMT ref: 0081EDC9

Strings

Include, xrefs: 0081ECE8, 0081ED29
\Include\, xrefs: 007E72C5
\, xrefs: 0081EDEC
Software\AutoIt v3\AutoIt, xrefs: 007E72FE

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 9c02e61f4d03bab508227911e92089c40dc08f3015a20a140c1ecbb7c90ba9af
Instruction ID: 89922bcbf56d55104dbb1e62094f961652fe09c9dffe0ec593792b282221d3d5
Opcode Fuzzy Hash: 9c02e61f4d03bab508227911e92089c40dc08f3015a20a140c1ecbb7c90ba9af
Instruction Fuzzy Hash: 8B71AF7110D3419ED314EF6AEC85A9BBBE8FF89310F40452EF546C72A1EB709948DB52

Function 007E3A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 007E3A62
LoadCursorW.USER32(00000000,00007F00), ref: 007E3A71
LoadIconW.USER32(00000063), ref: 007E3A88
LoadIconW.USER32(000000A4), ref: 007E3A9A
LoadIconW.USER32(000000A2), ref: 007E3AAC
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 007E3AD2
RegisterClassExW.USER32(?), ref: 007E3B28

Part of subcall function 007E3041: GetSysColorBrush.USER32(0000000F), ref: 007E3074
Part of subcall function 007E3041: RegisterClassExW.USER32(00000030), ref: 007E309E
Part of subcall function 007E3041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 007E30AF
Part of subcall function 007E3041: InitCommonControlsEx.COMCTL32(?), ref: 007E30CC
Part of subcall function 007E3041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 007E30DC
Part of subcall function 007E3041: LoadIconW.USER32(000000A9), ref: 007E30F2
Part of subcall function 007E3041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 007E3101

Strings

#, xrefs: 007E3B0D
AutoIt v3, xrefs: 007E3B17
0, xrefs: 007E3B06

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: d21cc752d1b4fecdecba448b004ba5e1f5ae68130a55374d772ccd1e3595006a
Instruction ID: f29552923ee382182939c0a5aa2e235d1776f95b745e441874cde6bcbdcebbcb
Opcode Fuzzy Hash: d21cc752d1b4fecdecba448b004ba5e1f5ae68130a55374d772ccd1e3595006a
Instruction Fuzzy Hash: E1215C71D01308AFEB109FA5EC09B9D7FF5FB09711F04412AF604A66A1E3BA56649F84

Function 007E3633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 007E36D2
KillTimer.USER32(?,00000001), ref: 007E36FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 007E371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 007E372A
CreatePopupMenu.USER32 ref: 007E373E
PostQuitMessage.USER32(00000000), ref: 007E375F

Strings

TaskbarCreated, xrefs: 007E3725

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 5a03f643c7b0f46df78a1eb162552277a8ea94c4b645da20995cc5870022f005
Instruction ID: 487a97be099afd762265219bd840ff15fb34c2b44601b43c53964d102312a009
Opcode Fuzzy Hash: 5a03f643c7b0f46df78a1eb162552277a8ea94c4b645da20995cc5870022f005
Instruction Fuzzy Hash: 9D4129B22061C5FBEF105F75EC4DB793759FB09300F180129F612C76A6EAAD9E609361

Function 007E3778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/AutoIt3ExecuteLine, xrefs: 007E38B9
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 007E37C0
/ErrorStdOut, xrefs: 007E388F
CMDLINE, xrefs: 007E3834
/AutoIt3ExecuteScript, xrefs: 007E38CE
/AutoIt3OutputDebug, xrefs: 007E38A4
CMDLINERAW, xrefs: 007E380D

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-3513169116
Opcode ID: c7aa245efaf8652cff8967a7de4ab9c8f38c155d77780ee33bf927d750d18e8b
Instruction ID: 5e39f4e0f5ef9c80f21285e44a18ba1b650f71a6e2c812cdf7dd1302efd56aea
Opcode Fuzzy Hash: c7aa245efaf8652cff8967a7de4ab9c8f38c155d77780ee33bf927d750d18e8b
Instruction Fuzzy Hash: A6A1637281125DDADB04EBA2DC99EEEB778FF18300F040129F516B7191EF789A09CB60

Function 036225E0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 036226B1
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 036228D7

Memory Dump Source

Source File: 00000000.00000002.1737890993.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
Instruction ID: ff726a0309c41d201d897c32841844844102abe590d719e715e39dda219018a8
Opcode Fuzzy Hash: 014c9b5c74d83c0a726ef6016946af978a068631e2f3efa1e9065a42f07dad7c
Instruction Fuzzy Hash: A8A12774E00618EBDB54CFA4C9A8BEEBBB5FF48304F208559E501BB280D7799A45CF94

Function 007E39E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 007E3A15
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 007E3A36
ShowWindow.USER32(00000000,?,?), ref: 007E3A4A
ShowWindow.USER32(00000000,?,?), ref: 007E3A53

Strings

AutoIt v3, xrefs: 007E3A0D, 007E3A12, 007E3A13
edit, xrefs: 007E3A30

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: cd4679025f2c0fd648ec137f5e27fd9a69ac5605e97310fcbbc09ce28e52ff9c
Instruction ID: f6f330ec5f8aca6da49cc00b7ffed0001b346f00756ab8406ea7470e49c90088
Opcode Fuzzy Hash: cd4679025f2c0fd648ec137f5e27fd9a69ac5605e97310fcbbc09ce28e52ff9c
Instruction Fuzzy Hash: 60F03A706002907EFA3017237C09F273E7DF7C7F60F05002ABA00A2175D6A54820DAB0

Function 036223B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 145
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 036222A0: Sleep.KERNELBASE(000001F4), ref: 036222B1

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 036224D7

Strings

O8RR3SBXT7FKC, xrefs: 0362253A, 0362253D

Memory Dump Source

Source File: 00000000.00000002.1737890993.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: CreateFileSleep
String ID: O8RR3SBXT7FKC
API String ID: 2694422964-3454224395
Opcode ID: 48060d0062db0533f434980de3e4ffa64c9c8f88740b523c165e10d0f500b340
Instruction ID: 5e2c1d612ec4eb18fe4d6f13a0599c63ad1a2bba58bbff245648c9c82f9bf76d
Opcode Fuzzy Hash: 48060d0062db0533f434980de3e4ffa64c9c8f88740b523c165e10d0f500b340
Instruction Fuzzy Hash: 6A518470D04259DBEF10DBE4C855BEEBB79AF58300F008599E609BB2C0D7B91B45CBA5

Function 007E410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0081D5EC

Part of subcall function 007E7D2C: _memmove.LIBCMT ref: 007E7D66

_memset.LIBCMT ref: 007E418D
_wcscpy.LIBCMT ref: 007E41E1
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 007E41F1

Strings

Line: , xrefs: 0081D615

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 801f19d5dffd80cad1434ab1c94faee3266ab45fca84f447e3a49cd879cd760f
Instruction ID: 842aba0bfd74ca0c18022856a2fe22f0b0d9313d5a405c4b1fdd4dba3bdca68c
Opcode Fuzzy Hash: 801f19d5dffd80cad1434ab1c94faee3266ab45fca84f447e3a49cd879cd760f
Instruction Fuzzy Hash: 7731E47100A3889AE725EB61DC4AFDB77ECBF59304F14451EF194920A1EFB8A648C793

Function 0080564D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 008056AB
_memcpy_s.LIBCMT ref: 0080571D
__read_nolock.LIBCMT ref: 0080577B
__filbuf.LIBCMT ref: 0080579E
_memset.LIBCMT ref: 008057E2

Part of subcall function 00808D68: __getptd_noexit.LIBCMT ref: 00808D68

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction ID: 3c3107d7757f89d30c2119e4d090928d4271e551ff98a408de935098b8f6100b
Opcode Fuzzy Hash: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction Fuzzy Hash: 0D519030A00B09DBDBA48EA98C8466F77A5FF50324F648729F835D62D0DB719D50AF61

Function 007E69CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 007E4F3D: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,008A62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 007E4F6F

_free.LIBCMT ref: 0081E68C
_free.LIBCMT ref: 0081E6D3

Part of subcall function 007E6BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 007E6D0D

Strings

Bad directive syntax error, xrefs: 0081E6BB
>>>AUTOIT SCRIPT<<<, xrefs: 0081E462

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: d612c5e8bfc6c8fa2fa1e99a480289313f145aab9d71561905ad739f94ac23d4
Instruction ID: f588d0f621092358c09999521fd1a48a375b36eaa95447a7f6f0fc6ba521d888
Opcode Fuzzy Hash: d612c5e8bfc6c8fa2fa1e99a480289313f145aab9d71561905ad739f94ac23d4
Instruction Fuzzy Hash: 28918B71910259EFCF04EFA9C8859EDB7B9FF18314F044429F816EB2A1EB34A945CB50

Function 007E35B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,007E35A1,SwapMouseButtons,00000004,?), ref: 007E35D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,007E35A1,SwapMouseButtons,00000004,?,?,?,?,007E2754), ref: 007E35F5
RegCloseKey.KERNELBASE(00000000,?,?,007E35A1,SwapMouseButtons,00000004,?,?,?,?,007E2754), ref: 007E3617

Strings

Control Panel\Mouse, xrefs: 007E35D2

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 67d367589a4a5ee856d3ca48ec324b49c23f40ead975f2eaa090b084fec8822d
Instruction ID: edd361f21168252819bfad6e2bf3338f9c96322204801f025baa476811e77098
Opcode Fuzzy Hash: 67d367589a4a5ee856d3ca48ec324b49c23f40ead975f2eaa090b084fec8822d
Instruction Fuzzy Hash: B0115A71512248FFDB20CFA5EC48DAEB7B8EF09740F015469F905D7210E2719F409761

Function 036212A0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 03621ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 03621AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 03621B13

Memory Dump Source

Source File: 00000000.00000002.1737890993.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: cc658a0e6010fd3573e63fe9dffc1f366d2843c5c23e1a249a06af30add5367b
Instruction ID: 05e1fcde958fd292bfa40d0efcfb1d8067bfd1e21b14bd727b3f6265df14d23e
Opcode Fuzzy Hash: cc658a0e6010fd3573e63fe9dffc1f366d2843c5c23e1a249a06af30add5367b
Instruction Fuzzy Hash: 22621730A14658DBEB24CBA4C850BDEB776EF58300F1091A9D10DEB394E77A9E81CF59

Function 008497E5 Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 007E5045: _fseek.LIBCMT ref: 007E505D

Part of subcall function 008499BE: _wcscmp.LIBCMT ref: 00849AAE
Part of subcall function 008499BE: _wcscmp.LIBCMT ref: 00849AC1

_free.LIBCMT ref: 0084992C
_free.LIBCMT ref: 00849933
_free.LIBCMT ref: 0084999E

Part of subcall function 00802F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00809C64), ref: 00802FA9
Part of subcall function 00802F95: GetLastError.KERNEL32(00000000,?,00809C64), ref: 00802FBB

_free.LIBCMT ref: 008499A6

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 922d4df5b64e1696f8af207ae7c752e1e6b30532c460fe4269bae0bb53f03174
Instruction ID: dc0ac388dd0da4bab7be0a99c71e9a22cca597561c8829d68546094a18359be5
Opcode Fuzzy Hash: 922d4df5b64e1696f8af207ae7c752e1e6b30532c460fe4269bae0bb53f03174
Instruction Fuzzy Hash: B2516CB190525CAFDF249F65CC85A9EBBB9FF48314F0000AEF249A7281DB755A808F59

Function 0080493A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 008049D0
__flush.LIBCMT ref: 008049F0
__write.LIBCMT ref: 00804A23
__flsbuf.LIBCMT ref: 00804A51

Part of subcall function 00808D68: __getptd_noexit.LIBCMT ref: 00808D68

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction ID: 1b4278510bfc3222126f7c5979ae2034a597c530884f25410b7dff5be40b26e0
Opcode Fuzzy Hash: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction Fuzzy Hash: 8841E5B178061A9BDF688EA9CC8096F7BA5FF80360B24913DEA55C76E0D7709D418744

Function 007E73E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0081EE62
GetOpenFileNameW.COMDLG32(?), ref: 0081EEAC

Part of subcall function 007E48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007E48A1,?,?,007E37C0,?), ref: 007E48CE

Part of subcall function 008009D5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 008009F4

Strings

X, xrefs: 0081EE7A

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 74b2bbf507608441ace80b4ea3ab3940307297de14255f47a76d1e9627285d47
Instruction ID: 68239686c6d8d4071b07d614c865c2830404d2ff267424172c3f9b20fb5e673f
Opcode Fuzzy Hash: 74b2bbf507608441ace80b4ea3ab3940307297de14255f47a76d1e9627285d47
Instruction Fuzzy Hash: C5219271A052989BDF559B98CC457EE7BFCAF49310F04401AE508E7281DBB859898F91

Function 0084901B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00849036
__fread_nolock.LIBCMT ref: 0084904B

Strings

EA06, xrefs: 0084907D

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: ce13d308df0032cb2c5ed9448d638225e5090750c2be5941121944e5982f524f
Instruction ID: bb437b4ef8e311cb53cfc713e6189ba11f06da72bddffd13195b1dbd8e00f9fc
Opcode Fuzzy Hash: ce13d308df0032cb2c5ed9448d638225e5090750c2be5941121944e5982f524f
Instruction Fuzzy Hash: 0001F971804618AEDB28C6A8CC1AEFFBBFCEB01311F00419AF592D21C1E575A6088BA0

Function 00849B6D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00849B82
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00849B99

Strings

aut, xrefs: 00849B93

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 05c2b3351d960727c07c9979b250dfb39e2f4cd6929f03e09b8605e15af01e33
Instruction ID: 64ab39762ab163bccdb4297695cbd6bfbb5a8e946c54c4d01ad84d2d69238c4f
Opcode Fuzzy Hash: 05c2b3351d960727c07c9979b250dfb39e2f4cd6929f03e09b8605e15af01e33
Instruction Fuzzy Hash: 2DD0177954030DABDA10AB90EC0EF9A772CE704704F0052A1BB64912A2DAB495988A95

Function 0085CDF1 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 754dc7b3f3ee34cd337b1c690129a4552327fddd58b8189416ac99ae734c2d45
Instruction ID: 4c81e88e9aedc7ccf0939f133acf3e5932fe31ca178e88adf2e5e8acee96412b
Opcode Fuzzy Hash: 754dc7b3f3ee34cd337b1c690129a4552327fddd58b8189416ac99ae734c2d45
Instruction Fuzzy Hash: BCF156716083459FC724DF28C484A6ABBE5FF88314F14896EF899DB251D770E94ACF82

Function 007EF8CF Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 008003A2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 008003D3
Part of subcall function 008003A2: MapVirtualKeyW.USER32(00000010,00000000), ref: 008003DB
Part of subcall function 008003A2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 008003E6
Part of subcall function 008003A2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 008003F1
Part of subcall function 008003A2: MapVirtualKeyW.USER32(00000011,00000000), ref: 008003F9
Part of subcall function 008003A2: MapVirtualKeyW.USER32(00000012,00000000), ref: 00800401

Part of subcall function 007F6259: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,007EFA90), ref: 007F62B4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 007EFB2D
OleInitialize.OLE32(00000000), ref: 007EFBAA
CloseHandle.KERNEL32(00000000), ref: 008249F2

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 2c1d9523c309dbcd35ae846e28ab7dbf7c1783e8926f54a526c33b751cd78e92
Instruction ID: b76184ffd32a3e25feb974fc284c54fe292728b9d2ba9aac3c091c7261b83c11
Opcode Fuzzy Hash: 2c1d9523c309dbcd35ae846e28ab7dbf7c1783e8926f54a526c33b751cd78e92
Instruction Fuzzy Hash: 2C81DCB0916240CEEB84DF79E8446157BE4FB5E314718813AD128C7BAAFB798429CF58

Function 007E43DB Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007E4401
Shell_NotifyIconW.SHELL32(00000000,?), ref: 007E44A6
Shell_NotifyIconW.SHELL32(00000001,?), ref: 007E44C3

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: f27ab2ad993b50ad33992f83575d34c1c2a33a734fa80818109f3010d2ba53b9
Instruction ID: 795e885f3ad1927b7959ab19b94fea2dacfc6d99ab5ab62901f1e4103075f04b
Opcode Fuzzy Hash: f27ab2ad993b50ad33992f83575d34c1c2a33a734fa80818109f3010d2ba53b9
Instruction Fuzzy Hash: 263193B06057818FD720DF25D884797BBF8FB4A304F04092EF69AC3281E7B5A944CB92

Function 0080594C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00805963

Part of subcall function 0080A3AB: __NMSG_WRITE.LIBCMT ref: 0080A3D2
Part of subcall function 0080A3AB: __NMSG_WRITE.LIBCMT ref: 0080A3DC

__NMSG_WRITE.LIBCMT ref: 0080596A

Part of subcall function 0080A408: GetModuleFileNameW.KERNEL32(00000000,008A43BA,00000104,?,00000001,00000000), ref: 0080A49A
Part of subcall function 0080A408: ___crtMessageBoxW.LIBCMT ref: 0080A548

Part of subcall function 008032DF: ___crtCorExitProcess.LIBCMT ref: 008032E5
Part of subcall function 008032DF: ExitProcess.KERNEL32 ref: 008032EE

Part of subcall function 00808D68: __getptd_noexit.LIBCMT ref: 00808D68

RtlAllocateHeap.NTDLL(01230000,00000000,00000001,00000000,?,?,?,00801013,?), ref: 0080598F

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 165984f90a71f45ac6fb33370f90086819427bbe0704e57328b0fcaeb3e2f415
Instruction ID: da25d992318413f37170ec3d957689193fa857bd79de3da9332cc4826c4d0858
Opcode Fuzzy Hash: 165984f90a71f45ac6fb33370f90086819427bbe0704e57328b0fcaeb3e2f415
Instruction Fuzzy Hash: 1A01F531200B15DEE6952B68FC42B2F7A48FF82770F11013AF901DB1D2DEB09D418A72

Function 00849B2C Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,008497D2,?,?,?,?,?,00000004), ref: 00849B45
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,008497D2,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00849B5B
CloseHandle.KERNEL32(00000000,?,008497D2,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00849B62

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: d0d4f9773d065cd4989f9772512e036843b3866ca26304d2ab896036c5fbc88c
Instruction ID: 78d48eac5ceddcb2e0652ffedecebb0e21f345e89aedaf3924880107fbef2e1b
Opcode Fuzzy Hash: d0d4f9773d065cd4989f9772512e036843b3866ca26304d2ab896036c5fbc88c
Instruction Fuzzy Hash: 52E08632181224B7D7321B54FC09FCA7B58FB067B1F114120FB54A91E187F169119798

Function 00848F97 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00848FA5

Part of subcall function 00802F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00809C64), ref: 00802FA9
Part of subcall function 00802F95: GetLastError.KERNEL32(00000000,?,00809C64), ref: 00802FBB

_free.LIBCMT ref: 00848FB6
_free.LIBCMT ref: 00848FC8

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 180ac2cc07007adee99720b26c657bf09b4177bae862674a470a9d0e5fc62c6e
Instruction ID: 4557bcb8bb696ac1212a7a481a0967776fa9a8bb5f7e26a81fdd2d700696435d
Opcode Fuzzy Hash: 180ac2cc07007adee99720b26c657bf09b4177bae862674a470a9d0e5fc62c6e
Instruction Fuzzy Hash: 7DE012A160A7068ACA74A67CAD44A9757EEFF48390758081DB419DB182DE64E8458124

Function 007EAB23 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 0082002B

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 519f2f2d46acc316bdec8c4ea2e7451840be5ea3f871c5c18cca828cc39cd312
Instruction ID: b3475f9f74c73577ed871bb6644c01083ef42af43d1df2db88b93e478e6da7da
Opcode Fuzzy Hash: 519f2f2d46acc316bdec8c4ea2e7451840be5ea3f871c5c18cca828cc39cd312
Instruction Fuzzy Hash: 98224A70509291DFD724DF15C894B2ABBE1FF88304F14896DE8968B362D739ED85CB82

Function 007E4DD0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007E4E1A

Strings

EA06, xrefs: 0081DCF5

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: aabf0dc842c5ffe9d1dfba7211dc11436de3d815a2ecd3ce55d24f20cf88ec4c
Instruction ID: 9052539f67e04968b6cca3902a70b24673f4a5745bf550c2ce8c1dbe3d751dc9
Opcode Fuzzy Hash: aabf0dc842c5ffe9d1dfba7211dc11436de3d815a2ecd3ce55d24f20cf88ec4c
Instruction Fuzzy Hash: 83417D61A052D89BCF215B658C557BE7FA5EF0D300F1C4065F882EB282C52D9D4083E1

Function 007E492E Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 007E4992

Part of subcall function 008035AC: __lock.LIBCMT ref: 008035B2
Part of subcall function 008035AC: DecodePointer.KERNEL32(00000001,?,007E49A7,008381BC), ref: 008035BE
Part of subcall function 008035AC: EncodePointer.KERNEL32(?,?,007E49A7,008381BC), ref: 008035C9

Part of subcall function 007E4A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 007E4A73
Part of subcall function 007E4A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 007E4A88

Part of subcall function 007E3B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 007E3B7A
Part of subcall function 007E3B4C: IsDebuggerPresent.KERNEL32 ref: 007E3B8C
Part of subcall function 007E3B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?,008A62F8,008A62E0,?,?), ref: 007E3BFD
Part of subcall function 007E3B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 007E3C81

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 007E49D2

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: ce54e1b1e0fc6507abbeb490f10a49631aba77f88321333cd9845ba025ba374f
Instruction ID: 2fdb98f3743707527ad6f225ba351f1e98b614925e66176a5028ab228f9bdcd4
Opcode Fuzzy Hash: ce54e1b1e0fc6507abbeb490f10a49631aba77f88321333cd9845ba025ba374f
Instruction Fuzzy Hash: 8D11CD729093419FD300DF2AEC09A4AFBE8FF99710F00852EF051932B2EBB49554CB96

Function 007E5DF9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,007E5981,?,?,?,?), ref: 007E5E27
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,007E5981,?,?,?,?), ref: 0081E19C

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9ccfc1809b11032012e8ddcdd2fa8a2d1e69e0fe8b74590432a67423ff063e4f
Instruction ID: e342224ee2369ea39f347bd61c99e5605eec578250f62b17dae0dd8004fbfc19
Opcode Fuzzy Hash: 9ccfc1809b11032012e8ddcdd2fa8a2d1e69e0fe8b74590432a67423ff063e4f
Instruction Fuzzy Hash: D8015270245748BEF7250E25DC8AF663B9CFB0576CF108319FAE55E1E0C6B45E458B50

Function 00800FF6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0080594C: __FF_MSGBANNER.LIBCMT ref: 00805963
Part of subcall function 0080594C: __NMSG_WRITE.LIBCMT ref: 0080596A
Part of subcall function 0080594C: RtlAllocateHeap.NTDLL(01230000,00000000,00000001,00000000,?,?,?,00801013,?), ref: 0080598F

std::exception::exception.LIBCMT ref: 0080102C
__CxxThrowException@8.LIBCMT ref: 00801041

Part of subcall function 008087DB: RaiseException.KERNEL32(?,?,?,0089BAF8,00000000,?,?,?,?,00801046,?,0089BAF8,?,00000001), ref: 00808830

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: bfbac83842b96c229a979b7aadb2665bc472b56ffe0b6d74ead2bd1b41ead074
Instruction ID: 9ee6790c64723c5167503e82e55385fca9c844f1c920be0d6104995257ff2491
Opcode Fuzzy Hash: bfbac83842b96c229a979b7aadb2665bc472b56ffe0b6d74ead2bd1b41ead074
Instruction Fuzzy Hash: 68F0D13550061DA6CB60AA9CEC099DF7BA8FF00360F104025F988D22D1DFB18A8486A2

Function 0080582D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0080585C
__lock_file.LIBCMT ref: 0080587D

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 9b4c3e3d8f83082a30bec9229bfb21c8a9bfbe822c2b7ac3b4f3853f2ba3b527
Instruction ID: 05efa2eca9e70c65a5ca3d59fc5d1b845870e1e1eef7c4c5ff8d61ad49d2e118
Opcode Fuzzy Hash: 9b4c3e3d8f83082a30bec9229bfb21c8a9bfbe822c2b7ac3b4f3853f2ba3b527
Instruction Fuzzy Hash: 0F017571900A09EBCFA1AF6D8C0159F7B61FF40760F148225BC24DA1E1DB31CA61DF62

Function 008055D6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00808D68: __getptd_noexit.LIBCMT ref: 00808D68

__lock_file.LIBCMT ref: 0080561B

Part of subcall function 00806E4E: __lock.LIBCMT ref: 00806E71

__fclose_nolock.LIBCMT ref: 00805626

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 22d2c60c8f70096b62272df8b3f04a6378f87d080734ce74fe3ec4dff720ceeb
Instruction ID: dfdb3aba37eb04fe4ff757121fabc087f499af79a633f3493c0e4f6a6a72452d
Opcode Fuzzy Hash: 22d2c60c8f70096b62272df8b3f04a6378f87d080734ce74fe3ec4dff720ceeb
Instruction Fuzzy Hash: 29F06D72801A05DADBA0AB798C0276F77A1FF50334F658209A465EB1C1CF7C89419E66

Function 007E81C1 Relevance: 2.6, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000001,00000000,00000000,?,?,?,007E558F,?,?,?,?,?), ref: 007E81DA
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000001,00000000,?,?,?,007E558F,?,?,?,?,?), ref: 007E820D

Part of subcall function 007E78AD: _memmove.LIBCMT ref: 007E78E9

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ByteCharMultiWide$_memmove
String ID:
API String ID: 3033907384-0
Opcode ID: 94b7f6041492e59de47639c22c7ab3413f40077a96b8337c939080887a28af3f
Instruction ID: b926d3bc1dd37cfae6dc680d56d0bf2e882a3ef24dede4b8ea685ce27d4af6c1
Opcode Fuzzy Hash: 94b7f6041492e59de47639c22c7ab3413f40077a96b8337c939080887a28af3f
Instruction Fuzzy Hash: 55018B31202544BEEB256A26ED4AF7B3B6CFB8A760F10802AFA05CD1D1DE60D800D662

Function 0362129D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 03621ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 03621AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 03621B13

Memory Dump Source

Source File: 00000000.00000002.1737890993.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
Instruction ID: 7aedb375134df94abc6256a7bf1e08c25cc229fc652aed54e43e1dd8f516984c
Opcode Fuzzy Hash: d88754d343c0358fec48bb39518f6d050a5efe1528146ba10a354079ac39ca1d
Instruction Fuzzy Hash: DE12CE24E18658C6EB24DF64D8507DEB232EF69300F1090E9910DEB7A5E77A4F81CF5A

Function 007EF3F0 Relevance: 1.7, APIs: 1, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 210f237ed62e5e8651b48d89fbd28020a56be7c21399f18783fa37da349ccf5d
Instruction ID: 47648a18f18560a6db187cbe2ad2a8661c3c8c47be60efbd0877fec3172f1412
Opcode Fuzzy Hash: 210f237ed62e5e8651b48d89fbd28020a56be7c21399f18783fa37da349ccf5d
Instruction Fuzzy Hash: D961BB7060128ADFDB20DF65C881ABAB7E5FF09300F148079E916DB682E739ED91CB51

Function 007F2123 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3bba466fc15b4d597ecdee188d3e16ee8002551d33a0abbc4442fc44a76e176
Instruction ID: a74c3a64dc67a772d200e468dac7c0f1e44441c33f52a6467d85ad735406d5cd
Opcode Fuzzy Hash: e3bba466fc15b4d597ecdee188d3e16ee8002551d33a0abbc4442fc44a76e176
Instruction Fuzzy Hash: 96519F31600618EBCF14EB68C995EBD77A5FF89314F148068F906AB392DE38ED01CB55

Function 007E5C4E Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 007E5CF6

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 2ac03fdad986760fa23b675e14c49debb166e702aa80fdb7f236d0762170da19
Instruction ID: 2304575b5ef18d4df792ba0ed4418e7b7c7be67c894e0374a685c56a0e93d8e6
Opcode Fuzzy Hash: 2ac03fdad986760fa23b675e14c49debb166e702aa80fdb7f236d0762170da19
Instruction Fuzzy Hash: F8316D31A01B4AEFCB18CF2EC8946ADB7B5FF48314F248629D81993710D775B950DB90

Function 008200D6 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 008200E1

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 67f33ad99fbbcabe19ad124494eb195528994996399e41532924b051676ab246
Instruction ID: 0a65bf040423294ced1a9752c1ce2eef71ecb33d9aa16343bd76c0c36a4cfd6e
Opcode Fuzzy Hash: 67f33ad99fbbcabe19ad124494eb195528994996399e41532924b051676ab246
Instruction Fuzzy Hash: 2F412674505391DFDB14DF15C484B1ABBE0BF48318F0988ACE9898B362C335E885CF52

Function 007E4F3D Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 007E4D13: FreeLibrary.KERNEL32(00000000,?), ref: 007E4D4D

Part of subcall function 0080548B: __wfsopen.LIBCMT ref: 00805496

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?,008A62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 007E4F6F

Part of subcall function 007E4CC8: FreeLibrary.KERNEL32(00000000), ref: 007E4D02

Part of subcall function 007E4DD0: _memmove.LIBCMT ref: 007E4E1A

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: c7b493fbaf62bb4aa11d1f819d485d63f3676729714bbb9c080854869ab3f99f
Instruction ID: 6a8578d1f22dd626702474c430c06e4ca2e742b9bc40079f8eaff9c826589531
Opcode Fuzzy Hash: c7b493fbaf62bb4aa11d1f819d485d63f3676729714bbb9c080854869ab3f99f
Instruction Fuzzy Hash: FB11EB32701709EBCB10EF75DC16BAE77A9EF48B10F118429F541D72C1DA799A059B60

Function 008201AF Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 008201BB

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 301e29b8c982e71e332f275d360e7ce32faf226612cf7e82b2ee3f0294f2cbd2
Instruction ID: 3638d78299b345bbac8171e3d7519dd0d22c3099bae9bfc613fb89b97ac98207
Opcode Fuzzy Hash: 301e29b8c982e71e332f275d360e7ce32faf226612cf7e82b2ee3f0294f2cbd2
Instruction Fuzzy Hash: 4E2133B4508391DFCB14DF24C845A1ABBE0FF88314F058968E98A87762D735F845CB53

Function 007E5D20 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,007E5807,00000000,00010000,00000000,00000000,00000000,00000000), ref: 007E5D76

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 8e0053705dc4825e654a73a74cc4b2d2fe1127f2167273f06cba3baf04d49f9f
Instruction ID: fa93de9f885edabc0601a36d613518ff645ea2c2fb751a9f319b98d564424dfa
Opcode Fuzzy Hash: 8e0053705dc4825e654a73a74cc4b2d2fe1127f2167273f06cba3baf04d49f9f
Instruction Fuzzy Hash: A9113A31201B499FD330CF16C888B62B7E9FF49764F10C92EE5AA86A51D7B4E945CF60

Function 00854583 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(?,?,00007FFF,00000000), ref: 008545C0

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: EnvironmentVariable
String ID:
API String ID: 1431749950-0
Opcode ID: d886f18cf2e94155e893ad8d561526133dd66f37f39426282430ed27e1eb4a48
Instruction ID: 60a126c0fa29d1f6e58e469dc7f1db9fcd371de1318cfa678d59fec1472be7ca
Opcode Fuzzy Hash: d886f18cf2e94155e893ad8d561526133dd66f37f39426282430ed27e1eb4a48
Instruction Fuzzy Hash: 0CF08135604148AFDB14EB69DC0ACAF7BBCFF49720B00405AF945DB2A1DE70B940CB91

Function 00804A93 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00804AD6

Part of subcall function 00808D68: __getptd_noexit.LIBCMT ref: 00808D68

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: a6f0ed3139327eff66796a76006ee06a0253313ab912861d176f1e9b8e1b8661
Instruction ID: 8a44917c289a07605d6b3adca6db9d51d588b4e3e24e7c59deb7d52749550b80
Opcode Fuzzy Hash: a6f0ed3139327eff66796a76006ee06a0253313ab912861d176f1e9b8e1b8661
Instruction Fuzzy Hash: B8F08171980219EBDFE1BF788C0639E3661FF00325F144514B524EA1D1DB788960DB52

Function 007E4FAA Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,008A62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 007E4FDE

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 9b05d3e00a4b020b8187c98693db465e894208da2a5fb9d630c1b42d0734cf63
Instruction ID: 0698464147a7e39001fd654801ee56d5587d2f076c19f3afbe4ad21c0fbf39f4
Opcode Fuzzy Hash: 9b05d3e00a4b020b8187c98693db465e894208da2a5fb9d630c1b42d0734cf63
Instruction Fuzzy Hash: E2F03971106752CFCB349F66E894812BBE1BF087293298E3EE1D682A10C775A840DF50

Function 008009D5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 008009F4

Part of subcall function 007E7D2C: _memmove.LIBCMT ref: 007E7D66

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 98a6c1aa8eb644c20e667c27c0e99ad69734c5ba555d31477fefe1b776a4af3d
Instruction ID: 4982ada5c5794c59d2d4cd6a1876cb9c956351343e40e7ee2385f11060479aa8
Opcode Fuzzy Hash: 98a6c1aa8eb644c20e667c27c0e99ad69734c5ba555d31477fefe1b776a4af3d
Instruction Fuzzy Hash: 3BE08676A0522857C720D6589C09FFA77ADEF886A0F0501B5FD0CD7205DAA49C818691

Function 00849129 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0084914B

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction ID: 9d7af4a1eb2d2ef983d2a141a82278bedd34b18b56713b99773eb83ab2a3eb8a
Opcode Fuzzy Hash: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction Fuzzy Hash: 62E092B0114B045FD7348A24D8107E373E0FB06315F00081DF6DAC3341EB62B8418B59

Function 007E5DAE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,0081E16B,?,?,00000000), ref: 007E5DBF

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: b514199ad62e808c70733f2ffab2659ed30edacabf76fd0ab4bc41edf0a5471f
Instruction ID: 46b4f191700b5290bbf79dc50694e82557a9c9269ddf19fa26230916dca6d587
Opcode Fuzzy Hash: b514199ad62e808c70733f2ffab2659ed30edacabf76fd0ab4bc41edf0a5471f
Instruction Fuzzy Hash: 55D0C77464420CBFE710DB80DC46FA9777CE705710F100194FE0456290D6F27D508795

Function 0080548B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00805496

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 182b5f7cc5631809c3c1a73da4532737d6fcdb86698b85e977b4fa020baf2ba8
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 7BB09B7544050C77DE411D45EC02A553B199740674F404010FB0C1816195739560559D

Function 0084D2E6 Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 0084D46A

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 6b1696a68080c3a5a066b8b04cdce4a75b29c785f83d68f66c18eb447613f7a4
Instruction ID: a71f6a01dd0ca8518bfe0f21b0233ce3865e9cea0d0e81d419772fb253817ffb
Opcode Fuzzy Hash: 6b1696a68080c3a5a066b8b04cdce4a75b29c785f83d68f66c18eb447613f7a4
Instruction Fuzzy Hash: B4715E30209346CFC714EF29C495A6AB7E0FF88314F04496DF9969B2A2DB74ED49CB52

Function 00800E48 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00800EF7

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 8dceb91d72abaebf5be368ed47412255e5a01ade533c47b98641ee3de10b35a5
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 8931D570A0010ADBC768DF58D880A69F7A6FF59300F648AA5E409DB792DB31EDC1DF80

Function 036222A0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 036222B1

Memory Dump Source

Source File: 00000000.00000002.1737890993.0000000003620000.00000040.00001000.00020000.00000000.sdmp, Offset: 03620000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3620000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: a330922185303cf880ea90bf4d33852469b623bcd2231b247d9651f8efe592fd
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: EEE0E67494110EDFDB00EFB8D54969E7FB4EF04701F1005A1FD01D2280D6319D508A72

Non-executed Functions

Function 0086CDAC Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 007E2612: GetWindowLongW.USER32(?,000000EB), ref: 007E2623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0086CE50
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0086CE91
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 0086CED6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0086CF00
SendMessageW.USER32 ref: 0086CF29
_wcsncpy.LIBCMT ref: 0086CFA1
GetKeyState.USER32(00000011), ref: 0086CFC2
GetKeyState.USER32(00000009), ref: 0086CFCF
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0086CFE5
GetKeyState.USER32(00000010), ref: 0086CFEF
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0086D018
SendMessageW.USER32 ref: 0086D03F
SendMessageW.USER32(?,00001030,?,0086B602), ref: 0086D145
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0086D15B
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0086D16E
SetCapture.USER32(?), ref: 0086D177
ClientToScreen.USER32(?,?), ref: 0086D1DC
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0086D1E9
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0086D203
ReleaseCapture.USER32 ref: 0086D20E
GetCursorPos.USER32(?), ref: 0086D248
ScreenToClient.USER32(?,?), ref: 0086D255
SendMessageW.USER32(?,00001012,00000000,?), ref: 0086D2B1
SendMessageW.USER32 ref: 0086D2DF
SendMessageW.USER32(?,00001111,00000000,?), ref: 0086D31C
SendMessageW.USER32 ref: 0086D34B
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0086D36C
SendMessageW.USER32(?,0000110B,00000009,?), ref: 0086D37B
GetCursorPos.USER32(?), ref: 0086D39B
ScreenToClient.USER32(?,?), ref: 0086D3A8
GetParent.USER32(?), ref: 0086D3C8
SendMessageW.USER32(?,00001012,00000000,?), ref: 0086D431
SendMessageW.USER32 ref: 0086D462
ClientToScreen.USER32(?,?), ref: 0086D4C0
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0086D4F0
SendMessageW.USER32(?,00001111,00000000,?), ref: 0086D51A
SendMessageW.USER32 ref: 0086D53D
ClientToScreen.USER32(?,?), ref: 0086D58F
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0086D5C3

Part of subcall function 007E25DB: GetWindowLongW.USER32(?,000000EB), ref: 007E25EC

GetWindowLongW.USER32(?,000000F0), ref: 0086D65F

Strings

@GUI_DRAGID, xrefs: 0086D1AA
F, xrefs: 0086D543

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: fc48daf0cefb1459fa112612859d90c523eaf5dc8dbd603f58527ad5e5c43f18
Instruction ID: 5f6eca0a8ee9d9f50fa20b01f15a1c496b590dc15f546c409338e9d2040e16f0
Opcode Fuzzy Hash: fc48daf0cefb1459fa112612859d90c523eaf5dc8dbd603f58527ad5e5c43f18
Instruction Fuzzy Hash: 11429B70604341AFD721CF28C848EAABBF5FF49314F164629F6A6C72A1D772D854CB92

Function 0086804A Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 571windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 0086873F

Strings

%d/%02d/%02d, xrefs: 00868478

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: 0052e9d80cb70ff0adb98dba76042a9326ef9b96b5db7591330eab5d1f64b2fd
Instruction ID: 8997814404cf52fa7a053f6f38672ab0ce0cf4c5457815e32dd3b788726c905f
Opcode Fuzzy Hash: 0052e9d80cb70ff0adb98dba76042a9326ef9b96b5db7591330eab5d1f64b2fd
Instruction Fuzzy Hash: 6712C471500248EBEB258F68DC49FAE7BB8FF45714F264229F51AEA2E1DF709941CB10

Function 007F710E Relevance: 48.8, APIs: 19, Strings: 6, Instructions: 5093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007F75C2
_memset.LIBCMT ref: 007F76B1
_memmove.LIBCMT ref: 007F7C4B
_memmove.LIBCMT ref: 007F7E4F

Strings

DEFINE, xrefs: 008325AF
\b(?=\w), xrefs: 00833C34
[:<:]], xrefs: 007F75F1
[:>:]], xrefs: 007F760A
\b(?<=\w), xrefs: 00833C41
Q\E, xrefs: 007F81C1

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: _memmove$_memset
String ID: DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-1798697756
Opcode ID: 6d1139fbed4c309ae9f25a47618e038178ea34d64b1bac3c0662f5454e7363b1
Instruction ID: df39542d7a8c90516980bd99ed23b5660138d4b9d74a013b73688cd9d74424c2
Opcode Fuzzy Hash: 6d1139fbed4c309ae9f25a47618e038178ea34d64b1bac3c0662f5454e7363b1
Instruction Fuzzy Hash: 28939071A04219DBDB24CF58C881BBDB7B1FF88714F25816AE955EB390E7749E81CB80

Function 007E4A35 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 007E4A3D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0081DA8E
IsIconic.USER32(?), ref: 0081DA97
ShowWindow.USER32(?,00000009), ref: 0081DAA4
SetForegroundWindow.USER32(?), ref: 0081DAAE
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0081DAC4
GetCurrentThreadId.KERNEL32 ref: 0081DACB
GetWindowThreadProcessId.USER32(?,00000000), ref: 0081DAD7
AttachThreadInput.USER32(?,00000000,00000001), ref: 0081DAE8
AttachThreadInput.USER32(?,00000000,00000001), ref: 0081DAF0
AttachThreadInput.USER32(00000000,?,00000001), ref: 0081DAF8
SetForegroundWindow.USER32(?), ref: 0081DAFB
MapVirtualKeyW.USER32(00000012,00000000), ref: 0081DB10
keybd_event.USER32(00000012,00000000), ref: 0081DB1B
MapVirtualKeyW.USER32(00000012,00000000), ref: 0081DB25
keybd_event.USER32(00000012,00000000), ref: 0081DB2A
MapVirtualKeyW.USER32(00000012,00000000), ref: 0081DB33
keybd_event.USER32(00000012,00000000), ref: 0081DB38
MapVirtualKeyW.USER32(00000012,00000000), ref: 0081DB42
keybd_event.USER32(00000012,00000000), ref: 0081DB47
SetForegroundWindow.USER32(?), ref: 0081DB4A
AttachThreadInput.USER32(?,?,00000000), ref: 0081DB71

Strings

Shell_TrayWnd, xrefs: 0081DA89

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 7f3a1551d633c4fc1935e5377b4189d6b750e1adfc83deda23cc681f04a39779
Instruction ID: bcab2a2ccf4922d67ef438d267de7f5b9727e10b39c5fc1ef0cbd2f6a66e58f0
Opcode Fuzzy Hash: 7f3a1551d633c4fc1935e5377b4189d6b750e1adfc83deda23cc681f04a39779
Instruction Fuzzy Hash: BC318771A443187BEB216F61AC49FBF3E6CFF44B60F115025FB05EA1D1CAB09D40AAA5

Function 00838858 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00838CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00838D0D
Part of subcall function 00838CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00838D3A
Part of subcall function 00838CC3: GetLastError.KERNEL32 ref: 00838D47

_memset.LIBCMT ref: 0083889B
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 008388ED
CloseHandle.KERNEL32(?), ref: 008388FE
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00838915
GetProcessWindowStation.USER32 ref: 0083892E
SetProcessWindowStation.USER32(00000000), ref: 00838938
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00838952

Part of subcall function 00838713: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00838851), ref: 00838728
Part of subcall function 00838713: CloseHandle.KERNEL32(?,?,00838851), ref: 0083873A

Strings

default, xrefs: 0083894D
, xrefs: 008388AA
winsta0, xrefs: 00838910

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 3118ce5a6a5dc6c52e850bc06676a064f9c91e1493ce250a73091d5ed57886de
Instruction ID: 22192feb1b0e2cc7867c0a872a93a45aeac5cdde84335cb1d4f5d3b384d8f90a
Opcode Fuzzy Hash: 3118ce5a6a5dc6c52e850bc06676a064f9c91e1493ce250a73091d5ed57886de
Instruction Fuzzy Hash: 24814871900319EFDF11DFA4EC45AAE7BB8FF44304F08412AF910E6261DB718E149BA2

Function 0085425A Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(0086F910), ref: 00854284
IsClipboardFormatAvailable.USER32(0000000D), ref: 00854292
GetClipboardData.USER32(0000000D), ref: 0085429A
CloseClipboard.USER32 ref: 008542A6
GlobalLock.KERNEL32(00000000), ref: 008542C2
CloseClipboard.USER32 ref: 008542CC
GlobalUnlock.KERNEL32(00000000,00000000), ref: 008542E1
IsClipboardFormatAvailable.USER32(00000001), ref: 008542EE
GetClipboardData.USER32(00000001), ref: 008542F6
GlobalLock.KERNEL32(00000000), ref: 00854303
GlobalUnlock.KERNEL32(00000000,00000000,?), ref: 00854337
CloseClipboard.USER32 ref: 00854447

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 70d1282915d630e178a626b96f2d110e7ca6370f5d607bb50bc00c2cdc45e238
Instruction ID: 024f17e8f17212ee61dcbe32aae478f72b4d21c6581ce3f62ccb8787cfcd657e
Opcode Fuzzy Hash: 70d1282915d630e178a626b96f2d110e7ca6370f5d607bb50bc00c2cdc45e238
Instruction Fuzzy Hash: EC51D235204305ABD300EF64EC89F6E77A8FF84B05F015529FA56D22A2DFB0D9488B62

Function 0084C9C7 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0084C9F8
FindClose.KERNEL32(00000000), ref: 0084CA4C
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0084CA71
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0084CA88
FileTimeToSystemTime.KERNEL32(?,?), ref: 0084CAAF
__swprintf.LIBCMT ref: 0084CAFB
__swprintf.LIBCMT ref: 0084CB3E

Part of subcall function 007E7F41: _memmove.LIBCMT ref: 007E7F82

__swprintf.LIBCMT ref: 0084CB92

Part of subcall function 008038D8: __woutput_l.LIBCMT ref: 00803931

__swprintf.LIBCMT ref: 0084CBE0

Part of subcall function 008038D8: __flsbuf.LIBCMT ref: 00803953
Part of subcall function 008038D8: __flsbuf.LIBCMT ref: 0080396B

__swprintf.LIBCMT ref: 0084CC2F
__swprintf.LIBCMT ref: 0084CC7E
__swprintf.LIBCMT ref: 0084CCCD

Strings

%4d, xrefs: 0084CB38
%4d%02d%02d%02d%02d%02d, xrefs: 0084CAF5
%02d, xrefs: 0084CB86, 0084CB90, 0084CBDE, 0084CC2D, 0084CC7C, 0084CCCB

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 2fc51c3fce28b6aa0466b58567f98f7c3734841e92051615f5a6c692a23e173e
Instruction ID: 50dddda2776d334d6cc870b517e658d39a7ee248ea54451a4442fff3064e1812
Opcode Fuzzy Hash: 2fc51c3fce28b6aa0466b58567f98f7c3734841e92051615f5a6c692a23e173e
Instruction Fuzzy Hash: 8FA130B2509344EBC744EB65CC86DAFB7ECFF98704F404929F685D2191EA74DA08CB62

Function 0084F200 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 0084F221
_wcscmp.LIBCMT ref: 0084F236
_wcscmp.LIBCMT ref: 0084F24D
GetFileAttributesW.KERNEL32(?), ref: 0084F25F
SetFileAttributesW.KERNEL32(?,?), ref: 0084F279
FindNextFileW.KERNEL32(00000000,?), ref: 0084F291
FindClose.KERNEL32(00000000), ref: 0084F29C
FindFirstFileW.KERNEL32(*.*,?), ref: 0084F2B8
_wcscmp.LIBCMT ref: 0084F2DF
_wcscmp.LIBCMT ref: 0084F2F6
SetCurrentDirectoryW.KERNEL32(?), ref: 0084F308
SetCurrentDirectoryW.KERNEL32(0089A5A0), ref: 0084F326
FindNextFileW.KERNEL32(00000000,00000010), ref: 0084F330
FindClose.KERNEL32(00000000), ref: 0084F33D
FindClose.KERNEL32(00000000), ref: 0084F34F

Strings

*.*, xrefs: 0084F2B3

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 2c2bac21eee31f49c6b4e5f5625a824015d92a597dd2ac8c3bdecc692f036dda
Instruction ID: 679a2aae59f28c9a57cf5d408b982db7a819621a4a3c43eb602a9716da67d82f
Opcode Fuzzy Hash: 2c2bac21eee31f49c6b4e5f5625a824015d92a597dd2ac8c3bdecc692f036dda
Instruction Fuzzy Hash: 3F31B17660021D6ADB10DFB4EC58ADE77ACFF08360F15017AEA14D3292EB74DA45CA60

Function 00860AE2 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00860BDE
RegCreateKeyExW.ADVAPI32(?,?,00000000,0086F910,00000000,?,00000000,?,?), ref: 00860C4C
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00860C94
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00860D1D
RegCloseKey.ADVAPI32(?), ref: 0086103D
RegCloseKey.ADVAPI32(00000000), ref: 0086104A

Strings

REG_DWORD, xrefs: 00860F0E
REG_EXPAND_SZ, xrefs: 00860CBA
REG_MULTI_SZ, xrefs: 00860E05
REG_QWORD, xrefs: 00860F8B
REG_SZ, xrefs: 00860D5B
REG_BINARY, xrefs: 00860FD8

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: bcda201d940163d20a9db751cec5474e5e36f1059bc721bb2a9c6ca247fa43e8
Instruction ID: 00dafaf1c3310b2310af549933f824a4b97da8b7b1b8a45e5e63b20bc8283683
Opcode Fuzzy Hash: bcda201d940163d20a9db751cec5474e5e36f1059bc721bb2a9c6ca247fa43e8
Instruction Fuzzy Hash: 4F024975200651DFCB14EF19C885A2AB7E5FF88714F05885DF98A9B3A2CB34ED41CB82

Function 0084F35D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 0084F37E
_wcscmp.LIBCMT ref: 0084F393
_wcscmp.LIBCMT ref: 0084F3AA

Part of subcall function 008445C1: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 008445DC

FindNextFileW.KERNEL32(00000000,?), ref: 0084F3D9
FindClose.KERNEL32(00000000), ref: 0084F3E4
FindFirstFileW.KERNEL32(*.*,?), ref: 0084F400
_wcscmp.LIBCMT ref: 0084F427
_wcscmp.LIBCMT ref: 0084F43E
SetCurrentDirectoryW.KERNEL32(?), ref: 0084F450
SetCurrentDirectoryW.KERNEL32(0089A5A0), ref: 0084F46E
FindNextFileW.KERNEL32(00000000,00000010), ref: 0084F478
FindClose.KERNEL32(00000000), ref: 0084F485
FindClose.KERNEL32(00000000), ref: 0084F497

Strings

*.*, xrefs: 0084F3FB

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 27b5c771c89bcffd8f937f974ee811ec4b9eac78f3e448f9e837843e83d560f1
Instruction ID: 3d0257191052f45a6aeb781d770107da780b8ec5a65b268e4acd628d7c47c204
Opcode Fuzzy Hash: 27b5c771c89bcffd8f937f974ee811ec4b9eac78f3e448f9e837843e83d560f1
Instruction Fuzzy Hash: 9B31D37160121D6BCF10AFA4EC88ADE77ACFF49324F150179EA14E32A2DB74DE44CA64

Function 008381F7 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0083874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00838766
Part of subcall function 0083874A: GetLastError.KERNEL32(?,0083822A,?,?,?), ref: 00838770
Part of subcall function 0083874A: GetProcessHeap.KERNEL32(00000008,?,?,0083822A,?,?,?), ref: 0083877F
Part of subcall function 0083874A: HeapAlloc.KERNEL32(00000000,?,0083822A,?,?,?), ref: 00838786
Part of subcall function 0083874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0083879D

Part of subcall function 008387E7: GetProcessHeap.KERNEL32(00000008,00838240,00000000,00000000,?,00838240,?), ref: 008387F3
Part of subcall function 008387E7: HeapAlloc.KERNEL32(00000000,?,00838240,?), ref: 008387FA
Part of subcall function 008387E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00838240,?), ref: 0083880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 0083825B
_memset.LIBCMT ref: 00838270
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 0083828F
GetLengthSid.ADVAPI32(?), ref: 008382A0
GetAce.ADVAPI32(?,00000000,?), ref: 008382DD
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 008382F9
GetLengthSid.ADVAPI32(?), ref: 00838316
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00838325
HeapAlloc.KERNEL32(00000000), ref: 0083832C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 0083834D
CopySid.ADVAPI32(00000000), ref: 00838354
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00838385
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 008383AB
SetUserObjectSecurity.USER32(?,00000004,?), ref: 008383BF

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 321f3c529563e4883a46c8955ca96129dca18a274f586d5999ce73276728c87a
Instruction ID: dccf0e8dadbdf0e9b8b5ce7f164ac962d534fbead36b2b8b0147417f961df3f0
Opcode Fuzzy Hash: 321f3c529563e4883a46c8955ca96129dca18a274f586d5999ce73276728c87a
Instruction Fuzzy Hash: 58615671900209EFDF019FA4DC85AAEBBB9FF84700F148129F915E6391DB719A05CBA1

Function 007F6843 Relevance: 18.4, Strings: 14, Instructions: 883COMMON

Download Yara Rule

Strings

ANYCRLF), xrefs: 00831734
NO_START_OPT), xrefs: 00831588
CR), xrefs: 008316C0
LIMIT_RECURSION=, xrefs: 00831635
ANY), xrefs: 00831717
BSR_UNICODE), xrefs: 00831771
UTF), xrefs: 00831533
UCP), xrefs: 00831546
LF), xrefs: 008316DD
BSR_ANYCRLF), xrefs: 00831757
UTF16), xrefs: 00831508
LIMIT_MATCH=, xrefs: 008315A9
NO_AUTO_POSSESS), xrefs: 00831567
CRLF), xrefs: 008316FA

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-4052911093
Opcode ID: e43519037f04ce8ae940c92fd3532bbed1ed4d4324d0c291843a2388fe1ee828
Instruction ID: db77ce497da250fa02151cd741117837e53933b6ac9e5f15cd059fcb8369ee07
Opcode Fuzzy Hash: e43519037f04ce8ae940c92fd3532bbed1ed4d4324d0c291843a2388fe1ee828
Instruction Fuzzy Hash: 1B726E71E002199BDF24DF58C8847BEB7B5FF88710F14816AE949EB394EB749981CB90

Function 00860665 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 008610A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00860038,?,?), ref: 008610BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00860737

Part of subcall function 007E9997: __itow.LIBCMT ref: 007E99C2
Part of subcall function 007E9997: __swprintf.LIBCMT ref: 007E9A0C

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 008607D6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 0086086E
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00860AAD
RegCloseKey.ADVAPI32(00000000), ref: 00860ABA

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: a3b7ee3431cd21c68f93744c8587aa3800f8929a35e8baf92004e260731a9996
Instruction ID: a9cd3a58898f4daf2663b144f46cf753ee10e7688ba03abd3eded5664a4f668a
Opcode Fuzzy Hash: a3b7ee3431cd21c68f93744c8587aa3800f8929a35e8baf92004e260731a9996
Instruction Fuzzy Hash: BDE14B31204214AFCB14DF69C895E2BBBE9FF89714B05856DF54ADB262DB30E901CF52

Function 00840219 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00840241
GetAsyncKeyState.USER32(000000A0), ref: 008402C2
GetKeyState.USER32(000000A0), ref: 008402DD
GetAsyncKeyState.USER32(000000A1), ref: 008402F7
GetKeyState.USER32(000000A1), ref: 0084030C
GetAsyncKeyState.USER32(00000011), ref: 00840324
GetKeyState.USER32(00000011), ref: 00840336
GetAsyncKeyState.USER32(00000012), ref: 0084034E
GetKeyState.USER32(00000012), ref: 00840360
GetAsyncKeyState.USER32(0000005B), ref: 00840378
GetKeyState.USER32(0000005B), ref: 0084038A

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 3b14c3cae893ffa5badfacd4fc7953e39b5a79726ee535e4ab1e86ec360a2e28
Instruction ID: ba02db65bcc0c64eed1ca77ece44b50518c81874abc0102317a7961216dbc9d1
Opcode Fuzzy Hash: 3b14c3cae893ffa5badfacd4fc7953e39b5a79726ee535e4ab1e86ec360a2e28
Instruction Fuzzy Hash: ED4154345087DD6AFB319B6498083A7BEA1FB11344F08455AD7C6962C2D6F49DC48F92

Function 008586D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 007E9997: __itow.LIBCMT ref: 007E99C2
Part of subcall function 007E9997: __swprintf.LIBCMT ref: 007E9A0C

CoInitialize.OLE32 ref: 00858718
CoUninitialize.OLE32 ref: 00858723
CoCreateInstance.OLE32(?,00000000,00000017,00872BEC,?), ref: 00858783
IIDFromString.OLE32(?,?), ref: 008587F6
VariantInit.OLEAUT32(?), ref: 00858890
VariantClear.OLEAUT32(?), ref: 008588F1

Strings

Invalid parameter, xrefs: 0085880F
Failed to create object, xrefs: 0085878E, 00858844
NULL Pointer assignment, xrefs: 008587C8

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 350b00d3fe0060f21c6e3c8a4b16f1fc7c2d3240cb99b62eced8d628bc47cbeb
Instruction ID: 1191c1a024b273545cb1e85236ff7e74a7c89fa0d30dab898ac19e9f7040c9eb
Opcode Fuzzy Hash: 350b00d3fe0060f21c6e3c8a4b16f1fc7c2d3240cb99b62eced8d628bc47cbeb
Instruction Fuzzy Hash: 6561A071608301DFD710DF24C848A6ABBE8FF48715F14486AF985EB291DB74ED48CB92

Function 00854458 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0085447F
EmptyClipboard.USER32 ref: 00854485
GlobalAlloc.KERNEL32(00000002,?), ref: 0085449A
CloseClipboard.USER32 ref: 00854539

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 293fa0fdba340bb41d183e92e126c38b4a9fbf2a951360949f066472073d36f4
Instruction ID: 3634d1bec127a4dadf6b4c45b656e93a26bcb7b6f1146bd8ecc4e11e7b55b87f
Opcode Fuzzy Hash: 293fa0fdba340bb41d183e92e126c38b4a9fbf2a951360949f066472073d36f4
Instruction Fuzzy Hash: DA21A135201220AFDB10AF24FC09B697BA8FF54715F11902AFA06DB2B2DBB4EC40CB55

Function 00843A2B Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 007E48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007E48A1,?,?,007E37C0,?), ref: 007E48CE

Part of subcall function 00844CD3: GetFileAttributesW.KERNEL32(?,00843947), ref: 00844CD4

FindFirstFileW.KERNEL32(?,?), ref: 00843ADF
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00843B87
MoveFileW.KERNEL32(?,?), ref: 00843B9A
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00843BB7
FindNextFileW.KERNEL32(00000000,00000010), ref: 00843BD9
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00843BF5

Strings

\*.*, xrefs: 00843A8A, 00843A93, 00843AA8

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 53f672872dfd92f3242a27b912d49a48e62bc4bbd6643ef0caf3639fe0cdeea0
Instruction ID: a48f8325d9cdb2a95dfa040ffa010947bb6d2ec9782b7bbd49d74892e236c4fd
Opcode Fuzzy Hash: 53f672872dfd92f3242a27b912d49a48e62bc4bbd6643ef0caf3639fe0cdeea0
Instruction Fuzzy Hash: BD51A33180218C9ACF15EBA1DD969EDB778FF18314F244169E441B7192EF746F09CBA0

Function 0084F65E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 007E7F41: _memmove.LIBCMT ref: 007E7F82

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 0084F6AB
Sleep.KERNEL32(0000000A), ref: 0084F6DB
_wcscmp.LIBCMT ref: 0084F6EF
_wcscmp.LIBCMT ref: 0084F70A
FindNextFileW.KERNEL32(?,?), ref: 0084F7A8
FindClose.KERNEL32(00000000), ref: 0084F7BE

Strings

*.*, xrefs: 0084F690

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 5de76650723542e6702b49099483c731b0ea56462dd13220eace65e15927652e
Instruction ID: 051e8e49d9594ad6e02f1580a7551e732090bef5c1015d6bc0d151d3224ab48a
Opcode Fuzzy Hash: 5de76650723542e6702b49099483c731b0ea56462dd13220eace65e15927652e
Instruction Fuzzy Hash: 1041A07190124E9FDF15DF64CC49AEEBBB4FF09314F14456AE914E2292EB349E44CB90

Function 007F4140 Relevance: 11.6, APIs: 1, Strings: 5, Instructions: 1132COMMON

Download Yara Rule

Strings

VUUU, xrefs: 007F44DB
VUUU, xrefs: 007F44ED
VUUU, xrefs: 00827B0C
VUUU, xrefs: 007F4520
ERCP, xrefs: 007F421F

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 972c1e1d9a56c6aaa1624df9ee496034f1b640f8f52a27093e557c5af5c7c4b7
Instruction ID: efe07c9cc38aeb3b9c4c3293e40154d2e3446f367f789bb6aa1f70d083d989fe
Opcode Fuzzy Hash: 972c1e1d9a56c6aaa1624df9ee496034f1b640f8f52a27093e557c5af5c7c4b7
Instruction Fuzzy Hash: BAA25874A0422A8BDF24CF59D9807BEB7B1FB54314F1481AADA56E7380E7789EC1CB50

Function 007F58C0 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007F5A05
_memmove.LIBCMT ref: 007F5A55
_memmove.LIBCMT ref: 007F5ABB

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 20e962eda93fdf5e3cd2193c6704e14686db33717b67ae1deb52fa3919fe94c1
Instruction ID: 92fd7081d9abdfc0244b6989baa1c1d79cd03c3e0d5e6807e015d7c4e4c9b399
Opcode Fuzzy Hash: 20e962eda93fdf5e3cd2193c6704e14686db33717b67ae1deb52fa3919fe94c1
Instruction Fuzzy Hash: C7129970A00609DFDF14DFA5D985AAEB7F5FF48300F108129E546E7291EB39AD21CB91

Function 0084545F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00838CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00838D0D
Part of subcall function 00838CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00838D3A
Part of subcall function 00838CC3: GetLastError.KERNEL32 ref: 00838D47

ExitWindowsEx.USER32(?,00000000), ref: 0084549B

Strings

@, xrefs: 0084548E
SeShutdownPrivilege, xrefs: 0084546B
, xrefs: 00845489

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 43ef4d79a60a1140b6a0c69e1817225155e8630705ad4d78b7aa3a4e582c11c0
Instruction ID: e83df2b7e1f0f4426dae1f4a478d413770edc71996af4133c47127e1b2121bad
Opcode Fuzzy Hash: 43ef4d79a60a1140b6a0c69e1817225155e8630705ad4d78b7aa3a4e582c11c0
Instruction Fuzzy Hash: 260142B1655B0D6BF7286278EC4BBBE7258FB00352F240030FD07DA0C3DA904C8081E9

Function 00856596 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 008565EF
WSAGetLastError.WSOCK32(00000000), ref: 008565FE
bind.WSOCK32(00000000,?,00000010), ref: 0085661A
listen.WSOCK32(00000000,00000005), ref: 00856629
WSAGetLastError.WSOCK32(00000000), ref: 00856643
closesocket.WSOCK32(00000000,00000000), ref: 00856657

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 0f4ee76b15e60511aa83a3e8d444e7def025f05c2535eb9c5b0957a6b10c1ddd
Instruction ID: b2dde08c171114f3dc635917ad619fe9fc40c437b346c9cf826cc9677653f667
Opcode Fuzzy Hash: 0f4ee76b15e60511aa83a3e8d444e7def025f05c2535eb9c5b0957a6b10c1ddd
Instruction Fuzzy Hash: 9821C1352002049FCB00AF28D889B6EB7E9FF48321F158169EA16E73D2DB70AD14CB51

Function 007F5680 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00800FF6: std::exception::exception.LIBCMT ref: 0080102C
Part of subcall function 00800FF6: __CxxThrowException@8.LIBCMT ref: 00801041

_memmove.LIBCMT ref: 0083062F
_memmove.LIBCMT ref: 00830744
_memmove.LIBCMT ref: 008307EB

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 318d56d8153ad8bb17c9587b8b436b5ce0c9e25a54f9b73b58aeba17cb69af04
Instruction ID: b2d2f7637eebbaac94814378033265dfa9fba7ccdcc1e712679cdc8f5550f7fc
Opcode Fuzzy Hash: 318d56d8153ad8bb17c9587b8b436b5ce0c9e25a54f9b73b58aeba17cb69af04
Instruction Fuzzy Hash: BD029EB0A01209DBDF04DF68D995ABEBBB5FF84300F148069E906DB395EB35DA50CB91

Function 007E1287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 007E2612: GetWindowLongW.USER32(?,000000EB), ref: 007E2623

DefDlgProcW.USER32(?,?,?,?,?), ref: 007E19FA
GetSysColor.USER32(0000000F), ref: 007E1A4E
SetBkColor.GDI32(?,00000000), ref: 007E1A61

Part of subcall function 007E1290: DefDlgProcW.USER32(?,00000020,?), ref: 007E12D8

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: e89764f40aad94e021edc1b61bb13f281f9ab0ed0f61bd4505f98ad740270e25
Instruction ID: 5a645eadd1de01cc145fa63f96984e9385744fedd1915d05f10fe21349d8b10c
Opcode Fuzzy Hash: e89764f40aad94e021edc1b61bb13f281f9ab0ed0f61bd4505f98ad740270e25
Instruction Fuzzy Hash: AEA17AB01070C4BAE624AB3F9C4BDBF265DFF4E359B954129F402D6592DA3CDC4182B2

Function 00856A5A Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 008580A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 008580CB

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00856AB1
WSAGetLastError.WSOCK32(00000000), ref: 00856ADA
bind.WSOCK32(00000000,?,00000010), ref: 00856B13
WSAGetLastError.WSOCK32(00000000), ref: 00856B20
closesocket.WSOCK32(00000000,00000000), ref: 00856B34

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 730df6df17d71a149d01aa31e26aa6ed10a9b09251ebbfbd81b2a4e395509c33
Instruction ID: e05cbd1b3f36f0b3a3c0436e3e8597894b00df5a66bcc2fe94cef96e742a27e1
Opcode Fuzzy Hash: 730df6df17d71a149d01aa31e26aa6ed10a9b09251ebbfbd81b2a4e395509c33
Instruction Fuzzy Hash: B6419675600214EFEB10AF29DC8AF6E77A9EF48710F448058FA19AB2D2DA749D008791

Function 008655FD Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 0086564C
IsWindowEnabled.USER32 ref: 0086565A
GetForegroundWindow.USER32(?,?,00000001), ref: 00865667
IsIconic.USER32 ref: 00865675
IsZoomed.USER32 ref: 00865683

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: afa8a07d13db65a6620b5a08b9d9b0fd36e6ce3fef3cf809e0858aa93be1d88e
Instruction ID: c372e1b1b468e590c5de5e06eff5df7a077068e96d17690936fa4fd14583774e
Opcode Fuzzy Hash: afa8a07d13db65a6620b5a08b9d9b0fd36e6ce3fef3cf809e0858aa93be1d88e
Instruction Fuzzy Hash: 0411C472301911AFE7211F26DC48A6F7B98FF68721F428039F946D7242CB74DD01CAA5

Function 0085C304 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00821D88,?), ref: 0085C312
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0085C324

Strings

GetSystemWow64DirectoryW, xrefs: 0085C31E
kernel32.dll, xrefs: 0085C30D

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 22414ee354793e335e3731a218774313dbd6b9784a304238b9cbdff8ae6eb232
Instruction ID: 112d700e8d6f1ede0217ad3165af117749dac6250c412604756959a41434b999
Opcode Fuzzy Hash: 22414ee354793e335e3731a218774313dbd6b9784a304238b9cbdff8ae6eb232
Instruction Fuzzy Hash: 9EE08C70200703CFCF205B25E804A8676D8FF09756F808439E995C2350E7B8D884CB60

Function 007F3190 Relevance: 6.6, APIs: 4, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: 3c9891d698755bbd333fb46efd974cff6c6441d0041b7dc84ee67294c941ee29
Instruction ID: 642773fe7a35431fbef7e106b193c8dde3a00415dd0a20dfeb528af58e895d4f
Opcode Fuzzy Hash: 3c9891d698755bbd333fb46efd974cff6c6441d0041b7dc84ee67294c941ee29
Instruction Fuzzy Hash: 64227771508355DBC724DF28C885B6AB7E4FF88710F10492DFA9697391EB38EA44CB92

Function 0085F121 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0085F151
Process32FirstW.KERNEL32(00000000,?), ref: 0085F15F

Part of subcall function 007E7F41: _memmove.LIBCMT ref: 007E7F82

Process32NextW.KERNEL32(00000000,?), ref: 0085F21F
CloseHandle.KERNEL32(00000000,?,?,?), ref: 0085F22E

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 0a1659b2d72c98217b34afdff7f4051e7fb558b430eead6f9f98588e52828236
Instruction ID: fbc8137a21a1eaa01f0fb08211cb26b8a9b4b3fe9a2eba42a10d61e378d2ae1c
Opcode Fuzzy Hash: 0a1659b2d72c98217b34afdff7f4051e7fb558b430eead6f9f98588e52828236
Instruction Fuzzy Hash: 31516C715053409FD310EF25DC85A6BBBE8FF88710F10492DF99597292EB74A908CB92

Function 008440B1 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 008440D1
_memset.LIBCMT ref: 008440F2
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00844144
CloseHandle.KERNEL32(00000000), ref: 0084414D

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 26d92be0aef29b921bb083ea26f3cd775839718525505e18c625993eaf4c27ae
Instruction ID: 47b6f470856630c6170648b3502fcf78249eb0e6684f0bc7913fab08c3121ba8
Opcode Fuzzy Hash: 26d92be0aef29b921bb083ea26f3cd775839718525505e18c625993eaf4c27ae
Instruction Fuzzy Hash: 1511AB7590122C7AD7305BA5AC4DFABBB7CFF45760F104196F908D7280D6748E808BA4

Function 0083EB07 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 0083EB19

Strings

(, xrefs: 0083EB5F
|, xrefs: 0083EB49

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: e44971ce6d8d7280ee8373b300d343cf938189afe860f59735a1accc28fd847f
Instruction ID: 0ee04c6164457f9d4920930a5495d492545d6ffc3f1b143fd01e52e85447f6f0
Opcode Fuzzy Hash: e44971ce6d8d7280ee8373b300d343cf938189afe860f59735a1accc28fd847f
Instruction Fuzzy Hash: 37321675A006059FDB28DF19C481A6AB7F1FF88320F15C56EE59ADB3A1DB70E941CB80

Function 008525E2 Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000), ref: 008526D5
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 0085270C

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 716131d4359942cbec07556daeb982a2a4c797837a4dbb58368c6f675874f831
Instruction ID: d4a9f3742aecbce5d5c6ff36a68e871420c14187ebb5d10e2566dede59523f0f
Opcode Fuzzy Hash: 716131d4359942cbec07556daeb982a2a4c797837a4dbb58368c6f675874f831
Instruction Fuzzy Hash: 9941D271500209BFEB20DB94DC85EBBB7ECFB5572AF10406AFA01E6140EE709E499B60

Function 0084B59E Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0084B5AE
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 0084B608
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 0084B655

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: fcb29e9e3428a78687a780fdce3b9c88c37e1e5057e0fd97aff52c3d45f918b6
Instruction ID: 1e91813dc27373e14f0ca5656edfcde7bdb9b247ae278452cc0efb7ae9883cc4
Opcode Fuzzy Hash: fcb29e9e3428a78687a780fdce3b9c88c37e1e5057e0fd97aff52c3d45f918b6
Instruction Fuzzy Hash: 42216D75A00518EFCB00EFA5E884AEDBBB8FF49314F1580AAE905EB351DB31A915CB51

Function 00838CC3 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00800FF6: std::exception::exception.LIBCMT ref: 0080102C
Part of subcall function 00800FF6: __CxxThrowException@8.LIBCMT ref: 00801041

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00838D0D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00838D3A
GetLastError.KERNEL32 ref: 00838D47

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 544b59c4295fc326d2933921ab5d284a51bcc295cbc086186b56bfb6d12341ed
Instruction ID: b167c5048970d9efefb2810c9e113b1431a7f5bd38cb0eb5d321b6b86a7ed2a9
Opcode Fuzzy Hash: 544b59c4295fc326d2933921ab5d284a51bcc295cbc086186b56bfb6d12341ed
Instruction Fuzzy Hash: FD118FB2414309AFE728DF58EC85D6BB7B8FB44710B20852EF456D7291EF70EC418A60

Function 00844C03 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00844C2C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00844C43
FreeSid.ADVAPI32(?), ref: 00844C53

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 5ff1f54db711d9dd3206476205d6f4a1a2cf7c39bb303e284c4bfd6196f75984
Instruction ID: acdb748e8a3850f821c1a4af8adf851f39910a56a5b4b3c5a6e2ccc835f39bd5
Opcode Fuzzy Hash: 5ff1f54db711d9dd3206476205d6f4a1a2cf7c39bb303e284c4bfd6196f75984
Instruction Fuzzy Hash: E5F03C7591120CBBDB04DFE09D89AADB7B8FB08201F004469E601E2182D7709A048B51

Function 007EE060 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9eb9004bafd9bc91a49a61a92c4534fbc4112aac994f3b4cc6ae750a1db5e478
Instruction ID: ec35388513fefde83744381b955dcd75afd2239c242e23eddbcef07ca64019ab
Opcode Fuzzy Hash: 9eb9004bafd9bc91a49a61a92c4534fbc4112aac994f3b4cc6ae750a1db5e478
Instruction Fuzzy Hash: 8F22D27090125ACFDB24DF59C494ABEB7F0FF08310F148869E9569B395E738AD81CB91

Function 0084C93C Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0084C966
FindClose.KERNEL32(00000000), ref: 0084C996

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 343cc133be9c8719d9ce5f259deabe8d9eeeff13a87edd18672818f3ebc41371
Instruction ID: 17bc5a84078a5610226d4d3b0050430c63d1df009646125521d1dc1a2ba9632f
Opcode Fuzzy Hash: 343cc133be9c8719d9ce5f259deabe8d9eeeff13a87edd18672818f3ebc41371
Instruction Fuzzy Hash: AD115E726106149FD710EF29D849A6AFBE9FF98324F01851EF9A9D7391DB74AC00CB81

Function 0084A2D5 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,0085977D,?,0086FB84,?), ref: 0084A302
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,0085977D,?,0086FB84,?), ref: 0084A314

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 9c0965146f6ac5f371c40d65788f8f5820b94edd467eab78251ed56df4e5c070
Instruction ID: 9f30a7a48404c8c8df54d7df911174b45919ad07ee646d6c7a9d893317cf9114
Opcode Fuzzy Hash: 9c0965146f6ac5f371c40d65788f8f5820b94edd467eab78251ed56df4e5c070
Instruction Fuzzy Hash: D9F0E23114822DABDB109FA4CC48FEA736CFF08761F004265F908D6281E6709940CBA1

Function 00838713 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00838851), ref: 00838728
CloseHandle.KERNEL32(?,?,00838851), ref: 0083873A

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: ef8ab4bf00705056ba70cf59927cb16fa1c8b5c6c637e41f7118afa6feee95d0
Instruction ID: bca431ebd85204245f6a4d9ef66b029bfa26a5ccb70ac24eb82eee736ba7c5de
Opcode Fuzzy Hash: ef8ab4bf00705056ba70cf59927cb16fa1c8b5c6c637e41f7118afa6feee95d0
Instruction Fuzzy Hash: 81E04632000A00EEEB222B24FC08D737BA9FB00360B208829F596C0471CBA2AC90DB50

Function 0080A395 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00808F97,?,?,?,00000001), ref: 0080A39A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 0080A3A3

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b864b535d653b3bd3bbf2e5a6d656614e1cc510d4fff8736c49a9e43a473db64
Instruction ID: 0c1f27dd89c5ca22dcd24f80bbf595ab00b4941569ae443e1eae3c971cb4b848
Opcode Fuzzy Hash: b864b535d653b3bd3bbf2e5a6d656614e1cc510d4fff8736c49a9e43a473db64
Instruction Fuzzy Hash: 67B09231058208ABCA002B91FD09B883F68FB44AA2F415020F70D84362EBA294508A91

Function 0080F419 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 747bf7f3e0e71157e4ca6a1afa9bd9d5fb6dfda9b191a1d81c7abaebcf106bc9
Instruction ID: 0ffaee3f1657a2e136bed80d384800652743f9f232f8479d43e6875b5a88b04b
Opcode Fuzzy Hash: 747bf7f3e0e71157e4ca6a1afa9bd9d5fb6dfda9b191a1d81c7abaebcf106bc9
Instruction Fuzzy Hash: 7332DD22D69F454DE7639634DC26326A248FFA63D4F15D737E81AB5EAAEB28C4C34100

Function 0081267E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b823a865b41dbe5bea37303f28e3ea0ac0eed0275c13ec0136f4a0112061fa0d
Instruction ID: 4533e7868a0195cee602b8af93f693fe1be991be9d1193febbbc8be01005f13f
Opcode Fuzzy Hash: b823a865b41dbe5bea37303f28e3ea0ac0eed0275c13ec0136f4a0112061fa0d
Instruction Fuzzy Hash: 3EB1F020D2AF514DD2239A398879336B64CBFFB2D5B51D71BFC2A74E26EB2281C34141

Function 00848B13 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00848B25

Part of subcall function 0080543A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,008491F8,00000000,?,?,?,?,008493A9,00000000,?), ref: 00805443
Part of subcall function 0080543A: __aulldiv.LIBCMT ref: 00805463

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: f5e3b0ca7a5286b66022f6d59d7f25c687cc46af340ab109b0b3de8ac13f9559
Instruction ID: fdd955076b097d327b48f215cb9d2fb87b8b4e5d03cc4427cde4408b5590b9e1
Opcode Fuzzy Hash: f5e3b0ca7a5286b66022f6d59d7f25c687cc46af340ab109b0b3de8ac13f9559
Instruction Fuzzy Hash: 2C21DF72625610CFD729CF29D841A52B3E1FBA5321F288E6CD0E5CB2D0CA74B905DB94

Function 008541FD Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00854218

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 5755de848b57755f43259f699504e1e5dfe4522237f6ad7bf3f31232025f65e3
Instruction ID: 3029419e8905457afa58b903834030808d4b8d953ff745ee353a0ad5b435bdb6
Opcode Fuzzy Hash: 5755de848b57755f43259f699504e1e5dfe4522237f6ad7bf3f31232025f65e3
Instruction Fuzzy Hash: E3E048722401149FC710EF5AD444A9AF7D8FF587A5F01D025FD4AD7352DA74E844CBA0

Function 00844EC9 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00844EEC

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: dc2edfda1286a4358da6189cc51eac49857d0a287f7fc2e28bc5d78eae1a2c38
Instruction ID: e45dfad84cadf6527e2a739f285bd17da4a47b5f096a8fabfdd01382f7b9617b
Opcode Fuzzy Hash: dc2edfda1286a4358da6189cc51eac49857d0a287f7fc2e28bc5d78eae1a2c38
Instruction Fuzzy Hash: 21D09E9916464D79FD584B249C5FF771109F3407A5FE4754AB102C90C2D8D56C556031

Function 00838C93 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,008388D1), ref: 00838CB3

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 2435ca0bd7596e03ba34eeee0df071d6506cb42142abfe2df5675f44677f74e6
Instruction ID: e5cb1c40153dca8c82d64436372ad430a5b0d6ab9bdb6ecb12213f3b72babd1c
Opcode Fuzzy Hash: 2435ca0bd7596e03ba34eeee0df071d6506cb42142abfe2df5675f44677f74e6
Instruction Fuzzy Hash: 78D05E3226090EBBEF018EA4ED01EAE3B69FB04B01F408111FE15C50A1C7B5D835AB60

Function 00822230 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00822242

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: edd5c7c4e41639c80fca016d4fccfbd48649b5a50f1bac0e5246a7e4f39519e4
Instruction ID: 9b967241456bf242aba8c37c246971262fb79275ae782910ff931468089fae40
Opcode Fuzzy Hash: edd5c7c4e41639c80fca016d4fccfbd48649b5a50f1bac0e5246a7e4f39519e4
Instruction Fuzzy Hash: 6DC04CF180011DDBDB05DB90E988DEE77BCBB14314F204055E201F2101D7749B448A71

Function 0080A364 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 0080A36A

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 17bbb2d849785bcd2e6b8b6f35b908f53e53e3933d25715d5f909e5bb0a93171
Instruction ID: f3e4eb4cfc605bcf02720c780852ebae9aa2838d6d6de1c0c9d8533229f888b1
Opcode Fuzzy Hash: 17bbb2d849785bcd2e6b8b6f35b908f53e53e3933d25715d5f909e5bb0a93171
Instruction Fuzzy Hash: 77A0113000020CAB8A002B82FC08888BFACEA002A0B008020FA0C80222ABB2A8208A80

Function 007F8A0E Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13b946d696e925be5080085b49d3e1b49fefaff996499d794f16d04cf9b93f08
Instruction ID: 3d8da38ca5da9fc586f0ff1b1b9e3443048d716ed67065d1cef2975388157006
Opcode Fuzzy Hash: 13b946d696e925be5080085b49d3e1b49fefaff996499d794f16d04cf9b93f08
Instruction Fuzzy Hash: 15223A7060565DCBCF688F14C49467D77A1FF82304F2884AADA52DB391EB389D81CBB2

Function 00802405 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: b39155f2565a218acd21c95d47a2bd2a2bd949f8d40898952c92ba946e983e17
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 6EC1943220509309DFAD86399D3813EBAE1FEA27B131A075DE8B3CB5D5EF60D564D620

Function 0080283A Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 6dd0f2cc27e3db753967a0263d92d2a8a52beb33ce1f1d8f4153ebe598f9d0bf
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: D4C195322051A309DFAD46399D3813EBBE1FBA27B131A076DE4B2DB5D4EF60D524D620

Function 00801BB8 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: a27948a5f4aba7ec88f34935283a86b0c6671ec6c7a2f16d0a69d103b8b288a6
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: ABC1533220519309DFAD463AD97813EBAE1FBA27B131A076DE8B2CB5D4EF20D564D610

Function 00857B1B Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00857B70
DeleteObject.GDI32(00000000), ref: 00857B82
DestroyWindow.USER32 ref: 00857B90
GetDesktopWindow.USER32 ref: 00857BAA
GetWindowRect.USER32(00000000), ref: 00857BB1
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00857CF2
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00857D02
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00857D4A
GetClientRect.USER32(00000000,?), ref: 00857D56
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00857D90
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00857DB2
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00857DC5
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00857DD0
GlobalLock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00857DD9
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00857DE8
GlobalUnlock.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00857DF1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00857DF8
GlobalFree.KERNEL32(00000000), ref: 00857E03
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00857E15
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00872CAC,00000000), ref: 00857E2B
GlobalFree.KERNEL32(00000000), ref: 00857E3B
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00857E61
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00857E80
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00857EA2
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0085808F

Strings

, xrefs: 00858015
static, xrefs: 00857D8A, 00857EE1
AutoIt v3, xrefs: 00857D42
DISPLAY, xrefs: 00857EF2

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 8cc3843c14299d62f6dd8cc3a488f5c72533b060e50fd0c4f28aed45f29f0841
Instruction ID: 93fbf8242fb9fdf5ca38307f8d8800a5befafb1adf2bfe0c40b329877f88e23f
Opcode Fuzzy Hash: 8cc3843c14299d62f6dd8cc3a488f5c72533b060e50fd0c4f28aed45f29f0841
Instruction Fuzzy Hash: C4025871900119EFDB14DF68EC89EAE7BB9FB49311F148158FA15EB2A1DB74AD00CB60

Function 008637F3 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,0086F910), ref: 008638AF
IsWindowVisible.USER32(?), ref: 008638D3

Strings

UNCHECK, xrefs: 00863B0B
TABRIGHT, xrefs: 00863925
FINDSTRING, xrefs: 008639FE
GETLINE, xrefs: 00863C23
ISCHECKED, xrefs: 00863AC1
GETCURRENTSELECTION, xrefs: 00863A6B
GETLINECOUNT, xrefs: 00863B4E
TABLEFT, xrefs: 0086390F
SELECTSTRING, xrefs: 00863A8E
ISVISIBLE, xrefs: 008638BF
GETSELECTED, xrefs: 00863B2B
ISENABLED, xrefs: 008638F3
CURRENTTAB, xrefs: 00863945
CHECK, xrefs: 00863AF5
GETCURRENTLINE, xrefs: 00863B75
DELSTRING, xrefs: 008639D1
EDITPASTE, xrefs: 00863BE7
HIDEDROPDOWN, xrefs: 00863988
ADDSTRING, xrefs: 0086399E
GETCURRENTCOL, xrefs: 00863BB0
SENDCOMMANDID, xrefs: 00863C62
SETCURRENTSELECTION, xrefs: 00863A3E
SHOWDROPDOWN, xrefs: 00863968

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 98fb09993bc1fc06f092e80970d31d8e6526e271b306a193566273ef7b3bc043
Instruction ID: 6afde055b215883e9bfd702e4d07ae0f212ffd61ef7ca3b0e8feeae24fb6a053
Opcode Fuzzy Hash: 98fb09993bc1fc06f092e80970d31d8e6526e271b306a193566273ef7b3bc043
Instruction Fuzzy Hash: A9D1AF30208305DBCB14EF54C955A6A7BA1FF94354F154468F986EB3E2CB34EE0ACB92

Function 0086A849 Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0086A89F
GetSysColorBrush.USER32(0000000F), ref: 0086A8D0
GetSysColor.USER32(0000000F), ref: 0086A8DC
SetBkColor.GDI32(?,000000FF), ref: 0086A8F6
SelectObject.GDI32(?,?), ref: 0086A905
InflateRect.USER32(?,000000FF,000000FF), ref: 0086A930
GetSysColor.USER32(00000010), ref: 0086A938
CreateSolidBrush.GDI32(00000000), ref: 0086A93F
FrameRect.USER32(?,?,00000000), ref: 0086A94E
DeleteObject.GDI32(00000000), ref: 0086A955
InflateRect.USER32(?,000000FE,000000FE), ref: 0086A9A0
FillRect.USER32(?,?,?), ref: 0086A9D2
GetWindowLongW.USER32(?,000000F0), ref: 0086A9FD

Part of subcall function 0086AB60: GetSysColor.USER32(00000012), ref: 0086AB99
Part of subcall function 0086AB60: SetTextColor.GDI32(?,?), ref: 0086AB9D
Part of subcall function 0086AB60: GetSysColorBrush.USER32(0000000F), ref: 0086ABB3
Part of subcall function 0086AB60: GetSysColor.USER32(0000000F), ref: 0086ABBE
Part of subcall function 0086AB60: GetSysColor.USER32(00000011), ref: 0086ABDB
Part of subcall function 0086AB60: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0086ABE9
Part of subcall function 0086AB60: SelectObject.GDI32(?,00000000), ref: 0086ABFA
Part of subcall function 0086AB60: SetBkColor.GDI32(?,00000000), ref: 0086AC03
Part of subcall function 0086AB60: SelectObject.GDI32(?,?), ref: 0086AC10
Part of subcall function 0086AB60: InflateRect.USER32(?,000000FF,000000FF), ref: 0086AC2F
Part of subcall function 0086AB60: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0086AC46
Part of subcall function 0086AB60: GetWindowLongW.USER32(00000000,000000F0), ref: 0086AC5B

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 09482b519e54902e684f0d4daff13def739ccdea191eca2a7bd7938f4e69908a
Instruction ID: da11e811ca92740c1854a93c13823134b58ad890d8f871bebcfc73b68ff247b1
Opcode Fuzzy Hash: 09482b519e54902e684f0d4daff13def739ccdea191eca2a7bd7938f4e69908a
Instruction Fuzzy Hash: 61A18F72008301EFD7159F64EC08A6B7BA9FF89321F125A29FA62E61A1D771D844CF52

Function 007E2C18 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 007E2CA2
DeleteObject.GDI32(00000000), ref: 007E2CE8
DeleteObject.GDI32(00000000), ref: 007E2CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 007E2CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 007E2D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 0081C68B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0081C6C4
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0081CAED

Part of subcall function 007E1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,007E2036,?,00000000,?,?,?,?,007E16CB,00000000,?), ref: 007E1B9A

SendMessageW.USER32(?,00001053), ref: 0081CB2A
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0081CB41
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0081CB57
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0081CB62

Strings

0, xrefs: 0081C981

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 80bbe227489dcde59f897ccdb5645a1bc5a61a653595ec9e25f6e4dccc35ead3
Instruction ID: 55137a631e494d4357ff6250fa3118827b0dd1b02961d0b5c0e81bfa1795268a
Opcode Fuzzy Hash: 80bbe227489dcde59f897ccdb5645a1bc5a61a653595ec9e25f6e4dccc35ead3
Instruction Fuzzy Hash: F512BF70645251EFCB11CF24C888BA9BBE9FF09310F144569E596DB262C771EC82CB61

Function 008577BE Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 008577F1
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 008578B0
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 008578EE
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00857900
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00857946
GetClientRect.USER32(00000000,?), ref: 00857952
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00857996
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 008579A5
GetStockObject.GDI32(00000011), ref: 008579B5
SelectObject.GDI32(00000000,00000000), ref: 008579B9
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 008579C9
GetDeviceCaps.GDI32(00000000,0000005A), ref: 008579D2
DeleteDC.GDI32(00000000), ref: 008579DB
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00857A07
SendMessageW.USER32(00000030,00000000,00000001), ref: 00857A1E
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00857A59
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00857A6D
SendMessageW.USER32(00000404,00000001,00000000), ref: 00857A7E
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00857AAE
GetStockObject.GDI32(00000011), ref: 00857AB9
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00857AC4
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00857ACE

Strings

static, xrefs: 00857990, 00857AA8
AutoIt v3, xrefs: 0085793E
msctls_progress32, xrefs: 00857A4F
DISPLAY, xrefs: 0085799B

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: d57c003cbbf94719e5997adb581edda528812d74ea674d374e2a1dc8c23a88a3
Instruction ID: 2a0b46f997d6c6b5b0bdc2d47230e4b8902c18297ca0f95f2929831177b031c8
Opcode Fuzzy Hash: d57c003cbbf94719e5997adb581edda528812d74ea674d374e2a1dc8c23a88a3
Instruction Fuzzy Hash: 20A18171A00215BFEB14DBA4DC4AFAA7BA9FB49710F048114FA15E72E1D7B4AD00CB64

Function 0084AF7B Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0084AF89
GetDriveTypeW.KERNEL32(?,0086FAC0,?,\\.\,0086F910), ref: 0084B066
SetErrorMode.KERNEL32(00000000,0086FAC0,?,\\.\,0086F910), ref: 0084B1C4

Strings

PhysicalDrive, xrefs: 0084B012
CDROM, xrefs: 0084B09A
ATAPI, xrefs: 0084B138
Virtual, xrefs: 0084B18C
Fibre, xrefs: 0084B154
RAID, xrefs: 0084B162
ATA, xrefs: 0084B13F
SCSI, xrefs: 0084B131
\\.\, xrefs: 0084AFDB
Unknown, xrefs: 0084B086, 0084B12A
FileBackedVirtual, xrefs: 0084B193
SAS, xrefs: 0084B170
RAMDisk, xrefs: 0084B090
MMC, xrefs: 0084B185
SATA, xrefs: 0084B177
SSD, xrefs: 0084B0F1
1394, xrefs: 0084B146
USB, xrefs: 0084B15B
iSCSI, xrefs: 0084B169
Fixed, xrefs: 0084B0AE
SSA, xrefs: 0084B14D
Network, xrefs: 0084B0A4
Removable, xrefs: 0084B0B8

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 4d7e1c43d1a5183b601de389887c525921970f5f0cc48b1242458cedd21c5b16
Instruction ID: 208861de90026b3dc78c2ec597c29dbbca396253ebff5d54dcf0dcb950f290fb
Opcode Fuzzy Hash: 4d7e1c43d1a5183b601de389887c525921970f5f0cc48b1242458cedd21c5b16
Instruction Fuzzy Hash: FE51B13068434DEBCF08EB94C9929BD73B1FB583497244015E42AEB391DB79ED41DB82

Function 007E6A3C Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 007E6A91
__wcsnicmp.LIBCMT ref: 007E6AA9
__wcsnicmp.LIBCMT ref: 007E6AC1
__wcsnicmp.LIBCMT ref: 007E6AD9
__wcsnicmp.LIBCMT ref: 007E6AF1
__wcsnicmp.LIBCMT ref: 007E6B09
__wcsnicmp.LIBCMT ref: 007E6B21
__wcsnicmp.LIBCMT ref: 007E6B35
__wcsnicmp.LIBCMT ref: 007E6B76
__wcsnicmp.LIBCMT ref: 007E6B8A
__wcsnicmp.LIBCMT ref: 007E6B9E
__wcsnicmp.LIBCMT ref: 007E6BB2

Strings

#OnAutoItStartRegister, xrefs: 007E6AD3
#ce, xrefs: 007E6BAC
Bad directive syntax error, xrefs: 0081E743
Unterminated group of comments, xrefs: 0081E82C
#notrayicon, xrefs: 007E6AA3
#comments-end, xrefs: 007E6B98
#comments-start, xrefs: 007E6B1B, 007E6B70
Cannot parse #include, xrefs: 0081E819
#pragma compile, xrefs: 007E6A8B
#cs, xrefs: 007E6B2F, 007E6B84
#requireadmin, xrefs: 007E6ABB
#include, xrefs: 007E6B03
#include-once, xrefs: 007E6AEB

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: fd335f069aeca8d309eb01b084b8e0ff6ac64c37978f770096532def85f92420
Instruction ID: 2352616bf4d827cc1c09c2af33ef1503ba2a7a4876f4cf422a649740c748e75b
Opcode Fuzzy Hash: fd335f069aeca8d309eb01b084b8e0ff6ac64c37978f770096532def85f92420
Instruction Fuzzy Hash: B6812DB0701655AADB24AB65CC86FBE775CFF28740F148025FD45EA1C2EB68DA41C2A1

Function 0086AB60 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0086AB99
SetTextColor.GDI32(?,?), ref: 0086AB9D
GetSysColorBrush.USER32(0000000F), ref: 0086ABB3
GetSysColor.USER32(0000000F), ref: 0086ABBE
CreateSolidBrush.GDI32(?), ref: 0086ABC3
GetSysColor.USER32(00000011), ref: 0086ABDB
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0086ABE9
SelectObject.GDI32(?,00000000), ref: 0086ABFA
SetBkColor.GDI32(?,00000000), ref: 0086AC03
SelectObject.GDI32(?,?), ref: 0086AC10
InflateRect.USER32(?,000000FF,000000FF), ref: 0086AC2F
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0086AC46
GetWindowLongW.USER32(00000000,000000F0), ref: 0086AC5B
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0086ACA7
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0086ACCE
InflateRect.USER32(?,000000FD,000000FD), ref: 0086ACEC
DrawFocusRect.USER32(?,?), ref: 0086ACF7
GetSysColor.USER32(00000011), ref: 0086AD05
SetTextColor.GDI32(?,00000000), ref: 0086AD0D
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0086AD21
SelectObject.GDI32(?,0086A869), ref: 0086AD38
DeleteObject.GDI32(?), ref: 0086AD43
SelectObject.GDI32(?,?), ref: 0086AD49
DeleteObject.GDI32(?), ref: 0086AD4E
SetTextColor.GDI32(?,?), ref: 0086AD54
SetBkColor.GDI32(?,?), ref: 0086AD5E

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: c247c8a166027dfb9a3b142c98181df22e1aa133a0ac49871d6656c69f19f36f
Instruction ID: eff7a89d58e2f4e8e2f008f3525a8bc79c2e064eac49e6df656462185e6d3f51
Opcode Fuzzy Hash: c247c8a166027dfb9a3b142c98181df22e1aa133a0ac49871d6656c69f19f36f
Instruction Fuzzy Hash: 2B615D71900218EFDB159FA4EC49AAE7B79FB08320F125125FA11BB2A1D7B5DD40DF90

Function 00868C44 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00868D34
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00868D45
CharNextW.USER32(0000014E), ref: 00868D74
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00868DB5
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00868DCB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00868DDC
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00868DF9
SetWindowTextW.USER32(?,0000014E), ref: 00868E45
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00868E5B
SendMessageW.USER32(?,00001002,00000000,?), ref: 00868E8C
_memset.LIBCMT ref: 00868EB1
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00868EFA
_memset.LIBCMT ref: 00868F59
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00868F83
SendMessageW.USER32(?,00001074,?,00000001), ref: 00868FDB
SendMessageW.USER32(?,0000133D,?,?), ref: 00869088
InvalidateRect.USER32(?,00000000,00000001), ref: 008690AA
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 008690F4
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00869121
DrawMenuBar.USER32(?), ref: 00869130
SetWindowTextW.USER32(?,0000014E), ref: 00869158

Strings

0, xrefs: 008690C2

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 8129dd2a91279c4a3d5cea54a787c33038dfb888c7b348b02674dd44df55a096
Instruction ID: 79591183d7ebb59af7a53d6531d2650067dcb8ae21f59e386a4d9180728de821
Opcode Fuzzy Hash: 8129dd2a91279c4a3d5cea54a787c33038dfb888c7b348b02674dd44df55a096
Instruction Fuzzy Hash: 19E18F70900209EBDF209F54CC88AEE7B79FF05714F118255FA19EA2E1DB748A81DF61

Function 00864B16 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00864C51
GetDesktopWindow.USER32 ref: 00864C66
GetWindowRect.USER32(00000000), ref: 00864C6D
GetWindowLongW.USER32(?,000000F0), ref: 00864CCF
DestroyWindow.USER32(?), ref: 00864CFB
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00864D24
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00864D42
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00864D68
SendMessageW.USER32(?,00000421,?,?), ref: 00864D7D
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00864D90
IsWindowVisible.USER32(?), ref: 00864DB0
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00864DCB
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00864DDF
GetWindowRect.USER32(?,?), ref: 00864DF7
MonitorFromPoint.USER32(?,?,00000002), ref: 00864E1D
GetMonitorInfoW.USER32(00000000,?), ref: 00864E37
CopyRect.USER32(?,?), ref: 00864E4E
SendMessageW.USER32(?,00000412,00000000), ref: 00864EB9

Strings

tooltips_class32, xrefs: 00864D1D
0, xrefs: 00864BFC
(, xrefs: 00864E2A

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: bbb2e52971a53f7f5207e575b2ae6e9223a8b0503aceb2367725ced373b72d81
Instruction ID: 4e028ad1684d2b36fef6e903a649af27006e16a46d54de337d4b76fdc0264a79
Opcode Fuzzy Hash: bbb2e52971a53f7f5207e575b2ae6e9223a8b0503aceb2367725ced373b72d81
Instruction Fuzzy Hash: 45B16971608340AFDB04DF65D848B6EBBE4FF88314F01991CF6999B2A2D7B5E804CB91

Function 007E27D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 007E28BC
GetSystemMetrics.USER32(00000007), ref: 007E28C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 007E28EF
GetSystemMetrics.USER32(00000008), ref: 007E28F7
GetSystemMetrics.USER32(00000004), ref: 007E291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 007E2939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 007E2949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 007E297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 007E2990
GetClientRect.USER32(00000000,000000FF), ref: 007E29AE
GetStockObject.GDI32(00000011), ref: 007E29CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 007E29D5

Part of subcall function 007E2344: GetCursorPos.USER32(?), ref: 007E2357
Part of subcall function 007E2344: ScreenToClient.USER32(008A67B0,?), ref: 007E2374
Part of subcall function 007E2344: GetAsyncKeyState.USER32(00000001), ref: 007E2399
Part of subcall function 007E2344: GetAsyncKeyState.USER32(00000002), ref: 007E23A7

SetTimer.USER32(00000000,00000000,00000028,007E1256), ref: 007E29FC

Strings

AutoIt v3 GUI, xrefs: 007E2974

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 7a5329c5e838a5ca1f2a8824bde3db31d9aefd4d6b44c7aa81da9f2a59d42815
Instruction ID: 70ba2bf1ebf913367074dd6ff01426733510b2872d6aa7a1d95f6ac1006b34e1
Opcode Fuzzy Hash: 7a5329c5e838a5ca1f2a8824bde3db31d9aefd4d6b44c7aa81da9f2a59d42815
Instruction Fuzzy Hash: E1B1AF7164024ADFDB14DFA8DC49BAD7BB8FB08314F118229FA16E7291DB78D851CB50

Function 00864069 Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 008640F6
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 008641B6

Strings

GETSELECTEDCOUNT, xrefs: 00864199
GETITEMCOUNT, xrefs: 00864128
FINDITEM, xrefs: 00864329
VIEWCHANGE, xrefs: 00864375
SELECTINVERT, xrefs: 00864286
SELECTCLEAR, xrefs: 00864235
DESELECT, xrefs: 008642A4
GETSELECTED, xrefs: 008642E4
GETSUBITEMCOUNT, xrefs: 00864141
GETTEXT, xrefs: 0086415F
ISSELECTED, xrefs: 008641C1
SELECT, xrefs: 00864250
SELECTALL, xrefs: 0086421D

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: a29d884c9e262ff32428533dd95f09fd340fbb2a331ee41e5ed426fcdaeefc97
Instruction ID: 8774b0173aa2493082aa40e344bb9993654cb85cd6e28a16b10936c5a40e589e
Opcode Fuzzy Hash: a29d884c9e262ff32428533dd95f09fd340fbb2a331ee41e5ed426fcdaeefc97
Instruction Fuzzy Hash: 17A1CD30214245DBCB04EF24C951A6EB3A5FF98314F15992CB9A6DB3D2EB34EC09CB52

Function 008552F0 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00855309
LoadCursorW.USER32(00000000,00007F8A), ref: 00855314
LoadCursorW.USER32(00000000,00007F00), ref: 0085531F
LoadCursorW.USER32(00000000,00007F03), ref: 0085532A
LoadCursorW.USER32(00000000,00007F8B), ref: 00855335
LoadCursorW.USER32(00000000,00007F01), ref: 00855340
LoadCursorW.USER32(00000000,00007F81), ref: 0085534B
LoadCursorW.USER32(00000000,00007F88), ref: 00855356
LoadCursorW.USER32(00000000,00007F80), ref: 00855361
LoadCursorW.USER32(00000000,00007F86), ref: 0085536C
LoadCursorW.USER32(00000000,00007F83), ref: 00855377
LoadCursorW.USER32(00000000,00007F85), ref: 00855382
LoadCursorW.USER32(00000000,00007F82), ref: 0085538D
LoadCursorW.USER32(00000000,00007F84), ref: 00855398
LoadCursorW.USER32(00000000,00007F04), ref: 008553A3
LoadCursorW.USER32(00000000,00007F02), ref: 008553AE
GetCursorInfo.USER32(?), ref: 008553BE
GetLastError.KERNEL32(00000001,00000000), ref: 008553E9

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 3378b5678d11bbf307f1ffab8da84eeba1b1916993fdc47745afb42e0ad990a2
Instruction ID: a44fbc68d8abf7671d008c623c78bf735886530953c1040a27bbd393577d8e1c
Opcode Fuzzy Hash: 3378b5678d11bbf307f1ffab8da84eeba1b1916993fdc47745afb42e0ad990a2
Instruction Fuzzy Hash: C7415370E04319AADB109FBA8C4996EFFF8FF51B50F10452FE509E7291DAB8A401CE55

Function 0083AA64 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0083AAA5
__swprintf.LIBCMT ref: 0083AB46
_wcscmp.LIBCMT ref: 0083AB59
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 0083ABAE
_wcscmp.LIBCMT ref: 0083ABEA
GetClassNameW.USER32(?,?,00000400), ref: 0083AC21
GetDlgCtrlID.USER32(?), ref: 0083AC73
GetWindowRect.USER32(?,?), ref: 0083ACA9
GetParent.USER32(?), ref: 0083ACC7
ScreenToClient.USER32(00000000), ref: 0083ACCE
GetClassNameW.USER32(?,?,00000100), ref: 0083AD48
_wcscmp.LIBCMT ref: 0083AD5C
GetWindowTextW.USER32(?,?,00000400), ref: 0083AD82
_wcscmp.LIBCMT ref: 0083AD96

Part of subcall function 0080386C: _iswctype.LIBCMT ref: 00803874

Strings

%s%u, xrefs: 0083AB40

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: ce85b1bf8e06e047bb522854457d2ec277f984ae5909b9e5b643f0436e9604c7
Instruction ID: eacc77e810cbf4d279e92701c8ea90cf3c6d8585eb49ec86c232d6566c6bbf2d
Opcode Fuzzy Hash: ce85b1bf8e06e047bb522854457d2ec277f984ae5909b9e5b643f0436e9604c7
Instruction Fuzzy Hash: 7AA1BE71204306AFDB18DF64C884BAAB7A8FF84315F008629FAE9D2591D770E955CBD2

Function 0083B397 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 0083B3DB
_wcscmp.LIBCMT ref: 0083B3EC
GetWindowTextW.USER32(00000001,?,00000400), ref: 0083B414
CharUpperBuffW.USER32(?,00000000), ref: 0083B431
_wcscmp.LIBCMT ref: 0083B44F
_wcsstr.LIBCMT ref: 0083B460
GetClassNameW.USER32(00000018,?,00000400), ref: 0083B498
_wcscmp.LIBCMT ref: 0083B4A8
GetWindowTextW.USER32(00000002,?,00000400), ref: 0083B4CF
GetClassNameW.USER32(00000018,?,00000400), ref: 0083B518
_wcscmp.LIBCMT ref: 0083B528
GetClassNameW.USER32(00000010,?,00000400), ref: 0083B550
GetWindowRect.USER32(00000004,?), ref: 0083B5B9

Strings

ThumbnailClass, xrefs: 0083B4A3, 0083B523
@, xrefs: 0083B3BC

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 419d0f8034877f6e31d6127cd82e501a6b8c3aec8709d054390945e719e20f9f
Instruction ID: 7dc111c6d138d5a5a0e870433eed3c18a724834cf54d7320f03fb93b94cf45f0
Opcode Fuzzy Hash: 419d0f8034877f6e31d6127cd82e501a6b8c3aec8709d054390945e719e20f9f
Instruction Fuzzy Hash: 4181C0B10083499BDB05DF14C885FAA7BE8FF94314F048569FE89CA092EB74DE45CBA1

Function 0083B1E0 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0083B23F

Strings

[LAST, xrefs: 0083B2EC
LAST, xrefs: 0083B204
[ACTIVE, xrefs: 0083B22C
REGEXP=, xrefs: 0083B254
CLASSNAME=, xrefs: 0083B27C
ALL, xrefs: 0083B2D3
HANDLE=, xrefs: 0083B238
[REGEXPTITLE:, xrefs: 0083B267
[ALL, xrefs: 0083B2E5
[HANDLE:, xrefs: 0083B24B
[CLASS:, xrefs: 0083B28F
ACTIVE, xrefs: 0083B21A

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 0d54f1c5fd37ce437143034395c88adc3d2960a334ec9162ed08eb424bed80ef
Instruction ID: d93fbdb29a4a9190c4d473e21d33e02c8a38fad9f2a6bfc492386eb92e2f8ad5
Opcode Fuzzy Hash: 0d54f1c5fd37ce437143034395c88adc3d2960a334ec9162ed08eb424bed80ef
Instruction Fuzzy Hash: 0231DE71A04249E6DF14FAA9CD43EEE77A8FF28750F240228F591F11D2EF696E04C592

Function 0083C4C1 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 0083C4D4
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0083C4E6
SetWindowTextW.USER32(?,?), ref: 0083C4FD
GetDlgItem.USER32(?,000003EA), ref: 0083C512
SetWindowTextW.USER32(00000000,?), ref: 0083C518
GetDlgItem.USER32(?,000003E9), ref: 0083C528
SetWindowTextW.USER32(00000000,?), ref: 0083C52E
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 0083C54F
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 0083C569
GetWindowRect.USER32(?,?), ref: 0083C572
SetWindowTextW.USER32(?,?), ref: 0083C5DD
GetDesktopWindow.USER32 ref: 0083C5E3
GetWindowRect.USER32(00000000), ref: 0083C5EA
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 0083C636
GetClientRect.USER32(?,?), ref: 0083C643
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 0083C668
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 0083C693

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 0571af2dcd566284defb882014bc094b66f680296e4b9552cda902bce56d6306
Instruction ID: 05c9970410cfa87a781b613055cfddb7439273d57dc1424cc831b2fd97b0528e
Opcode Fuzzy Hash: 0571af2dcd566284defb882014bc094b66f680296e4b9552cda902bce56d6306
Instruction Fuzzy Hash: 4A518B71900709AFDB20DFA8DD89B6EBBF5FF44704F004928E692E25A1D7B4E904CB90

Function 0086A428 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0086A4C8
DestroyWindow.USER32(?,?), ref: 0086A542

Part of subcall function 007E7D2C: _memmove.LIBCMT ref: 007E7D66

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0086A5BC
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0086A5DE
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0086A5F1
DestroyWindow.USER32(00000000), ref: 0086A613
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,007E0000,00000000), ref: 0086A64A
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0086A663
GetDesktopWindow.USER32 ref: 0086A67C
GetWindowRect.USER32(00000000), ref: 0086A683
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0086A69B
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0086A6B3

Part of subcall function 007E25DB: GetWindowLongW.USER32(?,000000EB), ref: 007E25EC

Strings

tooltips_class32, xrefs: 0086A5B5, 0086A643
0, xrefs: 0086A4DE

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: d46bfd1ba9dd521f05f35ff704849d074272f415b1262811c67aaac3ed474670
Instruction ID: bbbfc92491e48caefdf060664c5d2530342977842f4423518a53704630c61849
Opcode Fuzzy Hash: d46bfd1ba9dd521f05f35ff704849d074272f415b1262811c67aaac3ed474670
Instruction Fuzzy Hash: 5B719770140245AFE724CF28CC49F6A7BEAFBA8704F09452CF995972A1D7B4E912CF12

Function 0086C8EE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 007E2612: GetWindowLongW.USER32(?,000000EB), ref: 007E2623

DragQueryPoint.SHELL32(?,?), ref: 0086C917

Part of subcall function 0086ADF1: ClientToScreen.USER32(?,?), ref: 0086AE1A
Part of subcall function 0086ADF1: GetWindowRect.USER32(?,?), ref: 0086AE90
Part of subcall function 0086ADF1: PtInRect.USER32(?,?,0086C304), ref: 0086AEA0

SendMessageW.USER32(?,000000B0,?,?), ref: 0086C980
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0086C98B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0086C9AE
_wcscat.LIBCMT ref: 0086C9DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0086C9F5
SendMessageW.USER32(?,000000B0,?,?), ref: 0086CA0E
SendMessageW.USER32(?,000000B1,?,?), ref: 0086CA25
SendMessageW.USER32(?,000000B1,?,?), ref: 0086CA47
DragFinish.SHELL32(?), ref: 0086CA4E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0086CB41

Strings

@GUI_DRAGID, xrefs: 0086CAB9
@GUI_DRAGFILE, xrefs: 0086CAF0
@GUI_DROPID, xrefs: 0086CA6E

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 98794a5c92ea7cd6b46bc09e93fa5bb48753ff923368b3d8c4a2900ed10eded6
Instruction ID: 566deb52ab4731d9ed44acfc46f4a3732ec01430ab19da59665c3562c8b03298
Opcode Fuzzy Hash: 98794a5c92ea7cd6b46bc09e93fa5bb48753ff923368b3d8c4a2900ed10eded6
Instruction Fuzzy Hash: E3618F71108340AFC700DF65DC89DAFBBE8FF89710F040A2DF6A5961A1EB749909CB52

Function 00864619 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 008646AB
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 008646F6

Strings

GETSELECTED, xrefs: 00864806
EXISTS, xrefs: 0086475F
UNCHECK, xrefs: 008648D2
GETITEMCOUNT, xrefs: 008647D8
CHECK, xrefs: 00864716
GETTEXT, xrefs: 00864849
GETTOTALCOUNT, xrefs: 008646DD
EXPAND, xrefs: 008647A8
ISCHECKED, xrefs: 00864879
SELECT, xrefs: 008648A7
COLLAPSE, xrefs: 0086473C

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 3d30e0d50eeb82bc922a8ed384af96aa972365ad4bc3a494ff00f9e366ae76a5
Instruction ID: e4488f2723372f093d88d53a15fd230bfa394d426409763ad692defab3bc587f
Opcode Fuzzy Hash: 3d30e0d50eeb82bc922a8ed384af96aa972365ad4bc3a494ff00f9e366ae76a5
Instruction Fuzzy Hash: 03919E35204345DBCB14EF14C851A6EBBA1FF98314F05946CF9969B3A2CB34ED0ACB82

Function 0086BAB8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0086BB6E
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00866D80,?), ref: 0086BBCA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0086BC03
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 0086BC46
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0086BC7D
FreeLibrary.KERNEL32(?), ref: 0086BC89
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0086BC99
DestroyIcon.USER32(?), ref: 0086BCA8
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0086BCC5
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0086BCD1

Part of subcall function 0080313D: __wcsicmp_l.LIBCMT ref: 008031C6

Strings

.icl, xrefs: 0086BAE4
.dll, xrefs: 0086BB27
.exe, xrefs: 0086BB04

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: 0a70795405292b21574bfeb1f279dd3574639e829132033708cc8cdadb501883
Instruction ID: 37e939a065750261a2fb8a1da4bf4cc48dfa372842098fb9e73a62b13919d42e
Opcode Fuzzy Hash: 0a70795405292b21574bfeb1f279dd3574639e829132033708cc8cdadb501883
Instruction Fuzzy Hash: 1061BF71500219FAEB14DF64DC46BBA77A8FF08724F10422AFA15D61D1DBB4EA90DBA0

Function 0084A5BD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 007E9997: __itow.LIBCMT ref: 007E99C2
Part of subcall function 007E9997: __swprintf.LIBCMT ref: 007E9A0C

CharLowerBuffW.USER32(?,?), ref: 0084A636
GetDriveTypeW.KERNEL32 ref: 0084A683
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0084A6CB
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0084A702
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0084A730

Part of subcall function 007E7D2C: _memmove.LIBCMT ref: 007E7D66

Strings

open, xrefs: 0084A65D
type cdaudio alias cd wait, xrefs: 0084A6AE
close cd wait, xrefs: 0084A71B
open , xrefs: 0084A692
set cd door , xrefs: 0084A6D1
close, xrefs: 0084A63C
closed, xrefs: 0084A64A, 0084A653
wait, xrefs: 0084A6ED

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 6413b68e5b6749b37e7960316a0c0489ebba90a8108b2b9eabb1b2e1e3ff2947
Instruction ID: 0999cea0954233c47d46fda27cc25d1134f5ef5c225436b8d8ecd3b6f00bda18
Opcode Fuzzy Hash: 6413b68e5b6749b37e7960316a0c0489ebba90a8108b2b9eabb1b2e1e3ff2947
Instruction Fuzzy Hash: 14516D711043499FC704EF15C88596AB7F8FF98718F04896CF8959B261DB35EE0ACB92

Function 0084A45A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0084A47A
__swprintf.LIBCMT ref: 0084A49C
CreateDirectoryW.KERNEL32(?,00000000), ref: 0084A4D9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0084A4FE
_memset.LIBCMT ref: 0084A51D
_wcsncpy.LIBCMT ref: 0084A559
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0084A58E
CloseHandle.KERNEL32(00000000), ref: 0084A599
RemoveDirectoryW.KERNEL32(?), ref: 0084A5A2
CloseHandle.KERNEL32(00000000), ref: 0084A5AC

Strings

\??\%s, xrefs: 0084A496
:, xrefs: 0084A4BD
\, xrefs: 0084A4B2

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: eaa44dcd7311c658b996bd9fbcdf948f425f626e596b97f32423479df684df34
Instruction ID: 9660a2292957c963c49e6dc3b39e1a3634df0a0ea91e604d9086e1358e0fc011
Opcode Fuzzy Hash: eaa44dcd7311c658b996bd9fbcdf948f425f626e596b97f32423479df684df34
Instruction Fuzzy Hash: 643190B5540209ABDB219FA4DC49FEB73BCFF88701F1141B6FA08D6161EBB096448B25

Function 0081AB1B Relevance: 22.7, APIs: 15, Instructions: 211COMMONLIBRARYCODE

Download Yara Rule

APIs

_copy_environ.LIBCMT ref: 0081AB7B
___wtomb_environ.LIBCMT ref: 0081AB9D

Part of subcall function 00808D68: __getptd_noexit.LIBCMT ref: 00808D68

__malloc_crt.LIBCMT ref: 0081ABC5
__malloc_crt.LIBCMT ref: 0081ABE2
_free.LIBCMT ref: 0081AC19
__recalloc_crt.LIBCMT ref: 0081AC52
__recalloc_crt.LIBCMT ref: 0081AC97
_strlen.LIBCMT ref: 0081ACC3
__calloc_crt.LIBCMT ref: 0081ACCD
_strlen.LIBCMT ref: 0081ACDC
SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000), ref: 0081AD0A
_free.LIBCMT ref: 0081AD24
_free.LIBCMT ref: 0081AD31
_free.LIBCMT ref: 0081AD43
__invoke_watson.LIBCMT ref: 0081AD5D

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
String ID:
API String ID: 884005220-0
Opcode ID: 175cca8029a20d70d3bc7fb2f63037721c2c2d9d48f426fe399d7782fcd0a0f5
Instruction ID: 07b64adab50589506678f1b82582d76b5cde83e244f21cfed9697f5571efb52c
Opcode Fuzzy Hash: 175cca8029a20d70d3bc7fb2f63037721c2c2d9d48f426fe399d7782fcd0a0f5
Instruction Fuzzy Hash: FD610372906205EFEB285F28EC01BA977ADFF51731F204125E841DB2D1DB7589C18793

Function 0084DB04 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 0084DC7B
_wcscat.LIBCMT ref: 0084DC93
_wcscat.LIBCMT ref: 0084DCA5
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0084DCBA
SetCurrentDirectoryW.KERNEL32(?), ref: 0084DCCE
GetFileAttributesW.KERNEL32(?), ref: 0084DCE6
SetFileAttributesW.KERNEL32(?,00000000), ref: 0084DD00
SetCurrentDirectoryW.KERNEL32(?), ref: 0084DD12

Strings

*.*, xrefs: 0084DD51

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 021de02f2b7b74305888c3dccd2e3ac2a0a3b0726f1e7fe78252b0b7e9e310c9
Instruction ID: 307e55475f029bec6c794083990a9cf9b6d229ed5c5e2a13d95b563e69dd722d
Opcode Fuzzy Hash: 021de02f2b7b74305888c3dccd2e3ac2a0a3b0726f1e7fe78252b0b7e9e310c9
Instruction Fuzzy Hash: 1B81A4726043499FCB24EF64C8859AAB7E8FF88314F19882EF985C7251E774DD44CB52

Function 0086C49C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007E2612: GetWindowLongW.USER32(?,000000EB), ref: 007E2623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0086C4EC
GetFocus.USER32 ref: 0086C4FC
GetDlgCtrlID.USER32(00000000), ref: 0086C507
_memset.LIBCMT ref: 0086C632
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0086C65D
GetMenuItemCount.USER32(?), ref: 0086C67D
GetMenuItemID.USER32(?,00000000), ref: 0086C690
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0086C6C4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0086C70C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0086C744
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0086C779

Strings

0, xrefs: 0086C62A

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 87e1161fc09506e830853f4529ab4b1d7b77a3633f8c947191618537478d5058
Instruction ID: 3f7d21f6813bc66f126f953deab75c36812e83239c116d3e95af71edccce3c8f
Opcode Fuzzy Hash: 87e1161fc09506e830853f4529ab4b1d7b77a3633f8c947191618537478d5058
Instruction Fuzzy Hash: 1A816D702093059FD710CF28D988A7BBBE8FB98314F05452DFA96D7291DB70D905CBA2

Function 008383F4 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0083874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00838766
Part of subcall function 0083874A: GetLastError.KERNEL32(?,0083822A,?,?,?), ref: 00838770
Part of subcall function 0083874A: GetProcessHeap.KERNEL32(00000008,?,?,0083822A,?,?,?), ref: 0083877F
Part of subcall function 0083874A: HeapAlloc.KERNEL32(00000000,?,0083822A,?,?,?), ref: 00838786
Part of subcall function 0083874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0083879D

Part of subcall function 008387E7: GetProcessHeap.KERNEL32(00000008,00838240,00000000,00000000,?,00838240,?), ref: 008387F3
Part of subcall function 008387E7: HeapAlloc.KERNEL32(00000000,?,00838240,?), ref: 008387FA
Part of subcall function 008387E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00838240,?), ref: 0083880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00838458
_memset.LIBCMT ref: 0083846D
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 0083848C
GetLengthSid.ADVAPI32(?), ref: 0083849D
GetAce.ADVAPI32(?,00000000,?), ref: 008384DA
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 008384F6
GetLengthSid.ADVAPI32(?), ref: 00838513
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00838522
HeapAlloc.KERNEL32(00000000), ref: 00838529
GetLengthSid.ADVAPI32(?,00000008,?), ref: 0083854A
CopySid.ADVAPI32(00000000), ref: 00838551
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00838582
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 008385A8
SetUserObjectSecurity.USER32(?,00000004,?), ref: 008385BC

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 5f5b4b0a2858c36fafa365479368da6cd1c85426a14eeac584ad2b6df3487934
Instruction ID: 4a549f7278710a4ad692180de267e633598b51d522177b9f0acbec0779f68414
Opcode Fuzzy Hash: 5f5b4b0a2858c36fafa365479368da6cd1c85426a14eeac584ad2b6df3487934
Instruction Fuzzy Hash: AB61247190020AEFDF019FA5EC45AAEBBB9FF84300F148169F915E6291DB71DA05CFA1

Function 0085762D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 008576A2
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 008576AE
CreateCompatibleDC.GDI32(?), ref: 008576BA
SelectObject.GDI32(00000000,?), ref: 008576C7
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 0085771B
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00857757
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 0085777B
SelectObject.GDI32(00000006,?), ref: 00857783
DeleteObject.GDI32(?), ref: 0085778C
DeleteDC.GDI32(00000006), ref: 00857793
ReleaseDC.USER32(00000000,?), ref: 0085779E

Strings

(, xrefs: 00857723

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: f29708df750695cf06d9da15649286d51fe24395ae053d8ab09110e00420f95a
Instruction ID: 2871b60765fe262833b3b7995801b92e905624aff8f63fc270fcf085c0451678
Opcode Fuzzy Hash: f29708df750695cf06d9da15649286d51fe24395ae053d8ab09110e00420f95a
Instruction Fuzzy Hash: 76513775904609EFCB15CFA8EC85EAEBBB9FF48310F148429EA4AD7211D771A8448B60

Function 0084A0B5 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,0086FB78), ref: 0084A0FC

Part of subcall function 007E7F41: _memmove.LIBCMT ref: 007E7F82

LoadStringW.USER32(?,?,00000FFF,?), ref: 0084A11E
__swprintf.LIBCMT ref: 0084A177
__swprintf.LIBCMT ref: 0084A190
_wprintf.LIBCMT ref: 0084A246
_wprintf.LIBCMT ref: 0084A264

Strings

^ ERROR, xrefs: 0084A1E8
Error: , xrefs: 0084A20E
Line %d (File "%s"):, xrefs: 0084A171, 0084A18A
"%s" (%d) : ==> %s:, xrefs: 0084A25F
"%s" (%d) : ==> %s:%s%s, xrefs: 0084A241

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: ccede8439f694e165532c45f5c9ebfe22aa39fc1d1b2cc0deb2a2878395db65b
Instruction ID: 3b7bf63c2f2f89f44cb2dff6c84d0e05d448500d09d8f939847fc9d4e67e4d9e
Opcode Fuzzy Hash: ccede8439f694e165532c45f5c9ebfe22aa39fc1d1b2cc0deb2a2878395db65b
Instruction Fuzzy Hash: 0C51AC3190120DAACF19EBA0CD8AEEEB778FF08304F140164F515B21A1EB756F58DBA1

Function 007E6BEC Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00800B9B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,007E6C6C,?,00008000), ref: 00800BB7

Part of subcall function 007E48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007E48A1,?,?,007E37C0,?), ref: 007E48CE

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 007E6D0D
SetCurrentDirectoryW.KERNEL32(?), ref: 007E6E5A

Part of subcall function 007E59CD: _wcscpy.LIBCMT ref: 007E5A05

Part of subcall function 0080387D: _iswctype.LIBCMT ref: 00803885

Strings

#include depth exceeded. Make sure there are no recursive includes, xrefs: 0081E84A
Bad directive syntax error, xrefs: 0081EBC6
EA06, xrefs: 0081E87B
Error opening the file, xrefs: 0081E866, 0081E8E1
>>>AUTOIT SCRIPT<<<, xrefs: 0081E8BF
AU3!, xrefs: 007E6CC1
Unterminated string, xrefs: 0081EC0D

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: 56d455f8dd4bb52186c77efe7d5768c863706c18f8693d2d7d4a5943aeb4ff3c
Instruction ID: 03bfd154ffa66ce7e944f04a1305c43ed62d67d9fb2f6bc934f2235cbc0cb548
Opcode Fuzzy Hash: 56d455f8dd4bb52186c77efe7d5768c863706c18f8693d2d7d4a5943aeb4ff3c
Instruction Fuzzy Hash: 10026931109385DFC724EF25C885AAEBBE5FF98354F04492DF886972A2DB34D949CB42

Function 007E45DF Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007E45F9
GetMenuItemCount.USER32(008A6890), ref: 0081D7CD
GetMenuItemCount.USER32(008A6890), ref: 0081D87D
GetCursorPos.USER32(?), ref: 0081D8C1
SetForegroundWindow.USER32(00000000), ref: 0081D8CA
TrackPopupMenuEx.USER32(008A6890,00000000,?,00000000,00000000,00000000), ref: 0081D8DD
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 0081D8E9

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: d2dbfaaa65b6b526a6b5343773989a6858312fe9cf96719aad5ee0a206a0f160
Instruction ID: c4f0036727873e0796851d79f09d97e43f282853845a46ebb75382a4550d7365
Opcode Fuzzy Hash: d2dbfaaa65b6b526a6b5343773989a6858312fe9cf96719aad5ee0a206a0f160
Instruction Fuzzy Hash: B7710570601349BAEB209F15DC89FEABF68FF05368F200216F615E61E1C7B59C50DB95

Function 008610A5 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00860038,?,?), ref: 008610BC

Strings

HKLM, xrefs: 0086113A
HKU, xrefs: 008611CE
HKEY_CURRENT_USER, xrefs: 0086119B
HKCC, xrefs: 0086118A
HKCU, xrefs: 008611AC
HKEY_LOCAL_MACHINE, xrefs: 00861125
HKCR, xrefs: 00861164
HKEY_CURRENT_CONFIG, xrefs: 00861179
HKEY_USERS, xrefs: 008611BD
HKEY_CLASSES_ROOT, xrefs: 0086114F

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 5bd7e8824a96b9f0a9ee73b846eba22b21a0445c26794f60406750b1866d3466
Instruction ID: ab934829af4def68cd1b0748cb5ab4ac5f1ba0c8fe5b1100e6c4e943a6d0d7a6
Opcode Fuzzy Hash: 5bd7e8824a96b9f0a9ee73b846eba22b21a0445c26794f60406750b1866d3466
Instruction Fuzzy Hash: 7E417B3011424ECBCF10EF94EDA9AEA3724FF26300F194515EE91DB292DB34A91ACB61

Function 00845569 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 007E7D2C: _memmove.LIBCMT ref: 007E7D66

Part of subcall function 007E7A84: _memmove.LIBCMT ref: 007E7B0D

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 008455D2
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 008455E8
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 008455F9
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 0084560B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0084561C

Strings

alias PlayMe, xrefs: 008455AB
play PlayMe, xrefs: 00845617
status PlayMe mode, xrefs: 008455CD
open , xrefs: 00845581
close PlayMe, xrefs: 008455E3, 00845610
play PlayMe wait, xrefs: 00845606

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 552cb5d676592f426f7a4e79cb3301ae0d4bcb727cb0866816e2367adfeb898c
Instruction ID: 24ad16a525b22211b132d67f95a545495d535a5c41812601247ca23780f843f4
Opcode Fuzzy Hash: 552cb5d676592f426f7a4e79cb3301ae0d4bcb727cb0866816e2367adfeb898c
Instruction Fuzzy Hash: CD11B2206511ADBADB28B6A2CC4EDFFBB7CFF95B00F440429B411E21D2DEA80D05C5E1

Function 008448F3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 0084490E
gethostname.WSOCK32(?,00000100), ref: 00844928
gethostbyname.WSOCK32(?), ref: 00844935
_wcscpy.LIBCMT ref: 0084495D
_memmove.LIBCMT ref: 00844970
inet_ntoa.WSOCK32(?), ref: 0084497B
_strcat.LIBCMT ref: 00844989
_wcscpy.LIBCMT ref: 008449A0
WSACleanup.WSOCK32 ref: 008449AE
_wcscpy.LIBCMT ref: 008449BC

Strings

0.0.0.0, xrefs: 00844957

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: db2c9f040c410b592df0c051727cb95b22d95fc326638e3c03317e9fbe5dc553
Instruction ID: c2567f74c9706b3755ba12b938805f9c00ea92babd18b8efdee74d74b5091420
Opcode Fuzzy Hash: db2c9f040c410b592df0c051727cb95b22d95fc326638e3c03317e9fbe5dc553
Instruction Fuzzy Hash: 1811D53190811DABCB74EB24AC0AFDB7BACFF40720F0511B6F544D61A2EFB0DA819652

Function 00845217 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0084521C

Part of subcall function 00800719: timeGetTime.WINMM(?,75C0B400,007F0FF9), ref: 0080071D

Sleep.KERNEL32(0000000A), ref: 00845248
EnumThreadWindows.USER32(?,Function_000651CA,00000000), ref: 0084526C
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 0084528E
SetActiveWindow.USER32 ref: 008452AD
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 008452BB
SendMessageW.USER32(00000010,00000000,00000000), ref: 008452DA
Sleep.KERNEL32(000000FA), ref: 008452E5
IsWindow.USER32 ref: 008452F1
EndDialog.USER32(00000000), ref: 00845302

Strings

BUTTON, xrefs: 00845280

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 842eb84bef358b8153f344c6b061616675f27487dd90f8649012677aea0ca0a1
Instruction ID: bb6ab10c5935bf9191791ff554f19b446a8d875afceb35003c33773da22f78a4
Opcode Fuzzy Hash: 842eb84bef358b8153f344c6b061616675f27487dd90f8649012677aea0ca0a1
Instruction Fuzzy Hash: 04216270104708AFF7016F60FD89B297B69FB56786F052425F201C26B3EBE19D509B62

Function 0084D7F8 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 007E9997: __itow.LIBCMT ref: 007E99C2
Part of subcall function 007E9997: __swprintf.LIBCMT ref: 007E9A0C

CoInitialize.OLE32(00000000), ref: 0084D855
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0084D8E8
SHGetDesktopFolder.SHELL32(?), ref: 0084D8FC
CoCreateInstance.OLE32(00872D7C,00000000,00000001,0089A89C,?), ref: 0084D948
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 0084D9B7
CoTaskMemFree.OLE32(?,?), ref: 0084DA0F
_memset.LIBCMT ref: 0084DA4C
SHBrowseForFolderW.SHELL32(?), ref: 0084DA88
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0084DAAB
CoTaskMemFree.OLE32(00000000), ref: 0084DAB2
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 0084DAE9
CoUninitialize.OLE32(00000001,00000000), ref: 0084DAEB

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: b346843f3c71f14579be09ea0e64ca8baf0a2e69e024e3f57f08a3390f9eb232
Instruction ID: 4aac6ab2571c7f0eaacdff1baa77dd6e54ceb53de621e8c4cd597aec23042fae
Opcode Fuzzy Hash: b346843f3c71f14579be09ea0e64ca8baf0a2e69e024e3f57f08a3390f9eb232
Instruction Fuzzy Hash: 98B1EC75A00219EFDB04DF65C888DAEBBB9FF48314B1484A9F905EB261DB30ED45CB50

Function 0084052C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 008405A7
SetKeyboardState.USER32(?), ref: 00840612
GetAsyncKeyState.USER32(000000A0), ref: 00840632
GetKeyState.USER32(000000A0), ref: 00840649
GetAsyncKeyState.USER32(000000A1), ref: 00840678
GetKeyState.USER32(000000A1), ref: 00840689
GetAsyncKeyState.USER32(00000011), ref: 008406B5
GetKeyState.USER32(00000011), ref: 008406C3
GetAsyncKeyState.USER32(00000012), ref: 008406EC
GetKeyState.USER32(00000012), ref: 008406FA
GetAsyncKeyState.USER32(0000005B), ref: 00840723
GetKeyState.USER32(0000005B), ref: 00840731

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: f8933d53fd1c3a4345032cad00325a3e8858d89c027548cff847a81c9e3eab37
Instruction ID: 35ac64450fd36c4c9b01de35c6f07484867b63bc1e2652a189b598d50eefca36
Opcode Fuzzy Hash: f8933d53fd1c3a4345032cad00325a3e8858d89c027548cff847a81c9e3eab37
Instruction Fuzzy Hash: 3151C960A0478C19FF35DBA484547EBBFB4FF11380F094599D6C2AA1C2DA749A8CCF52

Function 0083C72A Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 0083C746
GetWindowRect.USER32(00000000,?), ref: 0083C758
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0083C7B6
GetDlgItem.USER32(?,00000002), ref: 0083C7C1
GetWindowRect.USER32(00000000,?), ref: 0083C7D3
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0083C827
GetDlgItem.USER32(?,000003E9), ref: 0083C835
GetWindowRect.USER32(00000000,?), ref: 0083C846
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0083C889
GetDlgItem.USER32(?,000003EA), ref: 0083C897
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0083C8B4
InvalidateRect.USER32(?,00000000,00000001), ref: 0083C8C1

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: e11ce9c236efe2a74fa5e2cd628581f9f9e21f8627fa200a7bb5f6a9a8d77950
Instruction ID: dc7391a5cb66f76e72ac66fd8fed85cbd54d37620b97ec933e4f1e82ab10e115
Opcode Fuzzy Hash: e11ce9c236efe2a74fa5e2cd628581f9f9e21f8627fa200a7bb5f6a9a8d77950
Instruction Fuzzy Hash: 07512171B00205ABDB18CFA9DD95AAEBBB6FB98311F14813DF615E6291D7B0DD008B50

Function 007E201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 007E1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,007E2036,?,00000000,?,?,?,?,007E16CB,00000000,?), ref: 007E1B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 007E20D3
KillTimer.USER32(-00000001,?,?,?,?,007E16CB,00000000,?,?,007E1AE2,?,?), ref: 007E216E
DestroyAcceleratorTable.USER32(00000000), ref: 0081BEF6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,007E16CB,00000000,?,?,007E1AE2,?,?), ref: 0081BF27
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,007E16CB,00000000,?,?,007E1AE2,?,?), ref: 0081BF3E
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,007E16CB,00000000,?,?,007E1AE2,?,?), ref: 0081BF5A
DeleteObject.GDI32(00000000), ref: 0081BF6C

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: d2b773cfc534e8244e9bec8ade086dc86fc29e5a10b3ddd9de04c84563a98b35
Instruction ID: d13573c9356bd3319bbc5d66cf023d4e61cb8d06469a29e1e5b4b73556e45ad9
Opcode Fuzzy Hash: d2b773cfc534e8244e9bec8ade086dc86fc29e5a10b3ddd9de04c84563a98b35
Instruction Fuzzy Hash: E161DD31102690DFDB359F16DD48B29B7F9FF09312F148528E142869A6CB79ACA2CF51

Function 007E21A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 007E25DB: GetWindowLongW.USER32(?,000000EB), ref: 007E25EC

GetSysColor.USER32(0000000F), ref: 007E21D3

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: b90e2daefbc1409813edc01e529d7caf6e0be00c2983203f86283a8a85e0c7d8
Instruction ID: f9c481a97e3058124a0006caf9ab86624a64fd8ef030f7cd0487d393866a869e
Opcode Fuzzy Hash: b90e2daefbc1409813edc01e529d7caf6e0be00c2983203f86283a8a85e0c7d8
Instruction Fuzzy Hash: C0419231141180ABDB255F29EC48BB9376DFB0A331F1A4265FF668A1E7C7758C82DB21

Function 0084AB12 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,0086F910), ref: 0084AB76
GetDriveTypeW.KERNEL32(00000061,0089A620,00000061), ref: 0084AC40
_wcscpy.LIBCMT ref: 0084AC6A

Strings

all, xrefs: 0084AB7C
network, xrefs: 0084ABD4
unknown, xrefs: 0084AC01
cdrom, xrefs: 0084AB92
ramdisk, xrefs: 0084ABEA
fixed, xrefs: 0084ABBE
removable, xrefs: 0084ABA8

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 9428324d5160c83bee3a0c523470a8eb4265fda3b6315b2dfd48f77caab2fb6d
Instruction ID: 95e83235cb63c5c2142ba7ee9b3d3ca719e59a8ddc31188b36b77d24221e3d25
Opcode Fuzzy Hash: 9428324d5160c83bee3a0c523470a8eb4265fda3b6315b2dfd48f77caab2fb6d
Instruction Fuzzy Hash: 7651EE311483499BC718EF18CC81AAAB7A5FF94304F04482DF986DB2A2DB35DD09CB53

Function 007E9997 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 007E99C2
__swprintf.LIBCMT ref: 007E9A0C
__i64tow.LIBCMT ref: 0081FA0F

Strings

0x%p, xrefs: 0081F9F1
True, xrefs: 0081F9D0
False, xrefs: 0081F9D7
%.15g, xrefs: 007E9A06

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 9a53e99e51dc4d4a8425b78c32ba0e6f55d789573a31b9f31511e12ad0a39790
Instruction ID: 13ac9789a1e99d2088cf06b040415798e14601b1d2bd32d18e851d4033b5cce6
Opcode Fuzzy Hash: 9a53e99e51dc4d4a8425b78c32ba0e6f55d789573a31b9f31511e12ad0a39790
Instruction Fuzzy Hash: B041E472504209ABDB24EB39DC42F7A77E8FF48300F24446EE649D7292EA75A941CB12

Function 008673C1 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008673D9
CreateMenu.USER32 ref: 008673F4
SetMenu.USER32(?,00000000), ref: 00867403
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00867490
IsMenu.USER32(?), ref: 008674A6
CreatePopupMenu.USER32 ref: 008674B0
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 008674DD
DrawMenuBar.USER32 ref: 008674E5

Strings

F, xrefs: 008674D1
0, xrefs: 008673CF

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: c37b1cfea4a86f9d13f48aba3e4c46ba9f9c15d267d7b0e36b7c38cabcbf4171
Instruction ID: 7f0c632bce29dd3c2c4529e83eef1c4132c94e2223d83ab0b0820113345042d0
Opcode Fuzzy Hash: c37b1cfea4a86f9d13f48aba3e4c46ba9f9c15d267d7b0e36b7c38cabcbf4171
Instruction Fuzzy Hash: 0F414974A01209EFDB10DF64E848E9ABBB9FF49304F154029FA56D7361DB74AD20CB94

Function 0086772A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 008677CD
CreateCompatibleDC.GDI32(00000000), ref: 008677D4
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 008677E7
SelectObject.GDI32(00000000,00000000), ref: 008677EF
GetPixel.GDI32(00000000,00000000,00000000), ref: 008677FA
DeleteDC.GDI32(00000000), ref: 00867803
GetWindowLongW.USER32(?,000000EC), ref: 0086780D
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00867821
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 0086782D

Strings

static, xrefs: 00867765

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: e45fecf50aca481fa6bdd802e285bb0b939112e15c5b334cf032e508540fd406
Instruction ID: 2321d9565508f55602a0d9fbaf0faf06b82f7ffcfe97f14a05bd16b07b34bebb
Opcode Fuzzy Hash: e45fecf50aca481fa6bdd802e285bb0b939112e15c5b334cf032e508540fd406
Instruction Fuzzy Hash: 11318B32105215ABDF129FA4EC09FDA3B69FF0D369F120224FA15E60A1CB71D821DBA4

Function 00807040 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0080707B

Part of subcall function 00808D68: __getptd_noexit.LIBCMT ref: 00808D68

__gmtime64_s.LIBCMT ref: 00807114
__gmtime64_s.LIBCMT ref: 0080714A
__gmtime64_s.LIBCMT ref: 00807167
__allrem.LIBCMT ref: 008071BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008071D9
__allrem.LIBCMT ref: 008071F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0080720E
__allrem.LIBCMT ref: 00807225
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00807243
__invoke_watson.LIBCMT ref: 008072B4

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction ID: 577799ebe38c5058611a8ba3bd8b26ff18c72d53b69e5a321674410470a4c1d4
Opcode Fuzzy Hash: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction Fuzzy Hash: E371C371E04B16ABE7549E7DCC41B9AB3A8FF50324F14422AF915E62D1E770FA408791

Function 00842A16 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00842A31
GetMenuItemInfoW.USER32(008A6890,000000FF,00000000,00000030), ref: 00842A92
SetMenuItemInfoW.USER32(008A6890,00000004,00000000,00000030), ref: 00842AC8
Sleep.KERNEL32(000001F4), ref: 00842ADA
GetMenuItemCount.USER32(?), ref: 00842B1E
GetMenuItemID.USER32(?,00000000), ref: 00842B3A
GetMenuItemID.USER32(?,-00000001), ref: 00842B64
GetMenuItemID.USER32(?,?), ref: 00842BA9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00842BEF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00842C03
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00842C24

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 0164ebf02776398ebcfac2464a0375316dfa27230c46dea239159e8b22004ec2
Instruction ID: 2aa48c23ed87933b673885e96c0a47640453c5990e4d833bc0700c9f08c77b56
Opcode Fuzzy Hash: 0164ebf02776398ebcfac2464a0375316dfa27230c46dea239159e8b22004ec2
Instruction Fuzzy Hash: AA61AEB090824DEFDB21CF64D888EAEBBB8FB41318F940559F942E3251DB71AD15DB21

Function 00867192 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00867214
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00867217
GetWindowLongW.USER32(?,000000F0), ref: 0086723B
_memset.LIBCMT ref: 0086724C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0086725E
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 008672D6

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: d06a7d7acafc7baf7f092f360e8288a9b40f116fefe79083349a6ebeb6bb9244
Instruction ID: f4ce47aa1f32dec4d6600948ffdc064779196a0f3d22d091cae931d29cba22bc
Opcode Fuzzy Hash: d06a7d7acafc7baf7f092f360e8288a9b40f116fefe79083349a6ebeb6bb9244
Instruction Fuzzy Hash: E9617971900208AFDB10DFA8CD81EEE77B8FB09704F140169FA15E73A1D774A941DBA0

Function 0083710E Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00837135
SafeArrayAllocData.OLEAUT32(?), ref: 0083718E
VariantInit.OLEAUT32(?), ref: 008371A0
SafeArrayAccessData.OLEAUT32(?,?), ref: 008371C0
VariantCopy.OLEAUT32(?,?), ref: 00837213
SafeArrayUnaccessData.OLEAUT32(?), ref: 00837227
VariantClear.OLEAUT32(?), ref: 0083723C
SafeArrayDestroyData.OLEAUT32(?), ref: 00837249
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00837252
VariantClear.OLEAUT32(?), ref: 00837264
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0083726F

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: ebcf0e242280795a7bb119b7d6491b4f30073a4f4d382fdc8cb2efaed9ac25c0
Instruction ID: 46dbf9d3f1adcf559bcc35a5c83bb992506503ce6f33623f8c0061b50731abe6
Opcode Fuzzy Hash: ebcf0e242280795a7bb119b7d6491b4f30073a4f4d382fdc8cb2efaed9ac25c0
Instruction Fuzzy Hash: 6C415175904219EFCF10DF68D8489AEBBB9FF48354F018069FA16E7262DB70E945CB90

Function 00855A45 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00855AA6
inet_addr.WSOCK32(?,?,?), ref: 00855AEB
gethostbyname.WSOCK32(?), ref: 00855AF7
IcmpCreateFile.IPHLPAPI ref: 00855B05
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00855B75
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00855B8B
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00855C00
WSACleanup.WSOCK32 ref: 00855C06

Strings

Ping, xrefs: 00855B29

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: e29dbc51f009de5d713f8da8c1824f7ec86e470ec38bcfb0cff4784718eb77c6
Instruction ID: 5d1ce4eb9fffe42f7b1d9cd525484da753ff33c3106efeb0ee264cb939ae658e
Opcode Fuzzy Hash: e29dbc51f009de5d713f8da8c1824f7ec86e470ec38bcfb0cff4784718eb77c6
Instruction Fuzzy Hash: 9F51BF31204701DFDB11AF25DC59B2ABBE0FF48324F14892AF955DB2A1DB70E804CB42

Function 0084B72E Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0084B73B
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0084B7B1
GetLastError.KERNEL32 ref: 0084B7BB
SetErrorMode.KERNEL32(00000000,READY), ref: 0084B828

Strings

INVALID, xrefs: 0084B7FA
UNKNOWN, xrefs: 0084B7E0
READY, xrefs: 0084B801
NOTREADY, xrefs: 0084B7E7
READONLY, xrefs: 0084B7F3

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 6ab020fca6ad7c4eb35594af0c30f3d9b3bcbeb6b0b7a136f67a46f2e2f3b2c2
Instruction ID: 98df706e160c6c02abc065b1b6129466d8b38ad94406d2ea9bf0c0b4bdf9dc6e
Opcode Fuzzy Hash: 6ab020fca6ad7c4eb35594af0c30f3d9b3bcbeb6b0b7a136f67a46f2e2f3b2c2
Instruction Fuzzy Hash: 8E316335A0020DDFDB14EF68D885AAE7BB4FF48744F148029E511E7292EB75DD42C791

Function 00839471 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007E7F41: _memmove.LIBCMT ref: 007E7F82

Part of subcall function 0083B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0083B0E7

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 008394F6
GetDlgCtrlID.USER32 ref: 00839501
GetParent.USER32 ref: 0083951D
SendMessageW.USER32(00000000,?,00000111,?), ref: 00839520
GetDlgCtrlID.USER32(?), ref: 00839529
GetParent.USER32(?), ref: 00839545
SendMessageW.USER32(00000000,?,?,00000111), ref: 00839548

Strings

ComboBox, xrefs: 0083947E
ListBox, xrefs: 008394B3

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 40f0bb85b1097c05ce0ac3d6f604c7fd0805b6156c45556b3acd06c914516926
Instruction ID: 0e18d2b791d57ccdba5f0d4762e45fed446a0f6b6619e4186c2dd6cab3ff5f2b
Opcode Fuzzy Hash: 40f0bb85b1097c05ce0ac3d6f604c7fd0805b6156c45556b3acd06c914516926
Instruction Fuzzy Hash: 9F21D870900108BBCF05AB65CC85DFEBB74FF99300F114129F662972E2EBB99919DB60

Function 0083955C Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007E7F41: _memmove.LIBCMT ref: 007E7F82

Part of subcall function 0083B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0083B0E7

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 008395DF
GetDlgCtrlID.USER32 ref: 008395EA
GetParent.USER32 ref: 00839606
SendMessageW.USER32(00000000,?,00000111,?), ref: 00839609
GetDlgCtrlID.USER32(?), ref: 00839612
GetParent.USER32(?), ref: 0083962E
SendMessageW.USER32(00000000,?,?,00000111), ref: 00839631

Strings

ComboBox, xrefs: 00839569
ListBox, xrefs: 0083959E

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 397d0f33e21e251107bbc0a2b5f5ed6a36793bdce39ea13472b683df93d46c93
Instruction ID: 8e7a1353d2098e27461a4b5bf76c58ec8a43f938f8341a6022f625d74860fe92
Opcode Fuzzy Hash: 397d0f33e21e251107bbc0a2b5f5ed6a36793bdce39ea13472b683df93d46c93
Instruction Fuzzy Hash: 8021D670901108BBDF04AB64CCC5EFEBB78FF98300F114119F661972A2EBB99919DA60

Function 00839645 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00839651
GetClassNameW.USER32(00000000,?,00000100), ref: 00839666
_wcscmp.LIBCMT ref: 00839678
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 008396F3

Strings

SHELLDLL_DefView, xrefs: 00839672
smallicons, xrefs: 008396BB
details, xrefs: 008396A1
list, xrefs: 008396D5
largeicons, xrefs: 00839687

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: e121b33050713afb1d1cc357970a8d3e24f912ab25e730350244b11f38e7a054
Instruction ID: da4de92c1ad2e3d2c4df56ee042324d86f566dd314093b0d0623d65605fb898f
Opcode Fuzzy Hash: e121b33050713afb1d1cc357970a8d3e24f912ab25e730350244b11f38e7a054
Instruction Fuzzy Hash: 90110A76249307BAFF012629EC07DA7779CFB64364F21002AFA50E50D2FED1991085D9

Function 00858BC0 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00858BEC
CoInitialize.OLE32(00000000), ref: 00858C19
CoUninitialize.OLE32 ref: 00858C23
GetRunningObjectTable.OLE32(00000000,?), ref: 00858D23
SetErrorMode.KERNEL32(00000001,00000029), ref: 00858E50
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00872C0C), ref: 00858E84
CoGetObject.OLE32(?,00000000,00872C0C,?), ref: 00858EA7
SetErrorMode.KERNEL32(00000000), ref: 00858EBA
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00858F3A
VariantClear.OLEAUT32(?), ref: 00858F4A

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 57da830b48bdb443ba8246fde993ff23cde12c20728e738ceb9a83f374f48694
Instruction ID: 7ce8be8653257176b2787c0eeaa616a7f8226036c26f78635cd9687fc22e3504
Opcode Fuzzy Hash: 57da830b48bdb443ba8246fde993ff23cde12c20728e738ceb9a83f374f48694
Instruction Fuzzy Hash: 57C1E171208205EFC700DF68C88492AB7E9FF89749F10496DF99ADB251DB71ED09CB52

Function 00844189 Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 0084419D
__swprintf.LIBCMT ref: 008441AA

Part of subcall function 008038D8: __woutput_l.LIBCMT ref: 00803931

FindResourceW.KERNEL32(?,?,0000000E), ref: 008441D4
LoadResource.KERNEL32(?,00000000), ref: 008441E0
LockResource.KERNEL32(00000000), ref: 008441ED
FindResourceW.KERNEL32(?,?,00000003), ref: 0084420D
LoadResource.KERNEL32(?,00000000), ref: 0084421F
SizeofResource.KERNEL32(?,00000000), ref: 0084422E
LockResource.KERNEL32(?), ref: 0084423A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 0084429B

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: dcf66bb5edfb48c60ce4c3df9e2997172f0d468d52c0922d923e6db4ba9bea7a
Instruction ID: 2a4c3e17d9c2885223bf34e5316c6a7f68beb799cc759c5d4fbff7c034e5dfcb
Opcode Fuzzy Hash: dcf66bb5edfb48c60ce4c3df9e2997172f0d468d52c0922d923e6db4ba9bea7a
Instruction Fuzzy Hash: A331BE72A0522EAFDB119FA0EC58EBF7BACFF09301F004525F901D2151E7B4DA618BA0

Function 008416DE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00841700
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00840778,?,00000001), ref: 00841714
GetWindowThreadProcessId.USER32(00000000), ref: 0084171B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00840778,?,00000001), ref: 0084172A
GetWindowThreadProcessId.USER32(?,00000000), ref: 0084173C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00840778,?,00000001), ref: 00841755
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00840778,?,00000001), ref: 00841767
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00840778,?,00000001), ref: 008417AC
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00840778,?,00000001), ref: 008417C1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00840778,?,00000001), ref: 008417CC

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: bfa4a36ccf147ffd862da3efdb2e3b9f9d0e12eef05c33cb0ce3e8beea8886da
Instruction ID: 62132eeb2160c374002d16a70ff9e0a8de0bc3fc5d1cfee2f3371f0427d41274
Opcode Fuzzy Hash: bfa4a36ccf147ffd862da3efdb2e3b9f9d0e12eef05c33cb0ce3e8beea8886da
Instruction Fuzzy Hash: 8031CE75600208BFEF219F24ED88F793BE9FB16711F114024F901C66A0EBB89E818B61

Function 0083A693 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,0083AA64), ref: 0083A9A2

Strings

CLASSNN, xrefs: 0083A744
TEXT, xrefs: 0083A8D9
CLASS, xrefs: 0083A721
NAME, xrefs: 0083A7D4
INSTANCE, xrefs: 0083A8B0
REGEXPCLASS, xrefs: 0083A767

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 25c7f461302b418996ca4685aad4bc1c4052b6bcc96c61eb39a1119370803a4b
Instruction ID: 342362777099b0ce419eca9524715390983f3a4818f8991faaaeefafb4c1bcf1
Opcode Fuzzy Hash: 25c7f461302b418996ca4685aad4bc1c4052b6bcc96c61eb39a1119370803a4b
Instruction Fuzzy Hash: 0C91937060024ADADB4CDFA4C881BE9FB74FF54304F148129D9DAE7291DB346A59CBE2

Function 007E2E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 007E2EAE

Part of subcall function 007E1DB3: GetClientRect.USER32(?,?), ref: 007E1DDC
Part of subcall function 007E1DB3: GetWindowRect.USER32(?,?), ref: 007E1E1D
Part of subcall function 007E1DB3: ScreenToClient.USER32(?,?), ref: 007E1E45

GetDC.USER32 ref: 0081CF82
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0081CF95
SelectObject.GDI32(00000000,00000000), ref: 0081CFA3
SelectObject.GDI32(00000000,00000000), ref: 0081CFB8
ReleaseDC.USER32(?,00000000), ref: 0081CFC0
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0081D04B

Strings

U, xrefs: 0081CF20

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: cdcb7ce7aa6e9eea0f97d29e5925069be984cf5a85d2ece08908c0ead2009533
Instruction ID: 53e60a80a12b3835121b55a1074f9e5caf4d6109c0c33476023b5c5367a5f0e1
Opcode Fuzzy Hash: cdcb7ce7aa6e9eea0f97d29e5925069be984cf5a85d2ece08908c0ead2009533
Instruction Fuzzy Hash: 3771F331400248DFCF21CF64C884AEA3BBAFF4D350F18426AED55DA1A6DB358C92DB61

Function 0086C27C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007E2612: GetWindowLongW.USER32(?,000000EB), ref: 007E2623

Part of subcall function 007E2344: GetCursorPos.USER32(?), ref: 007E2357
Part of subcall function 007E2344: ScreenToClient.USER32(008A67B0,?), ref: 007E2374
Part of subcall function 007E2344: GetAsyncKeyState.USER32(00000001), ref: 007E2399
Part of subcall function 007E2344: GetAsyncKeyState.USER32(00000002), ref: 007E23A7

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 0086C2E4
ImageList_EndDrag.COMCTL32 ref: 0086C2EA
ReleaseCapture.USER32 ref: 0086C2F0
SetWindowTextW.USER32(?,00000000), ref: 0086C39A
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0086C3AD
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 0086C48F

Strings

@GUI_DRAGFILE, xrefs: 0086C424
@GUI_DROPID, xrefs: 0086C3E1

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: c3e6f05b14e01061f26c3e6cc9d01698b833852ea2ff74f6600e06681e1a19b6
Instruction ID: d507d30f22475f2165f07fc9a83c48c4211bd80f8ef16c862e8d379b5a96eb7d
Opcode Fuzzy Hash: c3e6f05b14e01061f26c3e6cc9d01698b833852ea2ff74f6600e06681e1a19b6
Instruction Fuzzy Hash: 06517C70204244EFD704EF24DC59F6A7BE5FB88310F04852DF6A69B2A2DB74A958CB52

Function 00858F5B Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,0086F910), ref: 0085903D
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0086F910), ref: 00859071
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 008591EB
SysFreeString.OLEAUT32(?), ref: 00859215

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: ab4bb8a57404d4bd36da56e61a4fb24802d412c2d204f8cbdc903d997f0d4d45
Instruction ID: 81289cbc03d26be35355e396801b792af60cf512989d55d55ccf0df5ecf5eb46
Opcode Fuzzy Hash: ab4bb8a57404d4bd36da56e61a4fb24802d412c2d204f8cbdc903d997f0d4d45
Instruction Fuzzy Hash: 46F12971A00219EFCB04DF94C888EAEB7B9FF49315F108499F956EB291DB31AD49CB50

Function 0085F9A8 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0085F9C9
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0085FB5C
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0085FB80
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0085FBC0
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0085FBE2
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0085FD5E
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 0085FD90
CloseHandle.KERNEL32(?), ref: 0085FDBF
CloseHandle.KERNEL32(?), ref: 0085FE36

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: c6b4bb9cd2689c7455bab7f6b6651904464d81c81b7a84b4ab8bf4264a61f685
Instruction ID: 988d390bf80ac468aac90b120cb5c3a362b0f624271a354bf7e216c9a1302930
Opcode Fuzzy Hash: c6b4bb9cd2689c7455bab7f6b6651904464d81c81b7a84b4ab8bf4264a61f685
Instruction Fuzzy Hash: ACE18E31204251DFCB15EF28C885A6ABBE1FF88354F14846DFA999B3A2DB31DC44CB52

Function 00844F63 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 008448AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,008438D3,?), ref: 008448C7

Part of subcall function 008448AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,008438D3,?), ref: 008448E0

Part of subcall function 00844CD3: GetFileAttributesW.KERNEL32(?,00843947), ref: 00844CD4

lstrcmpiW.KERNEL32(?,?), ref: 00844FE2
_wcscmp.LIBCMT ref: 00844FFC
MoveFileW.KERNEL32(?,?), ref: 00845017

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 0bb930fe2466e81928ea27f980eccf82908d5d9b6d468959ae951a9ab1912668
Instruction ID: 10e432b35ea91bc349c203e7d35b4babeb8215eb5c3080a4224f0849fb1143e0
Opcode Fuzzy Hash: 0bb930fe2466e81928ea27f980eccf82908d5d9b6d468959ae951a9ab1912668
Instruction Fuzzy Hash: 895154B20087899BC764DB54DC859DFB3ECFF84340F10592EB685D3192EF74A5888766

Function 008688B4 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0086896E

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 63e0535e254fca46dda9752dc734c66212e0c3f359138e07dece5c68b9cd7d61
Instruction ID: 2aec126d8f9e25f0159ec5767d47a82fb8d4da8b331a688d46e566755a44c1a2
Opcode Fuzzy Hash: 63e0535e254fca46dda9752dc734c66212e0c3f359138e07dece5c68b9cd7d61
Instruction Fuzzy Hash: 9651B730500258FFEF209F68CC89B693B65FB05355F524222FA19E75A1DFB1E990CB52

Function 007E2B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0081C547
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0081C569
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0081C581
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0081C59F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0081C5C0
DestroyIcon.USER32(00000000), ref: 0081C5CF
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0081C5EC
DestroyIcon.USER32(?), ref: 0081C5FB

Part of subcall function 0086A71E: DeleteObject.GDI32(00000000), ref: 0086A757

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: fee2d6a94431e0a90d39c720c116d7ac94edd2146647fb78d6272c95741b6e70
Instruction ID: e80d78417e92b68cc41b8be0c69d0d80db899fe28297060bee1db5a32c4e66a3
Opcode Fuzzy Hash: fee2d6a94431e0a90d39c720c116d7ac94edd2146647fb78d6272c95741b6e70
Instruction Fuzzy Hash: 8B517770640249AFDB24DF25DC45FAA37AAFF58310F100528F902D76A1EBB4ED91DB60

Function 00838E03 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00838A84,00000B00,?,?), ref: 00838E0C
HeapAlloc.KERNEL32(00000000,?,00838A84,00000B00,?,?), ref: 00838E13
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00838A84,00000B00,?,?), ref: 00838E28
GetCurrentProcess.KERNEL32(?,00000000,?,00838A84,00000B00,?,?), ref: 00838E30
DuplicateHandle.KERNEL32(00000000,?,00838A84,00000B00,?,?), ref: 00838E33
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00838A84,00000B00,?,?), ref: 00838E43
GetCurrentProcess.KERNEL32(00838A84,00000000,?,00838A84,00000B00,?,?), ref: 00838E4B
DuplicateHandle.KERNEL32(00000000,?,00838A84,00000B00,?,?), ref: 00838E4E
CreateThread.KERNEL32(00000000,00000000,00838E74,00000000,00000000,00000000), ref: 00838E68

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 6ad1cb700a3d1ab2db575349cb389517e82e182bb1232f2e85d9c6c9659208b8
Instruction ID: 9488543eea124f2eb49f4f9f70500de5e7b2e6484d82005f20fd3d0a8205a5a1
Opcode Fuzzy Hash: 6ad1cb700a3d1ab2db575349cb389517e82e182bb1232f2e85d9c6c9659208b8
Instruction Fuzzy Hash: AB01AC75240304FFE611AB65EC49F573B6CFB89751F015421FB05DB291CAB5D8008A60

Function 00859428 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0085947C
VariantInit.OLEAUT32(?), ref: 0085954D
VariantInit.OLEAUT32(?), ref: 0085964E
VariantClear.OLEAUT32(?), ref: 00859658
VariantClear.OLEAUT32(?), ref: 008596B5

Strings

Null Object assignment in FOR..IN loop, xrefs: 008594DD, 0085960B, 008596C3
Incorrect Object type in FOR..IN loop, xrefs: 00859631

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 4f93ea7a45f3913af3c41f5f6e66ef029c94914eeb315d1335ee70725768c54d
Instruction ID: 53b768795a1f693819a70ebc8a979b996ced4a6b96fb56a0cdc25c7e8f2a2d8b
Opcode Fuzzy Hash: 4f93ea7a45f3913af3c41f5f6e66ef029c94914eeb315d1335ee70725768c54d
Instruction Fuzzy Hash: 8191AB71A00209EBDF24DFA5C848FAEBBB8FF45315F108159F959EB280D7709909CBA0

Function 00859A72 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00837652: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0083758C,80070057,?,?,?,0083799D), ref: 0083766F
Part of subcall function 00837652: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0083758C,80070057,?,?), ref: 0083768A
Part of subcall function 00837652: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0083758C,80070057,?,?), ref: 00837698
Part of subcall function 00837652: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0083758C,80070057,?), ref: 008376A8

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00859B1B
_memset.LIBCMT ref: 00859B28
_memset.LIBCMT ref: 00859C6B
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00859C97
CoTaskMemFree.OLE32(?), ref: 00859CA2

Strings

NULL Pointer assignment, xrefs: 00859CF0

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: ea8e204118a29cf690e073c779315d504aa3c56a5b1cae36227cc17c070ef183
Instruction ID: c6b26d701fe6aae07f65badc77b7436c7f5441ae4654a24b223c082a8980c3b0
Opcode Fuzzy Hash: ea8e204118a29cf690e073c779315d504aa3c56a5b1cae36227cc17c070ef183
Instruction Fuzzy Hash: EA911871901229EBDB10DFA5DC85ADEBBB8FF08710F204169E919A7241EB719A44CFA0

Function 00866FEF Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00867093
SendMessageW.USER32(?,00001036,00000000,?), ref: 008670A7
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 008670C1
_wcscat.LIBCMT ref: 0086711C
SendMessageW.USER32(?,00001057,00000000,?), ref: 00867133
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00867161

Strings

SysListView32, xrefs: 00867065

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 69d11baef18e7694d9cd64880db95868425ac3cd66ff37194df559f3cb99fda1
Instruction ID: cc3006bb11805b6a0fa231eb7f08ad9341b0b9ba9682febbebe0a392f782cb86
Opcode Fuzzy Hash: 69d11baef18e7694d9cd64880db95868425ac3cd66ff37194df559f3cb99fda1
Instruction Fuzzy Hash: 6E41A271A04308EFEB21DFA4DC85BEE77A8FF08354F11052AF654E7292D6719D848BA0

Function 0085EC47 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00843E91: CreateToolhelp32Snapshot.KERNEL32 ref: 00843EB6
Part of subcall function 00843E91: Process32FirstW.KERNEL32(00000000,?), ref: 00843EC4
Part of subcall function 00843E91: CloseHandle.KERNEL32(00000000), ref: 00843F8E

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0085ECB8
GetLastError.KERNEL32 ref: 0085ECCB
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0085ECFA
TerminateProcess.KERNEL32(00000000,00000000), ref: 0085ED77
GetLastError.KERNEL32(00000000), ref: 0085ED82
CloseHandle.KERNEL32(00000000), ref: 0085EDB7

Strings

SeDebugPrivilege, xrefs: 0085ECD6

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 9ba9368b363a36b3c6ac79e1039a7c1e4c4618e604b630a609a69df234a8e039
Instruction ID: ed2f794b692ca09e78c957c1fc6902b6e3dab01b2d10fc95b84c58b46970a660
Opcode Fuzzy Hash: 9ba9368b363a36b3c6ac79e1039a7c1e4c4618e604b630a609a69df234a8e039
Instruction Fuzzy Hash: DC41AE712002009FDB15EF28CC95F6DB7A5FF84714F088459F9429B3C2DBB9A908CB96

Function 00843226 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 008432C5

Strings

blank, xrefs: 00843247
info, xrefs: 00843266
stop, xrefs: 00843296
question, xrefs: 0084327E
warning, xrefs: 008432AE

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 5bffa38e9408c1f3da331ebd31b61c43c4954f61ccf1cb42aca66d935859395b
Instruction ID: 3e2d6b01a938082526f0b9d907d3fe53fd1eb94e323507e1dc7b016fcfa784dd
Opcode Fuzzy Hash: 5bffa38e9408c1f3da331ebd31b61c43c4954f61ccf1cb42aca66d935859395b
Instruction Fuzzy Hash: F011E73120836EBAEB056B54EC43C6AB39CFF19375F20002AF915E62C1E7E99B4045E6

Function 00844534 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 0084454E
LoadStringW.USER32(00000000), ref: 00844555
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0084456B
LoadStringW.USER32(00000000), ref: 00844572
_wprintf.LIBCMT ref: 00844598
MessageBoxW.USER32(00000000,?,?,00011010), ref: 008445B6

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00844593

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 606460432cf60627e5134cee8de9f89cf95558ebab75db083971e9ad975cd513
Instruction ID: 7cc5733d6f18604c96a74fdbe7adb584075e87e24efef55e87a1f99fcc4d4b71
Opcode Fuzzy Hash: 606460432cf60627e5134cee8de9f89cf95558ebab75db083971e9ad975cd513
Instruction Fuzzy Hash: 6A0184F250020CBFE711A794ED89EE6776CFB08300F0015A5F745D2052E6B49E854B70

Function 0086D74C Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007E2612: GetWindowLongW.USER32(?,000000EB), ref: 007E2623

GetSystemMetrics.USER32(0000000F), ref: 0086D78A
GetSystemMetrics.USER32(0000000F), ref: 0086D7AA
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0086D9E5
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0086DA03
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0086DA24
ShowWindow.USER32(00000003,00000000), ref: 0086DA43
InvalidateRect.USER32(?,00000000,00000001), ref: 0086DA68
DefDlgProcW.USER32(?,00000005,?,?), ref: 0086DA8B

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 55bbc860b509eb46a2ec069a6049419a12bb94a196d77e3a48b620a63d865e36
Instruction ID: 4e890a1cd8607c048a90f7da1de2bff32f7f68ac886fad9567cc1293c2193697
Opcode Fuzzy Hash: 55bbc860b509eb46a2ec069a6049419a12bb94a196d77e3a48b620a63d865e36
Instruction Fuzzy Hash: 6FB16871A04229ABDF14CF69C9897B97BB1FF08701F0A8169ED48DF296D734A950CB50

Function 007E2A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0081C417,00000004,00000000,00000000,00000000), ref: 007E2ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,0081C417,00000004,00000000,00000000,00000000,000000FF), ref: 007E2B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,0081C417,00000004,00000000,00000000,00000000), ref: 0081C46A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0081C417,00000004,00000000,00000000,00000000), ref: 0081C4D6

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 6de1a493f44f7ff7bd739f37dd55d41f77dd0b20f263a845ff0d1ca7526373a8
Instruction ID: cf08eb6f85b6c10dc512b550b13bfcf976556830b4b6a009306b640b8cb6caad
Opcode Fuzzy Hash: 6de1a493f44f7ff7bd739f37dd55d41f77dd0b20f263a845ff0d1ca7526373a8
Instruction Fuzzy Hash: D24106312096C0AAD7358B2A9C98B7A3B9EFF49300F18C43AE547C6562C67D98C3C710

Function 00847368 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0084737F

Part of subcall function 00800FF6: std::exception::exception.LIBCMT ref: 0080102C
Part of subcall function 00800FF6: __CxxThrowException@8.LIBCMT ref: 00801041

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 008473B6
EnterCriticalSection.KERNEL32(?), ref: 008473D2
_memmove.LIBCMT ref: 00847420
_memmove.LIBCMT ref: 0084743D
LeaveCriticalSection.KERNEL32(?), ref: 0084744C
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00847461
InterlockedExchange.KERNEL32(?,000001F6), ref: 00847480

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 044ec255cfc8ef90cc91100ab119bc0f2dfdca5decf389259e1ea6745c29a658
Instruction ID: 435407e03abcbd86473381e87b21998fcf7d3ef3e02333acaca421929950209e
Opcode Fuzzy Hash: 044ec255cfc8ef90cc91100ab119bc0f2dfdca5decf389259e1ea6745c29a658
Instruction Fuzzy Hash: DC319E31904205EBCF10EF68DC85AAE7BB8FF45710F1540A5FA04EB286DB70DA14DBA1

Function 00866442 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 0086645A
GetDC.USER32(00000000), ref: 00866462
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0086646D
ReleaseDC.USER32(00000000,00000000), ref: 00866479
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 008664B5
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 008664C6
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00869299,?,?,000000FF,00000000,?,000000FF,?), ref: 00866500
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00866520

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 4b26394fbde2dd9dff06c2e61ba71e61c6fe971e1295f8dd89a1d70b60d4693c
Instruction ID: 7dfd3cbb2db43269458d026b7a8940ac2f713b76d6d11e95cebbdb413a5c95c8
Opcode Fuzzy Hash: 4b26394fbde2dd9dff06c2e61ba71e61c6fe971e1295f8dd89a1d70b60d4693c
Instruction Fuzzy Hash: AB318B72200210BFEB118F10DC8AFEA3FA9FF09761F050065FE08DA2A2D6B59851CB74

Function 0083C072 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0083C087
_memcmp.LIBCMT ref: 0083C0A9
_memcmp.LIBCMT ref: 0083C0C1
_memcmp.LIBCMT ref: 0083C0D4
_memcmp.LIBCMT ref: 0083C0EE
_memcmp.LIBCMT ref: 0083C101
_memcmp.LIBCMT ref: 0083C119
_memcmp.LIBCMT ref: 0083C134

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: eb87cca5efd8bbfc1568801a2d7f09cd70649efb4756a8133030d4e5ca511161
Instruction ID: 31833f6ac0b64de4f03ac4090c1d5d44fbf6f889884156bfeae81ada9ed0269f
Opcode Fuzzy Hash: eb87cca5efd8bbfc1568801a2d7f09cd70649efb4756a8133030d4e5ca511161
Instruction Fuzzy Hash: DB21F561601609B7D668A6258C66FBF379CFFB03A4F044020FD19E6392EB16DD1193E2

Function 0084ED8E Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 007E9997: __itow.LIBCMT ref: 007E99C2
Part of subcall function 007E9997: __swprintf.LIBCMT ref: 007E9A0C

Part of subcall function 007FFEC6: _wcscpy.LIBCMT ref: 007FFEE9

_wcstok.LIBCMT ref: 0084EEFF
_wcscpy.LIBCMT ref: 0084EF8E
_memset.LIBCMT ref: 0084EFC1

Strings

X, xrefs: 0084EFFE

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 10a879012476ffa5031bd0f8d0d66e3c53c45fdbc608809cc0db00fb7df2630e
Instruction ID: 883769da2071f50c73ae0442b20240fa142b8b725f0b00510f3b260db12b3820
Opcode Fuzzy Hash: 10a879012476ffa5031bd0f8d0d66e3c53c45fdbc608809cc0db00fb7df2630e
Instruction Fuzzy Hash: 1BC17771508744DFC724EF28C889A5AB7E4FF88314F00496DF999DB2A2DB74E904CB82

Function 007E1424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a4928c9065ed48cf101f072da384f0d83d6963e8b03fce2dd07bd41245f6da0
Instruction ID: ed85a029356e1a3c9f6efe1bf2174c6b22dda9f6542ea6020c88a8a7078da1be
Opcode Fuzzy Hash: 9a4928c9065ed48cf101f072da384f0d83d6963e8b03fce2dd07bd41245f6da0
Instruction Fuzzy Hash: 66719E30901149EFCB14CF99CC4AEBEBB79FF8A310F508159F915AA291D734AA51CFA0

Function 00856E8A Relevance: 10.7, APIs: 7, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b86e96698ae0f65db93840b38c8f536b943a7d38168cab4afe3fa05983ec3a2
Instruction ID: b6732a2be7bad603b21fbcec1af702a2b5cfc809b2d4643e7a1b54777674150a
Opcode Fuzzy Hash: 6b86e96698ae0f65db93840b38c8f536b943a7d38168cab4afe3fa05983ec3a2
Instruction Fuzzy Hash: 8361CF72108740ABC710EB25DC86E6FB7E9FF88714F50891DFA459B2E2DA749D08C792

Function 0086B60B Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01246830), ref: 0086B6A5
IsWindowEnabled.USER32(01246830), ref: 0086B6B1
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 0086B795
SendMessageW.USER32(01246830,000000B0,?,?), ref: 0086B7CC
IsDlgButtonChecked.USER32(?,?), ref: 0086B809
GetWindowLongW.USER32(01246830,000000EC), ref: 0086B82B
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0086B843

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: c2b74a6d72a953ba123f9b2342041100b8c668fcca90943c4e52971a60e1ba6d
Instruction ID: cb79844bfe312bf669e3df0ba25b4fbf62626328ce1907af49b4538f5d46b2b4
Opcode Fuzzy Hash: c2b74a6d72a953ba123f9b2342041100b8c668fcca90943c4e52971a60e1ba6d
Instruction Fuzzy Hash: E771D234604204AFEB209F64C8D4FBA7BB9FF59308F1A4069EA56D73A1D731AC91CB50

Function 0085F732 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0085F75C
_memset.LIBCMT ref: 0085F825
ShellExecuteExW.SHELL32(?), ref: 0085F86A

Part of subcall function 007E9997: __itow.LIBCMT ref: 007E99C2
Part of subcall function 007E9997: __swprintf.LIBCMT ref: 007E9A0C

Part of subcall function 007FFEC6: _wcscpy.LIBCMT ref: 007FFEE9

GetProcessId.KERNEL32(00000000), ref: 0085F8E1
CloseHandle.KERNEL32(00000000), ref: 0085F910

Strings

@, xrefs: 0085F839

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 869f7c508870abc7afe4f827d82059ece1bb2ed7b0a0f418f36930348ff72114
Instruction ID: 8c187b61a2b5f8233861bdc3d4e73b4705490940d838671c0395d3c47e339b9b
Opcode Fuzzy Hash: 869f7c508870abc7afe4f827d82059ece1bb2ed7b0a0f418f36930348ff72114
Instruction Fuzzy Hash: 2161AC75A00659DFCF14EF69C9849AEBBF4FF48310F148469E94AAB352CB34AD44CB90

Function 0084145D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0084149C
GetKeyboardState.USER32(?), ref: 008414B1
SetKeyboardState.USER32(?), ref: 00841512
PostMessageW.USER32(?,00000101,00000010,?), ref: 00841540
PostMessageW.USER32(?,00000101,00000011,?), ref: 0084155F
PostMessageW.USER32(?,00000101,00000012,?), ref: 008415A5
PostMessageW.USER32(?,00000101,0000005B,?), ref: 008415C8

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 04964fa59a7510cc4f9f3974be464979f7edef1ffdcc813707535b2de13f005e
Instruction ID: f36ad1572d3aa49c0adcc28ef0a4087f06948e823b42eece40adedca5afcd20c
Opcode Fuzzy Hash: 04964fa59a7510cc4f9f3974be464979f7edef1ffdcc813707535b2de13f005e
Instruction Fuzzy Hash: A351C1A0A047D93AFF3646288C49BBABEA9BB46304F094589E1D6C68C2D7D8DCC4D751

Function 00841276 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 008412B5
GetKeyboardState.USER32(?), ref: 008412CA
SetKeyboardState.USER32(?), ref: 0084132B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00841357
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00841374
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 008413B8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 008413D9

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 0b6685885957a0fe91f85021a6f003f53deae5430297176817beb277fce1cf39
Instruction ID: 722f22afe6894d3d2fa0810f81b359cd1cf15cddf5d0419e93381d2b469cbd3c
Opcode Fuzzy Hash: 0b6685885957a0fe91f85021a6f003f53deae5430297176817beb277fce1cf39
Instruction Fuzzy Hash: 9051C1A06047D93DFF3287248C49B7ABEA9FB06304F088589E1D8C69C2D799ACD4D765

Function 0084589F Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 008458AC
_wcsncpy.LIBCMT ref: 008458E1
_wcsncpy.LIBCMT ref: 00845913
_wcsncpy.LIBCMT ref: 00845946
_wcsncpy.LIBCMT ref: 00845988
_wcsncpy.LIBCMT ref: 008459C2
_wcsncpy.LIBCMT ref: 008459F1

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: fbbb48042cb466b8a44117fd354ee8bcc3202989eb08f68548855f25a60ebf52
Instruction ID: 7e3d7f757cecf03931c595971f667e1df68ca2776fd2d600defd1b62ffcdd5fa
Opcode Fuzzy Hash: fbbb48042cb466b8a44117fd354ee8bcc3202989eb08f68548855f25a60ebf52
Instruction Fuzzy Hash: D74190A5C2012C76CB50EBB8CC8A9CFB7A8FF05310F509466E518E3162E634E715C7A6

Function 008438AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 008448AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,008438D3,?), ref: 008448C7

Part of subcall function 008448AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,008438D3,?), ref: 008448E0

lstrcmpiW.KERNEL32(?,?), ref: 008438F3
_wcscmp.LIBCMT ref: 0084390F
MoveFileW.KERNEL32(?,?), ref: 00843927
_wcscat.LIBCMT ref: 0084396F
SHFileOperationW.SHELL32(?), ref: 008439DB

Strings

\*.*, xrefs: 00843969

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: e4f4874f4912dcc8a27c799053be353d09e6fb7613df45fbd645cc36f0d4292f
Instruction ID: 634b8fc7e5302ad554fd17daa54cbee401162ae6417ed3202b6d1303c309ca9b
Opcode Fuzzy Hash: e4f4874f4912dcc8a27c799053be353d09e6fb7613df45fbd645cc36f0d4292f
Instruction Fuzzy Hash: 074181B14083889AC751EF64C486ADBBBE8FF89340F14192EB489C3191EA74D648C752

Function 00867500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00867519
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 008675C0
IsMenu.USER32(?), ref: 008675D8
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00867620
DrawMenuBar.USER32 ref: 00867633

Strings

0, xrefs: 0086750D

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 4ea9fab9393b9a5ae3320662b166b30da98149636ebf29ddfc41b043d836af6d
Instruction ID: 1d2134adaa2455db2e0d06489846bb6d172be326a42b4eb6bb9478339d72442f
Opcode Fuzzy Hash: 4ea9fab9393b9a5ae3320662b166b30da98149636ebf29ddfc41b043d836af6d
Instruction Fuzzy Hash: 0F414975A04609EFDB10DF54E884E9ABBF8FB09328F158169E916D7290D730ED50CF90

Function 0086122D Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 0086125C
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00861286
FreeLibrary.KERNEL32(00000000), ref: 0086133D

Part of subcall function 0086122D: RegCloseKey.ADVAPI32(?), ref: 008612A3
Part of subcall function 0086122D: FreeLibrary.KERNEL32(?), ref: 008612F5
Part of subcall function 0086122D: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00861318

RegDeleteKeyW.ADVAPI32(?,?), ref: 008612E0

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 44563b1c5cbd2fe3b5daf1926dbfd62353cd1878d8063f2724241b412fc8604b
Instruction ID: 826970deaa3b1dbac0a41105c83cffa56132f31c704d9a4a1c2110cf46b479a7
Opcode Fuzzy Hash: 44563b1c5cbd2fe3b5daf1926dbfd62353cd1878d8063f2724241b412fc8604b
Instruction Fuzzy Hash: 44311C71901109BFDF15DB94EC89AFEB7BCFF08340F050169E602E2252DB749E459AA1

Function 0086653C Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 0086655B
GetWindowLongW.USER32(01246830,000000F0), ref: 0086658E
GetWindowLongW.USER32(01246830,000000F0), ref: 008665C3
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 008665F5
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 0086661F
GetWindowLongW.USER32(00000000,000000F0), ref: 00866630
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 0086664A

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: e264a2feda6e2e0d95cd1be3f00cd558434866b943f974055b17c0c710e44577
Instruction ID: 901735e1128af3432299a41d66cc4677505f63ecfb0c3a70bcf0c50cb985279f
Opcode Fuzzy Hash: e264a2feda6e2e0d95cd1be3f00cd558434866b943f974055b17c0c710e44577
Instruction Fuzzy Hash: 7231D730604194AFEB21CF28EC8AF5537E5FB5A714F1A0164F612CB2B6EB61EC60DB51

Function 00856486 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 008580A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 008580CB

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 008564D9
WSAGetLastError.WSOCK32(00000000), ref: 008564E8
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00856521
connect.WSOCK32(00000000,?,00000010), ref: 0085652A
WSAGetLastError.WSOCK32 ref: 00856534
closesocket.WSOCK32(00000000), ref: 0085655D
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00856576

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 5ca3189341c0f9deef15bf67d1bd85bf628243d8472b9c3bfa9802408c754c81
Instruction ID: ed8855c99b3516f61e7c72a2b709c25a56651fa97c92d2c732e38fb3194cba2e
Opcode Fuzzy Hash: 5ca3189341c0f9deef15bf67d1bd85bf628243d8472b9c3bfa9802408c754c81
Instruction Fuzzy Hash: 79318171600118AFDB10AF24DC85BBE7BA9FF44715F448069FE05E7291EB74AD18CBA1

Function 0083E0B5 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0083E0FA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0083E120
SysAllocString.OLEAUT32(00000000), ref: 0083E123
SysAllocString.OLEAUT32 ref: 0083E144
SysFreeString.OLEAUT32 ref: 0083E14D
StringFromGUID2.OLE32(?,?,00000028), ref: 0083E167
SysAllocString.OLEAUT32(?), ref: 0083E175

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: c45900e03ade9b6becb5cc5204e74eb04757321e8940f87818834107d117b634
Instruction ID: cd652a232771e2b2cafb7f9922e89583ff0e7dfce608a62506d09cb07d8b0661
Opcode Fuzzy Hash: c45900e03ade9b6becb5cc5204e74eb04757321e8940f87818834107d117b634
Instruction Fuzzy Hash: 80214135604108AFDB10AFA8DC88DAB77ECFB49760F118135FA55CB2A5DAB0DC418BA4

Function 0086783C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007E1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 007E1D73
Part of subcall function 007E1D35: GetStockObject.GDI32(00000011), ref: 007E1D87
Part of subcall function 007E1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 007E1D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 008678A1
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 008678AE
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 008678B9
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 008678C8
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 008678D4

Strings

Msctls_Progress32, xrefs: 00867872

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: ef518b64f358761d53840b475fe0f32800b4f9112c923c4562b9957630f53293
Instruction ID: e5353aed03ca987ab342be114678dc63d457dac8aab912ba129aaf4f97b7b9c6
Opcode Fuzzy Hash: ef518b64f358761d53840b475fe0f32800b4f9112c923c4562b9957630f53293
Instruction Fuzzy Hash: 89118EB2110219BFEF159E60CC85EE77F6DFF08798F014125FA04A60A0D7729C21DBA4

Function 008041C9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00804292,?), ref: 008041E3
GetProcAddress.KERNEL32(00000000), ref: 008041EA
EncodePointer.KERNEL32(00000000), ref: 008041F6
DecodePointer.KERNEL32(00000001,00804292,?), ref: 00804213

Strings

combase.dll, xrefs: 008041DE
RoInitialize, xrefs: 008041D2

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 31371aaa80ffcd34739877a8f67b740803da42460c527d4d43289eae5b17f83f
Instruction ID: 83e04c635298bb504c4a32e9e1fdd9740e99831be1dce2b0c1f23b210a10ac93
Opcode Fuzzy Hash: 31371aaa80ffcd34739877a8f67b740803da42460c527d4d43289eae5b17f83f
Instruction Fuzzy Hash: B5E01AB0690300AEEF205BB0FC09B043AA5F7A2B02F11B424F621D56E1DBF680918F00

Function 0080429E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,008041B8), ref: 008042B8
GetProcAddress.KERNEL32(00000000), ref: 008042BF
EncodePointer.KERNEL32(00000000), ref: 008042CA
DecodePointer.KERNEL32(008041B8), ref: 008042E5

Strings

combase.dll, xrefs: 008042B3
RoUninitialize, xrefs: 008042A7

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 7f7a9a3bc62cf1f4ca98fdeaf2946b33addc815f2f41685a7fde8f426ef95d93
Instruction ID: c0aa63fe913cf4f5800cec97035072c709cca4b7e77f019beefeb7e042f9d5ab
Opcode Fuzzy Hash: 7f7a9a3bc62cf1f4ca98fdeaf2946b33addc815f2f41685a7fde8f426ef95d93
Instruction Fuzzy Hash: FAE0B6B8681310AFEF509B60FD0EB143AA4F766B42F21702AF215E16A5DBF5C540CB14

Function 0084675A Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 008468AD
_memmove.LIBCMT ref: 008467E8

Part of subcall function 007E9997: __itow.LIBCMT ref: 007E99C2
Part of subcall function 007E9997: __swprintf.LIBCMT ref: 007E9A0C

_memmove.LIBCMT ref: 0084685B
_memmove.LIBCMT ref: 00846942
_memmove.LIBCMT ref: 0084695B
_memmove.LIBCMT ref: 00846977

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 9bd310fd09ae2354bcac085273aa9b4df644df47a2912129c0e3355fe0b9d60c
Instruction ID: a3c2700aecfca8cfbf0d5ae40dc0e05a3f412bd377fe71d74aa97ec7953df0bc
Opcode Fuzzy Hash: 9bd310fd09ae2354bcac085273aa9b4df644df47a2912129c0e3355fe0b9d60c
Instruction Fuzzy Hash: 3F61BC3150068E9BCF15EF29CC85EFE3BA8FF49308F044519F9859B292EB34A855CB52

Function 0086046F Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 007E7F41: _memmove.LIBCMT ref: 007E7F82

Part of subcall function 008610A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00860038,?,?), ref: 008610BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00860548
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00860588
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 008605AB
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 008605D4
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00860617
RegCloseKey.ADVAPI32(00000000), ref: 00860624

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 1d3f4a2552308c585c034364dbd668ba54e5b2fc5be17d3d3578023d6d7549a5
Instruction ID: 802c162ff263925c318e68f375cfdf6218b486de1bc05f47df54932adaae7907
Opcode Fuzzy Hash: 1d3f4a2552308c585c034364dbd668ba54e5b2fc5be17d3d3578023d6d7549a5
Instruction Fuzzy Hash: DA514931108244EFCB14EB68D889E6BBBE8FF88314F04492DF585972A2DB75E914CF52

Function 00865A20 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00865A82
GetMenuItemCount.USER32(00000000), ref: 00865AB9
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00865AE1
GetMenuItemID.USER32(?,?), ref: 00865B50
GetSubMenu.USER32(?,?), ref: 00865B5E
PostMessageW.USER32(?,00000111,?,00000000), ref: 00865BAF

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 8d2a943c96f19dc2df22dd54b6085675a023361ac3c0fedc71affde97bab046c
Instruction ID: 5e76f9e9901f5ae41f423c8315a67af0fc33566d725a46261cc45ff30bc715e1
Opcode Fuzzy Hash: 8d2a943c96f19dc2df22dd54b6085675a023361ac3c0fedc71affde97bab046c
Instruction Fuzzy Hash: 48516E35A00629EFDF11DFA4C845AAEB7B4FF48320F114469E941FB391CB74AE418B91

Function 0083F3DD Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0083F3F7
VariantClear.OLEAUT32(00000013), ref: 0083F469
VariantClear.OLEAUT32(00000000), ref: 0083F4C4
_memmove.LIBCMT ref: 0083F4EE
VariantClear.OLEAUT32(?), ref: 0083F53B
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 0083F569

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 39b01cc248425adddfe77f44217e4935d0812500702246dd1c07c0d0eac6d7ad
Instruction ID: 6fe8d78e5a33001ce97cf03f61a4222f8ed0949f36460009c1a40b036c6bc6cc
Opcode Fuzzy Hash: 39b01cc248425adddfe77f44217e4935d0812500702246dd1c07c0d0eac6d7ad
Instruction Fuzzy Hash: 9C514CB5A00209DFCB14CF58D884AAAB7B8FF8C354F15856AEA59DB311D730E911CFA0

Function 008426F9 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00842747
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00842792
IsMenu.USER32(00000000), ref: 008427B2
CreatePopupMenu.USER32 ref: 008427E6
GetMenuItemCount.USER32(000000FF), ref: 00842844
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00842875

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: f2024619dcf906161045efe5dc9d6626825e72a729014be99448b0197ba6639e
Instruction ID: 4a4fdc51c51c5dcdff61f613d57bf8f771891a1e9740a2cf9317062d23e5e7ed
Opcode Fuzzy Hash: f2024619dcf906161045efe5dc9d6626825e72a729014be99448b0197ba6639e
Instruction Fuzzy Hash: 42519D70A0820EEBDF24CF68D888AAEBBF5FF54318F504169F821DB291D7709944CB61

Function 007E1765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 007E2612: GetWindowLongW.USER32(?,000000EB), ref: 007E2623

BeginPaint.USER32(?,?,?,?,?,?), ref: 007E179A
GetWindowRect.USER32(?,?), ref: 007E17FE
ScreenToClient.USER32(?,?), ref: 007E181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 007E182C
EndPaint.USER32(?,?), ref: 007E1876

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 67d03884c72f5512f5201671ab252ed0008a8ab249ff2fdf27f77283ee462938
Instruction ID: 52b825027a143ed215d4fdd15e26f43d1a86a2fe6e566b3f6770d80d530a2351
Opcode Fuzzy Hash: 67d03884c72f5512f5201671ab252ed0008a8ab249ff2fdf27f77283ee462938
Instruction Fuzzy Hash: 8A41BC70101240AFD710DF26DC85FBA7BE8FF4A734F040628FAA5C62A2D7749845DB62

Function 0086B958 Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(008A67B0,00000000,01246830,?,?,008A67B0,?,0086B862,?,?), ref: 0086B9CC
EnableWindow.USER32(00000000,00000000), ref: 0086B9F0
ShowWindow.USER32(008A67B0,00000000,01246830,?,?,008A67B0,?,0086B862,?,?), ref: 0086BA50
ShowWindow.USER32(00000000,00000004,?,0086B862,?,?), ref: 0086BA62
EnableWindow.USER32(00000000,00000001), ref: 0086BA86
SendMessageW.USER32(?,0000130C,?,00000000), ref: 0086BAA9

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 1f97c7c448d64e812f8f58033473a5b1e43fb3538d7b10d6829a90949f168564
Instruction ID: aefd5b441daecc9af8d4eb1a3b3821eadf2712f7452b4a43afbc7a4d9628ac56
Opcode Fuzzy Hash: 1f97c7c448d64e812f8f58033473a5b1e43fb3538d7b10d6829a90949f168564
Instruction Fuzzy Hash: 64416C30601250AFDB26CF68D489B957FE0FB05319F1A42B9FA48CF2A2D771E885CB51

Function 008573B1 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00855134,?,?,00000000,00000001), ref: 008573BF

Part of subcall function 00853C94: GetWindowRect.USER32(?,?), ref: 00853CA7

GetDesktopWindow.USER32 ref: 008573E9
GetWindowRect.USER32(00000000), ref: 008573F0
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00857422

Part of subcall function 008454E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0084555E

GetCursorPos.USER32(?), ref: 0085744E
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 008574AC

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 26de166c32bb6b8351e56ddb98117753ce197d6a03c86c20f8554a73aafb1838
Instruction ID: 66dd8765274e757038f4a70e4b5314e4dbc30f9cf9af8d3328877378ba47fbb2
Opcode Fuzzy Hash: 26de166c32bb6b8351e56ddb98117753ce197d6a03c86c20f8554a73aafb1838
Instruction Fuzzy Hash: 7631B472508305ABD720DF54E849E5BBBA9FF88314F004919F989D7192C770E949CB96

Function 00838D5B Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 008385F1: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00838608
Part of subcall function 008385F1: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00838612
Part of subcall function 008385F1: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00838621
Part of subcall function 008385F1: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00838628
Part of subcall function 008385F1: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 0083863E

GetLengthSid.ADVAPI32(?,00000000,00838977), ref: 00838DAC
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00838DB8
HeapAlloc.KERNEL32(00000000), ref: 00838DBF
CopySid.ADVAPI32(00000000,00000000,?), ref: 00838DD8
GetProcessHeap.KERNEL32(00000000,00000000,00838977), ref: 00838DEC
HeapFree.KERNEL32(00000000), ref: 00838DF3

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: b18cc426cfc047524273379c94b4126585a026a7fe0d72c9d26d4b529dc564c8
Instruction ID: 07ddcbf50906b2d742947d00b8e3efe4f206a6c9aedc314f91317ffaa395b889
Opcode Fuzzy Hash: b18cc426cfc047524273379c94b4126585a026a7fe0d72c9d26d4b529dc564c8
Instruction Fuzzy Hash: C411A932600605FFDB119FA4EC09BAE7BA9FF95355F104029FA45D7251CB72AA04CBA0

Function 00838AF9 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00838B2A
OpenProcessToken.ADVAPI32(00000000), ref: 00838B31
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00838B40
CloseHandle.KERNEL32(00000004), ref: 00838B4B
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00838B7A
DestroyEnvironmentBlock.USERENV(00000000), ref: 00838B8E

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 59b076817e0aa773fb28c8e575e059bd15da79ae0063b7d2e8b19a13b34843fa
Instruction ID: baa1fe67b1b8bce6793867d76d6dda6ea8e7e49e24cf8416d7bb26953d6a0859
Opcode Fuzzy Hash: 59b076817e0aa773fb28c8e575e059bd15da79ae0063b7d2e8b19a13b34843fa
Instruction Fuzzy Hash: 2E114AB250024AEBDB018FA4ED49FDABBA9FB48314F055064FA04A2161C771CD609BA1

Function 0086C19A Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 007E12F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 007E134D
Part of subcall function 007E12F3: SelectObject.GDI32(?,00000000), ref: 007E135C
Part of subcall function 007E12F3: BeginPath.GDI32(?), ref: 007E1373
Part of subcall function 007E12F3: SelectObject.GDI32(?,00000000), ref: 007E139C

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 0086C1C4
LineTo.GDI32(00000000,00000003,?), ref: 0086C1D8
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0086C1E6
LineTo.GDI32(00000000,00000000,?), ref: 0086C1F6
EndPath.GDI32(00000000), ref: 0086C206
StrokePath.GDI32(00000000), ref: 0086C216

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 83c0e3ba49cd7d66edc5cae03be48dd4d2ba0c45e4b5fcf5b12bcf72f357ad36
Instruction ID: 8092a3a73e097c322c10baab5d6779337c0c31d2ebc120d42ce0dbdaea809a90
Opcode Fuzzy Hash: 83c0e3ba49cd7d66edc5cae03be48dd4d2ba0c45e4b5fcf5b12bcf72f357ad36
Instruction Fuzzy Hash: 54110C7640014CBFEB129F91EC48EAA7FADFF09394F058021FA1896162D7719D55DBA0

Function 008003A2 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 008003D3
MapVirtualKeyW.USER32(00000010,00000000), ref: 008003DB
MapVirtualKeyW.USER32(000000A0,00000000), ref: 008003E6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 008003F1
MapVirtualKeyW.USER32(00000011,00000000), ref: 008003F9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00800401

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 90515ffe62d8d325e6611495156fb3ddcede0d9a6c22364820cfe746b21c7db2
Instruction ID: 0ce9d00ce434e2d7664db6b0e554803bf65bdeead7ccf51524341dacad8831bd
Opcode Fuzzy Hash: 90515ffe62d8d325e6611495156fb3ddcede0d9a6c22364820cfe746b21c7db2
Instruction Fuzzy Hash: 01016CB09017597DE3008F5A8C85B52FFA8FF19354F00411BE15C4B942C7F5A864CBE5

Function 0084568B Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 0084569B
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 008456B1
GetWindowThreadProcessId.USER32(?,?), ref: 008456C0
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 008456CF
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 008456D9
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 008456E0

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: a2df07f984216da6e748fa4a9489079d82903ae0c7cd3894f9db975e1892bc3e
Instruction ID: 62efdb51fc318ee7bb8c5977b0d160b080511efa63be8ea96124397df6d03be6
Opcode Fuzzy Hash: a2df07f984216da6e748fa4a9489079d82903ae0c7cd3894f9db975e1892bc3e
Instruction Fuzzy Hash: 18F06D32241118BBE7215BA2EC0DEAF7B7CFBD6B11F011169FB00D105296E09A0186B5

Function 008474D2 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 008474E5
EnterCriticalSection.KERNEL32(?,?,007F1044,?,?), ref: 008474F6
TerminateThread.KERNEL32(00000000,000001F6,?,007F1044,?,?), ref: 00847503
WaitForSingleObject.KERNEL32(00000000,000003E8,?,007F1044,?,?), ref: 00847510

Part of subcall function 00846ED7: CloseHandle.KERNEL32(00000000,?,0084751D,?,007F1044,?,?), ref: 00846EE1

InterlockedExchange.KERNEL32(?,000001F6), ref: 00847523
LeaveCriticalSection.KERNEL32(?,?,007F1044,?,?), ref: 0084752A

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: ef190db04ac8d1a1c979570b6ecdb8f2281a2958a67e373125784a7bf6e16645
Instruction ID: 3b7968bd550047826c09585a5168022ef5324539eb37e3ccb2f64e7dd6ba7f27
Opcode Fuzzy Hash: ef190db04ac8d1a1c979570b6ecdb8f2281a2958a67e373125784a7bf6e16645
Instruction Fuzzy Hash: 94F05E3A144612EBDB122B64FC9CDEB772AFF45302B121532F302951B2DBB59811CF50

Function 00838E74 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00838E7F
UnloadUserProfile.USERENV(?,?), ref: 00838E8B
CloseHandle.KERNEL32(?), ref: 00838E94
CloseHandle.KERNEL32(?), ref: 00838E9C
GetProcessHeap.KERNEL32(00000000,?), ref: 00838EA5
HeapFree.KERNEL32(00000000), ref: 00838EAC

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: f947093cac4bcc70e9437f898e79a32d938016d95a95d53d78a819bfca340159
Instruction ID: 2d5ada1893dca87badae12fde434806ce7d705fea6c2bcc398223c160ada8b51
Opcode Fuzzy Hash: f947093cac4bcc70e9437f898e79a32d938016d95a95d53d78a819bfca340159
Instruction Fuzzy Hash: 35E0C236004001FBDA021FE1FD0C90ABB69FB8A362B129230F31981171CBB29420DB50

Function 00858902 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00858928
CharUpperBuffW.USER32(?,?), ref: 00858A37
VariantClear.OLEAUT32(?), ref: 00858BAF

Part of subcall function 00847804: VariantInit.OLEAUT32(00000000), ref: 00847844
Part of subcall function 00847804: VariantCopy.OLEAUT32(00000000,?), ref: 0084784D
Part of subcall function 00847804: VariantClear.OLEAUT32(00000000), ref: 00847859

Strings

AUTOIT.ERROR, xrefs: 00858A3D
Incorrect Parameter format, xrefs: 00858960, 00858B22

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 53144883b1b3fe08b350a9a43edb2e3327cebb3227cc7d6adada78d27f7e9aa8
Instruction ID: e50321bbb3e78d9c590ae871ca0d10e2016d0c45f4b4a64ebb5a5797a0c3440e
Opcode Fuzzy Hash: 53144883b1b3fe08b350a9a43edb2e3327cebb3227cc7d6adada78d27f7e9aa8
Instruction Fuzzy Hash: D7914871608345DFC710DF29C48496ABBE8FF88315F04896EF996DB262DB30E909CB52

Function 00842F86 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007FFEC6: _wcscpy.LIBCMT ref: 007FFEE9

_memset.LIBCMT ref: 00843077
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 008430A6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00843159
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00843187

Strings

0, xrefs: 00843063

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 851495b014f910b0c0b779773d63de9ff20aa34ce54c59faebacb44f3d7e77a6
Instruction ID: 9571cf2ece9b0309544ffa5fa1482b97c7079894b86624128f0f661c6e514087
Opcode Fuzzy Hash: 851495b014f910b0c0b779773d63de9ff20aa34ce54c59faebacb44f3d7e77a6
Instruction Fuzzy Hash: ED51A0316083099AE7259F28D849A6BB7E8FF55324F040A2EF895D71E1EB74CE44CB52

Function 0083DA5D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0083DAC5
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0083DAFB
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0083DB0C
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 0083DB8E

Strings

DllGetClassObject, xrefs: 0083DB01

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 458537d5d63111d8b7c20571343209434a3044806a54bac1cac684ef61ce3d30
Instruction ID: a924af943c79552f44556c1809b0a53cf4767cca0ad8df4455dbe1dea957f37e
Opcode Fuzzy Hash: 458537d5d63111d8b7c20571343209434a3044806a54bac1cac684ef61ce3d30
Instruction Fuzzy Hash: 35415FB1600309EFDB15DF55D884A9ABBA9FF84360F1680A9ED05DF206D7B1DA44CBE0

Function 00842C42 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00842CAF
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00842CCB
DeleteMenu.USER32(?,00000007,00000000), ref: 00842D11
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,008A6890,00000000), ref: 00842D5A

Strings

0, xrefs: 00842CA4

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 4a7aaeda31dc7f3b850cb5d209dc80404955fa271133ee2145142f6954ea021a
Instruction ID: a6bfc002b6889802c02dcc41ad058f6a5346392651ae5ccb9adbe470da66b055
Opcode Fuzzy Hash: 4a7aaeda31dc7f3b850cb5d209dc80404955fa271133ee2145142f6954ea021a
Instruction Fuzzy Hash: 6F41AF306093499FD720DF28CC45B1AB7A8FF85324F444A6EF966D7291DB70E904CB92

Function 0085DAB9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0085DAD9

Part of subcall function 007E79AB: _memmove.LIBCMT ref: 007E79F9

Strings

winapi, xrefs: 0085DB4A
stdcall, xrefs: 0085DB5B
cdecl, xrefs: 0085DB30
none, xrefs: 0085DBB4

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 95fa96d47527324fc00514ad6a593bc389a4af5dc9af39885f5976585381fc7e
Instruction ID: e3ff3fc20af594211b8c1fe7b88a2ce8aa4fc833ba8f8a4455d1c90e3c0c97ea
Opcode Fuzzy Hash: 95fa96d47527324fc00514ad6a593bc389a4af5dc9af39885f5976585381fc7e
Instruction Fuzzy Hash: 6131B27050461ADBCF10EF98CC819AEB7B5FF14320B008629EC65D76D1CB71A909CB81

Function 00839372 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007E7F41: _memmove.LIBCMT ref: 007E7F82

Part of subcall function 0083B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0083B0E7

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 008393F6
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00839409
SendMessageW.USER32(?,00000189,?,00000000), ref: 00839439

Part of subcall function 007E7D2C: _memmove.LIBCMT ref: 007E7D66

Strings

ComboBox, xrefs: 00839380
ListBox, xrefs: 008393B5

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 3c73dd386964ffe763305d7aaba1a04d745f869141a8745cee6881b7fa51db9b
Instruction ID: cff2a4b0f86c6110e47a96b1cc01a39b4b231502e44662b027e4f0010846cf13
Opcode Fuzzy Hash: 3c73dd386964ffe763305d7aaba1a04d745f869141a8745cee6881b7fa51db9b
Instruction Fuzzy Hash: 782104B1901108AADB18AB74DC8ACFFB768FF85360F104129F961D72E1DB784D0AD660

Function 00851B21 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00851B40
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00851B66
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00851B96
InternetCloseHandle.WININET(00000000), ref: 00851BDD

Part of subcall function 00852777: GetLastError.KERNEL32(?,?,00851B0B,00000000,00000000,00000001), ref: 0085278C
Part of subcall function 00852777: SetEvent.KERNEL32(?,?,00851B0B,00000000,00000000,00000001), ref: 008527A1

Strings

, xrefs: 00851B87

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 6944aed5db4b698e5de7c1227a504b4abe55150239107c26038803b4690c0ddf
Instruction ID: e9f70cc2cec6e4df4e98c242c77917cbe06cf2c1fd2530b12cd2482027732c5a
Opcode Fuzzy Hash: 6944aed5db4b698e5de7c1227a504b4abe55150239107c26038803b4690c0ddf
Instruction Fuzzy Hash: 28219FB1500208BFEB119F649C89FBF77ECFB4975AF10416AF905E6240EB609D099762

Function 00866656 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 007E1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 007E1D73
Part of subcall function 007E1D35: GetStockObject.GDI32(00000011), ref: 007E1D87
Part of subcall function 007E1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 007E1D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 008666D0
LoadLibraryW.KERNEL32(?), ref: 008666D7
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 008666EC
DestroyWindow.USER32(?), ref: 008666F4

Strings

SysAnimate32, xrefs: 008666AB

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: fd982d45f0adb7caa28b182c3a5adcd3dd1972046de1c46e04475920df0494cc
Instruction ID: a09c574dcb8a08000e3a85e773c8b074402dbef2f62eef742c20310264138105
Opcode Fuzzy Hash: fd982d45f0adb7caa28b182c3a5adcd3dd1972046de1c46e04475920df0494cc
Instruction Fuzzy Hash: EF219FB1200246ABEF104F64EC81EBB77ADFB69368F124629FA11D6190E7B1CC619761

Function 0084703E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 0084705E
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00847091
GetStdHandle.KERNEL32(0000000C), ref: 008470A3
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 008470DD

Strings

nul, xrefs: 008470D8

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: e633fa740bfecb42a7f5d05bb1b877a8f43d38f07670d1ec1f357f32f2e0c505
Instruction ID: 89637347d66b7d6e3884ee8364b8736b2bc6cc60de7dac81205f9e17d91f6331
Opcode Fuzzy Hash: e633fa740bfecb42a7f5d05bb1b877a8f43d38f07670d1ec1f357f32f2e0c505
Instruction Fuzzy Hash: 7F218C7460560DABDF209F78EC05A9A77A8FF55724F204A29FDA0D72D0EBB0D8508B61

Function 0084710C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 0084712B
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 0084715D
GetStdHandle.KERNEL32(000000F6), ref: 0084716E
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 008471A8

Strings

nul, xrefs: 008471A3

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 9adf473778d1b15d6fd15491948eb91f6e005449474a88c58f60cd4cd8a17ef7
Instruction ID: 75627571c9b2cf3f905de49397928af47055a62a00d7caaf2fda9736382df545
Opcode Fuzzy Hash: 9adf473778d1b15d6fd15491948eb91f6e005449474a88c58f60cd4cd8a17ef7
Instruction Fuzzy Hash: D921417550420D9BDF209F689C04A9AB7E8FF55724F200A1AFDA1D72D0EB70D851CB51

Function 0084AEAB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0084AEBF
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0084AF13
__swprintf.LIBCMT ref: 0084AF2C
SetErrorMode.KERNEL32(00000000,00000001,00000000,0086F910), ref: 0084AF6A

Strings

%lu, xrefs: 0084AF26

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 8bb89b57e9038370fe1a423190f4902a42ab1a3f9e14c62d37bf7aaa1265756a
Instruction ID: 321331a6bd5cf0b1eec3d32e357d7f1ae46dbbe7b8c7a3a0145c6b289f18e08a
Opcode Fuzzy Hash: 8bb89b57e9038370fe1a423190f4902a42ab1a3f9e14c62d37bf7aaa1265756a
Instruction Fuzzy Hash: DF21627160014DAFCB10DB59DC85DAE7BB8FF89704B004069F905EB252DB71EA45CB61

Function 0083A52F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007E7D2C: _memmove.LIBCMT ref: 007E7D66

Part of subcall function 0083A37C: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0083A399
Part of subcall function 0083A37C: GetWindowThreadProcessId.USER32(?,00000000), ref: 0083A3AC
Part of subcall function 0083A37C: GetCurrentThreadId.KERNEL32 ref: 0083A3B3
Part of subcall function 0083A37C: AttachThreadInput.USER32(00000000), ref: 0083A3BA

GetFocus.USER32 ref: 0083A554

Part of subcall function 0083A3C5: GetParent.USER32(?), ref: 0083A3D3

GetClassNameW.USER32(?,?,00000100), ref: 0083A59D
EnumChildWindows.USER32(?,0083A615), ref: 0083A5C5
__swprintf.LIBCMT ref: 0083A5DF

Strings

%s%d, xrefs: 0083A5D9

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: fce146080087c033b6b53ba38426a74d94da1a0c66cf8e870f8304bf5043237a
Instruction ID: 22c65027aa2c52b200a782f8f96c4ad43d0282a4fe118835329ede849f20d96a
Opcode Fuzzy Hash: fce146080087c033b6b53ba38426a74d94da1a0c66cf8e870f8304bf5043237a
Instruction Fuzzy Hash: CE11A571204208ABDF15BF64DC8AFEA3778FF88700F044075FA58DA253DA7599458BB6

Function 00842017 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00842048

Strings

REMOVE, xrefs: 0084204E
EXISTS, xrefs: 00842070
KEYS, xrefs: 0084205F
APPEND, xrefs: 00842081

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 02ef1e5ce108ddeadc987c35a01c8df93c3e31ca4ada342a0493c9b6ca1691d6
Instruction ID: 31d7eb231a732bd4eb2458fd5eabb32d1bc53b294eba5329f19f7a18ed21c10e
Opcode Fuzzy Hash: 02ef1e5ce108ddeadc987c35a01c8df93c3e31ca4ada342a0493c9b6ca1691d6
Instruction Fuzzy Hash: 6711393090410DCFCF04EFA4D8415AEB7B4FF25308F508568E956E7292EB32690ACB51

Function 0085EE69 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0085EF1B
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0085EF4B
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 0085F07E
CloseHandle.KERNEL32(?), ref: 0085F0FF

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 0192d37cf92f85666ce7ffdbc1bf825316ffc4540635751937f8011b3a9211db
Instruction ID: fb1e35ac3b998869f785bde447294d04060b2653cce43d6f4cbea6164b4a7dff
Opcode Fuzzy Hash: 0192d37cf92f85666ce7ffdbc1bf825316ffc4540635751937f8011b3a9211db
Instruction Fuzzy Hash: 57817FB16017009FD720DF29C84AB6AB7E5FF88710F14882DFA99DB292DB74AC04CB51

Function 008602C2 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 007E7F41: _memmove.LIBCMT ref: 007E7F82

Part of subcall function 008610A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00860038,?,?), ref: 008610BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00860388
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 008603C7
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 0086040E
RegCloseKey.ADVAPI32(?,?), ref: 0086043A
RegCloseKey.ADVAPI32(00000000), ref: 00860447

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 117a0ad87cb45d16d15275855e695ed9e69675f24ad535e1f4bcdc9127c6fddd
Instruction ID: cff9632a5b2318ed3de47ef4291fbbeba951760804493651b8b1fb1e6ccd3313
Opcode Fuzzy Hash: 117a0ad87cb45d16d15275855e695ed9e69675f24ad535e1f4bcdc9127c6fddd
Instruction Fuzzy Hash: 2C514931208244EFD704EB69D885E6BB7E8FF88308F04892DF595C72A2DB74E904CB56

Function 0085DBDC Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 007E9997: __itow.LIBCMT ref: 007E99C2
Part of subcall function 007E9997: __swprintf.LIBCMT ref: 007E9A0C

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0085DC3B
GetProcAddress.KERNEL32(00000000,?), ref: 0085DCBE
GetProcAddress.KERNEL32(00000000,00000000), ref: 0085DCDA
GetProcAddress.KERNEL32(00000000,?), ref: 0085DD1B
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0085DD35

Part of subcall function 007E5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00847B20,?,?,00000000), ref: 007E5B8C
Part of subcall function 007E5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00847B20,?,?,00000000,?,?), ref: 007E5BB0

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 345c6fbb0c26fa2aaa686c2cba6d1c2c93ad677bfe04e589e8d1c42d35d08bc4
Instruction ID: c2259941d178cc069129759688a1ff9c45b73e07074673f84696d70ef32fa3f0
Opcode Fuzzy Hash: 345c6fbb0c26fa2aaa686c2cba6d1c2c93ad677bfe04e589e8d1c42d35d08bc4
Instruction Fuzzy Hash: 28512435A01209DFCB10EFA8C4889ADB7F4FF49315B1580A9ED19AB322DB74AD45CB91

Function 0084E7DC Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 0084E88A
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 0084E8B3
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0084E8F2

Part of subcall function 007E9997: __itow.LIBCMT ref: 007E99C2
Part of subcall function 007E9997: __swprintf.LIBCMT ref: 007E9A0C

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 0084E917
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0084E91F

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 85abd4441676b5b392573ae000a7b9f36185ef373ebbf56f65f5d6fe73f7c0a7
Instruction ID: 7aaf401be6b643c1ec4187b3cebb1f21b9d73b755eccba264d7ec8048b7d0f2f
Opcode Fuzzy Hash: 85abd4441676b5b392573ae000a7b9f36185ef373ebbf56f65f5d6fe73f7c0a7
Instruction Fuzzy Hash: 42512B35A00209EFCF01EF69C9859ADBBF5FF48314B1480A9E949AB362CB35ED11DB51

Function 0086A2C5 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce0a007fcb68ac421f4e197898fba8c78a9d4f35713c1d75861537677bdb42ac
Instruction ID: 52f7c9bdc0750abc2da3afb17ec1b9fe463ca13012a3f93ed46755a3f271d065
Opcode Fuzzy Hash: ce0a007fcb68ac421f4e197898fba8c78a9d4f35713c1d75861537677bdb42ac
Instruction Fuzzy Hash: 8541EF35900208ABD728DF28DD48FA9BBA8FB09310F1A0165F926F73E1DB70AD51CE51

Function 007E2344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 007E2357
ScreenToClient.USER32(008A67B0,?), ref: 007E2374
GetAsyncKeyState.USER32(00000001), ref: 007E2399
GetAsyncKeyState.USER32(00000002), ref: 007E23A7

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 3020d1445f1fa4c3edeaf0b728c5d7157d6d0ead5559288bbf45904069857788
Instruction ID: edfb7f2a568a8858716db9b0302468ba3b7b0015cb2e55511cef1d4c7d33dbd3
Opcode Fuzzy Hash: 3020d1445f1fa4c3edeaf0b728c5d7157d6d0ead5559288bbf45904069857788
Instruction Fuzzy Hash: 2A417E31504159FBDF159F69C848AE9BB78FF09324F20431AF829D22A1C774AD94DF91

Function 00836920 Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0083695D
TranslateAcceleratorW.USER32(?,?,?), ref: 008369A9
TranslateMessage.USER32(?), ref: 008369D2
DispatchMessageW.USER32(?), ref: 008369DC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 008369EB

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: f21dd7c96b38925f0f4c9120a2677bd607a5823d33b9ef63483acb7f7df7822e
Instruction ID: 1991138167d18d9f91076dcb8f9338e999835597397c818752b7048fb8b25382
Opcode Fuzzy Hash: f21dd7c96b38925f0f4c9120a2677bd607a5823d33b9ef63483acb7f7df7822e
Instruction Fuzzy Hash: 3631D031901256BAEB21CF78DC44BB67FA8FB52304F188169E821C75A1F674D8A5DBE0

Function 00838F01 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00838F12
PostMessageW.USER32(?,00000201,00000001), ref: 00838FBC
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00838FC4
PostMessageW.USER32(?,00000202,00000000), ref: 00838FD2
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00838FDA

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 1472ab260984b08610cd44993098dcf9e91d9e7b62f6967529debc5c6b5077a1
Instruction ID: b920fe05cabe2bfbe1e29911901ba40642fb9003da8bdb2ba210d77324f4595f
Opcode Fuzzy Hash: 1472ab260984b08610cd44993098dcf9e91d9e7b62f6967529debc5c6b5077a1
Instruction Fuzzy Hash: 9D31EE71500219EFDB00CF68E94CA9E7BB6FB84315F104229FA24EB2D1CBB0D910CB90

Function 0083B6AF Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0083B6C7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0083B6E4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0083B71C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 0083B742
_wcsstr.LIBCMT ref: 0083B74C

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 74c261dfb879aa982f8f0472a8282522f7d853ca7939110bdb885def7d7f62d2
Instruction ID: fd5583a41697e27cc2d044df03c4ebc203224a6fc284ce0116dbf389a4b9af49
Opcode Fuzzy Hash: 74c261dfb879aa982f8f0472a8282522f7d853ca7939110bdb885def7d7f62d2
Instruction Fuzzy Hash: FC210A71204204BBEB255B39DC4AE7B7B98FF85720F004029FA05CA1A2EFA1CC4096A1

Function 0086B405 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 007E2612: GetWindowLongW.USER32(?,000000EB), ref: 007E2623

GetWindowLongW.USER32(?,000000F0), ref: 0086B44C
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0086B471
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0086B489
GetSystemMetrics.USER32(00000004), ref: 0086B4B2
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00851184,00000000), ref: 0086B4D0

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 499276b01cee8205332f056980bf3bb15f6421b487deb0d572e534ea06b13657
Instruction ID: 0e44a2a6825d67dcc6bc06dcd83149c6203d93089fc5a7467dc79a28456bf414
Opcode Fuzzy Hash: 499276b01cee8205332f056980bf3bb15f6421b487deb0d572e534ea06b13657
Instruction Fuzzy Hash: FD218371514255AFCB109F38DC08B6A37A4FB05728F164739F926D75E2EB309CA0DB94

Function 008397E9 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00839802

Part of subcall function 007E7D2C: _memmove.LIBCMT ref: 007E7D66

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00839834
__itow.LIBCMT ref: 0083984C
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00839874
__itow.LIBCMT ref: 00839885

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 54271e9b5403562388415ba66d499877b643c4bf1c7dfa7d1070d9a2e177a506
Instruction ID: e61628bb70ae229c15e259d4421b11a67de8ec86c29e203eba019b5ac22b13d6
Opcode Fuzzy Hash: 54271e9b5403562388415ba66d499877b643c4bf1c7dfa7d1070d9a2e177a506
Instruction Fuzzy Hash: EE21C831701248ABDB109A65DC8AEAE7BA8FFC9714F040035FE54DB291D6B4CD41C7D1

Function 007E12F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 007E134D
SelectObject.GDI32(?,00000000), ref: 007E135C
BeginPath.GDI32(?), ref: 007E1373
SelectObject.GDI32(?,00000000), ref: 007E139C

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 44e9e2ed6da08fdc66a7f0883556030786a3bae5af78d86211267afdae40e7ec
Instruction ID: ef99d4d24befc50ed5f4a841512549f506085af763e29e11a1ce710c7083f103
Opcode Fuzzy Hash: 44e9e2ed6da08fdc66a7f0883556030786a3bae5af78d86211267afdae40e7ec
Instruction Fuzzy Hash: 5D21B670801344DFEB108F26EC057A97BBCFB05721F584235F410969E5E37998A1CF91

Function 0083C161 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0083C176
_memcmp.LIBCMT ref: 0083C194
_memcmp.LIBCMT ref: 0083C1A7
_memcmp.LIBCMT ref: 0083C1BF
_memcmp.LIBCMT ref: 0083C1D7

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 25879d124ff78e404c259fb031e1802a465799a3e328c7accb33e216100feb86
Instruction ID: 1a6ad0077356fb9a9e332b75cc75edebbeecddf1cf3f088ddffa3e20b95584d4
Opcode Fuzzy Hash: 25879d124ff78e404c259fb031e1802a465799a3e328c7accb33e216100feb86
Instruction Fuzzy Hash: 3B01B9726042097BD614A6259C56F7F775CFBB13A8F048011FD24E6383EB55DE11A3E1

Function 00844D35 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00844D5C
__beginthreadex.LIBCMT ref: 00844D7A
MessageBoxW.USER32(?,?,?,?), ref: 00844D8F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00844DA5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00844DAC

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 152a2c9f894e90ebbf3511debff73982ecb4a7b9e42c7132dad61bb539335ac6
Instruction ID: 3939412450bc1e2d44551cdc7c05e02b27eedb440ae6f8cc20ff74d9abd10b8b
Opcode Fuzzy Hash: 152a2c9f894e90ebbf3511debff73982ecb4a7b9e42c7132dad61bb539335ac6
Instruction Fuzzy Hash: 261108B2D04248BBD7029FA8EC04B9A7FACFB46320F184265F924D3351D6B5CD1487A0

Function 0083874A Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00838766
GetLastError.KERNEL32(?,0083822A,?,?,?), ref: 00838770
GetProcessHeap.KERNEL32(00000008,?,?,0083822A,?,?,?), ref: 0083877F
HeapAlloc.KERNEL32(00000000,?,0083822A,?,?,?), ref: 00838786
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 0083879D

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: e80444c0828d99ba5be0da4a87aed525a45133ed57101a646b2d7f710084762d
Instruction ID: 64f928e9aedb4c8d938ed01ebc3b30f55ad29418bb6c8f946b7bac58f34d2548
Opcode Fuzzy Hash: e80444c0828d99ba5be0da4a87aed525a45133ed57101a646b2d7f710084762d
Instruction Fuzzy Hash: F8016271200204FFDB104FA5EC48D677B6DFF96355B200439F949C2260DA71CC10CAA0

Function 008454E6 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00845502
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00845510
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00845518
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00845522
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0084555E

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: e4075ba03faa9c68efe945f2c319c8e0006d6902ff8e75b4e4798245d9aa5611
Instruction ID: 7e2487b1eb7dd65732716126ca714f723dac89f9c0ecc132044c29dfa07e26ed
Opcode Fuzzy Hash: e4075ba03faa9c68efe945f2c319c8e0006d6902ff8e75b4e4798245d9aa5611
Instruction Fuzzy Hash: B3012D36D00A1DDBCF00DFE8E8485EDBB79FB09711F020056EA05F2142DB709554C7A1

Function 00837652 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0083758C,80070057,?,?,?,0083799D), ref: 0083766F
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0083758C,80070057,?,?), ref: 0083768A
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0083758C,80070057,?,?), ref: 00837698
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0083758C,80070057,?), ref: 008376A8
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,0083758C,80070057,?,?), ref: 008376B4

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: e172da85bf07950e7cc9f736eca772719c0d98796c38f1b743efe5fa3c3e6249
Instruction ID: 1321325875b8a0246d79c9c7cea55a986996f87ff0744f085fe77530c03bb370
Opcode Fuzzy Hash: e172da85bf07950e7cc9f736eca772719c0d98796c38f1b743efe5fa3c3e6249
Instruction Fuzzy Hash: 210171B2605608ABDB205F59EC45AAA7BEDFB88751F150078FE05D3212E771DD4097E0

Function 008385F1 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00838608
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00838612
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00838621
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00838628
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 0083863E

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 2dbf542e61d3ff035a48b52ab78506738b6dfb42427c4fe9e171b9a9c3f28292
Instruction ID: e96a6ac51f7177c9967a2f1262b1df528a6fb4955cb10cf29707277a3ef288dd
Opcode Fuzzy Hash: 2dbf542e61d3ff035a48b52ab78506738b6dfb42427c4fe9e171b9a9c3f28292
Instruction Fuzzy Hash: 17F03C31201304AFEB110FA5EC8EE6B3BACFF8A754F011429FA45C7151DBA1DC41DAA0

Function 00838652 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00838669
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00838673
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00838682
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00838689
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0083869F

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 21f9923700bbbc5aabe46bcd634638fd85d54cc1307ce6486fe6c9162fc42859
Instruction ID: 4d0279921a9f8bbe284c5132e5952537847acd96635449796f4c7d7fd8f9bf78
Opcode Fuzzy Hash: 21f9923700bbbc5aabe46bcd634638fd85d54cc1307ce6486fe6c9162fc42859
Instruction Fuzzy Hash: 21F04FB1200304EFEB111FA5EC8DE673BACFF8A754F111025FA45C6151DBA5D941DAA0

Function 0083C6A6 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0083C6BA
GetWindowTextW.USER32(00000000,?,00000100), ref: 0083C6D1
MessageBeep.USER32(00000000), ref: 0083C6E9
KillTimer.USER32(?,0000040A), ref: 0083C705
EndDialog.USER32(?,00000001), ref: 0083C71F

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 39a32edd7f38c3097c84ba12bc6e4d342ab40f1b5fbb7487bfbbcf0ce969ef35
Instruction ID: 683b396450dec6e1217a1ae4d6fbd9e388ed560d57e7e09331df3fcfed488285
Opcode Fuzzy Hash: 39a32edd7f38c3097c84ba12bc6e4d342ab40f1b5fbb7487bfbbcf0ce969ef35
Instruction Fuzzy Hash: 50016230500708ABEB21AB64ED4EF9677B8FF14745F00166DF642F14E1EBE5A9548F90

Function 007E13B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 007E13BF
StrokeAndFillPath.GDI32(?,?,0081BAD8,00000000,?), ref: 007E13DB
SelectObject.GDI32(?,00000000), ref: 007E13EE
DeleteObject.GDI32 ref: 007E1401
StrokePath.GDI32(?), ref: 007E141C

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: f301fb5cda627df324885ed365db2475ba740bfcd2a195cb1d1427e1667d00e9
Instruction ID: 0ce70eb5e7fe1231b82f49d3e14fccd271e10c7eae2973b92a909fd785086dc4
Opcode Fuzzy Hash: f301fb5cda627df324885ed365db2475ba740bfcd2a195cb1d1427e1667d00e9
Instruction Fuzzy Hash: E6F08C34004788EBEB114F26EC0D7583FA8B702322F19C234E529848F6E77988A5CF11

Function 0084C602 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0084C69D
CoCreateInstance.OLE32(00872D6C,00000000,00000001,00872BDC,?), ref: 0084C6B5

Part of subcall function 007E7F41: _memmove.LIBCMT ref: 007E7F82

CoUninitialize.OLE32 ref: 0084C922

Strings

.lnk, xrefs: 0084C631, 0084C659, 0084C663

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 287e9880efa18ddf673f3d269bb8b76997f946215903d63528839e14bd603136
Instruction ID: b780604e63a69066d992e6f9a8d3ac1c370313c7774cf8dfa2ea1c35fadab182
Opcode Fuzzy Hash: 287e9880efa18ddf673f3d269bb8b76997f946215903d63528839e14bd603136
Instruction Fuzzy Hash: 4AA12C72105245AFD700EF55C885EABB7ECFF98304F00896CF25697192EB74EA09CB92

Function 007F2E5B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00800FF6: std::exception::exception.LIBCMT ref: 0080102C
Part of subcall function 00800FF6: __CxxThrowException@8.LIBCMT ref: 00801041

Part of subcall function 007E7F41: _memmove.LIBCMT ref: 007E7F82

Part of subcall function 007E7BB1: _memmove.LIBCMT ref: 007E7C0B

__swprintf.LIBCMT ref: 007F302D

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 007F2EC6

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 14892b2c5912565df8deda1ca312232ecab21bef94056c575acb034e79dc54b4
Instruction ID: 9ed036f5f34a94b9d44be26180393c95cc8d2532f7703602841742c104614a3b
Opcode Fuzzy Hash: 14892b2c5912565df8deda1ca312232ecab21bef94056c575acb034e79dc54b4
Instruction Fuzzy Hash: BA919E71108245DFCB18EF28D989C6EB7A4FF89710F00491EF585972A1EE38EE44CB52

Function 0084BBA6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 007E48AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007E48A1,?,?,007E37C0,?), ref: 007E48CE

CoInitialize.OLE32(00000000), ref: 0084BC26
CoCreateInstance.OLE32(00872D6C,00000000,00000001,00872BDC,?), ref: 0084BC3F
CoUninitialize.OLE32 ref: 0084BC5C

Part of subcall function 007E9997: __itow.LIBCMT ref: 007E99C2
Part of subcall function 007E9997: __swprintf.LIBCMT ref: 007E9A0C

Strings

.lnk, xrefs: 0084BC08, 0084BC16

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: ccd91769a389ede1e248e3fcc9f8044d9c351adc933bf528644f3c3c11acc606
Instruction ID: 2aa1a4d250c7c5c1fd6c38997552a411b3897ec071071854644f21c275615340
Opcode Fuzzy Hash: ccd91769a389ede1e248e3fcc9f8044d9c351adc933bf528644f3c3c11acc606
Instruction Fuzzy Hash: 1AA163716043459FCB00DF19C888E6ABBE5FF88314F048998F9999B3A2CB31ED05CB91

Function 0080524D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 008052DD

Part of subcall function 00810340: __87except.LIBCMT ref: 0081037B

Strings

pow, xrefs: 008052B5, 008052D2

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: d114b364e6f6f2f32a82cacb84308dd5fb3e44394dec3763e0e0d6a3fd5f2cc6
Instruction ID: b1a3cc8b8d125cd87120777385dce94202f9e1e494517c0e5333df1c93c4efc5
Opcode Fuzzy Hash: d114b364e6f6f2f32a82cacb84308dd5fb3e44394dec3763e0e0d6a3fd5f2cc6
Instruction Fuzzy Hash: 13517921A0CA0586CB517718CD913AB2B98FF41354F244958E099C62EAEEB4CCD4DE9A

Function 0080023B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

#, xrefs: 00800280
+, xrefs: 00800277

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: 38b98adb67dd3e359c1c317db45529b2535e82819ba1c5193b861cc52b13e837
Instruction ID: 7298a3342faeafcb8179e2ac5c3f59b046d7b3c2758d6dfb93c39b51b2e9827f
Opcode Fuzzy Hash: 38b98adb67dd3e359c1c317db45529b2535e82819ba1c5193b861cc52b13e837
Instruction Fuzzy Hash: 5551107550568ACFCB269F28C8896FA7BA4FF99310F144065E891DB2E0D7349C42CBA1

Function 007F62F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007F63A8
_memmove.LIBCMT ref: 007F6446
_memset.LIBCMT ref: 007F646A

Strings

ERCP, xrefs: 007F6313

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 5e383cd561cd16bf6412b545a33b886790c54ea83f6ec0bd291e7da050739f10
Instruction ID: 35a3ca2cafadf0129958167a92abcd407b05aa8ccf07b31046df0ed771e62bdf
Opcode Fuzzy Hash: 5e383cd561cd16bf6412b545a33b886790c54ea83f6ec0bd291e7da050739f10
Instruction Fuzzy Hash: 6A51C27190071D9BCB24DF65C8857BABBF4FF44714F20856EEA4ACB241E7759A84CB80

Function 00867BB5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0086F910,00000000,?,?,?,?), ref: 00867C4E
GetWindowLongW.USER32 ref: 00867C6B
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00867C7B

Strings

SysTreeView32, xrefs: 00867C20

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: c1d9c925f197101a21fdbb64dac8c1366f76997c44343d7014afb0e898c43bec
Instruction ID: f2ed08662d582fa65ed2e63b84359fe5650483dc2e47b492e1a41e5cdf9d3f64
Opcode Fuzzy Hash: c1d9c925f197101a21fdbb64dac8c1366f76997c44343d7014afb0e898c43bec
Instruction Fuzzy Hash: 5331BE31204206ABDB218F38DC45BEA77A9FB09338F254725F975E32E1D735E8519B90

Function 00867648 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 008676D0
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 008676E4
SendMessageW.USER32(?,00001002,00000000,?), ref: 00867708

Strings

SysMonthCal32, xrefs: 0086769B

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 3e29d4cf900af2f8661ed4aab373616165c4430a9984359ca685246bc13f99a6
Instruction ID: 17995cb164c943a86e36b106d21928ee1cb0738a69151bdd62763fb18e7897ec
Opcode Fuzzy Hash: 3e29d4cf900af2f8661ed4aab373616165c4430a9984359ca685246bc13f99a6
Instruction Fuzzy Hash: 6421D132604218BBDF11CFA4DC46FEA3B79FF58718F160214FE15AB1D1DAB1A8508BA0

Function 00866F1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00866FAA
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00866FBA
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00866FDF

Strings

Listbox, xrefs: 00866F77

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: df2ac5c530e6933860b6c1a136fc7a70ad8d02f158b5bec41fa80a8d144f850c
Instruction ID: 79ef82495ce89bf2fe23cbfb7247601d740d719261436eb2b42ab29f56ab64e6
Opcode Fuzzy Hash: df2ac5c530e6933860b6c1a136fc7a70ad8d02f158b5bec41fa80a8d144f850c
Instruction Fuzzy Hash: 54219232610158BFDF118F54EC85FAB37AAFF89754F028124FA14DB191DA71AC61CBA0

Function 007EC684 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 007EC73D

Strings

~, xrefs: 007EC6D5
~, xrefs: 007EC6E9
~, xrefs: 007EC6E1

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: _wcscmp
String ID: ~$~$~
API String ID: 856254489-3081398557
Opcode ID: 506b72161975b759c3527887db3e9c6922a909a19c83d13ca18bd84448bfafc7
Instruction ID: b87cc438603e3b2999b0f043abe18c6f0795c181f59865424c1443ea4378dfa2
Opcode Fuzzy Hash: 506b72161975b759c3527887db3e9c6922a909a19c83d13ca18bd84448bfafc7
Instruction Fuzzy Hash: C521D57280A2C68FD7135B6DC850295FFB4AF5B360F1845D6C890EB293E26C5C86CB91

Function 0086797D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 008679E1
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 008679F6
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00867A03

Strings

msctls_trackbar32, xrefs: 008679B8

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 720b22133ef07940809f24e6af684906a437cb82f0787a66fe6de9eb2631e863
Instruction ID: 54892e757de98525930e2afe5823c2da3a1c85bfc4d38effbbd4fbf907cda1ca
Opcode Fuzzy Hash: 720b22133ef07940809f24e6af684906a437cb82f0787a66fe6de9eb2631e863
Instruction Fuzzy Hash: C4110A72244208BBEF109F74CC05FEB3BA9FF89768F120529FA51E6091D671D851CB60

Function 007E4C95 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,007E4C2E), ref: 007E4CA3
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 007E4CB5

Strings

GetNativeSystemInfo, xrefs: 007E4CAF
kernel32.dll, xrefs: 007E4C9E

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: cedb42f29cd087f9f33dd92026792908f94b973a51f163dc761f338241ee92fe
Instruction ID: 06b3f66317ba3f24b3cd134c2f871e00b57d013428f312ffe90923940f04dade
Opcode Fuzzy Hash: cedb42f29cd087f9f33dd92026792908f94b973a51f163dc761f338241ee92fe
Instruction Fuzzy Hash: F3D01230511723CFD7209F31E91860676D5BF05791B239C39D995D6261D6B8D480C660

Function 007E4D61 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,007E4D2E,?,007E4F4F,?,008A62F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 007E4D6F
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 007E4D81

Strings

Wow64DisableWow64FsRedirection, xrefs: 007E4D7B
kernel32.dll, xrefs: 007E4D6A

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: ee35a8cfb1a6f8040ac00ad9f9dcb8bdd4fcec11bdf36011630a1486842fb833
Instruction ID: 4ab106167d3bc7f2a4f42f29bafaad3077d0563bc54d5307a56c54d0fd411755
Opcode Fuzzy Hash: ee35a8cfb1a6f8040ac00ad9f9dcb8bdd4fcec11bdf36011630a1486842fb833
Instruction Fuzzy Hash: 85D01230610753CFD7219F31EC0865676D8BF19391B169839D596D6650D6B8D480CA50

Function 007E4D94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,007E4CE1,?), ref: 007E4DA2
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 007E4DB4

Strings

Wow64RevertWow64FsRedirection, xrefs: 007E4DAE
kernel32.dll, xrefs: 007E4D9D

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: c72d5a287d0d548e4c2d94da48889be53ed510b889b2bc527bf92da5474ac871
Instruction ID: cf26e4a97cf236e981c02b1216da65016fe1571788129f341c9cc39859a01e7d
Opcode Fuzzy Hash: c72d5a287d0d548e4c2d94da48889be53ed510b889b2bc527bf92da5474ac871
Instruction Fuzzy Hash: 37D01231650713DFD7209F31EC0878676D4FF09395B169839D9D5D6250D7B8D480C650

Function 00861072 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,008612C1), ref: 00861080
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00861092

Strings

RegDeleteKeyExW, xrefs: 0086108C
advapi32.dll, xrefs: 0086107B

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 8f2f885fc1a30fc2e551afa666530126f956fa221a23d8006460769349e34f6b
Instruction ID: b148e8ed0c48c7b289c907f60a9a19dac9513310bc6df3e84cb31a29895ab175
Opcode Fuzzy Hash: 8f2f885fc1a30fc2e551afa666530126f956fa221a23d8006460769349e34f6b
Instruction Fuzzy Hash: 19D01230510712CFDF205F75E91851676E4FF05791B1ADC39E495D6251D7B4C4C0C751

Function 008593F5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00859009,?,0086F910), ref: 00859403
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00859415

Strings

kernel32.dll, xrefs: 008593FE
GetModuleHandleExW, xrefs: 0085940F

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: cc51d426e5c9e1bb8c6618a0a2fcae4f5f49925ab4143286c72bcfc72ddab127
Instruction ID: dc6e77fe7aee24db1faa85722014311c19680130b57f41b7e1086d9b7f3c3472
Opcode Fuzzy Hash: cc51d426e5c9e1bb8c6618a0a2fcae4f5f49925ab4143286c72bcfc72ddab127
Instruction Fuzzy Hash: C0D0C730500313CFCB209F30E90820272E4FF02392B02D83AE9D2D6651E6B4C880CB50

Function 008376C5 Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1f23dfe8e23152ea29959c97cc6f9d642232388ec84ef93d9953d8aab756fdd
Instruction ID: dc935145fab8a372795327d18984e244a39bde1d767cbd5d7a5f0e0b78f49b18
Opcode Fuzzy Hash: f1f23dfe8e23152ea29959c97cc6f9d642232388ec84ef93d9953d8aab756fdd
Instruction Fuzzy Hash: 95C15DB5A0421AEFCB24DF94C884EAEBBB5FF88714F118599E805EB251D730DD81DB90

Function 0085E33E Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 0085E3D2
CharLowerBuffW.USER32(?,?), ref: 0085E415

Part of subcall function 0085DAB9: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0085DAD9

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 0085E615
_memmove.LIBCMT ref: 0085E628

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 0eb494812648fdfb114a2238f884079529c4f58a886e9f6dffcea27551e28c29
Instruction ID: ba60cba7d654b5afdcc549245b76b795a08da84c153697c0b79e4dac7a76362f
Opcode Fuzzy Hash: 0eb494812648fdfb114a2238f884079529c4f58a886e9f6dffcea27551e28c29
Instruction Fuzzy Hash: 8AC149716083519FC718DF28C88096ABBE4FF88718F14896DF999DB351D731EA49CB82

Function 008583A8 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 008583D8
CoUninitialize.OLE32 ref: 008583E3

Part of subcall function 0083DA5D: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0083DAC5

VariantInit.OLEAUT32(?), ref: 008583EE
VariantClear.OLEAUT32(?), ref: 008586BF

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 9b6bf9d0c47d9ba0c8d505dfc86332b88e515906b4ea4cf1fbb411c6875d4c9f
Instruction ID: 87d052b05932109e15c0b0adc1957c0624cb1cf15f17fe291bb2ea5da6e1f4b3
Opcode Fuzzy Hash: 9b6bf9d0c47d9ba0c8d505dfc86332b88e515906b4ea4cf1fbb411c6875d4c9f
Instruction Fuzzy Hash: 7EA13875204741DFCB10DF29C485A2AB7E5FF88314F148459FA9AAB3A2DB34ED08CB56

Function 00837A78 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00872C7C,?), ref: 00837C32
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00872C7C,?), ref: 00837C4A
CLSIDFromProgID.OLE32(?,?,00000000,0086FB80,000000FF,?,00000000,00000800,00000000,?,00872C7C,?), ref: 00837C6F
_memcmp.LIBCMT ref: 00837C90

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 7fce58037db0c0445d698791743711049cc7212ec7c97f58ca4f05a85782152a
Instruction ID: 6d0f07c0707adeca6ad52ffd000fedb14fea343b1eae0890cf429524da04d15f
Opcode Fuzzy Hash: 7fce58037db0c0445d698791743711049cc7212ec7c97f58ca4f05a85782152a
Instruction Fuzzy Hash: 4F810B71A00109EFCB14DF94C988EEEB7B9FF89315F244198E515EB250DB71AE06CBA0

Function 00836DF3 Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00836E04
SysAllocString.OLEAUT32(00000000), ref: 00836EAD
VariantCopy.OLEAUT32 ref: 00836EDC
VariantClear.OLEAUT32(?), ref: 00836F03

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: ade03c528747daa3381ede6e663359dd9ae24af7f9bdbdfee764ba896b0c5574
Instruction ID: ab6add4c7604f1bc9387f81a6effc6ff703fe4f79344a5d59c3a954a55272e4f
Opcode Fuzzy Hash: ade03c528747daa3381ede6e663359dd9ae24af7f9bdbdfee764ba896b0c5574
Instruction Fuzzy Hash: 9B51C875604705EADB34AF6DD895A29B3E4FF88310F208C1FE556DB291EF70D8409B91

Function 00869A63 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(0124EDE8,?), ref: 00869AD2
ScreenToClient.USER32(00000002,00000002), ref: 00869B05
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00869B72

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 645e39537df0af1a4bf98162e3c82cb6da8ae20a95dbe42ea87f7e3d4e7da49b
Instruction ID: 5be24d771e3568400c5e6b9299f0debe83305da5fa4dc65af0d21f44756d4390
Opcode Fuzzy Hash: 645e39537df0af1a4bf98162e3c82cb6da8ae20a95dbe42ea87f7e3d4e7da49b
Instruction Fuzzy Hash: 28514B34A00219EFDF10CF68E880AAE7BB9FB55360F158269F965DB2D0D770AD51CB90

Function 00856CBD Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00856CE4
WSAGetLastError.WSOCK32(00000000), ref: 00856CF4

Part of subcall function 007E9997: __itow.LIBCMT ref: 007E99C2
Part of subcall function 007E9997: __swprintf.LIBCMT ref: 007E9A0C

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00856D58
WSAGetLastError.WSOCK32(00000000), ref: 00856D64

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 163dfc3344e99cb8a543e59e86706656a2f070796502400f6fe95cdc8dd27721
Instruction ID: 9dd970d5883c06dae3a065c180017141a722eb0347553081995dcabe525fb6c7
Opcode Fuzzy Hash: 163dfc3344e99cb8a543e59e86706656a2f070796502400f6fe95cdc8dd27721
Instruction Fuzzy Hash: A641A275740200AFEB20AF29DC8AF7A77A5EF48B10F448458FA59DF2D3DA759C008791

Function 0085672D Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,0086F910), ref: 008567BA
_strlen.LIBCMT ref: 008567EC

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: ef4b4939f56c22cb6784e1bf7d62134ab5cce2a9c48c8ef38dcaa15088a7aecc
Instruction ID: 38761febda2642a123f4b62515c9b9d58dc790ffd8e4a1fc2032e9770e3da846
Opcode Fuzzy Hash: ef4b4939f56c22cb6784e1bf7d62134ab5cce2a9c48c8ef38dcaa15088a7aecc
Instruction Fuzzy Hash: 0141D331A00108ABCB14EB69DCC5FAEB7A8FF48315F548165F915DB292EB34AD14C751

Function 0084BA5F Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 0084BB09
GetLastError.KERNEL32(?,00000000), ref: 0084BB2F
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 0084BB54
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 0084BB80

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 627549885e800d5e6ade62869ab7b95f739f605d7895c20fa8df07ed9cf097d0
Instruction ID: 331daa062c9896a735615bf3e3f1927c5c8a1174ae3050c954dcd321e542c654
Opcode Fuzzy Hash: 627549885e800d5e6ade62869ab7b95f739f605d7895c20fa8df07ed9cf097d0
Instruction Fuzzy Hash: CA412C3A201654DFCB10EF19C588A5DBBE5FF89324B198498ED4A9B362CB34FD01CB91

Function 00868AC0 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00868B4D

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: e36d9bca73236d9720022575a8862ed799faa96684db19a41140660082bcc233
Instruction ID: 89ee6630ff9da1d71868e5606b700cb3214d732d464a5ca458ceccff673beec5
Opcode Fuzzy Hash: e36d9bca73236d9720022575a8862ed799faa96684db19a41140660082bcc233
Instruction Fuzzy Hash: 2631E6B4600218FFEF209E58DC59FA93764FB0A334F264712FA59D72A1DE30A9509B51

Function 0086ADF1 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0086AE1A
GetWindowRect.USER32(?,?), ref: 0086AE90
PtInRect.USER32(?,?,0086C304), ref: 0086AEA0
MessageBeep.USER32(00000000), ref: 0086AF11

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 71fcd0aee0615b168d8d1487bf08daffe02c08ee6db917b7e180e46d1f316c52
Instruction ID: bc0e123195d14571b87bcfad998b50f35a08fc4b80abcabe0400dd379bf3822c
Opcode Fuzzy Hash: 71fcd0aee0615b168d8d1487bf08daffe02c08ee6db917b7e180e46d1f316c52
Instruction Fuzzy Hash: 3441BC70600209DFDB19DF58D884BA9BBF5FF49300F1A80A9E814EB255DB32E801CF92

Function 00840FE6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00841037
SetKeyboardState.USER32(00000080,?,00000001), ref: 00841053
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 008410B9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 0084110B

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 0055f693f4744e2a0f75aa56d944a32b87f36c804f2a8db2e82da5670e7377fb
Instruction ID: 22d298f15f3b57530660a097e41ea2acb20d7a802432b56001db4a01600d1f90
Opcode Fuzzy Hash: 0055f693f4744e2a0f75aa56d944a32b87f36c804f2a8db2e82da5670e7377fb
Instruction Fuzzy Hash: 97313730E40A8CAEFF348B698C0DBFABBA9FB54310F04421AE691D21D1C77489C09B52

Function 00841121 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00841176
SetKeyboardState.USER32(00000080,?,00008000), ref: 00841192
PostMessageW.USER32(00000000,00000101,00000000), ref: 008411F1
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00841243

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 8127dbc0ad1a594ad5314dea4c8143835191f6e79390f376cf93199b11dfb778
Instruction ID: 1fb1849bac374a1852990be598e52f3842abd3f5dcbb7f233cacf1dc508f309b
Opcode Fuzzy Hash: 8127dbc0ad1a594ad5314dea4c8143835191f6e79390f376cf93199b11dfb778
Instruction Fuzzy Hash: EA31F630A4071C6AEF20CB69CC0D7FABBAAFB49314F04535BE691D21D1C3788AD59B56

Function 00816415 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0081644B
__isleadbyte_l.LIBCMT ref: 00816479
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 008164A7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 008164DD

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: deab2683866271917710d2e7910bf04a9a8463b4dbbcecc253c77c809b3bb5fe
Instruction ID: 2e91b4fda19b1259f600158eb52a980b3abf0317b6996d3a1ec0c7ac22ad567b
Opcode Fuzzy Hash: deab2683866271917710d2e7910bf04a9a8463b4dbbcecc253c77c809b3bb5fe
Instruction Fuzzy Hash: 2C31AF3160025AAFDB218F69CC45AFA7BADFF41310F154069E8A4C71A1E731D8E0DB94

Function 00865175 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00865189

Part of subcall function 0084387D: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00843897
Part of subcall function 0084387D: GetCurrentThreadId.KERNEL32 ref: 0084389E
Part of subcall function 0084387D: AttachThreadInput.USER32(00000000,?,008452A7), ref: 008438A5

GetCaretPos.USER32(?), ref: 0086519A
ClientToScreen.USER32(00000000,?), ref: 008651D5
GetForegroundWindow.USER32 ref: 008651DB

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 07fed6767ae3089ab8f9d1502aeb095ff07cce01c0e4d08fbb0a5e7b60d770a9
Instruction ID: 6ea147e57a4eee55c468d444b1d5077e20db6c59bb9fa2feb7ee3b36882cc02f
Opcode Fuzzy Hash: 07fed6767ae3089ab8f9d1502aeb095ff07cce01c0e4d08fbb0a5e7b60d770a9
Instruction Fuzzy Hash: 913130B2900148AFDB00EFA9CC459EFB7F9FF98300F11406AE515E7241EA759E05CBA1

Function 0086C788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007E2612: GetWindowLongW.USER32(?,000000EB), ref: 007E2623

GetCursorPos.USER32(?), ref: 0086C7C2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0081BBFB,?,?,?,?,?), ref: 0086C7D7
GetCursorPos.USER32(?), ref: 0086C824
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0081BBFB,?,?,?), ref: 0086C85E

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 02b614e0da1d92e8a9c5f7644cf5822ddbf0671270bbfc6da78fa003a92a3d60
Instruction ID: 1b9e7deecb8f875d908b8e980f15f87dc1da4a4bebad3da94e3642c45cf39c81
Opcode Fuzzy Hash: 02b614e0da1d92e8a9c5f7644cf5822ddbf0671270bbfc6da78fa003a92a3d60
Instruction Fuzzy Hash: E831D035600018AFDB25CF58C898EFA7BBAFB09310F058069F945CB262C7359D60DFA0

Function 00838B9E Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00838652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00838669
Part of subcall function 00838652: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00838673
Part of subcall function 00838652: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00838682
Part of subcall function 00838652: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00838689
Part of subcall function 00838652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0083869F

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00838BEB
_memcmp.LIBCMT ref: 00838C0E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00838C44
HeapFree.KERNEL32(00000000), ref: 00838C4B

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: f8ef8398a187ecba4e15e0da08d709705735cb5507f69d949d7b18e503621414
Instruction ID: 2bf5f456291f172ac7051f86e35fc67b0b25ce213a983f0150232cfb8e2a2b4f
Opcode Fuzzy Hash: f8ef8398a187ecba4e15e0da08d709705735cb5507f69d949d7b18e503621414
Instruction Fuzzy Hash: E7218971E01209EBCF00CFA4C959BAEB7B8FF80350F054059E554E7241EB75AA06DBA0

Function 00800BD0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00800BF2

Part of subcall function 007E5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00847B20,?,?,00000000), ref: 007E5B8C
Part of subcall function 007E5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00847B20,?,?,00000000,?,?), ref: 007E5BB0

_fprintf.LIBCMT ref: 00800C29
OutputDebugStringW.KERNEL32(?), ref: 00836331

Part of subcall function 00804CDA: _flsall.LIBCMT ref: 00804CF3

__setmode.LIBCMT ref: 00800C5E

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: a10e25123a5746d37c9eb713d0b72b39f4814b5972005729620de62f0f95d21d
Instruction ID: 829e08149beb8f14a087afe6e54e05dd49984bbbf88aab41d0857be362d189b4
Opcode Fuzzy Hash: a10e25123a5746d37c9eb713d0b72b39f4814b5972005729620de62f0f95d21d
Instruction Fuzzy Hash: D8113572904208BADB0473BC9C47ABE7F68FF85320F144119F204D72D2EE245C914792

Function 00851A5B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00851A97

Part of subcall function 00851B21: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00851B40
Part of subcall function 00851B21: InternetCloseHandle.WININET(00000000), ref: 00851BDD

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: d797ee06686562c9a1f36a3b3bb0389ef942f3adfa291c4a241079d54f9da6cd
Instruction ID: a9eab96b5a862bdc6046dcecda771bbb9ca3fa848cd2c18b721babc66dd9261a
Opcode Fuzzy Hash: d797ee06686562c9a1f36a3b3bb0389ef942f3adfa291c4a241079d54f9da6cd
Instruction Fuzzy Hash: 1B21D131200604BFDF129F608C09FBAB7ADFF48712F10001AFE11D6651EB71D8189BA1

Function 0083E1AF Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0083F5AD: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,0083E1C4,?,?,?,0083EFB7,00000000,000000EF,00000119,?,?), ref: 0083F5BC
Part of subcall function 0083F5AD: lstrcpyW.KERNEL32(00000000,?), ref: 0083F5E2
Part of subcall function 0083F5AD: lstrcmpiW.KERNEL32(00000000,?,0083E1C4,?,?,?,0083EFB7,00000000,000000EF,00000119,?,?), ref: 0083F613

lstrlenW.KERNEL32(?,00000002,?,?,?,?,0083EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 0083E1DD
lstrcpyW.KERNEL32(00000000,?), ref: 0083E203
lstrcmpiW.KERNEL32(00000002,cdecl,?,0083EFB7,00000000,000000EF,00000119,?,?,00000000), ref: 0083E237

Strings

cdecl, xrefs: 0083E22E

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 369bb181b54b7da80cfcea346e42ee7d5998b367cdce8cf452acc83d9e9eaa9c
Instruction ID: 52af037134d76d3bed8c7d590fb28bc663cd4ba454aa9101f85b516866da18ff
Opcode Fuzzy Hash: 369bb181b54b7da80cfcea346e42ee7d5998b367cdce8cf452acc83d9e9eaa9c
Instruction Fuzzy Hash: 48118E36200345EFCB25AF68DC45A7A77A9FF85350F40402AF916CB2A0EB71D85197E1

Function 00815332 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00815351

Part of subcall function 0080594C: __FF_MSGBANNER.LIBCMT ref: 00805963
Part of subcall function 0080594C: __NMSG_WRITE.LIBCMT ref: 0080596A
Part of subcall function 0080594C: RtlAllocateHeap.NTDLL(01230000,00000000,00000001,00000000,?,?,?,00801013,?), ref: 0080598F

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 7805627b15f6c7a2532cfcb9418fdec14b9d127d9c968ac8d4152484eb565334
Instruction ID: de62ecb2d93d967157917daed1a6764216544931f60456eb766460fc79907c09
Opcode Fuzzy Hash: 7805627b15f6c7a2532cfcb9418fdec14b9d127d9c968ac8d4152484eb565334
Instruction Fuzzy Hash: D811C132504A15EECB212F78AC0569A3B9CFF923A0F20052AF955DB3E1DFB589C09691

Function 007E4531 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007E4560

Part of subcall function 007E410D: _memset.LIBCMT ref: 007E418D
Part of subcall function 007E410D: _wcscpy.LIBCMT ref: 007E41E1
Part of subcall function 007E410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 007E41F1

KillTimer.USER32(?,00000001,?,?), ref: 007E45B5
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 007E45C4
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0081D6CE

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: c4d8d61e8208ac83352e624e7870261875d333509cd06c93ae77c747ef8dfae5
Instruction ID: 439ad7e0f65a2aff0e9003e1c0ca3b443f8c2de77e0a812b6b8e00e9e92e6696
Opcode Fuzzy Hash: c4d8d61e8208ac83352e624e7870261875d333509cd06c93ae77c747ef8dfae5
Instruction Fuzzy Hash: 1321D770905798AFEB328B24DC45BE7BBECEF15308F04009DE69E96285C7B45A848B91

Function 0085667C Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 007E5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00847B20,?,?,00000000), ref: 007E5B8C
Part of subcall function 007E5B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00847B20,?,?,00000000,?,?), ref: 007E5BB0

gethostbyname.WSOCK32(?,?,?), ref: 008566AC
WSAGetLastError.WSOCK32(00000000), ref: 008566B7
_memmove.LIBCMT ref: 008566E4
inet_ntoa.WSOCK32(?), ref: 008566EF

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 8e23886a4e4b68e780ccb1852e5d0beb537c38614e8ad2f88fed58b0cb5db06e
Instruction ID: 5943e5ed71ad5610998995fdf320d9959e16acce95df3f1ff116bb396c0a9d0e
Opcode Fuzzy Hash: 8e23886a4e4b68e780ccb1852e5d0beb537c38614e8ad2f88fed58b0cb5db06e
Instruction Fuzzy Hash: A9117F76500509EBCB00EBA5DD8ADEE77B8FF48314B144165F502E7162EF70AE14CB61

Function 00839023 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00839043
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00839055
SendMessageW.USER32(?,000000C9,?,00000000), ref: 0083906B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00839086

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 85db0d4780dff182d46c21700c28fef119844aa6d509ac1e8710143b38f02400
Instruction ID: 823dbe281e109c19eff2aa3873fd6d1cb82fd68e8afc36df4d07fbe6d17e4a5f
Opcode Fuzzy Hash: 85db0d4780dff182d46c21700c28fef119844aa6d509ac1e8710143b38f02400
Instruction Fuzzy Hash: AA115E79900218FFDB10DFA5CC84E9DBBB4FB48310F204095EA44B7250D6716E10DBD0

Function 007E1290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 007E2612: GetWindowLongW.USER32(?,000000EB), ref: 007E2623

DefDlgProcW.USER32(?,00000020,?), ref: 007E12D8
GetClientRect.USER32(?,?), ref: 0081B84B
GetCursorPos.USER32(?), ref: 0081B855
ScreenToClient.USER32(?,?), ref: 0081B860

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: d4e95e82e33cf296d2f05fd9f0dee096e9407036fe6c4c59052765024c59e026
Instruction ID: 88742175a118b55b6232d9c82e1a98731eb659af66cf2962c211f7303ef7e717
Opcode Fuzzy Hash: d4e95e82e33cf296d2f05fd9f0dee096e9407036fe6c4c59052765024c59e026
Instruction Fuzzy Hash: 61112835A01059EBCB00DF99DC8A9FE77BCFB09300F404465FA11E7251D774AA51CBA5

Function 00841652 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,008401FD,?,00841250,?,00008000), ref: 0084166F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,008401FD,?,00841250,?,00008000), ref: 00841694
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,008401FD,?,00841250,?,00008000), ref: 0084169E
Sleep.KERNEL32(?,?,?,?,?,?,?,008401FD,?,00841250,?,00008000), ref: 008416D1

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: bbfb825a8c6884e8e8209ee5db56bb0634e8666328ae9b2fcb89c0e0674560b5
Instruction ID: 329c6a83e15f1dec36138bc7308f52fb5ee7993bf09a3a481646831768033398
Opcode Fuzzy Hash: bbfb825a8c6884e8e8209ee5db56bb0634e8666328ae9b2fcb89c0e0674560b5
Instruction Fuzzy Hash: 12115E31C0552DDBCF009FA5E948AEEBB78FF19751F064055EA41F6240CB70D5A08B96

Function 00817207 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0081722B

Part of subcall function 00817912: __fltout2.LIBCMT ref: 0081793B

__cftog_l.LIBCMT ref: 00817251
__cftoe_l.LIBCMT ref: 00817283

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 1d695e4aca7b08ead69c70c966b3051a8757e7b2fe370facc5c03f98deea3341
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 6B01833204418EBBCF125E84DC018EE3F7BFF29354B148519FA1994031C237C9B2AB81

Function 0086B57F Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0086B59E
ScreenToClient.USER32(?,?), ref: 0086B5B6
ScreenToClient.USER32(?,?), ref: 0086B5DA
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0086B5F5

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 0c85e3df62fe2a125d83b60bcd075aed69815ecebc4a87a7466b3933117c5c51
Instruction ID: 051a6347d4877ae05bb5eb9e25c7edf963f01e087a4ef36ddd135166b246887a
Opcode Fuzzy Hash: 0c85e3df62fe2a125d83b60bcd075aed69815ecebc4a87a7466b3933117c5c51
Instruction Fuzzy Hash: 9D1163B9D00209EFDB41DFA9D8849EEFBB9FB18310F109166E915E3220D771AA518F90

Function 0086B8EF Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0086B8FE
_memset.LIBCMT ref: 0086B90D
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,008A7F20,008A7F64), ref: 0086B93C
CloseHandle.KERNEL32 ref: 0086B94E

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 3de841968c6407f23d855a4f39a894a702e4985a992e560e8b29f2675e8fc75c
Instruction ID: 47b3533fe571dd7eae3cfc7b8b5d4f4c7d7dfb0f5b1848d6d091ebc03a8d2597
Opcode Fuzzy Hash: 3de841968c6407f23d855a4f39a894a702e4985a992e560e8b29f2675e8fc75c
Instruction Fuzzy Hash: 3BF05EB25443407FF3102765AC05FBB3A5CFB0A354F001030FB08E5692EB718A1097A9

Function 00846E7C Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00846E88

Part of subcall function 0084794E: _memset.LIBCMT ref: 00847983

_memmove.LIBCMT ref: 00846EAB
_memset.LIBCMT ref: 00846EB8
LeaveCriticalSection.KERNEL32(?), ref: 00846EC8

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 2ddef9faa67b597ab7d0c1d4dbc8bee1c34dde2c52101eb54a03e17854d2b742
Instruction ID: 03e362f828192dbb07b90502a7e4d4d86b7e6741c97b6b7e10b58e4193486d7f
Opcode Fuzzy Hash: 2ddef9faa67b597ab7d0c1d4dbc8bee1c34dde2c52101eb54a03e17854d2b742
Instruction Fuzzy Hash: 63F0543A104204ABCF416F55EC85E49BF29FF45321B048061FE089E257C771E911CBB5

Function 0086C00C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 007E12F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 007E134D
Part of subcall function 007E12F3: SelectObject.GDI32(?,00000000), ref: 007E135C
Part of subcall function 007E12F3: BeginPath.GDI32(?), ref: 007E1373
Part of subcall function 007E12F3: SelectObject.GDI32(?,00000000), ref: 007E139C

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0086C030
LineTo.GDI32(00000000,?,?), ref: 0086C03D
EndPath.GDI32(00000000), ref: 0086C04D
StrokePath.GDI32(00000000), ref: 0086C05B

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 7020acf5cd168d445923cd9ee1174d3b853ad19a633513fd80e255d508d0d40e
Instruction ID: c3c6f28acc39d53674e29a1f6eba6dc5102cd6d15e8cdd2fa17b1117279ff42f
Opcode Fuzzy Hash: 7020acf5cd168d445923cd9ee1174d3b853ad19a633513fd80e255d508d0d40e
Instruction Fuzzy Hash: CAF05E35005659FBDB126F55AC0EFDE3F59BF0A311F154010FB11610E287B99561CBA6

Function 0083A37C Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0083A399
GetWindowThreadProcessId.USER32(?,00000000), ref: 0083A3AC
GetCurrentThreadId.KERNEL32 ref: 0083A3B3
AttachThreadInput.USER32(00000000), ref: 0083A3BA

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: f4a8ff7b784345dc0807766f876f5ad7974a2e3cfb0e4b3df2236d24168ec5df
Instruction ID: 370140308f8d62729957fc0b5d73d104230a89f2947139ae7bfa2eaf47f77fe2
Opcode Fuzzy Hash: f4a8ff7b784345dc0807766f876f5ad7974a2e3cfb0e4b3df2236d24168ec5df
Instruction Fuzzy Hash: CBE03931141228BADB201BA2EC0CED73F1CFF267A1F009024F609C4061C6B1C540CBE1

Function 007E2218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 007E2231
SetTextColor.GDI32(?,000000FF), ref: 007E223B
SetBkMode.GDI32(?,00000001), ref: 007E2250
GetStockObject.GDI32(00000005), ref: 007E2258
GetWindowDC.USER32(?,00000000), ref: 0081C0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 0081C0E0
GetPixel.GDI32(00000000,?,00000000), ref: 0081C0F9
GetPixel.GDI32(00000000,00000000,?), ref: 0081C112
GetPixel.GDI32(00000000,?,?), ref: 0081C132
ReleaseDC.USER32(?,00000000), ref: 0081C13D

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 7671b8fab0145cf4de298b33f8024f58c61031e887d1eb4bb68a8055abe943b7
Instruction ID: 75fd8bf712fa6c94aaab1f8ff05abc1be3f9cb937a02cf2b5b011c09e2a9ef2d
Opcode Fuzzy Hash: 7671b8fab0145cf4de298b33f8024f58c61031e887d1eb4bb68a8055abe943b7
Instruction Fuzzy Hash: A5E06D32544244EBDB225FA4FC0D7D83B18FB06336F018366FB69880E287B189C0DB12

Function 00838C5A Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00838C63
OpenThreadToken.ADVAPI32(00000000,?,?,?,0083882E), ref: 00838C6A
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,0083882E), ref: 00838C77
OpenProcessToken.ADVAPI32(00000000,?,?,?,0083882E), ref: 00838C7E

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: e8c731c381714ffb272f101deacef5b5e72248c155d043c43bf675be22bcaa03
Instruction ID: e5970f1f4be9c5ca7fc344476a858c0d6a32992bde31eff1ad64b8e27d425089
Opcode Fuzzy Hash: e8c731c381714ffb272f101deacef5b5e72248c155d043c43bf675be22bcaa03
Instruction Fuzzy Hash: 6AE04F36646311EBD7605FB1BD0CB563BA8FF50792F166828F345C9041DA74C4428B61

Function 00822187 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00822187
GetDC.USER32(00000000), ref: 00822191
GetDeviceCaps.GDI32(00000000,0000000C), ref: 008221B1
ReleaseDC.USER32(?), ref: 008221D2

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: f4f94654bcf860c3c5fc0493f741b521284309f53fe5c314e57d4ee8c30d12cd
Instruction ID: 5d3e4baef3078ca683857aae3d0d7a4110db1692cf721dca325910a9056fa7af
Opcode Fuzzy Hash: f4f94654bcf860c3c5fc0493f741b521284309f53fe5c314e57d4ee8c30d12cd
Instruction Fuzzy Hash: B3E0E5B5800614EFDB019F61E809A9D7BB1FB5C351F128425FA5AA7221CBB89142DF40

Function 0082219B Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0082219B
GetDC.USER32(00000000), ref: 008221A5
GetDeviceCaps.GDI32(00000000,0000000C), ref: 008221B1
ReleaseDC.USER32(?), ref: 008221D2

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: c37c639bddcaa8d95765088f707783ce3ea436e5e501e683768521fe0f2b8c94
Instruction ID: ac437f1d9e55690351544b15f9bda77ec100e46756d58f4809298794fe49b65a
Opcode Fuzzy Hash: c37c639bddcaa8d95765088f707783ce3ea436e5e501e683768521fe0f2b8c94
Instruction Fuzzy Hash: E9E012B5800204EFCB019FB1E80969D7BF1FF6C351F128029FA5AA7222CBB89142DF40

Function 0083B7B6 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 0083B981

Strings

Container, xrefs: 0083B8FE
AutoIt3GUI, xrefs: 0083B8F9

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: d8e6ced42c2294a37ccf2e6a2814fd91fcfd694c7288baa1f88315143e8efc49
Instruction ID: cf8a49f9db4223f11bad7dac63cfe78d2d45f8cee215f1ab644f859811b0feed
Opcode Fuzzy Hash: d8e6ced42c2294a37ccf2e6a2814fd91fcfd694c7288baa1f88315143e8efc49
Instruction Fuzzy Hash: 88914CB06006059FDB64DF68C884B66BBE9FF88710F14856DFA49CB791DB70E841CB90

Function 0084B217 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 007FFEC6: _wcscpy.LIBCMT ref: 007FFEE9

Part of subcall function 007E9997: __itow.LIBCMT ref: 007E99C2
Part of subcall function 007E9997: __swprintf.LIBCMT ref: 007E9A0C

__wcsnicmp.LIBCMT ref: 0084B298
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 0084B361

Strings

LPT, xrefs: 0084B292

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 42fe9a2814200fd4639c47b2c4a48092705c9c80c017f5a35fc95720f1ca9ada
Instruction ID: aff601a67aaf9febaf737cca13b4a0986f0b2860fcb4a17991f70994ea3c5ead
Opcode Fuzzy Hash: 42fe9a2814200fd4639c47b2c4a48092705c9c80c017f5a35fc95720f1ca9ada
Instruction Fuzzy Hash: B8611A76A00219AFCB14DF99C885AAEB7B8FB48310F154069F946EB391DB74EE40CB51

Function 007F2AB7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 007F2AC8
GlobalMemoryStatusEx.KERNEL32(?), ref: 007F2AE1

Strings

@, xrefs: 007F2AD5

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: f4bfe550d86eb49abec0efe3a7eb8c388cf38f07d73c2fc9d1adb4732b58b345
Instruction ID: 9a3b91c3356fdc3413dc9c34b84381251fa14c3608263cd904b8d4943db3a75a
Opcode Fuzzy Hash: f4bfe550d86eb49abec0efe3a7eb8c388cf38f07d73c2fc9d1adb4732b58b345
Instruction Fuzzy Hash: F0515C72419745DBD320AF15DC89BAFB7E8FF88310F82885DF2D951191DB348929CB16

Function 008499BE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 007E506B: __fread_nolock.LIBCMT ref: 007E5089

_wcscmp.LIBCMT ref: 00849AAE
_wcscmp.LIBCMT ref: 00849AC1

Strings

FILE, xrefs: 008499FA

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 1b4d559feaeb901141a4cfad91cd6c020aeedd18281d6403de192b971e6f3117
Instruction ID: 7706e32bdd5feefc9b88703fb800cf0821485f184ed15e30701acd1c7d87be01
Opcode Fuzzy Hash: 1b4d559feaeb901141a4cfad91cd6c020aeedd18281d6403de192b971e6f3117
Instruction Fuzzy Hash: C441D671A0061DBADF209EA5DC46FEFBBBDEF49714F000079F940E7181DA759A0487A1

Function 00852882 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00852892
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 008528C8

Strings

|, xrefs: 00852899

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 605a768d911ed8cc82da75d538cffc19c79daaf4fca89c880838860d4b2e02d5
Instruction ID: 4fef0cd5f0fae16d8af1b4fd5b42d0a7f19114f2cd10a63582c2458e7e7d31bb
Opcode Fuzzy Hash: 605a768d911ed8cc82da75d538cffc19c79daaf4fca89c880838860d4b2e02d5
Instruction Fuzzy Hash: F5313A71801119EFCF459FA1CC89EEEBFB8FF19300F104069F815A6266DA355A16DBA0

Function 00866CD2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00866D86
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00866DC2

Strings

static, xrefs: 00866D22

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 040944fa98bce5bdf5df07b6b0d87dcc33c85b6583a38fe5d49f6c11a640c4d1
Instruction ID: 0d193120bbffc79d10439a9cd02ae7dd5771c5f3a6dc26e82141ac05cfecc9c5
Opcode Fuzzy Hash: 040944fa98bce5bdf5df07b6b0d87dcc33c85b6583a38fe5d49f6c11a640c4d1
Instruction Fuzzy Hash: 3F319E71200644AADB109F68DC80AFB77A9FF48724F119629F9A5D7190DA31AC91CB60

Function 00842D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00842E00
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00842E3B

Strings

0, xrefs: 00842DF9

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 7f9cae4c14739fa2fa7c9ef588b634f1682d81868bdf9efc858cf0c43b32da34
Instruction ID: d304fe447688af29fa76116876e89b11519b8fe84802a29c4d690b86dae1ed13
Opcode Fuzzy Hash: 7f9cae4c14739fa2fa7c9ef588b634f1682d81868bdf9efc858cf0c43b32da34
Instruction Fuzzy Hash: CD312831A0830DEBEB24CF88C845BAEBBB9FF05354F940069F985E71A2E7709944CB11

Function 00866943 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 008669D0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 008669DB

Strings

Combobox, xrefs: 0086699D

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: f611d86dda5d723f260c6dc961d74d895088863fff701258b0c717848d57807e
Instruction ID: e1250923c621c7323efeddd51d99e2f466ca23eeb5d0fecd7e594fd33b443d5c
Opcode Fuzzy Hash: f611d86dda5d723f260c6dc961d74d895088863fff701258b0c717848d57807e
Instruction Fuzzy Hash: 1611C4717002487FEF119F24DC80EBB3B6AFB993A4F164224FD58DB291E6759C6187A0

Function 00866E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 007E1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 007E1D73
Part of subcall function 007E1D35: GetStockObject.GDI32(00000011), ref: 007E1D87
Part of subcall function 007E1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 007E1D91

GetWindowRect.USER32(00000000,?), ref: 00866EE0
GetSysColor.USER32(00000012), ref: 00866EFA

Strings

static, xrefs: 00866EBD

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: c9db46b0b322567928ea0582da5edb6295d67e28ce7e009ee612642ad4375fd9
Instruction ID: e61fc6043b41649886e670732439215ad951743612e806d796e6a006534d199e
Opcode Fuzzy Hash: c9db46b0b322567928ea0582da5edb6295d67e28ce7e009ee612642ad4375fd9
Instruction Fuzzy Hash: 64216A7261020AAFDB04DFA8DC45AFA7BB8FB08314F054628FD55D3251E775E861DB50

Function 00866B8F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00866C11
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00866C20

Strings

edit, xrefs: 00866BF5

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 097aa0ec16c909cdf53f73f002c6ddb5f55b8c132a21e6743d4ad6b547fc48f6
Instruction ID: 4632dd82f6a9b9e1d7298835f793a7017a61d40d1b9933b7f07fa498fb01e597
Opcode Fuzzy Hash: 097aa0ec16c909cdf53f73f002c6ddb5f55b8c132a21e6743d4ad6b547fc48f6
Instruction Fuzzy Hash: 8011BF71500148ABEB108F64EC45AFB3769FB05378F124724FA61D71E0E775DCA0AB60

Function 00842E9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00842F11
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00842F30

Strings

0, xrefs: 00842F07

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: e57b93ae54838349a97aee3d7cb655a152a092e7738d7c8339387ac7f6e9b080
Instruction ID: ef7fe78a0b9f32cefed702c07b9c852a313d146a1343961947561a93af7f605b
Opcode Fuzzy Hash: e57b93ae54838349a97aee3d7cb655a152a092e7738d7c8339387ac7f6e9b080
Instruction Fuzzy Hash: 6B11D33190912CABDB30DB98DC04B9977B9FB11314F8800B1F855F72A1EFB0AD088791

Function 008524CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00852520
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00852549

Strings

<local>, xrefs: 00852511

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 6593ba36df2feda1f57f813b4adc6bf539428144e9ae45d4e501c84b08c7fc5d
Instruction ID: 4c05ad4dc6b98aabec5e9464fd75095a483d133d641f67a4ceedd0be791c091a
Opcode Fuzzy Hash: 6593ba36df2feda1f57f813b4adc6bf539428144e9ae45d4e501c84b08c7fc5d
Instruction Fuzzy Hash: 0A110270100225BADB248F518C98EBBFFACFF07356F10812AFD45C6140EA706989DAF0

Function 008580A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0085830B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,008580C8,?,00000000,?,?), ref: 00858322

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 008580CB
htons.WSOCK32(00000000,?,00000000), ref: 00858108

Strings

255.255.255.255, xrefs: 008580E3

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: 3a59af0b3e6bfcb4c27bccb33b2bae2369569624347391827717cb4088f04ef7
Instruction ID: aebe23fc609d4e0608d38dd3b779261df13ed99434d994fd7ac48d5b6a2f98bc
Opcode Fuzzy Hash: 3a59af0b3e6bfcb4c27bccb33b2bae2369569624347391827717cb4088f04ef7
Instruction Fuzzy Hash: A111C234200249EBDB10AF68DC46BBDB724FF04355F108527ED11E7291DA71A8198791

Function 008392E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007E7F41: _memmove.LIBCMT ref: 007E7F82

Part of subcall function 0083B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0083B0E7

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00839355

Strings

ComboBox, xrefs: 008392F4
ListBox, xrefs: 0083931F

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: f7d9d0ed10f8038b9a0730639860e86bfa9685711c5dc95473f868fac96848d3
Instruction ID: a8773b145f678a3c6f3a60c78043375665ee062e3c7b3a38763d6628eb5f2331
Opcode Fuzzy Hash: f7d9d0ed10f8038b9a0730639860e86bfa9685711c5dc95473f868fac96848d3
Instruction Fuzzy Hash: 3901F9B1A05218ABCB08FB64CC95CFE7769FF45310F140619F572973D1EB755808C690

Function 008391DF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007E7F41: _memmove.LIBCMT ref: 007E7F82

Part of subcall function 0083B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0083B0E7

SendMessageW.USER32(?,00000180,00000000,?), ref: 0083924D

Strings

ComboBox, xrefs: 008391EC
ListBox, xrefs: 00839217

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: d8381976228eed05b1a3a22466158de0c0c7b9642cba3ae313cfc9b4a1982117
Instruction ID: 9f7962acdfd62278fd15b60e46641350b67389a976fdf1c991361234a2e9f4d7
Opcode Fuzzy Hash: d8381976228eed05b1a3a22466158de0c0c7b9642cba3ae313cfc9b4a1982117
Instruction Fuzzy Hash: 87018471A41108BBCB08EBA4C996DFF77A8EF89300F150129F962A7291EA555E0C96B1

Function 00839264 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007E7F41: _memmove.LIBCMT ref: 007E7F82

Part of subcall function 0083B0C4: GetClassNameW.USER32(?,?,000000FF), ref: 0083B0E7

SendMessageW.USER32(?,00000182,?,00000000), ref: 008392D0

Strings

ComboBox, xrefs: 00839271
ListBox, xrefs: 0083929C

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: d8bddf1e828a85b8156b685df83177ac5139571fd4a9e301ad78274e58334763
Instruction ID: 76ace715d3495c2c2ded0836b7c3c9366e7c5ab8bcea8a3fc70c20bda59ef447
Opcode Fuzzy Hash: d8bddf1e828a85b8156b685df83177ac5139571fd4a9e301ad78274e58334763
Instruction Fuzzy Hash: 9A01A771A41108B7CF04E6A4C996DFF77ACEF55300F140119F962A7282DA955E0896B1

Function 008451CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 008451E8
_wcscmp.LIBCMT ref: 008451FA

Strings

#32770, xrefs: 008451F4

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: d64bffc914b10175aad574b81914afaf7f4f6bd48ac0ebc587698dd616b9de9e
Instruction ID: bb92860c30e596b8aaedf5251aba9a8637a096d257e6b4a6d4ae6dd20c8fade7
Opcode Fuzzy Hash: d64bffc914b10175aad574b81914afaf7f4f6bd48ac0ebc587698dd616b9de9e
Instruction Fuzzy Hash: C5E09B7290422D27E710A799AC45A97F7ACFB45761F000167F914D3151E560994587E1

Function 008381BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 008381CA

Part of subcall function 00803598: _doexit.LIBCMT ref: 008035A2

Strings

Error allocating memory., xrefs: 008381C3
AutoIt, xrefs: 008381BE

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 54aba1f93731a5fb1582cdb6ea9c3a30e847c40886fb2295bb280341c5007790
Instruction ID: 3e9e0c266ffc4632c4d93b8d44b8ba5c2b2c61783b347fdfcd57d4cf4b43b831
Opcode Fuzzy Hash: 54aba1f93731a5fb1582cdb6ea9c3a30e847c40886fb2295bb280341c5007790
Instruction Fuzzy Hash: 12D02B323C531872D61132ED6C0FFC93548EB09B21F004026FB4CD55E38DD5848142DD

Function 0081B511 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0081B564: _memset.LIBCMT ref: 0081B571

Part of subcall function 00800B84: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,0081B540,?,?,?,007E100A), ref: 00800B89

IsDebuggerPresent.KERNEL32(?,?,?,007E100A), ref: 0081B544
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,007E100A), ref: 0081B553

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0081B54E

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: e83b1b6b50994ef7ab63a24ddeddcbb1b1239585b4b17c5d68dac415894eb0eb
Instruction ID: 856695c5d3e215edc50ed50045574c9dc67fef42ead1ed0aee6821e051e9334e
Opcode Fuzzy Hash: e83b1b6b50994ef7ab63a24ddeddcbb1b1239585b4b17c5d68dac415894eb0eb
Instruction Fuzzy Hash: D1E06D702007518BD360EF68E9043827BE4FF04715F04892CE556C3752E7B8D484CBA1

Function 00865BEB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00865BF5
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00865C08

Part of subcall function 008454E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 0084555E

Strings

Shell_TrayWnd, xrefs: 00865BEE

Memory Dump Source

Source File: 00000000.00000002.1736995948.00000000007E1000.00000020.00000001.01000000.00000003.sdmp, Offset: 007E0000, based on PE: true

Associated: 00000000.00000002.1736979186.00000000007E0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.000000000086F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737043929.0000000000895000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737084085.000000000089F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1737219662.00000000008A8000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7e0000_rPurchaseOrder300610-PDF.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 07cf5e1c1ba0190b63a34530996685a4ced14bc49744ab341c2768ce7e40eaea
Instruction ID: 57b30e120ce0a1932ab9246e90400eea72ddb9e245716ecf9bf2b4011bc0de82
Opcode Fuzzy Hash: 07cf5e1c1ba0190b63a34530996685a4ced14bc49744ab341c2768ce7e40eaea
Instruction Fuzzy Hash: 33D0C931388311B7E7A8BB70BC0FF976A14FB50B51F051825B756EA1D2D9E89840C654

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report rPurchaseOrder300610-PDF.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Maianthemum

C:\Users\user\AppData\Local\Temp\autCE2F.tmp

C:\Users\user\AppData\Local\Temp\autCE6E.tmp

C:\Users\user\AppData\Local\Temp\turbinate

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Windows Analysis Report
rPurchaseOrder300610-PDF.exe

Function 007E3B4C Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Function 007E4FE9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62
COMMON

Function 007E4AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 008493DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 007E3015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 71
windowregistryCOMMON

Function 007E3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 007E71EB Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 007E3A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 007E3633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 007E3778 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Function 036225E0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 007E39E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 036223B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 145
fileCOMMON

Function 007E410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Function 0080564D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre