Edit tour

Windows Analysis Report
6bdudXAsQW.exe

Overview

General Information

Sample name:	6bdudXAsQW.exe renamed because original name is a hash value
Original sample name:	a591da122e31234bad81a8125c761b07e01dbbec7ef1b254a30097b019a22c48.exe
Analysis ID:	1467023
MD5:	f3c77e436ab94a56d3e99fabb83a68d7
SHA1:	4a0a02c3f34f176a8defb6503f30674a17919f4f
SHA256:	a591da122e31234bad81a8125c761b07e01dbbec7ef1b254a30097b019a22c48
Tags:	exeFormbook
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected AgentTesla

Yara detected AntiVM3

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Check if machine is in data center or colocation facility

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Contains functionality to log keystrokes (.Net Source)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May check the online IP address of the machine

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Suspicious Outbound SMTP Connections

Uses 32bit PE files

Uses SMTP (mail sending)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

6bdudXAsQW.exe (PID: 7720 cmdline: "C:\Users\user\Desktop\6bdudXAsQW.exe" MD5: F3C77E436AB94A56D3E99FABB83A68D7)

RegSvcs.exe (PID: 7776 cmdline: "C:\Users\user\Desktop\6bdudXAsQW.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

ZUHFqcY.exe (PID: 7964 cmdline: "C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

conhost.exe (PID: 7976 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

ZUHFqcY.exe (PID: 7160 cmdline: "C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

conhost.exe (PID: 5496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Agent Tesla, AgentTesla	A .NET based information stealer readily available to actors due to leaked builders. The malware is able to log keystrokes, can access the host's clipboard and crawls the disk for credentials or other valuable information. It has the capability to send information back to its C&C via HTTP(S), SMTP, FTP, or towards a Telegram channel.	SWEED	http://blog.nsfocus.net/sweed-611/ http://l1v1ngc0d3.wordpress.com/2021/11/12/agenttesla-dropped-via-nsis-installer/ http://ropgadget.com/posts/originlogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://0xmrmagnezi.github.io/malware%20analysis/AgentTesla/	https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "SMTP", "Port": "587", "Host": "us2.smtp.mailhostbox.com", "Username": "techbro@zandberqen.com", "Password": "   scy$gFV5   "}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.2583320483.0000000002477000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.2583320483.000000000249C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.2583320483.0000000002451000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2583320483.0000000002451000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000002.00000002.2582286553.0000000000142000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2582286553.0000000000142000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1355424313.0000000003500000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1355424313.0000000003500000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
00000000.00000002.1355424313.0000000003500000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.1355424313.0000000003500000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x343c2:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34434:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x344be:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34550:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x345ba:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3462c:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x346c2:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34752:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Process Memory Space: 6bdudXAsQW.exe PID: 7720	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 6bdudXAsQW.exe PID: 7720	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: 6bdudXAsQW.exe PID: 7720	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: RegSvcs.exe PID: 7776	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7776	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.6bdudXAsQW.exe.3500000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.6bdudXAsQW.exe.3500000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.6bdudXAsQW.exe.3500000.1.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x325c2:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x32634:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x326be:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x32750:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x327ba:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3282c:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x328c2:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x32952:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
2.2.RegSvcs.exe.140000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.RegSvcs.exe.140000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.RegSvcs.exe.140000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
2.2.RegSvcs.exe.140000.0.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x343c2:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34434:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x344be:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34550:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x345ba:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3462c:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x346c2:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34752:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
0.2.6bdudXAsQW.exe.3500000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.6bdudXAsQW.exe.3500000.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
0.2.6bdudXAsQW.exe.3500000.1.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.6bdudXAsQW.exe.3500000.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID	Detects executables referencing Windows vault credential objects. Observed in infostealers	ditekSHen	0x343c2:$s1: 2F1A6504-0641-44CF-8BB5-3612D865F2E5 0x34434:$s2: 3CCD5499-87A8-4B10-A215-608888DD3B55 0x344be:$s3: 154E23D0-C644-4E6F-8CE6-5069272F999F 0x34550:$s4: 4BF4C442-9B8A-41A0-B380-DD4A704DDB28 0x345ba:$s5: 77BC582B-F0A6-4E15-4E80-61736B6F3B29 0x3462c:$s6: E69D7838-91B5-4FC9-89D5-230D4D4CC2BC 0x346c2:$s7: 3E0E35BE-1B77-43E7-B873-AED901B6275B 0x34752:$s8: 3C886FF3-2669-4AA2-A8FB-3F6759A77548
Click to see the 6 entries

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, ProcessId: 7776, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ZUHFqcY

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DesusertionIp: 208.91.199.225, DesusertionIsIpv6: false, DesusertionPort: 587, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe, Initiated: true, ProcessId: 7776, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49707

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "SMTP", "Port": "587", "Host": "us2.smtp.mailhostbox.com", "Username": "techbro@zandberqen.com", "Password": " scy$gFV5 "}

Multi AV Scanner detection for submitted file

Source: 6bdudXAsQW.exe

ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 6bdudXAsQW.exe

Joe Sandbox ML: detected

Source: 6bdudXAsQW.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: RegSvcs.pdb, source: ZUHFqcY.exe, 00000003.00000000.1465961982.0000000000E62000.00000002.00000001.01000000.00000006.sdmp, ZUHFqcY.exe.2.dr
Source:	Binary string: wntdll.pdbUGP source: 6bdudXAsQW.exe, 00000000.00000003.1351461146.0000000003590000.00000004.00001000.00020000.00000000.sdmp, 6bdudXAsQW.exe, 00000000.00000003.1349959385.00000000036E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 6bdudXAsQW.exe, 00000000.00000003.1351461146.0000000003590000.00000004.00001000.00020000.00000000.sdmp, 6bdudXAsQW.exe, 00000000.00000003.1349959385.00000000036E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: RegSvcs.pdb source: ZUHFqcY.exe, 00000003.00000000.1465961982.0000000000E62000.00000002.00000001.01000000.00000006.sdmp, ZUHFqcY.exe.2.dr

Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007C4696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_007C4696
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007CC93C FindFirstFileW,FindClose,	0_2_007CC93C
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007CC9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_007CC9C7
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007CF200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_007CF200
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007CF35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_007CF35D
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007CF65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_007CF65E
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007C3A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_007C3A2B
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007C3D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_007C3D4E
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007CBF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_007CBF27

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 2.2.RegSvcs.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1355424313.0000000003500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: global traffic

TCP traffic: 192.168.2.9:49707 -> 208.91.199.225:587

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 208.91.199.225 208.91.199.225

Source: Joe Sandbox View	ASN Name: TUT-ASUS TUT-ASUS
Source: Joe Sandbox View	ASN Name: PUBLIC-DOMAIN-REGISTRYUS PUBLIC-DOMAIN-REGISTRYUS

Source: unknown

DNS query: name: ip-api.com

Source: global traffic

TCP traffic: 192.168.2.9:49707 -> 208.91.199.225:587

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_007D25E2 InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_007D25E2

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Source: global traffic	DNS traffic detected: DNS query: ip-api.com
Source: global traffic	DNS traffic detected: DNS query: us2.smtp.mailhostbox.com

Source: RegSvcs.exe, 00000002.00000002.2585112522.00000000056E0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2583320483.000000000247D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: RegSvcs.exe, 00000002.00000002.2582719649.00000000006C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: RegSvcs.exe, 00000002.00000002.2585112522.0000000005745000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2585112522.00000000056E0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2583320483.000000000247D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2585112522.000000000570D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#
Source: RegSvcs.exe, 00000002.00000002.2583320483.0000000002421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: 6bdudXAsQW.exe, 00000000.00000002.1355424313.0000000003500000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2582719649.00000000006DE000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2582286553.0000000000142000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2583320483.0000000002421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com/line/?fields=hosting
Source: RegSvcs.exe, 00000002.00000002.2585112522.00000000056E0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2583320483.000000000247D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: RegSvcs.exe, 00000002.00000002.2585112522.0000000005745000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2585112522.00000000056E0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2583320483.000000000247D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2585112522.000000000570D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0A
Source: RegSvcs.exe, 00000002.00000002.2583320483.0000000002421000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000002.00000002.2583320483.000000000247D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://us2.smtp.mailhostbox.com
Source: 6bdudXAsQW.exe, 00000000.00000002.1355424313.0000000003500000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2582286553.0000000000142000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://account.dyn.com/
Source: RegSvcs.exe, 00000002.00000002.2585112522.0000000005745000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2585112522.00000000056E0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2583320483.000000000247D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2585112522.000000000570D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack, POq2Ux.cs

.Net Code: k8g7

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_007D425A OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_007D425A

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_007D4458 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_007D4458

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

0_2_007D425A

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_007C0219 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_007C0219

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_007ECDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_007ECDAC

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.6bdudXAsQW.exe.3500000.1.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 2.2.RegSvcs.exe.140000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen
Source: 00000000.00000002.1355424313.0000000003500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects executables referencing Windows vault credential objects. Observed in infostealers Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00763B4C
Source: 6bdudXAsQW.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: 6bdudXAsQW.exe, 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_01ca8cf2-e
Source: 6bdudXAsQW.exe, 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_0754ca92-c
Source: 6bdudXAsQW.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_2dcfbfd5-b
Source: 6bdudXAsQW.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_d54b616d-5

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_007C4021: CreateFileW,DeviceIoControl,CloseHandle,

0_2_007C4021

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_007B8858 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_007B8858

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_007C545F ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_007C545F

Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_0076E800	0_2_0076E800
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_0078DBB5	0_2_0078DBB5
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_0076E060	0_2_0076E060
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007E804A	0_2_007E804A
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_00774140	0_2_00774140
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_00782405	0_2_00782405
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_00796522	0_2_00796522
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_0079267E	0_2_0079267E
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007E0665	0_2_007E0665
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_00776843	0_2_00776843
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_0078283A	0_2_0078283A
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007989DF	0_2_007989DF
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_00778A0E	0_2_00778A0E
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007E0AE2	0_2_007E0AE2
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_00796A94	0_2_00796A94
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007C8B13	0_2_007C8B13
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007BEB07	0_2_007BEB07
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_0078CD61	0_2_0078CD61
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_00797006	0_2_00797006
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_0077710E	0_2_0077710E
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_00773190	0_2_00773190
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_00761287	0_2_00761287
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007833C7	0_2_007833C7
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_0078F419	0_2_0078F419
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007816C4	0_2_007816C4
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_00775680	0_2_00775680
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007878D3	0_2_007878D3
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007758C0	0_2_007758C0
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_00781BB8	0_2_00781BB8
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_00799D05	0_2_00799D05
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_0076FE40	0_2_0076FE40
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_0078BFE6	0_2_0078BFE6
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_00781FD0	0_2_00781FD0
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_00753630	0_2_00753630
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00A5D692	2_2_00A5D692
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00A54AF8	2_2_00A54AF8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00A53EE0	2_2_00A53EE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_00A54228	2_2_00A54228
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05CE2430	2_2_05CE2430
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05CE6250	2_2_05CE6250
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05CE5238	2_2_05CE5238
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05CEBCC0	2_2_05CEBCC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05CE79D8	2_2_05CE79D8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05CE0040	2_2_05CE0040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05CE0006	2_2_05CE0006
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05CE72F8	2_2_05CE72F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 2_2_05CE5958	2_2_05CE5958

Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: String function: 00788B40 appears 42 times
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: String function: 00767F41 appears 35 times
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: String function: 00780D27 appears 70 times

Source: 6bdudXAsQW.exe, 00000000.00000003.1343548577.0000000003663000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 6bdudXAsQW.exe
Source: 6bdudXAsQW.exe, 00000000.00000003.1353580475.000000000385D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 6bdudXAsQW.exe
Source: 6bdudXAsQW.exe, 00000000.00000002.1355424313.0000000003500000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename89dc2a08-79e0-4ffd-a731-68cb62249e53.exe4 vs 6bdudXAsQW.exe

Source: 6bdudXAsQW.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 0.2.6bdudXAsQW.exe.3500000.1.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 2.2.RegSvcs.exe.140000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers
Source: 00000000.00000002.1355424313.0000000003500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID author = ditekSHen, description = Detects executables referencing Windows vault credential objects. Observed in infostealers

Source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack, ZTFEpdjP8zw.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack, WnRNxU.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack, 2njIk.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack, I5ElxL.cs	Cryptographic APIs: 'CreateDecryptor', 'TransformBlock'
Source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack, QQSiOsa4hPS.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack, FdHU4eb83Z7.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack, 3VzYbXLJt4.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack, 3VzYbXLJt4.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack, 3VzYbXLJt4.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack, 3VzYbXLJt4.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/8@2/2

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_007CA2D5 GetLastError,FormatMessageW,

0_2_007CA2D5

Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007B8713 AdjustTokenPrivileges,CloseHandle,		0_2_007B8713
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007B8CC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_007B8CC3

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_007CB59E SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_007CB59E

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_007DF121 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_007DF121

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_007CC602 CoInitialize,CoCreateInstance,CoUninitialize,

0_2_007CC602

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_00764FE9 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00764FE9

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File created: C:\Users\user\AppData\Roaming\ZUHFqcY

Jump to behavior

Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7976:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5496:120:WilError_03

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

File created: C:\Users\user\AppData\Local\Temp\autD26F.tmp

Jump to behavior

Source: 6bdudXAsQW.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 6bdudXAsQW.exe

ReversingLabs: Detection: 65%

Source: unknown	Process created: C:\Users\user\Desktop\6bdudXAsQW.exe "C:\Users\user\Desktop\6bdudXAsQW.exe"
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\6bdudXAsQW.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe "C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe"
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe "C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe"
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\6bdudXAsQW.exe"	Jump to behavior

Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Outlook\Profiles

Jump to behavior

Source: 6bdudXAsQW.exe

Static file information: File size 1128960 > 1048576

Source: 6bdudXAsQW.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: 6bdudXAsQW.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: 6bdudXAsQW.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: 6bdudXAsQW.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: 6bdudXAsQW.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: 6bdudXAsQW.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: 6bdudXAsQW.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: RegSvcs.pdb, source: ZUHFqcY.exe, 00000003.00000000.1465961982.0000000000E62000.00000002.00000001.01000000.00000006.sdmp, ZUHFqcY.exe.2.dr
Source:	Binary string: wntdll.pdbUGP source: 6bdudXAsQW.exe, 00000000.00000003.1351461146.0000000003590000.00000004.00001000.00020000.00000000.sdmp, 6bdudXAsQW.exe, 00000000.00000003.1349959385.00000000036E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: 6bdudXAsQW.exe, 00000000.00000003.1351461146.0000000003590000.00000004.00001000.00020000.00000000.sdmp, 6bdudXAsQW.exe, 00000000.00000003.1349959385.00000000036E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: RegSvcs.pdb source: ZUHFqcY.exe, 00000003.00000000.1465961982.0000000000E62000.00000002.00000001.01000000.00000006.sdmp, ZUHFqcY.exe.2.dr

Source: 6bdudXAsQW.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: 6bdudXAsQW.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: 6bdudXAsQW.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: 6bdudXAsQW.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: 6bdudXAsQW.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_007DC304 LoadLibraryA,GetProcAddress,

0_2_007DC304

Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_0076C590 push eax; retn 0076h		0_2_0076C599
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_00788B85 push ecx; ret		0_2_00788B98

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File created: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe

Jump to dropped file

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ZUHFqcY			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ZUHFqcY			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

File opened: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_00764A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_00764A35
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007E55FD IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_007E55FD

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_007833C7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_007833C7

Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: 6bdudXAsQW.exe PID: 7720, type: MEMORYSTR

Check if machine is in data center or colocation facility

Source: global traffic

HTTP traffic detected: GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

API/Special instruction interceptor: Address: 753254

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 6bdudXAsQW.exe, 00000000.00000002.1355424313.0000000003500000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2583320483.0000000002451000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2582286553.0000000000142000.00000040.80000000.00040000.00000000.sdmp

Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Memory allocated: 15A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Memory allocated: 3220000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Memory allocated: 2FE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Memory allocated: 10E0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Memory allocated: 2A80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Memory allocated: 4A80000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 3947			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 1727			Jump to behavior

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-99662

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

API coverage: 4.9 %

Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe TID: 8028	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe TID: 6484	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007C4696 GetFileAttributesW,FindFirstFileW,FindClose,	0_2_007C4696
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007CC93C FindFirstFileW,FindClose,	0_2_007CC93C
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007CC9C7 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_007CC9C7
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007CF200 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_007CF200
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007CF35D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_007CF35D
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007CF65E FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_007CF65E
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007C3A2B FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_007C3A2B
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007C3D4E FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_007C3D4E
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007CBF27 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_007CBF27

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_00764AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00764AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 100000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99781	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99672	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99562	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99429	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99203	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 99094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98765	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98437	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 98094	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97984	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97434	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97328	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97219	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 97107	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 96991	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: RegSvcs.exe, 00000002.00000002.2583320483.0000000002451000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware
Source: RegSvcs.exe, 00000002.00000002.2582286553.0000000000142000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: vmware
Source: RegSvcs.exe, 00000002.00000002.2585112522.000000000570D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll<
Source: RegSvcs.exe, 00000002.00000002.2582286553.0000000000142000.00000040.80000000.00040000.00000000.sdmp	Binary or memory string: VMwareVBoxESelect * from Win32_ComputerSystem

Source: C:\Users\user\Desktop\6bdudXAsQW.exe	API call chain: ExitProcess graph end node			graph_0-98198
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	API call chain: ExitProcess graph end node			graph_0-98272

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Code function: 2_2_00A570E8 CheckRemoteDebuggerPresent,

2_2_00A570E8

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_007D41FD BlockInput,

0_2_007D41FD

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_00763B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00763B4C

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_00795CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00795CCC

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_007DC304 LoadLibraryA,GetProcAddress,

0_2_007DC304

Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007534C0 mov eax, dword ptr fs:[00000030h]	0_2_007534C0
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_00753520 mov eax, dword ptr fs:[00000030h]	0_2_00753520
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_00751E70 mov eax, dword ptr fs:[00000030h]	0_2_00751E70

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_007B81F7 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_007B81F7

Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_0078A364 SetUnhandledExceptionFilter,		0_2_0078A364
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_0078A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0078A395

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 36A008

Jump to behavior

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_007B8C93 LogonUserW,

0_2_007B8C93

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_00763B4C GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00763B4C

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_00764A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00764A35

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_007C4EF5 mouse_event,

0_2_007C4EF5

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\6bdudXAsQW.exe"

Jump to behavior

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

0_2_007B81F7

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_007C4C03 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_007C4C03

Source: 6bdudXAsQW.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: 6bdudXAsQW.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_0078886B cpuid

0_2_0078886B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Queries volume information: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Queries volume information: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_007950D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_007950D7

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_007A2230 GetUserNameW,

0_2_007A2230

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_0079418A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_0079418A

Source: C:\Users\user\Desktop\6bdudXAsQW.exe

Code function: 0_2_00764AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00764AFE

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 0.2.6bdudXAsQW.exe.3500000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2583320483.0000000002477000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2583320483.000000000249C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2583320483.0000000002451000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2582286553.0000000000142000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1355424313.0000000003500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6bdudXAsQW.exe PID: 7720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7776, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\NETGATE Technologies\BlackHawk\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\8pecxstudios\Cyberfox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: 6bdudXAsQW.exe	Binary or memory string: WIN_81
Source: 6bdudXAsQW.exe	Binary or memory string: WIN_XP
Source: 6bdudXAsQW.exe	Binary or memory string: WIN_XPe
Source: 6bdudXAsQW.exe	Binary or memory string: WIN_VISTA
Source: 6bdudXAsQW.exe	Binary or memory string: WIN_7
Source: 6bdudXAsQW.exe	Binary or memory string: WIN_8
Source: 6bdudXAsQW.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 5USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 0.2.6bdudXAsQW.exe.3500000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2583320483.0000000002451000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2582286553.0000000000142000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1355424313.0000000003500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6bdudXAsQW.exe PID: 7720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7776, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 0.2.6bdudXAsQW.exe.3500000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.140000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.6bdudXAsQW.exe.3500000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.2583320483.0000000002477000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2583320483.000000000249C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2583320483.0000000002451000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2582286553.0000000000142000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1355424313.0000000003500000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 6bdudXAsQW.exe PID: 7720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7776, type: MEMORYSTR

Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007D6596 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_007D6596
Source: C:\Users\user\Desktop\6bdudXAsQW.exe	Code function: 0_2_007D6A5A socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_007D6A5A

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	221 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	2 Valid Accounts	1 DLL Side-Loading	11 Deobfuscate/Decode Files or Information	121 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Registry Run Keys / Startup Folder	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	138 System Information Discovery	Distributed Component Object Model	121 Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	1 Masquerading	LSA Secrets	651 Security Software Discovery	SSH	3 Clipboard Data	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Registry Run Keys / Startup Folder	2 Valid Accounts	Cached Domain Credentials	251 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	251 Virtualization/Sandbox Evasion	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	212 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Files and Directories	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
6bdudXAsQW.exe	66%	ReversingLabs	Win32.Trojan.Strab
6bdudXAsQW.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://account.dyn.com/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://ip-api.com/line/?fields=hosting	0%	URL Reputation	safe
http://ip-api.com	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	0%	Avira URL Cloud	safe
http://us2.smtp.mailhostbox.com	0%	Avira URL Cloud	safe
http://ocsp.sectigo.com0A	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
us2.smtp.mailhostbox.com	208.91.199.225	true	true		unknown
ip-api.com	208.95.112.1	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://ip-api.com/line/?fields=hosting	false	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://crt.sectigo.com/SectigoRSADomainValidationSecureServerCA.crt0#	RegSvcs.exe, 00000002.00000002.2585112522.0000000005745000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2585112522.00000000056E0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2583320483.000000000247D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2585112522.000000000570D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.sectigo.com0A	RegSvcs.exe, 00000002.00000002.2585112522.0000000005745000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2585112522.00000000056E0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2583320483.000000000247D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2585112522.000000000570D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	RegSvcs.exe, 00000002.00000002.2585112522.0000000005745000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2585112522.00000000056E0000.00000004.00000020.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2583320483.000000000247D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2585112522.000000000570D000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://account.dyn.com/	6bdudXAsQW.exe, 00000000.00000002.1355424313.0000000003500000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000002.00000002.2582286553.0000000000142000.00000040.80000000.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
http://us2.smtp.mailhostbox.com	RegSvcs.exe, 00000002.00000002.2583320483.000000000247D000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000002.00000002.2583320483.0000000002421000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ip-api.com	RegSvcs.exe, 00000002.00000002.2583320483.0000000002421000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
208.95.112.1	ip-api.com	United States		53334	TUT-ASUS	true
208.91.199.225	us2.smtp.mailhostbox.com	United States		394695	PUBLIC-DOMAIN-REGISTRYUS	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467023
Start date and time:	2024-07-03 16:33:12 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	6bdudXAsQW.exe renamed because original name is a hash value
Original Sample Name:	a591da122e31234bad81a8125c761b07e01dbbec7ef1b254a30097b019a22c48.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/8@2/2
EGA Information:	Successful, ratio: 50%
HCA Information:	Successful, ratio: 100% Number of executed functions: 58 Number of non-executed functions: 281
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target ZUHFqcY.exe, PID 7160 because it is empty
Execution Graph export aborted for target ZUHFqcY.exe, PID 7964 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: 6bdudXAsQW.exe

Simulations

Behavior and APIs

Time	Type	Description
10:34:04	API Interceptor	28x Sleep call for process: RegSvcs.exe modified
15:34:06	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ZUHFqcY C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe
15:34:15	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ZUHFqcY C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	H50bdqfVH2.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	kZa81nzREg.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	bv8iPF7cTY.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	jsLnybSs43.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	tgBNtoWqIp.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	fiDe44VTwh.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	9691e6dc404680cc6648726c8d124a6d4fc637bb6b4a092661308012438623b2_dump.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	BomqT2a55e.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
	E48ALuMJ3m.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	ip-api.com/line/?fields=hosting
	H1sut2Xo3r.exe	Get hash	malicious	AgentTesla	Browse	ip-api.com/line/?fields=hosting
208.91.199.225	SecuriteInfo.com.Win32.PWSX-gen.21042.22708.exe	Get hash	malicious	AgentTesla	Browse
	I0Hw9G8QDJ.exe	Get hash	malicious	AgentTesla	Browse
	purchase order.exe	Get hash	malicious	AgentTesla	Browse
	Swift Copy_98754.bat.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.PWSX-gen.13475.26104.exe	Get hash	malicious	AgentTesla	Browse
	PO-070723-WA0002.exe	Get hash	malicious	AgentTesla	Browse
	7sMAMtr3zhCJoE7.exe	Get hash	malicious	AgentTesla	Browse
	SWIFT-MT103 COPY.exe	Get hash	malicious	AgentTesla	Browse
	yz4HYN8Zv2.exe	Get hash	malicious	AgentTesla	Browse
	HSBC-payment-Advice.bat	Get hash	malicious	AgentTesla, PureLog Stealer	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ip-api.com	H50bdqfVH2.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	kZa81nzREg.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	bv8iPF7cTY.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	jsLnybSs43.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	tgBNtoWqIp.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	fiDe44VTwh.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	9691e6dc404680cc6648726c8d124a6d4fc637bb6b4a092661308012438623b2_dump.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	BomqT2a55e.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	E48ALuMJ3m.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	H1sut2Xo3r.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
us2.smtp.mailhostbox.com	SecuriteInfo.com.Win32.PWSX-gen.21042.22708.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.12946.7200.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	001 Tech. Spec pdf.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	payment order.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.91.198.143
	Quotation No.06262024.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	I0Hw9G8QDJ.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	Urgent PO.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.91.199.224
	z1PURCHASEORDER736353.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.91.199.224
	PO#0094321.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	Mt103.exe	Get hash	malicious	AgentTesla	Browse	208.91.198.143

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TUT-ASUS	H50bdqfVH2.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	kZa81nzREg.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	bv8iPF7cTY.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	jsLnybSs43.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	tgBNtoWqIp.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	fiDe44VTwh.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	9691e6dc404680cc6648726c8d124a6d4fc637bb6b4a092661308012438623b2_dump.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	BomqT2a55e.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
	E48ALuMJ3m.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.95.112.1
	H1sut2Xo3r.exe	Get hash	malicious	AgentTesla	Browse	208.95.112.1
PUBLIC-DOMAIN-REGISTRYUS	SecuriteInfo.com.Win32.PWSX-gen.21042.22708.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.12946.7200.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.223
	https://wazzootech.co/cgi-ssl/	Get hash	malicious	Unknown	Browse	162.251.85.203
	cp3pOZHLxp.exe	Get hash	malicious	AgentTesla	Browse	216.10.246.185
	NsqPGxz4Gj.exe	Get hash	malicious	AgentTesla	Browse	216.10.246.185
	001 Tech. Spec pdf.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	payment order.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	208.91.198.143
	Quotation No.06262024.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.224
	I0Hw9G8QDJ.exe	Get hash	malicious	AgentTesla	Browse	208.91.199.225
	DRKi1Olgjp.elf	Get hash	malicious	Mirai, Moobot	Browse	103.50.160.26

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe	jsLnybSs43.exe	Get hash	malicious	AgentTesla	Browse
	19808bS58f.exe	Get hash	malicious	AgentTesla	Browse
	fiDe44VTwh.exe	Get hash	malicious	AgentTesla	Browse
	TRANEXAMIC ACID & CAMPHANEDIOL SPECIFICATIONS.exe	Get hash	malicious	AgentTesla	Browse
	DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe	Get hash	malicious	AgentTesla	Browse
	llD1w4ROY5.exe	Get hash	malicious	AgentTesla	Browse
	DHL AWB COMMERCAIL INVOICE AND TRACKNG DETAILS.exe	Get hash	malicious	AgentTesla	Browse
	8f5WsFcnTc.exe	Get hash	malicious	AgentTesla	Browse
	v31TgVEtHi.exe	Get hash	malicious	AgentTesla	Browse
	54dse57Lv7.exe	Get hash	malicious	AgentTesla	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ZUHFqcY.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	142
Entropy (8bit):	5.090621108356562
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUC7WglAFXMWA2yTMGfsbNRLFS9Am12MFuAvOAsDeieVyn:Q3La/xwczlAFXMWTyAGCDLIP12MUAvvw
MD5:	8C0458BB9EA02D50565175E38D577E35
SHA1:	F0B50702CD6470F3C17D637908F83212FDBDB2F2
SHA-256:	C578E86DB701B9AFA3626E804CF434F9D32272FF59FB32FA9A51835E5A148B53
SHA-512:	804A47494D9A462FFA6F39759480700ECBE5A7F3A15EC3A6330176ED9C04695D2684BF6BF85AB86286D52E7B727436D0BB2E8DA96E20D47740B5CE3F856B5D0F
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Temp\Marquand

Download File

Process:	C:\Users\user\Desktop\6bdudXAsQW.exe
File Type:	data
Category:	dropped
Size (bytes):	244224
Entropy (8bit):	6.790633778448519
Encrypted:	false
SSDEEP:	6144:6zUmDbBTb++xdhpTygqXoq39Jqe5gaZOcvuTtK9o:6zUmDbBT5HhpLEo29JPucfe
MD5:	5B5B77E8AA7729038E840792F3FA8D28
SHA1:	EC67359842F2FE9ECCBB4EF369A02E7634A047F2
SHA-256:	982B78D85B9449B33797AE19A024D061CA8AED0106A4AAC10DCE6287270DCC1B
SHA-512:	07BB883548A4D9A6226FECA53CC75664E87086F80E4BAADF6232B7D71321BFC07A00CBD1052FCE478D117CCC65AA197086EA806B2BF2CE80EAEF21A5230645AC
Malicious:	false
Reputation:	low
Preview:	y..M5R1MJ58I..XK.TKRP6J1.3UPQN4L3M6R1MN58ITBXKLTKRP6J1C3UPQN.L3M8M.CN.1.u.Y..u.:9EjA1\2"0#./R#X=Em,P.;!,x""t....'^'V{]\D.L3M6R1M.p8I.C[K#~.7P6J1C3UP.N6M8L=R1.M58ATBXKLT5.S6J.C3U.RN4LsM6r1MN78IPBXKLTKRT6J1C3UPQn0L3O6R1MN5:I..XK\TKBP6J1S3U@QN4L3M&R1MN58ITBXK\|.HR.6J1C.VP.K4L3M6R1MN58ITBXKLTKRT6F1C3UPQN4L3M6R1MN58ITBXKLTKRP6J1C3UPQN4L3M6R1MN58ITBXkLTCRP6J1C3UPQN<l3M~R1MN58ITBXKb .$6J1.VPQn4L3.5R1ON58ITBXKLTKRP6j1CS{""<WL3MpW1MN.;ITDXKL.HRP6J1C3UPQN4LsM6..?+YWTBTKLTKRT6J3C3U.RN4L3M6R1MN58I.BX.LTKRP6J1C3UPQN4LS.5R1MN5pITBZKIT..R6..B3VPQN5L3K6R1MN58ITBXKLTKRP6J1C3UPQN4L3M6R1MN58ITBXKLTKRP6W.....p\|1.GTU.k.R.J..K..-.._w_.8'...9.....8H.qI.Mh..B...D.;P)P......2:<@]k>{M9.Q.....kE.x.V?.N..H`.#H..`...mo....9>o...$..W#^cW"A!+.k(2#".V.SP6J1.......Z5}..NA+.[,.....@(`..+PQNPL3MDR1M/58I.BXK#TKR>6J1=3UP/N4LuM6RqMN5.ITB}KLT&RP6n1C3+PQN.1<B...$=..ITBXKy..b.[..l.g..zB.H.Su...-....I..]8.=r.t.._..'..!.ZKm{`NUD\NNSOQ\.Dz..qSJ0I1J2Q=p@~..c.m.r..;.....24L3M6R.MN.8IT..K.TKR.6.1.UPQ..L.M.R...5

C:\Users\user\AppData\Local\Temp\autD26F.tmp

Download File

Process:	C:\Users\user\Desktop\6bdudXAsQW.exe
File Type:	data
Category:	dropped
Size (bytes):	160268
Entropy (8bit):	7.921014386840454
Encrypted:	false
SSDEEP:	3072:We3Ewgxv2RKLF9Cl2FTigaMcbbwqrx6xZkl/wWBJsvV9AqrTLBhbP:WeIvku+2ZivpEqV6xZkdwWENOqrTjbP
MD5:	5BC1EBE1EF65F3E0CE523ADC7A6DC42D
SHA1:	E4C6239641BC53B74B0690FA77D9FCE8D6CB7242
SHA-256:	8E59F68A5512B25E209CF81EF0DF9F662732E4A1352FC8E22AA998C69A1A45D3
SHA-512:	6053F8F7C9C670C3AE6AEF73C25A5AF0A447270611DA8287A0DFDFB8ABD00E712FB33ECB5BB30B07310208ABCE0BAEE2D1BD4D3F7778581A4A508A94CAC150EA
Malicious:	false
Reputation:	low
Preview:	EA06......t.JcM.Mg..^..K.U)u..1.....:iL..f...8.x.P...`..h`....x.Sqt:v.c....0\|..?:..mT..re".H.....=..e....C,.H.WH\|v.....k.v.D..-f=p.Rc.:..G~.......M...d..1..f.....&......6. .b.M.\.%...P...P.[V.2gO.......)u.......uZ...$..].f..(....T"......6..xd.;.....t...{..d.~.<.A..I...>v..h.....b.....4:..E".U....\.....5J ....<\|.!.J??..j...........K\|.J.b..i...`?.:kp.x+T.MS_.M..z...X.Mi.:X....=..w...z#7....G.U}..EKsJ..)~..K..........B'8......N)..'.M.z.Z.._C..Q0S.......3..t.u<.Wms..6s.........E..<.i.....y)......>..5.......7..I7.....c..2.\n.(.H.R/.[cS..t\<.......S[."9N...dS....o..E.....`.E@.H..i..."&..H.4....=..%........x.......I.<.p.p.x..3.....Os\p....X.U..K.l........Bjw\.;.-.Bqq.L..].~'.(}.Y...8.{..C..R..:.D.S..:}F...^.....J.Rf4..F{p._.....Wm...]L^.w..u`.$.....m;j..p.......r.<=..!...6t.MKc..Mm.y..i..H$.).Ns^..f...j....h..H..(u.E".C...5...Q.O......1..$..MR.'.S..d.mJ...UZ..gh.L.1...g?..(r.-b.H.X.5...gA.....t..{....]:k<...9...x.M)4...T..#...6x..S.z...N..o...

C:\Users\user\AppData\Local\Temp\autD2BE.tmp

Download File

Process:	C:\Users\user\Desktop\6bdudXAsQW.exe
File Type:	data
Category:	dropped
Size (bytes):	9894
Entropy (8bit):	7.638743294651134
Encrypted:	false
SSDEEP:	192:R40AKn3FpocSf+2xX1KJtUZh6rqsB7oPUbHIg5xzzKQMOlKtm8gM7Y:R2ArOf+2zgUZu7omHvx/KQGmu8
MD5:	F2BD00171AB890509DAE6EF967712F8F
SHA1:	243718374ABB7F2CE5CEFE033680C2224E7572D2
SHA-256:	F91FE1545A3B2A8A73F89D8F471F43AB0F566EDC9E64F362A282996FA4BBCE5F
SHA-512:	BD74435B8A06B774576301F5CB0BA175EC6A10F0577EF13D2CF6654AF7640A4529E07EB799C7187C5581FCF1CBB81FC1FFD9C14E5EFB1062608632A19ED53779
Malicious:	false
Reputation:	low
Preview:	EA06..p..^.sy...e.L.v[..]4.L..)..g9.N..@..]2.N&...m6.N.p......k4....A:.6,.........,sK(...g.N.3P.oM.V....k.+4.i`.....3............6.P.o.t.....s.....VP...S.k4.md... ....@#....@.....e:........X..4.1..........$.p...0z.3..$}39.....=7..`d....!d..V9..7fs{...:...\|.)..W.b...\|v)..W.b...\|v+..W.b...\|v+8.W.c...\|v9..W,`O...k.@..X...7...^.:...F.4.z..G......d.....SI..G../Z...zmf...l.;........\|......5...}3[8........;^....=..t.........3..o....,.......x.....H<.lY@:...b..........4...fS{...K......`..i\|v.F......X,.....d..........3..f.._..p....A.>K.....ir.g..f.{$..f..fS.......y...S >..t...........w7..&.k0!..Y....d...j]6....i_.h,.......,.]:.,..3.)..6.L....... ....c....X...D.v..Y@!9/.X..c3Y...b.L........i...f....Y.SK$.e2..f.!...,v`......:.N,.... .....f ...J'3......~.!91.X...c6....c.K.....H.....f@...N...gd....6.-..p..S....4...S..N...;3.`..;.M. ..7(.....f`.....s9.......vh........E\|...M.y6....p.c3k5..2.W.!....F ...@B5e.Mf.......vj.....e.[..n...B30....;6.X.q4..3;..#3.....c.`....

C:\Users\user\AppData\Local\Temp\incalculable

Download File

Process:	C:\Users\user\Desktop\6bdudXAsQW.exe
File Type:	ASCII text, with very long lines (28674), with no line terminators
Category:	dropped
Size (bytes):	28674
Entropy (8bit):	4.068814985214508
Encrypted:	false
SSDEEP:	768:GSq7U/B1e2zFr5Ek6wOmno4gaUtl9Oe+AAWax4yflkecHFcPwEV9kQqR:2wO2Tr4aBWlGclc19kz
MD5:	CCC08177DDD7354D1FFCE7EFE15A3465
SHA1:	9DB76C476507ED27EDD50E3FF7A041EFC539CA61
SHA-256:	A64FDCA1B6AC15BD408F374E3B44BEC56F479B405B7DAF9955F252EE7CED5886
SHA-512:	74D059A1EC2AD757DB719B511B7FA2C351A74DB8A4DA77DCC69E415AE969669A8671BA7DB85F1FC2D431162E3A3B5BE108B1B6B866D9361A52BFF62B125A1182
Malicious:	false
Reputation:	low
Preview:	.z376dce63ceae.4.2.23839`:4d.2.2.2486;2766`;47.2.2.2486;2f68`c54.2.2.2486;376:`:4g.2.2.2486;276c`;47.2.2.2486;2f6e`c4e.2.2.2486;376g`:15.2.2.2486;2772`;14.2.2.2486;2f74`c0g.2.2.2486;3776`:46.2.2.2486;2778`;4e.2.2.2486;2f7:`c4e.2.2.2486;377c15a2486;277e`;4g.2.2.2486;6f26dhdhdh`c56.2.2.2486;7728dhdhdh`:46.2.2.2486;672:dhdhdh`;4e.2.2.2486;6f2cdhdhdh`c4e.2.2.2486;772edhdhdh`:0g.2.2.2486;672gdhdhdh`;46.2.2.2486;6f32dhdhdh`c4e.2.2.2486;7734dhdhdh`:4e.2.2.2486;6736dhdhdh15a;486;6f38dhdhdh`c57.2.2.2486;37b2`:55.2.2.2486;27b4`;47.2.2.2486;2fb6`c54.2.2.2486;37b8`:15.2.2.2486;27b:`;14.2.2.2486;2fbc`c0g.2.2.2486;37be`:46.2.2.2486;27bg`;4e.2.2.2486;2fc2`c4e.2.2.2486;37c415a2486;27c6`;43.2.2.2486;6f4:dhdhdh`c46.2.2.2486;774cdhdhdh`:58.2.2.2486;674edhdhdh`;43.2.2.2486;6f4gdhdhdh`c52.2.2.2486;7752dhdhdh`:4;.2.2.2486;6754dhdhdh`;15.2.2.2486;6f56dhdhdh`c14.2.2.2486;7758dhdhdh`:0g.2.2.2486;675:dhdhdh`;46.2.2.2486;6f5cdhdhdh`c4e.2.2.2486;775edhdhdh`:4e.2.2.2486;675gdhdhdh15a;486;2f62`c55.2.2.2486;37_2`:4:

C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45984
Entropy (8bit):	6.16795797263964
Encrypted:	false
SSDEEP:	768:4BbSoy+SdIBf0k2dsjYg6Iq8S1GYqWH8BR:noOIBf0ddsjY/ZGyc7
MD5:	9D352BC46709F0CB5EC974633A0C3C94
SHA1:	1969771B2F022F9A86D77AC4D4D239BECDF08D07
SHA-256:	2C1EEB7097023C784C2BD040A2005A5070ED6F3A4ABF13929377A9E39FAB1390
SHA-512:	13C714244EC56BEEB202279E4109D59C2A43C3CF29F90A374A751C04FD472B45228CA5A0178F41109ED863DBD34E0879E4A21F5E38AE3D89559C57E6BE990A9B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: jsLnybSs43.exe, Detection: malicious, Browse Filename: 19808bS58f.exe, Detection: malicious, Browse Filename: fiDe44VTwh.exe, Detection: malicious, Browse Filename: TRANEXAMIC ACID & CAMPHANEDIOL SPECIFICATIONS.exe, Detection: malicious, Browse Filename: DHL AWB COMMERCAIL INVOICE AND TRACKING DETAILS.exe, Detection: malicious, Browse Filename: llD1w4ROY5.exe, Detection: malicious, Browse Filename: DHL AWB COMMERCAIL INVOICE AND TRACKNG DETAILS.exe, Detection: malicious, Browse Filename: 8f5WsFcnTc.exe, Detection: malicious, Browse Filename: v31TgVEtHi.exe, Detection: malicious, Browse Filename: 54dse57Lv7.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....<.]..............0..d..........V.... ........@.. ..............................s.....`.....................................O.......8............r...A.......................................................... ............... ..H............text...\c... ...d.................. ..`.rsrc...8............f..............@..@.reloc...............p..............@..B................8.......H........+...S..........\|...P...........................................r...p(....2.(....(....z..r...p(....(....(......}......{.....s..........0..{...........Q.-.s.....+i~....o....(.....s.......o.....r!..p..(....Q.P,:.P.....(....o....o ........(....o!...o".....,..o#...t........0..(....... ....s$........o%....X..(....-...o&....0...........('......&.........................0...........(.......&.....*.................0............(.....(....~....,.(....~....o....9]...

\Device\ConDrv

Download File

Process:	C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	4.442398121585593
Encrypted:	false
SSDEEP:	24:zKLXkhDObntKlglUEnfQtvNuNpKOK5aM9YJC:zKL0hDQntKKH1MqJC
MD5:	6FB4D27A716A8851BC0505666E7C7A10
SHA1:	AD2A232C6E709223532C4D1AB892303273D8C814
SHA-256:	1DC36F296CE49BDF1D560B527DB06E1E9791C10263459A67EACE706C6DDCDEAE
SHA-512:	3192095C68C6B7AD94212B7BCA0563F2058BCE00C0C439B90F0E96EA2F029A37C2F2B69487591B494C1BA54697FE891E214582E392127CB8C90AB682E0D81ADB
Malicious:	false
Preview:	Microsoft (R) .NET Framework Services Installation Utility Version 4.8.4084.0..Copyright (C) Microsoft Corporation. All rights reserved.....USAGE: regsvcs.exe [options] AssemblyName..Options:.. /? or /help Display this usage message... /fc Find or create target application (default)... /c Create target application, error if it already exists... /exapp Expect an existing application... /tlb:<tlbfile> Filename for the exported type library... /appname:<name> Use the specified name for the target application... /parname:<name> Use the specified name or id for the target partition... /extlb Use an existing type library... /reconfig Reconfigure existing target application (default)... /noreconfig Don't reconfigure existing target application... /u Uninstall target application... /nologo Suppress logo output... /quiet Suppress logo output and success output... /c

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.068570361935756
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	6bdudXAsQW.exe
File size:	1'128'960 bytes
MD5:	f3c77e436ab94a56d3e99fabb83a68d7
SHA1:	4a0a02c3f34f176a8defb6503f30674a17919f4f
SHA256:	a591da122e31234bad81a8125c761b07e01dbbec7ef1b254a30097b019a22c48
SHA512:	a0aaf17e0b86892d1d59c9edad0f29bc3a374c2a47c38213601e390419ade7c30a251ee9fa0d7a039b06340ed6033ff154bb95b467e3a777e7f4dd9aa431f680
SSDEEP:	24576:emAHnh+eWsN3skA4RV1Hom2KXMmHa58+HKDs6965BHfzi5:eBh+ZkldoPK8Ya5lHxv5BHfU
TLSH:	3B35AD0273D2C032FFAB92739B6AF64156BD79254123852F13982D79BD701B2273E663
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x42800a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x667C647B [Wed Jun 26 18:56:59 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007FE8E8B5105Dh
jmp 00007FE8E8B43E14h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FE8E8B43F9Ah
cmp edi, eax
jc 00007FE8E8B442FEh
bt dword ptr [004C41FCh], 01h
jnc 00007FE8E8B43F99h
rep movsb
jmp 00007FE8E8B442ACh
cmp ecx, 00000080h
jc 00007FE8E8B44164h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FE8E8B43FA0h
bt dword ptr [004BF324h], 01h
jc 00007FE8E8B44470h
bt dword ptr [004C41FCh], 00000000h
jnc 00007FE8E8B4413Dh
test edi, 00000003h
jne 00007FE8E8B4414Eh
test esi, 00000003h
jne 00007FE8E8B4412Dh
bt edi, 02h
jnc 00007FE8E8B43F9Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FE8E8B43FA3h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FE8E8B43FF5h
bt esi, 03h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD5 build 40629
[RES] VS2013 build 21005
[LNK] VS2013 UPD5 build 40629

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbc0cc	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x4924c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x112000	0x7134	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4b50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dfdd	0x8e000	310e36668512d53489c005622bb1b4a9	False	0.5735602580325704	data	6.675248351711057	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2fd8e	0x2fe00	748cf1ab2605ce1fd72d53d912abb68f	False	0.32828818537859006	data	5.763244005758284	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbf000	0x8f74	0x5200	aae9601d920f07080bdfadf43dfeff12	False	0.1017530487804878	data	1.1963819235530628	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc8000	0x4924c	0x49400	21d392c5b98a60262d65c70c86f746bc	False	0.9094929874146758	data	7.853298220459549	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x112000	0x7134	0x7200	f04128ad0f87f42830e4a6cdbc38c719	False	0.7617530153508771	data	6.783955557128661	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc85a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc86d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc87f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc8920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc8c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc8d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc9bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xca480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xca9e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xccf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xce038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xce4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xce4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcea84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcf110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcf5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcfb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xd01f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xd0660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xd07b8	0x404e4	data			1.0003454874029978
RT_GROUP_ICON	0x110c9c	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x110d14	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x110d28	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x110d3c	0x14	data	English	Great Britain	1.25
RT_VERSION	0x110d50	0x10c	data	English	Great Britain	0.5932835820895522
RT_MANIFEST	0x110e5c	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 16:34:05.160372972 CEST	49706	80	192.168.2.9	208.95.112.1
Jul 3, 2024 16:34:05.165271997 CEST	80	49706	208.95.112.1	192.168.2.9
Jul 3, 2024 16:34:05.165344954 CEST	49706	80	192.168.2.9	208.95.112.1
Jul 3, 2024 16:34:05.168628931 CEST	49706	80	192.168.2.9	208.95.112.1
Jul 3, 2024 16:34:05.173505068 CEST	80	49706	208.95.112.1	192.168.2.9
Jul 3, 2024 16:34:05.651326895 CEST	80	49706	208.95.112.1	192.168.2.9
Jul 3, 2024 16:34:05.692646980 CEST	49706	80	192.168.2.9	208.95.112.1
Jul 3, 2024 16:34:06.210228920 CEST	49707	587	192.168.2.9	208.91.199.225
Jul 3, 2024 16:34:06.215038061 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:06.215116024 CEST	49707	587	192.168.2.9	208.91.199.225
Jul 3, 2024 16:34:06.878290892 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:06.879282951 CEST	49707	587	192.168.2.9	208.91.199.225
Jul 3, 2024 16:34:06.884200096 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:07.035276890 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:07.035520077 CEST	49707	587	192.168.2.9	208.91.199.225
Jul 3, 2024 16:34:07.041723013 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:07.190737963 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:07.198834896 CEST	49707	587	192.168.2.9	208.91.199.225
Jul 3, 2024 16:34:07.205341101 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:07.360516071 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:07.360567093 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:07.360577106 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:07.360589027 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:07.360599995 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:07.360665083 CEST	49707	587	192.168.2.9	208.91.199.225
Jul 3, 2024 16:34:07.679168940 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:07.679547071 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:07.679601908 CEST	49707	587	192.168.2.9	208.91.199.225
Jul 3, 2024 16:34:07.711977005 CEST	49707	587	192.168.2.9	208.91.199.225
Jul 3, 2024 16:34:07.718475103 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:07.870012045 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:07.884326935 CEST	49707	587	192.168.2.9	208.91.199.225
Jul 3, 2024 16:34:07.889205933 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:08.038928986 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:08.039863110 CEST	49707	587	192.168.2.9	208.91.199.225
Jul 3, 2024 16:34:08.044734001 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:08.197690010 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:08.198165894 CEST	49707	587	192.168.2.9	208.91.199.225
Jul 3, 2024 16:34:08.203994036 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:08.360192060 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:08.360522032 CEST	49707	587	192.168.2.9	208.91.199.225
Jul 3, 2024 16:34:08.365386009 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:08.518616915 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:08.519114971 CEST	49707	587	192.168.2.9	208.91.199.225
Jul 3, 2024 16:34:08.524008989 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:08.751028061 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:08.751231909 CEST	49707	587	192.168.2.9	208.91.199.225
Jul 3, 2024 16:34:08.756438017 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:08.908015013 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:08.908607960 CEST	49707	587	192.168.2.9	208.91.199.225
Jul 3, 2024 16:34:08.908679962 CEST	49707	587	192.168.2.9	208.91.199.225
Jul 3, 2024 16:34:08.908705950 CEST	49707	587	192.168.2.9	208.91.199.225
Jul 3, 2024 16:34:08.908730984 CEST	49707	587	192.168.2.9	208.91.199.225
Jul 3, 2024 16:34:08.913559914 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:08.913572073 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:08.913791895 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:08.913801908 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:09.304805994 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:34:09.348880053 CEST	49707	587	192.168.2.9	208.91.199.225
Jul 3, 2024 16:34:36.204196930 CEST	80	49706	208.95.112.1	192.168.2.9
Jul 3, 2024 16:34:36.204287052 CEST	49706	80	192.168.2.9	208.95.112.1
Jul 3, 2024 16:34:56.208698034 CEST	49706	80	192.168.2.9	208.95.112.1
Jul 3, 2024 16:34:56.214143038 CEST	80	49706	208.95.112.1	192.168.2.9
Jul 3, 2024 16:35:46.224894047 CEST	49707	587	192.168.2.9	208.91.199.225
Jul 3, 2024 16:35:46.229837894 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:35:46.380990982 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:35:46.381108046 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:35:46.381119013 CEST	587	49707	208.91.199.225	192.168.2.9
Jul 3, 2024 16:35:46.381270885 CEST	49707	587	192.168.2.9	208.91.199.225
Jul 3, 2024 16:35:46.381270885 CEST	49707	587	192.168.2.9	208.91.199.225
Jul 3, 2024 16:35:46.409662008 CEST	49707	587	192.168.2.9	208.91.199.225

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2024 16:34:05.146951914 CEST	60766	53	192.168.2.9	1.1.1.1
Jul 3, 2024 16:34:05.155107975 CEST	53	60766	1.1.1.1	192.168.2.9
Jul 3, 2024 16:34:06.201536894 CEST	55608	53	192.168.2.9	1.1.1.1
Jul 3, 2024 16:34:06.209564924 CEST	53	55608	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jul 3, 2024 16:34:05.146951914 CEST	192.168.2.9	1.1.1.1	0xe7c4	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:34:06.201536894 CEST	192.168.2.9	1.1.1.1	0xd53b	Standard query (0)	us2.smtp.mailhostbox.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jul 3, 2024 16:34:05.155107975 CEST	1.1.1.1	192.168.2.9	0xe7c4	No error (0)	ip-api.com	208.95.112.1	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:34:06.209564924 CEST	1.1.1.1	192.168.2.9	0xd53b	No error (0)	us2.smtp.mailhostbox.com	208.91.199.225	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:34:06.209564924 CEST	1.1.1.1	192.168.2.9	0xd53b	No error (0)	us2.smtp.mailhostbox.com	208.91.199.223	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:34:06.209564924 CEST	1.1.1.1	192.168.2.9	0xd53b	No error (0)	us2.smtp.mailhostbox.com	208.91.198.143	A (IP address)	IN (0x0001)	false
Jul 3, 2024 16:34:06.209564924 CEST	1.1.1.1	192.168.2.9	0xd53b	No error (0)	us2.smtp.mailhostbox.com	208.91.199.224	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

ip-api.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	49706	208.95.112.1	80	7776	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jul 3, 2024 16:34:05.168628931 CEST	80	OUT	GET /line/?fields=hosting HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Jul 3, 2024 16:34:05.651326895 CEST	175	IN	HTTP/1.1 200 OK Date: Wed, 03 Jul 2024 14:34:04 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 6 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 66 61 6c 73 65 0a Data Ascii: false

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Jul 3, 2024 16:34:06.878290892 CEST	587	49707	208.91.199.225	192.168.2.9	220 us2.outbound.mailhostbox.com ESMTP Postfix
Jul 3, 2024 16:34:06.879282951 CEST	49707	587	192.168.2.9	208.91.199.225	EHLO 927537
Jul 3, 2024 16:34:07.035276890 CEST	587	49707	208.91.199.225	192.168.2.9	250-us2.outbound.mailhostbox.com 250-PIPELINING 250-SIZE 41648128 250-VRFY 250-ETRN 250-STARTTLS 250-AUTH PLAIN LOGIN 250-AUTH=PLAIN LOGIN 250-ENHANCEDSTATUSCODES 250-8BITMIME 250-DSN 250 CHUNKING
Jul 3, 2024 16:34:07.035520077 CEST	49707	587	192.168.2.9	208.91.199.225	STARTTLS
Jul 3, 2024 16:34:07.190737963 CEST	587	49707	208.91.199.225	192.168.2.9	220 2.0.0 Ready to start TLS

Target ID:	0
Start time:	10:34:01
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\6bdudXAsQW.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\6bdudXAsQW.exe"
Imagebase:	0x760000
File size:	1'128'960 bytes
MD5 hash:	F3C77E436AB94A56D3E99FABB83A68D7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.1355424313.0000000003500000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: 00000000.00000002.1355424313.0000000003500000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.1355424313.0000000003500000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID, Description: Detects executables referencing Windows vault credential objects. Observed in infostealers, Source: 00000000.00000002.1355424313.0000000003500000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:34:02
Start date:	03/07/2024
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\6bdudXAsQW.exe"
Imagebase:	0x70000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2583320483.0000000002477000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2583320483.000000000249C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2583320483.0000000002451000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2583320483.0000000002451000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2582286553.0000000000142000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000002.00000002.2582286553.0000000000142000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	10:34:14
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe"
Imagebase:	0xe60000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:34:15
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:34:23
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe"
Imagebase:	0x790000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:34:23
Start date:	03/07/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	18.9%
Signature Coverage:	5.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	168

Executed Functions

Function 00763B4C Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00763B7A
IsDebuggerPresent.KERNEL32 ref: 00763B8C
GetFullPathNameW.KERNEL32(00007FFF,?,?, ,008262E0,?,?), ref: 00763BFD

Part of subcall function 00767D2C: _memmove.LIBCMT ref: 00767D66

Part of subcall function 00770A8D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00763C26, ,?,?,?), ref: 00770ACE

SetCurrentDirectoryW.KERNEL32(?), ref: 00763C81
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,008193F0,00000010), ref: 0079D4BC
SetCurrentDirectoryW.KERNEL32(?, ,?,?,?), ref: 0079D4F4
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00815D40, ,?,?,?), ref: 0079D57A
ShellExecuteW.SHELL32(00000000,?,?), ref: 0079D581

Part of subcall function 00763A58: GetSysColorBrush.USER32(0000000F), ref: 00763A62
Part of subcall function 00763A58: LoadCursorW.USER32(00000000,00007F00), ref: 00763A71
Part of subcall function 00763A58: LoadIconW.USER32(00000063), ref: 00763A88
Part of subcall function 00763A58: LoadIconW.USER32(000000A4), ref: 00763A9A
Part of subcall function 00763A58: LoadIconW.USER32(000000A2), ref: 00763AAC
Part of subcall function 00763A58: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00763AD2
Part of subcall function 00763A58: RegisterClassExW.USER32(?), ref: 00763B28

Part of subcall function 007639E7: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00763A15
Part of subcall function 007639E7: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00763A36
Part of subcall function 007639E7: ShowWindow.USER32(00000000,?,?), ref: 00763A4A
Part of subcall function 007639E7: ShowWindow.USER32(00000000,?,?), ref: 00763A53

Part of subcall function 007643DB: _memset.LIBCMT ref: 00764401
Part of subcall function 007643DB: Shell_NotifyIconW.SHELL32(00000000,?), ref: 007644A6

Strings

This is a third-party compiled AutoIt script., xrefs: 0079D4B4
runas, xrefs: 0079D575
, xrefs: 00763BC1, 00763C1C, 0079D545

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: $This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-2221924448
Opcode ID: 0c9e7c8869760f45a925b19afe125904b250b42e9e7f14f20e99736dfa312db7
Instruction ID: 3c825f5b9305b89fec484463c89433f8faba36ca862c6810628c9ca75accefb8
Opcode Fuzzy Hash: 0c9e7c8869760f45a925b19afe125904b250b42e9e7f14f20e99736dfa312db7
Instruction Fuzzy Hash: 4651DA30D04288EBCF219BB4EC59DED7B79FF44344B008165FC56A62A1DA7C5A56CB21

Function 00764FE9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00764EEE,?,?,00000000,00000000), ref: 00764FF9
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00764EEE,?,?,00000000,00000000), ref: 00765010
LoadResource.KERNEL32(?,00000000,?,?,00764EEE,?,?,00000000,00000000,?,?,?,?,?,?,00764F8F), ref: 0079DD60
SizeofResource.KERNEL32(?,00000000,?,?,00764EEE,?,?,00000000,00000000,?,?,?,?,?,?,00764F8F), ref: 0079DD75
LockResource.KERNEL32(Nv,?,?,00764EEE,?,?,00000000,00000000,?,?,?,?,?,?,00764F8F,00000000), ref: 0079DD88

Strings

SCRIPT, xrefs: 00765006
Nv, xrefs: 0079DD85

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT$Nv
API String ID: 3051347437-1531215381
Opcode ID: 0390bcbb7ea52db151f38933a9d35d8568aadcfcdc77c3d0226a3c851454e4d6
Instruction ID: 7336575ec950aac273238ad531d368b04287ab9a7946b58af7ed31897569913b
Opcode Fuzzy Hash: 0390bcbb7ea52db151f38933a9d35d8568aadcfcdc77c3d0226a3c851454e4d6
Instruction Fuzzy Hash: B4115A75201741AFD7218B65DC98F6B7BBDEBC9B11F208168F906CA660DB65EC009660

Function 00764AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00764B2B

Part of subcall function 00767D2C: _memmove.LIBCMT ref: 00767D66

GetCurrentProcess.KERNEL32(?,007EFAEC,00000000,00000000,?), ref: 00764BF8
IsWow64Process.KERNEL32(00000000), ref: 00764BFF
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00764C45
FreeLibrary.KERNEL32(00000000), ref: 00764C50
GetSystemInfo.KERNEL32(00000000), ref: 00764C81
GetSystemInfo.KERNEL32(00000000), ref: 00764C8D

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: a9c10b94da592ff49a64b69ac22b785ede55e8fca752453346fb25d8130403da
Instruction ID: 444bcc6e7cd6b4789fcc23817210970fd6ab538db2101cf80f33e38a90d2324a
Opcode Fuzzy Hash: a9c10b94da592ff49a64b69ac22b785ede55e8fca752453346fb25d8130403da
Instruction Fuzzy Hash: 4A91D67154A7C4DECB31CB7895511AABFE5AF2A300B484E9DD4CB97B01D238E948C729

Function 007C4696 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,0079E7C1), ref: 007C46A6
FindFirstFileW.KERNELBASE(?,?), ref: 007C46B7
FindClose.KERNEL32(00000000), ref: 007C46C7

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 118d08b2131a67c7b10a387f9147c799f92e1c624811f281097381b15b624155
Instruction ID: 88b2043ed1aa960dd2133122c2252eaef1311ee3a90ae33d9b39684be3d5a301
Opcode Fuzzy Hash: 118d08b2131a67c7b10a387f9147c799f92e1c624811f281097381b15b624155
Instruction Fuzzy Hash: 81E020318115005B46106738EC9DCEE775CDE0A335F10471DF935D14E0E7B85D6085DD

Function 0076E800 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 007A428C

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: b68f20b2a158501c51422a280c1a73aef73e2d8e8ed8120b6966f430f8b1c8c3
Instruction ID: 34b76065b1946efb837702e94f69152c12f4a841d9b69504f75868f0669a5468
Opcode Fuzzy Hash: b68f20b2a158501c51422a280c1a73aef73e2d8e8ed8120b6966f430f8b1c8c3
Instruction Fuzzy Hash: F7A27D78A04205DFCB24CF58C484AAEB7B1FF59310F248169ED16AB351D779AD82CBA1

Function 00770B30 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00770BBB
timeGetTime.WINMM ref: 00770E76
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00770FB3
TranslateMessage.USER32(?), ref: 00770FC7
DispatchMessageW.USER32(?), ref: 00770FD5
Sleep.KERNEL32(0000000A), ref: 00770FDF
LockWindowUpdate.USER32(00000000,?,?), ref: 0077105A
DestroyWindow.USER32 ref: 00771066
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00771080
Sleep.KERNEL32(0000000A,?,?), ref: 007A52AD
TranslateMessage.USER32(?), ref: 007A608A
DispatchMessageW.USER32(?), ref: 007A6098
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 007A60AC

Strings

@TRAY_ID, xrefs: 007A5BB9
@GUI_CTRLID, xrefs: 007A5364
@GUI_WINHANDLE, xrefs: 007A53B9
@GUI_CTRLHANDLE, xrefs: 007A540E
@COM_EVENTOBJ, xrefs: 007A591A

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Message$DispatchPeekSleepTranslateWindow$DestroyLockTimeUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4003667617-3242690629
Opcode ID: 5ade8a3c37711b192ad241e4c1b3055c6382b1c47f3ba336264e988c74431a60
Instruction ID: cf772915f8a1c3fe79f65c39e8a6cbdee999b9636791f836b4bb566ba0492454
Opcode Fuzzy Hash: 5ade8a3c37711b192ad241e4c1b3055c6382b1c47f3ba336264e988c74431a60
Instruction Fuzzy Hash: 8DB2D370608741DFDB24DF24C888BAAB7E5FF85304F148A1DF58A97291DB79E845CB82

Function 007C93DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007C91E9: __time64.LIBCMT ref: 007C91F3

Part of subcall function 00765045: _fseek.LIBCMT ref: 0076505D

__wsplitpath.LIBCMT ref: 007C94BE

Part of subcall function 0078432E: __wsplitpath_helper.LIBCMT ref: 0078436E

_wcscpy.LIBCMT ref: 007C94D1
_wcscat.LIBCMT ref: 007C94E4
__wsplitpath.LIBCMT ref: 007C9509
_wcscat.LIBCMT ref: 007C951F
_wcscat.LIBCMT ref: 007C9532

Part of subcall function 007C922F: _memmove.LIBCMT ref: 007C9268
Part of subcall function 007C922F: _memmove.LIBCMT ref: 007C9277

_wcscmp.LIBCMT ref: 007C9479

Part of subcall function 007C99BE: _wcscmp.LIBCMT ref: 007C9AAE
Part of subcall function 007C99BE: _wcscmp.LIBCMT ref: 007C9AC1

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 007C96DC
_wcsncpy.LIBCMT ref: 007C974F
DeleteFileW.KERNEL32(?,?), ref: 007C9785
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 007C979B
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 007C97AC
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 007C97BE

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 43ea6b1f35bb9ead38c4aa29cae895e2167e1fceaf6ef3323cbe9d00eb23ae4c
Instruction ID: 4a93399da9fc407059458d49ba61a7acc865e6a9fea171aa7ee594648dbe82b3
Opcode Fuzzy Hash: 43ea6b1f35bb9ead38c4aa29cae895e2167e1fceaf6ef3323cbe9d00eb23ae4c
Instruction Fuzzy Hash: ABC13DB1D00219ABCF61DFA5CC89EDEB7BDEF44310F0040AAF609E6151DB789A448F65

Function 007671EB Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00764864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF, ,?,007637C0,?), ref: 00764882

Part of subcall function 0078074F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,007672C5), ref: 00780771

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00767308
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0079ECF1
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0079ED32
RegCloseKey.ADVAPI32(?), ref: 0079ED70
_wcscat.LIBCMT ref: 0079EDC9

Strings

W, xrefs: 0076723B
\, xrefs: 0079EDEC
Include, xrefs: 0079ECE8, 0079ED29
\Include\, xrefs: 007672C5
Software\AutoIt v3\AutoIt, xrefs: 007672FE

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\$W
API String ID: 2673923337-3394087753
Opcode ID: 743a2dfcf5a47547e99fdc94e1ae2320282ab5c89410f49fb4eb40a025f25dbc
Instruction ID: 34be8824785442031e6401b09eb19e9a4f2d0069b784870405d626b91411e2d0
Opcode Fuzzy Hash: 743a2dfcf5a47547e99fdc94e1ae2320282ab5c89410f49fb4eb40a025f25dbc
Instruction Fuzzy Hash: 68719071509301DEC724EF66EC8589BBBE8FF58740F40852EF946C72A1EB34994ACB61

Function 00763015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 75
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00763074
RegisterClassExW.USER32(00000030), ref: 0076309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 007630AF
InitCommonControlsEx.COMCTL32(?), ref: 007630CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 007630DC
LoadIconW.USER32(000000A9), ref: 007630F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00763101

Strings

TaskbarCreated, xrefs: 007630A4
+, xrefs: 0076305D
0, xrefs: 00763056
AutoIt v3 GUI, xrefs: 00763090

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: a52f7b9151aecb73bd487d851e4b70fd2cd78a566d0a6e4cc5c3dd3dec707e95
Instruction ID: e402ad9e39557e85936c446602e3bfe2579a8ac365654bd91f2649cadf5ac20f
Opcode Fuzzy Hash: a52f7b9151aecb73bd487d851e4b70fd2cd78a566d0a6e4cc5c3dd3dec707e95
Instruction Fuzzy Hash: BB316DB1901345EFDB51CFA4DC88AD9BBF0FB09310F14812EE541EA290E3BA4552CF94

Function 00763041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00763074
RegisterClassExW.USER32(00000030), ref: 0076309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 007630AF
InitCommonControlsEx.COMCTL32(?), ref: 007630CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 007630DC
LoadIconW.USER32(000000A9), ref: 007630F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00763101

Strings

TaskbarCreated, xrefs: 007630A4
+, xrefs: 0076305D
0, xrefs: 00763056
AutoIt v3 GUI, xrefs: 00763090

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 8402639613631bada5e0be0aba445807023f66c34fdcff2f928af7787d901bfc
Instruction ID: 078cd88e9221c245d11b28470ddfec20994b7104e168a265b40e44ba7eb0ee8b
Opcode Fuzzy Hash: 8402639613631bada5e0be0aba445807023f66c34fdcff2f928af7787d901bfc
Instruction Fuzzy Hash: A221C7B1902258EFDB10DFA4EC89B9DBBF4FB0C710F00812AF911AA6A0E7B545558F95

Function 00763A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00763A62
LoadCursorW.USER32(00000000,00007F00), ref: 00763A71
LoadIconW.USER32(00000063), ref: 00763A88
LoadIconW.USER32(000000A4), ref: 00763A9A
LoadIconW.USER32(000000A2), ref: 00763AAC
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00763AD2
RegisterClassExW.USER32(?), ref: 00763B28

Part of subcall function 00763041: GetSysColorBrush.USER32(0000000F), ref: 00763074
Part of subcall function 00763041: RegisterClassExW.USER32(00000030), ref: 0076309E
Part of subcall function 00763041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 007630AF
Part of subcall function 00763041: InitCommonControlsEx.COMCTL32(?), ref: 007630CC
Part of subcall function 00763041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 007630DC
Part of subcall function 00763041: LoadIconW.USER32(000000A9), ref: 007630F2
Part of subcall function 00763041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00763101

Strings

AutoIt v3, xrefs: 00763B17
#, xrefs: 00763B0D
0, xrefs: 00763B06

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: b6be50a83b4fe2efada1819a7bbc24b767c983f6597abbae7236e77f157e615c
Instruction ID: be21053aa83b07a80e125f6e6e459773ef0fb7c8ca399fcfb81f5fcfb4cb0533
Opcode Fuzzy Hash: b6be50a83b4fe2efada1819a7bbc24b767c983f6597abbae7236e77f157e615c
Instruction Fuzzy Hash: F7212E71D01344FFEB219FA4EC49B9D7BB5FB08711F00812AF904A62A0E3B95665DF54

Function 00763778 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 007637C0
/AutoIt3OutputDebug, xrefs: 007638A4
CMDLINERAW, xrefs: 0076380D
/ErrorStdOut, xrefs: 0076388F
CMDLINE, xrefs: 00763834
/AutoIt3ExecuteScript, xrefs: 007638CE
/AutoIt3ExecuteLine, xrefs: 007638B9
, xrefs: 007637AF, 007637F6, 007638FF, 0079D42D, 0079D47F

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: $/AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-1897336602
Opcode ID: 40ab2dec38a933d555b916bab8c1fede1f65e31e88c7d3593e5293a147661fef
Instruction ID: 82189c63a24cf1f0052e45eb0fd4fc5a2ba62676719e2b673f4355a28a0490a9
Opcode Fuzzy Hash: 40ab2dec38a933d555b916bab8c1fede1f65e31e88c7d3593e5293a147661fef
Instruction Fuzzy Hash: 83A15C7181026DDACB14EBA0DC99EEEB778FF14300F14412AE817B7191EB796A09CB60

Function 00763633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 007636D2
KillTimer.USER32(?,00000001), ref: 007636FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0076371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0076372A
CreatePopupMenu.USER32 ref: 0076373E
PostQuitMessage.USER32(00000000), ref: 0076375F

Strings

TaskbarCreated, xrefs: 00763725

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 357d8a8cb171494ae92306f5f7753d516742ed84ebfae6abc88d318da4c2033d
Instruction ID: 1005fd921c0543b4d3a1e73de74330196af6b5deede191480bc2841f94755058
Opcode Fuzzy Hash: 357d8a8cb171494ae92306f5f7753d516742ed84ebfae6abc88d318da4c2033d
Instruction Fuzzy Hash: 214122B2201185EBDF205B68EC8DB793755FB04300F044129FE03DA2A2EA7CAE61D766

Function 0076F8CF Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007803A2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 007803D3
Part of subcall function 007803A2: MapVirtualKeyW.USER32(00000010,00000000), ref: 007803DB
Part of subcall function 007803A2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 007803E6
Part of subcall function 007803A2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 007803F1
Part of subcall function 007803A2: MapVirtualKeyW.USER32(00000011,00000000), ref: 007803F9
Part of subcall function 007803A2: MapVirtualKeyW.USER32(00000012,00000000), ref: 00780401

Part of subcall function 00776259: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,0076FA90), ref: 007762B4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0076FB2D
OleInitialize.OLE32(00000000), ref: 0076FBAA
CloseHandle.KERNEL32(00000000), ref: 007A49F2

Strings

8, xrefs: 0076F957
H@, xrefs: 0076F941
h, xrefs: 0076FA74
, xrefs: 0076FA5E

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: 8$H@$h$
API String ID: 1986988660-3130772577
Opcode ID: 2dd9680a26aa5fee6d4989692478b0777053601e176eca975a802016cb0e0f68
Instruction ID: e041d3efecbe86a7b6d370f2a295c4e0d406ee3ca858fe09c4e63e0256c47a16
Opcode Fuzzy Hash: 2dd9680a26aa5fee6d4989692478b0777053601e176eca975a802016cb0e0f68
Instruction Fuzzy Hash: 5E81F9B0901290CFC3A8EF69F9486147BE4FB98318750C27AD589C7362FB39556ACF58

Function 00752610 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 007526E1
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00752907

Memory Dump Source

Source File: 00000000.00000002.1354495733.0000000000750000.00000040.00001000.00020000.00000000.sdmp, Offset: 00750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_6bdudXAsQW.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: e3e00bf9dbafeb2e33b0b1731302cb2fbf5584eb46f22b1b855d3d8c7a9348fe
Instruction ID: 1bbb019199d0f94c0dfbd98a995356d1fe27290cfead8a9fa44134b36c88a1fe
Opcode Fuzzy Hash: e3e00bf9dbafeb2e33b0b1731302cb2fbf5584eb46f22b1b855d3d8c7a9348fe
Instruction Fuzzy Hash: 57A11770E00209EBDB14CFE4C894BEEB7B5FF49305F208559E901BB281D7B9AA45DB94

Function 007639E7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00763A15
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00763A36
ShowWindow.USER32(00000000,?,?), ref: 00763A4A
ShowWindow.USER32(00000000,?,?), ref: 00763A53

Strings

AutoIt v3, xrefs: 00763A0D, 00763A12, 00763A13
edit, xrefs: 00763A30

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 8450818377c04cf241d8e2023615d7eb4818d6db4473b2e1a5350f72a8290f49
Instruction ID: aba18b1a3cf09ad45b09ea56afabc0bd246d59b122e24bc3840231f9f637e173
Opcode Fuzzy Hash: 8450818377c04cf241d8e2023615d7eb4818d6db4473b2e1a5350f72a8290f49
Instruction Fuzzy Hash: 29F0DA71641290FFEA3117276C49E772E7DE7CAF60B01812AF904A6170D6B91C62DAB4

Function 007523B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 007522A0: Sleep.KERNELBASE(000001F4), ref: 007522B1

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00752500

Strings

4L3M6R1MN58ITBXKLTKRP6J1C3UPQN, xrefs: 00752563, 00752566

Memory Dump Source

Source File: 00000000.00000002.1354495733.0000000000750000.00000040.00001000.00020000.00000000.sdmp, Offset: 00750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_6bdudXAsQW.jbxd

Similarity

API ID: CreateFileSleep
String ID: 4L3M6R1MN58ITBXKLTKRP6J1C3UPQN
API String ID: 2694422964-428806503
Opcode ID: 7616aa78e98ed262272111559cc08dd3b22fb01c8267de6c48b4031b0c2c65ee
Instruction ID: 92410f37e2f406116c9fd2300e2dfe0bc71c517f8f795551068a9d32f5c68013
Opcode Fuzzy Hash: 7616aa78e98ed262272111559cc08dd3b22fb01c8267de6c48b4031b0c2c65ee
Instruction Fuzzy Hash: 33618130D04288DAEF11DBB8C858BEEBBB4AF15305F044199E6487B2C1D7F91B49CB66

Function 007C97E5 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00765045: _fseek.LIBCMT ref: 0076505D

Part of subcall function 007C99BE: _wcscmp.LIBCMT ref: 007C9AAE
Part of subcall function 007C99BE: _wcscmp.LIBCMT ref: 007C9AC1

_free.LIBCMT ref: 007C992C
_free.LIBCMT ref: 007C9933
_free.LIBCMT ref: 007C999E

Part of subcall function 00782F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00789C64), ref: 00782FA9
Part of subcall function 00782F95: GetLastError.KERNEL32(00000000,?,00789C64), ref: 00782FBB

_free.LIBCMT ref: 007C99A6

Strings

, xrefs: 007C97EF

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-3162483948
Opcode ID: 922d4df5b64e1696f8af207ae7c752e1e6b30532c460fe4269bae0bb53f03174
Instruction ID: 0d79c4af86248c89fd12537274c7fa9371058de388220dbda868f2b049bae7d3
Opcode Fuzzy Hash: 922d4df5b64e1696f8af207ae7c752e1e6b30532c460fe4269bae0bb53f03174
Instruction Fuzzy Hash: E9514FB1904218EFDF249F64CC45B9EBBB9EF48310F1004AEB609A7241DB755A80CF59

Function 0076410D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0079D5EC

Part of subcall function 00767D2C: _memmove.LIBCMT ref: 00767D66

_memset.LIBCMT ref: 0076418D
_wcscpy.LIBCMT ref: 007641E1
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 007641F1

Strings

Line: , xrefs: 0079D615

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: f8af2a5cbebc49967b33a488d2d9439bc1c2422c06313460b19c30e3c7e2d1d1
Instruction ID: bcc603c052850bb78f529231d7d99c9effcc08fd96297de3db1bfdb8a4f5a0f8
Opcode Fuzzy Hash: f8af2a5cbebc49967b33a488d2d9439bc1c2422c06313460b19c30e3c7e2d1d1
Instruction Fuzzy Hash: E931D371008344EBD739EB60DC4AFDB77ECBF45304F10851AF996920A1EB789A59C792

Function 0078564D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 007856AB
_memcpy_s.LIBCMT ref: 0078571D
__read_nolock.LIBCMT ref: 0078577B
__filbuf.LIBCMT ref: 0078579E
_memset.LIBCMT ref: 007857E2

Part of subcall function 00788D68: __getptd_noexit.LIBCMT ref: 00788D68

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction ID: 01aa3e670bf91c14019e2470268b217f9dd46f364cdbc0889c050852341c58d3
Opcode Fuzzy Hash: cbc132a2d90f1fa170c901e77712e707e3c45fd9b9f6dd10e42efcbbdaed9f46
Instruction Fuzzy Hash: 2F51A134B40B06DFDB24AFB9C88466EB7A6AF40730F64C729F825962D0E7799D508B50

Function 007669CA Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00764F3D: LoadLibraryExW.KERNELBASE(?,00000000,00000002,?, ,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00764F6F

_free.LIBCMT ref: 0079E68C
_free.LIBCMT ref: 0079E6D3

Part of subcall function 00766BEC: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00766D0D

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 0079E462
Bad directive syntax error, xrefs: 0079E6BB

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: a31bcbd85b3702a10f1b9c15a289eaa7e52c512baabc8459e4fc8ffc5f6fedb2
Instruction ID: fe9046c27383fa04fc409c73b265a40138f050d08030342281a4728709648baf
Opcode Fuzzy Hash: a31bcbd85b3702a10f1b9c15a289eaa7e52c512baabc8459e4fc8ffc5f6fedb2
Instruction Fuzzy Hash: E691A071910219EFCF04EFA4DC959EDBBB4FF19314F144429F816AB2A1EB38A905CB60

Function 007635B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,007635A1,SwapMouseButtons,00000004,?), ref: 007635D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,007635A1,SwapMouseButtons,00000004,?,?,?,?,00762754), ref: 007635F5
RegCloseKey.KERNELBASE(00000000,?,?,007635A1,SwapMouseButtons,00000004,?,?,?,?,00762754), ref: 00763617

Strings

Control Panel\Mouse, xrefs: 007635D2

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 6b49fe75bd2d20e3ea43dfb63cc99b9eb761c94367c432bb853449a060096e76
Instruction ID: e34cb57ed51101b92f3c3fe082f45d38dab1eb5f30af34c8d4805ab06d4028b4
Opcode Fuzzy Hash: 6b49fe75bd2d20e3ea43dfb63cc99b9eb761c94367c432bb853449a060096e76
Instruction Fuzzy Hash: AE115771611218BFDB21CF68DC80EAEBBB8EF04740F008469F806DB210E2759F40DBA4

Function 007512A0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 00751ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00751AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00751B13

Memory Dump Source

Source File: 00000000.00000002.1354495733.0000000000750000.00000040.00001000.00020000.00000000.sdmp, Offset: 00750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_6bdudXAsQW.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 51a3eba446a9bbb1a9416ea03989c14c5a1c3a2d5be52081b7aa0183c4e9d3fa
Instruction ID: 3958200f54a82fa104633f6b878331830e378b7ac2f792dbe8d0ed1548f3a328
Opcode Fuzzy Hash: 51a3eba446a9bbb1a9416ea03989c14c5a1c3a2d5be52081b7aa0183c4e9d3fa
Instruction Fuzzy Hash: CF624F30A14258DBEB24CFA4C841BDEB372EF58301F5091A9D50DEB390E7B99E85CB59

Function 0078493A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007849D0
__flush.LIBCMT ref: 007849F0
__write.LIBCMT ref: 00784A23
__flsbuf.LIBCMT ref: 00784A51

Part of subcall function 00788D68: __getptd_noexit.LIBCMT ref: 00788D68

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction ID: 27c0434da85b9c54e6a010224976ff6bba6b96c096ff260027dc4c1967fcaf20
Opcode Fuzzy Hash: 14470a6213cb86a88b8286372661136e60ed3d9327b1e96cf2061ba74b92ecb7
Instruction Fuzzy Hash: D041D671680707ABDF2CEE69C88496F77A9EF80360B24C17DE855CB640E7B8AD408B45

Function 007673E5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0079EE62
GetOpenFileNameW.COMDLG32(?), ref: 0079EEAC

Part of subcall function 007648AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007648A1,?,?,007637C0,?), ref: 007648CE

Part of subcall function 007809D5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 007809F4

Strings

X, xrefs: 0079EE7A

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 00b966d35c32fe1920e775d13c0c4178bfea90fb6bebba2c0e3dc015c0904028
Instruction ID: 1853b541183d648d6d47a216d7fa61a7c594a915eb7f70543173be25e80f3f0a
Opcode Fuzzy Hash: 00b966d35c32fe1920e775d13c0c4178bfea90fb6bebba2c0e3dc015c0904028
Instruction Fuzzy Hash: 4721A771900258DBDF15DF94C849BEE7BFDAF49314F004019E909E7241DBB8598ACF91

Function 007C901B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007C9036
__fread_nolock.LIBCMT ref: 007C904B

Strings

EA06, xrefs: 007C907D

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: c7d15c395037bf1569d614f0595242414428320d606a5792ca08cdeaa7895858
Instruction ID: fd5051bffadc8ceb0f93c743730bcb9c2f78b070aec7d423a4c2e29729fce102
Opcode Fuzzy Hash: c7d15c395037bf1569d614f0595242414428320d606a5792ca08cdeaa7895858
Instruction Fuzzy Hash: D401F971844218BEDB28D7A8CC1AFFE7BFCDB01301F00419FF552D2181E579A6048760

Function 007C9B6D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 007C9B82
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 007C9B99

Strings

aut, xrefs: 007C9B93

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 6b1d8cbea8acc8b99cfe9410171642a5ed0b044e2223806c584477f7bf7dad97
Instruction ID: 93b82f49c34ba6b4fee39383126f5e466257d86d954e79cad6ae59f44b8dae11
Opcode Fuzzy Hash: 6b1d8cbea8acc8b99cfe9410171642a5ed0b044e2223806c584477f7bf7dad97
Instruction Fuzzy Hash: E5D05B7554130D6BDB109B94DC4DFDA772CF704700F0041A1FF54D5191DEB455948B95

Function 007DCDF1 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d509fc47e1198c5e7bbb70d9a3032eca5e38738e4c9aadcd2f9242c24d9e8d6e
Instruction ID: e3fa3358c2249f2e651745bc2104ce42f7a2dd24b999c19d332d880a6468a407
Opcode Fuzzy Hash: d509fc47e1198c5e7bbb70d9a3032eca5e38738e4c9aadcd2f9242c24d9e8d6e
Instruction Fuzzy Hash: 02F11571608305DFC724DF28C484A6ABBE5BF88314F14892EF89A9B351D739E945CF82

Function 007643DB Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00764401
Shell_NotifyIconW.SHELL32(00000000,?), ref: 007644A6
Shell_NotifyIconW.SHELL32(00000001,?), ref: 007644C3

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 764ac5218bde8e30faf8b852824c95816df96aad15a6d181fd34b1eaba664ffa
Instruction ID: aec5ad068e4b02b44ed40c7dbd6de9bf3ae6f0fa98131fe462b7ccf858130485
Opcode Fuzzy Hash: 764ac5218bde8e30faf8b852824c95816df96aad15a6d181fd34b1eaba664ffa
Instruction Fuzzy Hash: 5D318170505741CFD721DF64D885B97BBF8FB49304F00492EE99A83251EB79A944CB92

Function 0078594C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00785963

Part of subcall function 0078A3AB: __NMSG_WRITE.LIBCMT ref: 0078A3D2
Part of subcall function 0078A3AB: __NMSG_WRITE.LIBCMT ref: 0078A3DC

__NMSG_WRITE.LIBCMT ref: 0078596A

Part of subcall function 0078A408: GetModuleFileNameW.KERNEL32(00000000,008243BA,00000104,?,00000001,00000000), ref: 0078A49A
Part of subcall function 0078A408: ___crtMessageBoxW.LIBCMT ref: 0078A548

Part of subcall function 007832DF: ___crtCorExitProcess.LIBCMT ref: 007832E5
Part of subcall function 007832DF: ExitProcess.KERNEL32 ref: 007832EE

Part of subcall function 00788D68: __getptd_noexit.LIBCMT ref: 00788D68

RtlAllocateHeap.NTDLL(00E20000,00000000,00000001,00000000,?,?,?,00781013,?), ref: 0078598F

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: b983736820062f1d3dd9f03926c9db55cba428ab92646e4717b6667e57bced87
Instruction ID: 567beb048b09cc6091d61fcfaafe14be08c8279dc226bb0cee522e3b6ca37f8e
Opcode Fuzzy Hash: b983736820062f1d3dd9f03926c9db55cba428ab92646e4717b6667e57bced87
Instruction Fuzzy Hash: 7B01F5313C0B15EEE6217B39DC4AA2E7288DF52B70F50412AF4049A1C1DE7CAD0187B1

Function 007C9B2C Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,007C97D2,?,?,?,?,?,00000004), ref: 007C9B45
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,007C97D2,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 007C9B5B
CloseHandle.KERNEL32(00000000,?,007C97D2,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 007C9B62

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: d63f6bed4062a172ac0f51463cde9ade5d1cea2732fe23d3e506424a799c589e
Instruction ID: bc698e4b0d2d3a6ffb13f437b4f402e6ad00b7feab73b70615c27c050252e6a2
Opcode Fuzzy Hash: d63f6bed4062a172ac0f51463cde9ade5d1cea2732fe23d3e506424a799c589e
Instruction Fuzzy Hash: C9E08632181218B7D7211F54EC49FCA7F28AB09761F10C120FB146D0E087B52921979C

Function 007C8F97 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 007C8FA5

Part of subcall function 00782F95: RtlFreeHeap.NTDLL(00000000,00000000,?,00789C64), ref: 00782FA9
Part of subcall function 00782F95: GetLastError.KERNEL32(00000000,?,00789C64), ref: 00782FBB

_free.LIBCMT ref: 007C8FB6
_free.LIBCMT ref: 007C8FC8

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 180ac2cc07007adee99720b26c657bf09b4177bae862674a470a9d0e5fc62c6e
Instruction ID: 5cf0ab199b4245d3906f18393358ae94186c8d6ac522f152401193bada76f623
Opcode Fuzzy Hash: 180ac2cc07007adee99720b26c657bf09b4177bae862674a470a9d0e5fc62c6e
Instruction Fuzzy Hash: 39E012B16097019ACA64B578AD44F9357EE5F48351F28081DB909DB143DE2CE842C264

Function 0076AB23 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 007A002B

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 6e30ffe916b1d273f0913a6fc6bfa089cd2df668485e475e469fbd5e41e2e15f
Instruction ID: 0d09b6a3c537c92b5a54072713fef2d0d9de2164660edc978123b6b8e40ebcc3
Opcode Fuzzy Hash: 6e30ffe916b1d273f0913a6fc6bfa089cd2df668485e475e469fbd5e41e2e15f
Instruction Fuzzy Hash: 26222774608241DFCB24DF14C494B6ABBE1BF85304F14896DE89A9B362D739ED85CF82

Function 00764DD0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00764E1A

Strings

EA06, xrefs: 0079DCF5

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: adce382c2adff3f65a413238c894875214da34f0d3ce3382a7d66bd56711580a
Instruction ID: 21837e46721feaf8d575d913a8f1a76fdca048c4336a2260be96f556a6486265
Opcode Fuzzy Hash: adce382c2adff3f65a413238c894875214da34f0d3ce3382a7d66bd56711580a
Instruction Fuzzy Hash: 68416B71A04654EFCF219B64CC657BF7FA6AB46300F684065FC839B282C62E9D4497E1

Function 00764F3D Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00764D13: FreeLibrary.KERNEL32(00000000,?), ref: 00764D4D

Part of subcall function 0078548B: __wfsopen.LIBCMT ref: 00785496

LoadLibraryExW.KERNELBASE(?,00000000,00000002,?, ,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00764F6F

Part of subcall function 00764CC8: FreeLibrary.KERNEL32(00000000), ref: 00764D02

Part of subcall function 00764DD0: _memmove.LIBCMT ref: 00764E1A

Strings

, xrefs: 00764F43

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-3162483948
Opcode ID: 3955f9fcb7776a5ddeabb5fac960c0fbe9e066668f64c282d362054acdbdc79e
Instruction ID: 8302b91d8b6d9c5ea0e480e21193734cbb1b2fcd604ac7f9b2f2fbdd7678895d
Opcode Fuzzy Hash: 3955f9fcb7776a5ddeabb5fac960c0fbe9e066668f64c282d362054acdbdc79e
Instruction Fuzzy Hash: 4D11E732700209EACF20BF70DC0AFAE77A89F44700F10842DFD42AA6C1DB799A059B60

Function 0076492E Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00764992

Part of subcall function 007835AC: __lock.LIBCMT ref: 007835B2
Part of subcall function 007835AC: DecodePointer.KERNEL32(00000001,?,007649A7,007B81BC), ref: 007835BE
Part of subcall function 007835AC: EncodePointer.KERNEL32(?,?,007649A7,007B81BC), ref: 007835C9

Part of subcall function 00764A5B: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00764A73
Part of subcall function 00764A5B: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00764A88

Part of subcall function 00763B4C: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00763B7A
Part of subcall function 00763B4C: IsDebuggerPresent.KERNEL32 ref: 00763B8C
Part of subcall function 00763B4C: GetFullPathNameW.KERNEL32(00007FFF,?,?, ,008262E0,?,?), ref: 00763BFD
Part of subcall function 00763B4C: SetCurrentDirectoryW.KERNEL32(?), ref: 00763C81

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 007649D2

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 18c114593daad324710736c4c5144572a3ede51b1521267fe5325e32a8250859
Instruction ID: ad2af38b2cf3da101014d8737afe627622170487b0f3c7610c235fd3e814a141
Opcode Fuzzy Hash: 18c114593daad324710736c4c5144572a3ede51b1521267fe5325e32a8250859
Instruction Fuzzy Hash: 8F11AC71908301EBC310EF69DC4994ABBE8FB88710F00851EF446872A1EB749656CB96

Function 00765DF9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,00765981,?,?,?,?), ref: 00765E27
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,00765981,?,?,?,?), ref: 0079E19C

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ad4be9f1ffca09914e815c7367374d0b6fce0c0475f3711a578b5f308a744e96
Instruction ID: 7977d0396afcd14b4cd53a494e3960107903d617d1449e1c26e1a18d03176400
Opcode Fuzzy Hash: ad4be9f1ffca09914e815c7367374d0b6fce0c0475f3711a578b5f308a744e96
Instruction Fuzzy Hash: C0019270284708BEFB244E24DC8AF663A9CAB05768F10C319FEE65E1E0C6B91E459B54

Function 00780FF6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0078594C: __FF_MSGBANNER.LIBCMT ref: 00785963
Part of subcall function 0078594C: __NMSG_WRITE.LIBCMT ref: 0078596A
Part of subcall function 0078594C: RtlAllocateHeap.NTDLL(00E20000,00000000,00000001,00000000,?,?,?,00781013,?), ref: 0078598F

std::exception::exception.LIBCMT ref: 0078102C
__CxxThrowException@8.LIBCMT ref: 00781041

Part of subcall function 007887DB: RaiseException.KERNEL32(?,?,?,0081BAF8,00000000,?,?,?,?,00781046,?,0081BAF8,?,00000001), ref: 00788830

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 977a04a97e2fd22f0d0e436b37d65fa8d0da9095b3f37c328f8cbcd3ed27367d
Instruction ID: 6c0de865279a5602d223ef67ae5c76bebe76b646dabdfae42633f930ac9da71a
Opcode Fuzzy Hash: 977a04a97e2fd22f0d0e436b37d65fa8d0da9095b3f37c328f8cbcd3ed27367d
Instruction Fuzzy Hash: 48F0C83568031DE7CB20BA98EC099EF7BAC9F01350F600425F904D6692EFB9DA9287D5

Function 0078582D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0078585C
__lock_file.LIBCMT ref: 0078587D

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: ba677e976c7a60103b9cee8dffde15c24f071309b39ea128ea9a1f34d82f18e2
Instruction ID: 3bbccf0f9454d7174a447a37ddc6b91853557d0b7e413c0c428dc84a06d11cdc
Opcode Fuzzy Hash: ba677e976c7a60103b9cee8dffde15c24f071309b39ea128ea9a1f34d82f18e2
Instruction Fuzzy Hash: 5101AC71C80604EBCF12BF698C0959F7F61BF80760F544216F8145B161DB3D8651DB91

Function 007855D6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00788D68: __getptd_noexit.LIBCMT ref: 00788D68

__lock_file.LIBCMT ref: 0078561B

Part of subcall function 00786E4E: __lock.LIBCMT ref: 00786E71

__fclose_nolock.LIBCMT ref: 00785626

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 1977f5b7900e5b0a2908c42f4bc7b2d986b2c4e0c6914f475dd80520973f0b3b
Instruction ID: c8457991cdba92ade4dae0558ce983786b2f8045b78cdc194eb12e16b46c79c3
Opcode Fuzzy Hash: 1977f5b7900e5b0a2908c42f4bc7b2d986b2c4e0c6914f475dd80520973f0b3b
Instruction Fuzzy Hash: 47F0E971AC0B04DAD760BF75880A76E7BE16F40B34F958209E424BB1C1DF7C89419F96

Function 007681C1 Relevance: 2.6, APIs: 2, Instructions: 54COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000001,00000000,00000000,?,?,?,0076558F,?,?,?,?,?), ref: 007681DA
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,00000001,00000000,?,?,?,0076558F,?,?,?,?,?), ref: 0076820D

Part of subcall function 007678AD: _memmove.LIBCMT ref: 007678E9

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ByteCharMultiWide$_memmove
String ID:
API String ID: 3033907384-0
Opcode ID: 82950e7b29a4f18034d1b6e6ea172ad5355a053993a219d3361133481ff2bf4b
Instruction ID: 0c8167989f2cfaaa14f3980c7695cb9e7163e1f35f1fc3f3031c9bcec10850a9
Opcode Fuzzy Hash: 82950e7b29a4f18034d1b6e6ea172ad5355a053993a219d3361133481ff2bf4b
Instruction Fuzzy Hash: 4F01AD31241248BFEB246A25DD9AF7B3F6CEB89760F10812AFD06CE190DE359800C672

Function 0075129D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 00751ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00751AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00751B13

Memory Dump Source

Source File: 00000000.00000002.1354495733.0000000000750000.00000040.00001000.00020000.00000000.sdmp, Offset: 00750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_6bdudXAsQW.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 935c44ad8318b3af66d252774f477c9026677184fbf87e93bc0843909b837ee7
Instruction ID: c13b09995ca748c079d0f3b8b6e910462fdc817588a1647e18f69404a350267f
Opcode Fuzzy Hash: 935c44ad8318b3af66d252774f477c9026677184fbf87e93bc0843909b837ee7
Instruction Fuzzy Hash: 5812EE24E14658C6EB24DF60D8507DEB232EF68301F1090E9910DEB7A5E77A4F85CF5A

Function 00772123 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b09d729421165aa3596197ecb66759e3c705c4d1f1280a169c48925743b6ff48
Instruction ID: 79d4be8675090aab921304023e6ebc751892227e5221ce9bd636fdf1d406caf3
Opcode Fuzzy Hash: b09d729421165aa3596197ecb66759e3c705c4d1f1280a169c48925743b6ff48
Instruction Fuzzy Hash: A251A034700604EFCF14EB64C999F6E77A6AF85310F18C168F91AAB292CB38ED01DB51

Function 00765C4E Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 00765CF6

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: b1d5d76fb2b1d39ce9e0d6f83e8707b2edf7c378cfd0dc5f62329473261fef25
Instruction ID: a268b55f2e988095b1fb0d48411eaebd4d50022bd1095ca598ec3d5554bee6fd
Opcode Fuzzy Hash: b1d5d76fb2b1d39ce9e0d6f83e8707b2edf7c378cfd0dc5f62329473261fef25
Instruction Fuzzy Hash: BF313C71A00B0AAFCB18DF2DC48465DB7B5FF48310F148629DC1A93750D775A950EB90

Function 007A00D6 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 007A00E1

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 068c23e55abdbebfea25f13b50f541b4f7e77eae73f00b8b0cc715a2e87dd667
Instruction ID: f5b847e215d6084a35189f97eabc4c517c9f3090457722064f239951986d921e
Opcode Fuzzy Hash: 068c23e55abdbebfea25f13b50f541b4f7e77eae73f00b8b0cc715a2e87dd667
Instruction Fuzzy Hash: B6410874604351DFDB14DF14C488B1ABBE0BF45318F1989ACE89A9B762C73AE885CF52

Function 007A01AF Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 007A01BB

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 61e4faaaeecef6e4d09b5705ec0c89911b84554f5b5953b4a20570cc1d947225
Instruction ID: 59d8e3ae3c0ec82fa499a35643a209353f54828eb5847e53d81aaabff5bd0fd8
Opcode Fuzzy Hash: 61e4faaaeecef6e4d09b5705ec0c89911b84554f5b5953b4a20570cc1d947225
Instruction Fuzzy Hash: 642113B4608341DFCB14DF24C845A1ABBE4BF89314F048968E98A5B761D73AE849CF93

Function 00765D20 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,00765807,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00765D76

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 81dcd176e88d8ee2cfc6fb7768bb575ce3e6ed27de384b4349e6a280eaae3cb1
Instruction ID: b3beee35d65ed7851affd4c84b9d3db4bf1d52175d74020c007453a7efc1b08e
Opcode Fuzzy Hash: 81dcd176e88d8ee2cfc6fb7768bb575ce3e6ed27de384b4349e6a280eaae3cb1
Instruction Fuzzy Hash: 42110A31200B059FD3308F15C488B66B7E5EF45750F14C92EE9AB86A90D779E945DB60

Function 00767F41 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00767F82

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: c56c3b4cee92743fd843ba2fcf40f434112ab0d27706c117a31bb8eb393c03f0
Instruction ID: e4b6873717412d71ea98156dee26b31c2c1c4a22f38c3060177d34006534d9c1
Opcode Fuzzy Hash: c56c3b4cee92743fd843ba2fcf40f434112ab0d27706c117a31bb8eb393c03f0
Instruction Fuzzy Hash: 8B01D672244701EED3246B29CC0AFA7BB98EB447A0F10852AFA5ACA191EA35E401C790

Function 00784A93 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00784AD6

Part of subcall function 00788D68: __getptd_noexit.LIBCMT ref: 00788D68

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: 43941bace3ec03d01e5607171fdb95296147960200933e240ddbd488408c5be3
Instruction ID: da50e03320d0dbc51c418a99a52b29a249bc1965427f0ba2bb3fb654dd7eab61
Opcode Fuzzy Hash: 43941bace3ec03d01e5607171fdb95296147960200933e240ddbd488408c5be3
Instruction Fuzzy Hash: FEF0A4719C020AEBDFB1BF748C0A79E7A61AF00335F448514F4249A1D1DBBC8950DF52

Function 00764FAA Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?, ,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00764FDE

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 803764401a29f6e8804e0d1c8c395b48cd22476af19301268da8189bbb6ced78
Instruction ID: 9287418723bc62900a1ea5c01cffb32064089e1bba7d8f7b66fcf7a45dc0b844
Opcode Fuzzy Hash: 803764401a29f6e8804e0d1c8c395b48cd22476af19301268da8189bbb6ced78
Instruction Fuzzy Hash: A9F06D71105712CFCB349F64E494892BBF2BF043293288E7EE9D782A10C779A850DF40

Function 007809D5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 007809F4

Part of subcall function 00767D2C: _memmove.LIBCMT ref: 00767D66

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 61619c5d6fe02b6ed0c52cdf616140c741a15f66834584c6241f310c1e5e7499
Instruction ID: 5a232126da7490fa66e2182ff33505a89de049f98eb31b052ccd5f8916a811ed
Opcode Fuzzy Hash: 61619c5d6fe02b6ed0c52cdf616140c741a15f66834584c6241f310c1e5e7499
Instruction Fuzzy Hash: 13E0CD76A0522897C720D6589C09FFA77EDDF8C794F0441B5FD0CD7204DA649C918690

Function 007C9129 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 007C914B

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction ID: 2a9e81d33dafe1fb0310cf00552fb18f55eaedfebbb047e3d973a1f70bc4b50b
Opcode Fuzzy Hash: 7603a7e23398706fbe611478ecf9e3358d47b441acc83f726054c373298f7434
Instruction Fuzzy Hash: D2E09AB0204B049FDB788A28D819BE373E0BB06315F04081DF2AA83342EB66B8418B59

Function 00765DAE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,0079E16B,?,?,00000000), ref: 00765DBF

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: a5e64287e60df41f0c30513d265409b8b0cd247ed695f17ceee439e7eab417bf
Instruction ID: bcb4bde1bc6c9868c3882dfa5320ba53ea136aedd36739812a60bfb859dcdc9c
Opcode Fuzzy Hash: a5e64287e60df41f0c30513d265409b8b0cd247ed695f17ceee439e7eab417bf
Instruction Fuzzy Hash: 80D0C77464020CBFE710DB80DC46FA9777CD745711F100195FD0456690D6B27E508795

Function 0078548B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00785496

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 10795ebb9f82293ca7f9864ed12aaa6397f72e37501004ea99f35ef12cd613a8
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: C5B0927688020CB7DF022E82EC02A593B199B40678F808020FB0C18162A677A6A09689

Function 007CD2E6 Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 007CD46A

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 18d643e7c2913f86137450eca95e65d555937fda2273d06b17b57643b687f0a3
Instruction ID: 2981ea3e680f09a5250267095f5f96e49370457bc79be58f2e9a85ed1e1803fb
Opcode Fuzzy Hash: 18d643e7c2913f86137450eca95e65d555937fda2273d06b17b57643b687f0a3
Instruction Fuzzy Hash: 9F718330204341CFC718EF64D495F6AB7E5AF88314F04456DF9969B2A2DB38EE49CB52

Function 00780E48 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00780EF7

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 5cb4e599ea0286671fdc4f8b0f94b7bf0a2d95c38556f9e70306c1f55b0a2bdc
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 6F31E470A80105DFC7A8EF58C48096AF7A6FF59300B688AA5E409CB651D735EDC5CBC0

Function 0075229C Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 007522B1

Memory Dump Source

Source File: 00000000.00000002.1354495733.0000000000750000.00000040.00001000.00020000.00000000.sdmp, Offset: 00750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_6bdudXAsQW.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction ID: 6af5941552caf4cd20611312a130baf668e6181178c3cc2c4f9f7d549d11b29f
Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction Fuzzy Hash: 5CE0BF7594010EEFDB00EFA4D5496DE7BB4FF04312F1005A1FD05E7691DB709E548A62

Function 007522A0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 007522B1

Memory Dump Source

Source File: 00000000.00000002.1354495733.0000000000750000.00000040.00001000.00020000.00000000.sdmp, Offset: 00750000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_750000_6bdudXAsQW.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 3cb058351ee7bd16b1920d4f5ff956cd4804e0519f5ef735d6ecd1466c989ed6
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 00E0BF7594010EAFDB00EFA4D54969E7BB4EF04302F100161FD05A2281D67099508A62

Non-executed Functions

Function 007ECDAC Relevance: 75.9, APIs: 40, Strings: 3, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00762612: GetWindowLongW.USER32(?,000000EB), ref: 00762623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 007ECE50
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 007ECE91
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 007ECED6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 007ECF00
SendMessageW.USER32 ref: 007ECF29
_wcsncpy.LIBCMT ref: 007ECFA1
GetKeyState.USER32(00000011), ref: 007ECFC2
GetKeyState.USER32(00000009), ref: 007ECFCF
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 007ECFE5
GetKeyState.USER32(00000010), ref: 007ECFEF
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 007ED018
SendMessageW.USER32 ref: 007ED03F
SendMessageW.USER32(?,00001030,?,007EB602), ref: 007ED145
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 007ED15B
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 007ED16E
SetCapture.USER32(?), ref: 007ED177
ClientToScreen.USER32(?,?), ref: 007ED1DC
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 007ED1E9
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 007ED203
ReleaseCapture.USER32 ref: 007ED20E
GetCursorPos.USER32(?), ref: 007ED248
ScreenToClient.USER32(?,?), ref: 007ED255
SendMessageW.USER32(?,00001012,00000000,?), ref: 007ED2B1
SendMessageW.USER32 ref: 007ED2DF
SendMessageW.USER32(?,00001111,00000000,?), ref: 007ED31C
SendMessageW.USER32 ref: 007ED34B
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 007ED36C
SendMessageW.USER32(?,0000110B,00000009,?), ref: 007ED37B
GetCursorPos.USER32(?), ref: 007ED39B
ScreenToClient.USER32(?,?), ref: 007ED3A8
GetParent.USER32(?), ref: 007ED3C8
SendMessageW.USER32(?,00001012,00000000,?), ref: 007ED431
SendMessageW.USER32 ref: 007ED462
ClientToScreen.USER32(?,?), ref: 007ED4C0
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 007ED4F0
SendMessageW.USER32(?,00001111,00000000,?), ref: 007ED51A
SendMessageW.USER32 ref: 007ED53D
ClientToScreen.USER32(?,?), ref: 007ED58F
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 007ED5C3

Part of subcall function 007625DB: GetWindowLongW.USER32(?,000000EB), ref: 007625EC

GetWindowLongW.USER32(?,000000F0), ref: 007ED65F

Strings

@U=u, xrefs: 007ECE91, 007ECF00, 007ECF29, 007ECFE5, 007ED018, 007ED03F, 007ED145, 007ED2B1, 007ED2DF, 007ED31C, 007ED34B, 007ED431, 007ED462, 007ED51A, 007ED53D
@GUI_DRAGID, xrefs: 007ED1AA
F, xrefs: 007ED543

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$@U=u$F
API String ID: 3977979337-1007936534
Opcode ID: 201078b2422943c166fd43c943db9d6f047e8445af443e4957fef542c2d42927
Instruction ID: 48f61740de2e3acc553966a908021a8488c26eb4510a29ceffa2009e2a0c91f7
Opcode Fuzzy Hash: 201078b2422943c166fd43c943db9d6f047e8445af443e4957fef542c2d42927
Instruction Fuzzy Hash: 0442AE742062C1EFC721CF29C888AAABBE5FF4C314F14452DF6558B6A1D7399C52CB92

Function 007E804A Relevance: 61.8, APIs: 33, Strings: 2, Instructions: 571windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 007E873F

Strings

@U=u, xrefs: 007E80E0, 007E8134, 007E81E7, 007E822E, 007E8256, 007E83BB, 007E8456, 007E84A0, 007E84EA, 007E850A, 007E85EC, 007E8625, 007E8676, 007E86E1, 007E873F
%d/%02d/%02d, xrefs: 007E8478

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d$@U=u
API String ID: 3850602802-2764005415
Opcode ID: 5b12f52cd8ae16d3e3353eee3f8b72b4c7783e54a96c65227e6c64c3034bd701
Instruction ID: 1d14cd85cf80742fe266b8d5c4abd6a92181ebcb44b426419a30a18a858be2be
Opcode Fuzzy Hash: 5b12f52cd8ae16d3e3353eee3f8b72b4c7783e54a96c65227e6c64c3034bd701
Instruction Fuzzy Hash: 1D12F470502284AFEB659F65CC89FAE7BB8EF4D310F244129F919EA1E1DF788941CB11

Function 0077710E Relevance: 50.6, APIs: 19, Strings: 7, Instructions: 5093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007775C2
_memset.LIBCMT ref: 007776B1
_memmove.LIBCMT ref: 00777C4B
_memmove.LIBCMT ref: 00777E4F

Strings

Oaw, xrefs: 007B287E
Q\E, xrefs: 007781C1
[:<:]], xrefs: 007775F1
\b(?<=\w), xrefs: 007B3C41
\b(?=\w), xrefs: 007B3C34
DEFINE, xrefs: 007B25AF
[:>:]], xrefs: 0077760A

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: _memmove$_memset
String ID: DEFINE$Oaw$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-1155851358
Opcode ID: 82b99a24be410557e69f82337bcd3214e9bef71f98723736cb12f75a35b85480
Instruction ID: 502235e77f5c01ff5894bb70bf9d4b9fd324b7c1dcb59f44dcf8bacee6ffae3b
Opcode Fuzzy Hash: 82b99a24be410557e69f82337bcd3214e9bef71f98723736cb12f75a35b85480
Instruction Fuzzy Hash: E4939271A00219DBDF24CF58C8857EDB7B1FF48350F25856AE949EB281E7789E82CB50

Function 00764A35 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 00764A3D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0079DA8E
IsIconic.USER32(?), ref: 0079DA97
ShowWindow.USER32(?,00000009), ref: 0079DAA4
SetForegroundWindow.USER32(?), ref: 0079DAAE
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0079DAC4
GetCurrentThreadId.KERNEL32 ref: 0079DACB
GetWindowThreadProcessId.USER32(?,00000000), ref: 0079DAD7
AttachThreadInput.USER32(?,00000000,00000001), ref: 0079DAE8
AttachThreadInput.USER32(?,00000000,00000001), ref: 0079DAF0
AttachThreadInput.USER32(00000000,?,00000001), ref: 0079DAF8
SetForegroundWindow.USER32(?), ref: 0079DAFB
MapVirtualKeyW.USER32(00000012,00000000), ref: 0079DB10
keybd_event.USER32(00000012,00000000), ref: 0079DB1B
MapVirtualKeyW.USER32(00000012,00000000), ref: 0079DB25
keybd_event.USER32(00000012,00000000), ref: 0079DB2A
MapVirtualKeyW.USER32(00000012,00000000), ref: 0079DB33
keybd_event.USER32(00000012,00000000), ref: 0079DB38
MapVirtualKeyW.USER32(00000012,00000000), ref: 0079DB42
keybd_event.USER32(00000012,00000000), ref: 0079DB47
SetForegroundWindow.USER32(?), ref: 0079DB4A
AttachThreadInput.USER32(?,?,00000000), ref: 0079DB71

Strings

Shell_TrayWnd, xrefs: 0079DA89

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: c630a9634b23a923d5308c0b7769c04c9892e6ae6d99a7c89c044f551623239e
Instruction ID: a88b15c057578089e11eedd5d7b552e017518e54a7e1d1bd6b10d7bc8b2f526f
Opcode Fuzzy Hash: c630a9634b23a923d5308c0b7769c04c9892e6ae6d99a7c89c044f551623239e
Instruction Fuzzy Hash: 8E317571A41358BBEF305FA19C89F7F3E6CEB48B50F118025FA04EA1D0C6755D10AAA4

Function 007B8858 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 007B8CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 007B8D0D
Part of subcall function 007B8CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 007B8D3A
Part of subcall function 007B8CC3: GetLastError.KERNEL32 ref: 007B8D47

_memset.LIBCMT ref: 007B889B
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 007B88ED
CloseHandle.KERNEL32(?), ref: 007B88FE
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 007B8915
GetProcessWindowStation.USER32 ref: 007B892E
SetProcessWindowStation.USER32(00000000), ref: 007B8938
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 007B8952

Part of subcall function 007B8713: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,007B8851), ref: 007B8728
Part of subcall function 007B8713: CloseHandle.KERNEL32(?,?,007B8851), ref: 007B873A

Strings

default, xrefs: 007B894D
winsta0, xrefs: 007B8910
, xrefs: 007B88AA

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 22aed2fb92d62fbf88fe187958bfc35e0c3af040eee3d22f8bf600a70589e25b
Instruction ID: 0e2a5a8238511ec5874ee3f13b8e2b67c3f74a01f7c3669053a515ca793d4fe3
Opcode Fuzzy Hash: 22aed2fb92d62fbf88fe187958bfc35e0c3af040eee3d22f8bf600a70589e25b
Instruction Fuzzy Hash: 8F815C71901249EFDF51DFA4DC49AEEBBBCEF08304F18816AF910A6161DB398E14DB61

Function 007D425A Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(007EF910), ref: 007D4284
IsClipboardFormatAvailable.USER32(0000000D), ref: 007D4292
GetClipboardData.USER32(0000000D), ref: 007D429A
CloseClipboard.USER32 ref: 007D42A6
GlobalLock.KERNEL32(00000000), ref: 007D42C2
CloseClipboard.USER32 ref: 007D42CC
GlobalUnlock.KERNEL32(00000000,00000000), ref: 007D42E1
IsClipboardFormatAvailable.USER32(00000001), ref: 007D42EE
GetClipboardData.USER32(00000001), ref: 007D42F6
GlobalLock.KERNEL32(00000000), ref: 007D4303
GlobalUnlock.KERNEL32(00000000,00000000,?), ref: 007D4337
CloseClipboard.USER32 ref: 007D4447

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 4eb6cfcaa4aac597fcb6e695a56fd46752dccdd938dbe8c579588ec5a1fb4028
Instruction ID: 3be396bb153f36442109fee8da8e149a08c3fcb8805fa500e108eae45a3cca71
Opcode Fuzzy Hash: 4eb6cfcaa4aac597fcb6e695a56fd46752dccdd938dbe8c579588ec5a1fb4028
Instruction Fuzzy Hash: 21519371204341ABD711FF64DC8AF6E77B8BF88B00F04852AF556D62A1DF78D9048B66

Function 007CC9C7 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 007CC9F8
FindClose.KERNEL32(00000000), ref: 007CCA4C
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 007CCA71
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 007CCA88
FileTimeToSystemTime.KERNEL32(?,?), ref: 007CCAAF
__swprintf.LIBCMT ref: 007CCAFB
__swprintf.LIBCMT ref: 007CCB3E

Part of subcall function 00767F41: _memmove.LIBCMT ref: 00767F82

__swprintf.LIBCMT ref: 007CCB92

Part of subcall function 007838D8: __woutput_l.LIBCMT ref: 00783931

__swprintf.LIBCMT ref: 007CCBE0

Part of subcall function 007838D8: __flsbuf.LIBCMT ref: 00783953
Part of subcall function 007838D8: __flsbuf.LIBCMT ref: 0078396B

__swprintf.LIBCMT ref: 007CCC2F
__swprintf.LIBCMT ref: 007CCC7E
__swprintf.LIBCMT ref: 007CCCCD

Strings

%4d, xrefs: 007CCB38
%02d, xrefs: 007CCB86, 007CCB90, 007CCBDE, 007CCC2D, 007CCC7C, 007CCCCB
%4d%02d%02d%02d%02d%02d, xrefs: 007CCAF5

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: b707c0e4307047cd1c90636b86845718ce541313b505a95d8516158710499dfd
Instruction ID: aab58088f38a6ce06e903d4f94b1dbf6d84336d2e1e1da7502017cfb4c3d56c2
Opcode Fuzzy Hash: b707c0e4307047cd1c90636b86845718ce541313b505a95d8516158710499dfd
Instruction Fuzzy Hash: 0DA12FB1508304EBC704EBA4C899DAFB7ECAF94704F40491DFA86D7191EA38DA08C762

Function 007CF200 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76F88FB0,?,00000000), ref: 007CF221
_wcscmp.LIBCMT ref: 007CF236
_wcscmp.LIBCMT ref: 007CF24D
GetFileAttributesW.KERNEL32(?), ref: 007CF25F
SetFileAttributesW.KERNEL32(?,?), ref: 007CF279
FindNextFileW.KERNEL32(00000000,?), ref: 007CF291
FindClose.KERNEL32(00000000), ref: 007CF29C
FindFirstFileW.KERNEL32(*.*,?), ref: 007CF2B8
_wcscmp.LIBCMT ref: 007CF2DF
_wcscmp.LIBCMT ref: 007CF2F6
SetCurrentDirectoryW.KERNEL32(?), ref: 007CF308
SetCurrentDirectoryW.KERNEL32(0081A5A0), ref: 007CF326
FindNextFileW.KERNEL32(00000000,00000010), ref: 007CF330
FindClose.KERNEL32(00000000), ref: 007CF33D
FindClose.KERNEL32(00000000), ref: 007CF34F

Strings

*.*, xrefs: 007CF2B3

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 56046fa4f7386c559f2c62b65a574ec925814937d818c03da37d41720e726cb5
Instruction ID: 4a724d9f201ccdec37905cc2fc12afc3fcb2921e663b85036d13a7742194f787
Opcode Fuzzy Hash: 56046fa4f7386c559f2c62b65a574ec925814937d818c03da37d41720e726cb5
Instruction Fuzzy Hash: D031D576501259BADB14EBB4DC88FDE77ADAF48360F10417DE910D7090EB38DA45CB54

Function 007E0AE2 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007E0BDE
RegCreateKeyExW.ADVAPI32(?,?,00000000,007EF910,00000000,?,00000000,?,?), ref: 007E0C4C
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 007E0C94
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 007E0D1D
RegCloseKey.ADVAPI32(?), ref: 007E103D
RegCloseKey.ADVAPI32(00000000), ref: 007E104A

Strings

REG_QWORD, xrefs: 007E0F8B
REG_BINARY, xrefs: 007E0FD8
REG_SZ, xrefs: 007E0D5B
REG_MULTI_SZ, xrefs: 007E0E05
REG_DWORD, xrefs: 007E0F0E
REG_EXPAND_SZ, xrefs: 007E0CBA

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: ebd89bad555d4251eea50507e3b6d7a64f99b2fcc9068ba30ba179aa2c0290a9
Instruction ID: e600170a7ebb249fac1caaa75d73ce8ba87600bccb0e4b71c3791c844431c96f
Opcode Fuzzy Hash: ebd89bad555d4251eea50507e3b6d7a64f99b2fcc9068ba30ba179aa2c0290a9
Instruction Fuzzy Hash: 55024A75200641DFCB14EF15C899A2AB7E9FF88714F04885DF98A9B362CB78ED41CB81

Function 007CF35D Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76F88FB0,?,00000000), ref: 007CF37E
_wcscmp.LIBCMT ref: 007CF393
_wcscmp.LIBCMT ref: 007CF3AA

Part of subcall function 007C45C1: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 007C45DC

FindNextFileW.KERNEL32(00000000,?), ref: 007CF3D9
FindClose.KERNEL32(00000000), ref: 007CF3E4
FindFirstFileW.KERNEL32(*.*,?), ref: 007CF400
_wcscmp.LIBCMT ref: 007CF427
_wcscmp.LIBCMT ref: 007CF43E
SetCurrentDirectoryW.KERNEL32(?), ref: 007CF450
SetCurrentDirectoryW.KERNEL32(0081A5A0), ref: 007CF46E
FindNextFileW.KERNEL32(00000000,00000010), ref: 007CF478
FindClose.KERNEL32(00000000), ref: 007CF485
FindClose.KERNEL32(00000000), ref: 007CF497

Strings

*.*, xrefs: 007CF3FB

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 810121ea8bbff060ac67834d7662de2b8abc420ac3661d9859dc9231a2cc91ef
Instruction ID: 848d30ec95ba634156e193c6bcda56b261df2824ab8a0a106b1319feeebe641c
Opcode Fuzzy Hash: 810121ea8bbff060ac67834d7662de2b8abc420ac3661d9859dc9231a2cc91ef
Instruction Fuzzy Hash: 3731D572502299ABCB14ABA4EC88FDE77ADAF49324F10417DE810E71A0D73CDB44CB64

Function 007B81F7 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 007B874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 007B8766
Part of subcall function 007B874A: GetLastError.KERNEL32(?,007B822A,?,?,?), ref: 007B8770
Part of subcall function 007B874A: GetProcessHeap.KERNEL32(00000008,?,?,007B822A,?,?,?), ref: 007B877F
Part of subcall function 007B874A: HeapAlloc.KERNEL32(00000000,?,007B822A,?,?,?), ref: 007B8786
Part of subcall function 007B874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 007B879D

Part of subcall function 007B87E7: GetProcessHeap.KERNEL32(00000008,007B8240,00000000,00000000,?,007B8240,?), ref: 007B87F3
Part of subcall function 007B87E7: HeapAlloc.KERNEL32(00000000,?,007B8240,?), ref: 007B87FA
Part of subcall function 007B87E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,007B8240,?), ref: 007B880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 007B825B
_memset.LIBCMT ref: 007B8270
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 007B828F
GetLengthSid.ADVAPI32(?), ref: 007B82A0
GetAce.ADVAPI32(?,00000000,?), ref: 007B82DD
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 007B82F9
GetLengthSid.ADVAPI32(?), ref: 007B8316
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 007B8325
HeapAlloc.KERNEL32(00000000), ref: 007B832C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 007B834D
CopySid.ADVAPI32(00000000), ref: 007B8354
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 007B8385
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 007B83AB
SetUserObjectSecurity.USER32(?,00000004,?), ref: 007B83BF

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 07e688809aa3aa347c3adf4e915eea1fd7ae608ce30f7de819b169503d5dba35
Instruction ID: 0a00076e034d93eaf164c07c3b21f175fd30809de44947efd2b75d2ef019a046
Opcode Fuzzy Hash: 07e688809aa3aa347c3adf4e915eea1fd7ae608ce30f7de819b169503d5dba35
Instruction Fuzzy Hash: 98614871900209EBDF40DFA4DC85AEEBBB9FF08704F148169F815AB291DB399A05CF61

Function 00776843 Relevance: 20.9, Strings: 16, Instructions: 883COMMON

Download Yara Rule

Strings

ANYCRLF), xrefs: 007B1734
-es, xrefs: 007B1768
UCP), xrefs: 007B1546
NO_AUTO_POSSESS), xrefs: 007B1567
UTF), xrefs: 007B1533
LIMIT_RECURSION=, xrefs: 007B1635
CRLF), xrefs: 007B16FA
BSR_UNICODE), xrefs: 007B1771
LF), xrefs: 007B16DD
Oaw, xrefs: 007B1888, 007B192F, 007B19DD
NO_START_OPT), xrefs: 007B1588
CR), xrefs: 007B16C0
BSR_ANYCRLF), xrefs: 007B1757
UTF16), xrefs: 007B1508
ANY), xrefs: 007B1717
LIMIT_MATCH=, xrefs: 007B15A9

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID:
String ID: -es$ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$Oaw$UCP)$UTF)$UTF16)
API String ID: 0-1482563720
Opcode ID: a401b980090896520216fcd0b85d4aee1acf18d9e4f7d6571721ea989aac6d3e
Instruction ID: 325640e6fb538a8168b6c9f4dd5d395f737106bb9e51587c5adebb0b8d4df1b7
Opcode Fuzzy Hash: a401b980090896520216fcd0b85d4aee1acf18d9e4f7d6571721ea989aac6d3e
Instruction Fuzzy Hash: AD727D71E00619DBDF24CF58C8947EEB7B5FF48350F54816AE949EB284EB389D818B90

Function 007E0665 Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 007E10A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,007E0038,?,?), ref: 007E10BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007E0737

Part of subcall function 00769997: __itow.LIBCMT ref: 007699C2
Part of subcall function 00769997: __swprintf.LIBCMT ref: 00769A0C

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 007E07D6
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 007E086E
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 007E0AAD
RegCloseKey.ADVAPI32(00000000), ref: 007E0ABA

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: d4b387470a32f4e5aa938079b25dc547bb35a8c8445476d1cdd132fd10b70650
Instruction ID: d4a1539d949d428a5a61d3bb67fe679f7c77b8ad91f26528de493a057e9b8bd6
Opcode Fuzzy Hash: d4b387470a32f4e5aa938079b25dc547bb35a8c8445476d1cdd132fd10b70650
Instruction Fuzzy Hash: 0FE15D31205350EFCB14DF29C895E6ABBE8EF89714B04C56DF84ADB262DA34ED41CB91

Function 007C0219 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 007C0241
GetAsyncKeyState.USER32(000000A0), ref: 007C02C2
GetKeyState.USER32(000000A0), ref: 007C02DD
GetAsyncKeyState.USER32(000000A1), ref: 007C02F7
GetKeyState.USER32(000000A1), ref: 007C030C
GetAsyncKeyState.USER32(00000011), ref: 007C0324
GetKeyState.USER32(00000011), ref: 007C0336
GetAsyncKeyState.USER32(00000012), ref: 007C034E
GetKeyState.USER32(00000012), ref: 007C0360
GetAsyncKeyState.USER32(0000005B), ref: 007C0378
GetKeyState.USER32(0000005B), ref: 007C038A

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 446a4ca3582b9e6cf853ce2a1f75186a1fe52347a06bf37e2e2369db659fd2cf
Instruction ID: 1a2297ae1b4b050b98e91fbed9d1124207b04c9f6e7932b423edc6040269d910
Opcode Fuzzy Hash: 446a4ca3582b9e6cf853ce2a1f75186a1fe52347a06bf37e2e2369db659fd2cf
Instruction Fuzzy Hash: AA4199245047C9EEFF319BA48848BB5BFA07F16344F08809DD9C64A5C2EB9C99D4C7E6

Function 00774140 Relevance: 15.1, APIs: 1, Strings: 7, Instructions: 1132COMMON

Download Yara Rule

Strings

Oaw, xrefs: 00774984, 007A8173
ERCP, xrefs: 0077421F
VUUU, xrefs: 007A7B0C
VUUU, xrefs: 007744DB
-es, xrefs: 007A7A29
VUUU, xrefs: 007744ED
VUUU, xrefs: 00774520

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID:
String ID: -es$ERCP$Oaw$VUUU$VUUU$VUUU$VUUU
API String ID: 0-3412315229
Opcode ID: 34dbabf572297e018120147a714e0f1fccdd96919007374aa2b66558384f2d34
Instruction ID: 4e15e40d8812be17a03ad32a184bf3c5a370b0f609f000d042ec82d0ea41e6df
Opcode Fuzzy Hash: 34dbabf572297e018120147a714e0f1fccdd96919007374aa2b66558384f2d34
Instruction Fuzzy Hash: EDA28170E0421ACBDF28CF58C9907AEB7B1FB55354F14C2AAD959A7280E7389E81CF51

Function 007D4458 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 007D447F
EmptyClipboard.USER32 ref: 007D4485
GlobalAlloc.KERNEL32(00000002,?), ref: 007D449A
CloseClipboard.USER32 ref: 007D4539

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 87164dc1607e46f02e0d1ea5ea97eeef5acedbf7176ea7e1557b799d285278ef
Instruction ID: 44abf99ef611f0e71584eca77b3509dd6732d5bccdc9a29d813a049e166fce2f
Opcode Fuzzy Hash: 87164dc1607e46f02e0d1ea5ea97eeef5acedbf7176ea7e1557b799d285278ef
Instruction Fuzzy Hash: 49217C35201250DFDB11AF64EC49B6D7BA8EF48711F14C02AFA46DB2A1DB7CAD11CB98

Function 007C3A2B Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 007648AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007648A1,?,?,007637C0,?), ref: 007648CE

Part of subcall function 007C4CD3: GetFileAttributesW.KERNEL32(?,007C3947), ref: 007C4CD4

FindFirstFileW.KERNEL32(?,?), ref: 007C3ADF
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 007C3B87
MoveFileW.KERNEL32(?,?), ref: 007C3B9A
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 007C3BB7
FindNextFileW.KERNEL32(00000000,00000010), ref: 007C3BD9
FindClose.KERNEL32(00000000,?,?,?,?), ref: 007C3BF5

Strings

\*.*, xrefs: 007C3A8A, 007C3A93, 007C3AA8

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 421cdf2d3b7e7d2d7c2af0be9df44ac7aa90a5b8e3863b235ba0b34221a3e2ff
Instruction ID: aaf4bef60dc24a1ba38cf263a44ea50601e0c09b0314187c97d18459c9f2ccb9
Opcode Fuzzy Hash: 421cdf2d3b7e7d2d7c2af0be9df44ac7aa90a5b8e3863b235ba0b34221a3e2ff
Instruction Fuzzy Hash: 2D516D31805249DACF15EBA0DD96EEDB779AF14304F6481ADE84277091EF396F09CBA0

Function 007CF65E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00767F41: _memmove.LIBCMT ref: 00767F82

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 007CF6AB
Sleep.KERNEL32(0000000A), ref: 007CF6DB
_wcscmp.LIBCMT ref: 007CF6EF
_wcscmp.LIBCMT ref: 007CF70A
FindNextFileW.KERNEL32(?,?), ref: 007CF7A8
FindClose.KERNEL32(00000000), ref: 007CF7BE

Strings

*.*, xrefs: 007CF690

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 00acb34bd30fddea3f063e6cb306bfd57e97e870989952e9ab3500c69444738c
Instruction ID: 481218d6374a6db32e0a15d29543e5ab90aabaace65d0365e51e2be3d507bfb2
Opcode Fuzzy Hash: 00acb34bd30fddea3f063e6cb306bfd57e97e870989952e9ab3500c69444738c
Instruction Fuzzy Hash: 9F415B7190120A9BCF15DF64CC89FEEBBB9FF09310F54456EE815A62A0DB389E44CB90

Function 007758C0 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00775A05
_memmove.LIBCMT ref: 00775A55
_memmove.LIBCMT ref: 00775ABB

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 0c020af3e3350a1e9334c3c09c69245502d09929ecd6a3c0ccbb50406979b501
Instruction ID: 4db116344065282223ae588cc778684a6647cb2c49339ea972407fec77a7511e
Opcode Fuzzy Hash: 0c020af3e3350a1e9334c3c09c69245502d09929ecd6a3c0ccbb50406979b501
Instruction Fuzzy Hash: 3A127B70A00609DFDF14DFA4D985AEEB7B5FF48340F108669E80AE7251EB39AD11CB90

Function 00775680 Relevance: 11.0, APIs: 5, Strings: 1, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00780FF6: std::exception::exception.LIBCMT ref: 0078102C
Part of subcall function 00780FF6: __CxxThrowException@8.LIBCMT ref: 00781041

_memmove.LIBCMT ref: 007B062F
_memmove.LIBCMT ref: 007B0744
_memmove.LIBCMT ref: 007B07EB

Strings

yZw, xrefs: 007B0881, 007B07FF

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID: yZw
API String ID: 1300846289-710204300
Opcode ID: a3b9e199222019792490b9afecb77fa425f377538047521f900af80153fdf8e4
Instruction ID: fb2a09a72d1c96e6346290f9986066b04aa76c42d7abfd625226bcd89463d3e0
Opcode Fuzzy Hash: a3b9e199222019792490b9afecb77fa425f377538047521f900af80153fdf8e4
Instruction Fuzzy Hash: 8B0291B0A00209DFDF08DF64D985AAEBBB5FF44340F14C069E80ADB255EB39DA55CB91

Function 007C545F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 007B8CC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 007B8D0D
Part of subcall function 007B8CC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 007B8D3A
Part of subcall function 007B8CC3: GetLastError.KERNEL32 ref: 007B8D47

ExitWindowsEx.USER32(?,00000000), ref: 007C549B

Strings

SeShutdownPrivilege, xrefs: 007C546B
@, xrefs: 007C548E
, xrefs: 007C5489

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 03f62dedf60f3f44945008dc595e88ecef8e873e70c97878a2b1ecb6148ecf08
Instruction ID: aa6d7028bbc9c162ca9ccf8f18f716824679067246309663b6da2acc781695e5
Opcode Fuzzy Hash: 03f62dedf60f3f44945008dc595e88ecef8e873e70c97878a2b1ecb6148ecf08
Instruction Fuzzy Hash: C0014731655A816AE76C6278DC8AFBA735CEB04342F20012CFC06D60C2DA5E3EC081A0

Function 00773190 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

Oaw, xrefs: 00773482

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: __itow__swprintf
String ID: Oaw
API String ID: 674341424-906014102
Opcode ID: 753cf4fbf5e1cf2289b1eff014d03ae3cf7c7ed59bd3ea3b50938ead789650c4
Instruction ID: 63a64aa7c7f866fcc4045a0f7fefd7d3c4fe2e3d5bebe9086959b7e380c300f0
Opcode Fuzzy Hash: 753cf4fbf5e1cf2289b1eff014d03ae3cf7c7ed59bd3ea3b50938ead789650c4
Instruction Fuzzy Hash: 4522AD71508301DFCB24DF24C895BABB7E4BF84744F10892DF99A97291DB78EA04CB92

Function 007D6596 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 007D65EF
WSAGetLastError.WSOCK32(00000000), ref: 007D65FE
bind.WSOCK32(00000000,?,00000010), ref: 007D661A
listen.WSOCK32(00000000,00000005), ref: 007D6629
WSAGetLastError.WSOCK32(00000000), ref: 007D6643
closesocket.WSOCK32(00000000,00000000), ref: 007D6657

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: e0066c4dadf89981f7282d036fc9634e66d93abed52e36c12a671cb39ce91945
Instruction ID: 2b0714b6c9f3213b326c4008bcbcdff70d05be76bdc71697fd5fb4ca7a2ebf56
Opcode Fuzzy Hash: e0066c4dadf89981f7282d036fc9634e66d93abed52e36c12a671cb39ce91945
Instruction Fuzzy Hash: 27217E35600204DFDB10AF64D889B6EB7F9EF48720F14815AE956AB3D1CB78AD01CB55

Function 00761287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00762612: GetWindowLongW.USER32(?,000000EB), ref: 00762623

DefDlgProcW.USER32(?,?,?,?,?), ref: 007619FA
GetSysColor.USER32(0000000F), ref: 00761A4E
SetBkColor.GDI32(?,00000000), ref: 00761A61

Part of subcall function 00761290: DefDlgProcW.USER32(?,00000020,?), ref: 007612D8

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 834dd8524eafda377b4ad4750da77d0640afd622071d121e40dd34c4513f4790
Instruction ID: a69cb5b073062985a4dcc773e01de18aea8be6d6d4f2fcd89b0a08a1f7200b26
Opcode Fuzzy Hash: 834dd8524eafda377b4ad4750da77d0640afd622071d121e40dd34c4513f4790
Instruction Fuzzy Hash: 3DA178B11025C4FEDA38AB79AD4DD7F269CEB46346B9C8119FC03D6192DA2C9C02D2B1

Function 007D6A5A Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 007D80A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 007D80CB

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 007D6AB1
WSAGetLastError.WSOCK32(00000000), ref: 007D6ADA
bind.WSOCK32(00000000,?,00000010), ref: 007D6B13
WSAGetLastError.WSOCK32(00000000), ref: 007D6B20
closesocket.WSOCK32(00000000,00000000), ref: 007D6B34

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 2918903dbe78f048c4ea0e6b9c57f50849c924679d6ba286cec578b66e767520
Instruction ID: 281211b593e9d6602a0ff86a5832e48f33bb6c6b8400f43e1b99bdfd90fce98f
Opcode Fuzzy Hash: 2918903dbe78f048c4ea0e6b9c57f50849c924679d6ba286cec578b66e767520
Instruction Fuzzy Hash: 0241B275700210EFEB10AF64DC8AF6E77E99B48720F44C159FE5AAB3D2DA789D008791

Function 007E55FD Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 007E564C
IsWindowEnabled.USER32 ref: 007E565A
GetForegroundWindow.USER32(?,?,00000001), ref: 007E5667
IsIconic.USER32 ref: 007E5675
IsZoomed.USER32 ref: 007E5683

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: c3da8aad7f778c2ebb24945c6dcf6519326576ad3f4269fae192440561ef523f
Instruction ID: a5801b35e103d8a69568642ff94906aa3cb18678eb86a0a697cc60c2730d1a6b
Opcode Fuzzy Hash: c3da8aad7f778c2ebb24945c6dcf6519326576ad3f4269fae192440561ef523f
Instruction Fuzzy Hash: C211B6313026549FD7111F27DC48A6B7798EF5CB25B448429E906DB241CB7C9901CA95

Function 007CC602 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 007CC69D
CoCreateInstance.OLE32(007F2D6C,00000000,00000001,007F2BDC,?), ref: 007CC6B5

Part of subcall function 00767F41: _memmove.LIBCMT ref: 00767F82

CoUninitialize.OLE32 ref: 007CC922

Strings

.lnk, xrefs: 007CC631, 007CC659, 007CC663

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: dee611db8aeed43f344ba79c141ce4c1c48bda2219fef194b8cbdab057bf28bf
Instruction ID: 483c473425974e3cc000e1eaf0dea1687877a134c3a9c3e6a6fece1abf652687
Opcode Fuzzy Hash: dee611db8aeed43f344ba79c141ce4c1c48bda2219fef194b8cbdab057bf28bf
Instruction Fuzzy Hash: F4A15E71108205EFD300EF54C895EABB7ECEF94714F04891CF69697192DB74EA09CB52

Function 007DC304 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,007A1D88,?), ref: 007DC312
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 007DC324

Strings

GetSystemWow64DirectoryW, xrefs: 007DC31E
kernel32.dll, xrefs: 007DC30D

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: f66d8cf9db703a99822cad7f42bd093f0f475bbd3ff8634a0681d548a6b6d3fb
Instruction ID: f46f50e3a952429c5aef833c48858a8667e4c1a98a5b40e8e772da707b229994
Opcode Fuzzy Hash: f66d8cf9db703a99822cad7f42bd093f0f475bbd3ff8634a0681d548a6b6d3fb
Instruction Fuzzy Hash: 43E0C2B0202B07CFCB214F39D844A86B6E8EF0C304B80C43AE895C6710E77CD880CB60

Function 007DF121 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 007DF151
Process32FirstW.KERNEL32(00000000,?), ref: 007DF15F

Part of subcall function 00767F41: _memmove.LIBCMT ref: 00767F82

Process32NextW.KERNEL32(00000000,?), ref: 007DF21F
CloseHandle.KERNEL32(00000000,?,?,?), ref: 007DF22E

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 37eaea1c2d0fddacfdc94bee3422109eaa1abaa037dd2b0420f5697518d547bf
Instruction ID: d911ca5a443173e2eaa3eb3d2a0f5a92b5c00368b3cd13e14fe141ea76d1082b
Opcode Fuzzy Hash: 37eaea1c2d0fddacfdc94bee3422109eaa1abaa037dd2b0420f5697518d547bf
Instruction Fuzzy Hash: 30516B71504301DFD310EF24DC89A6BBBE8BF98750F14492DF99697291EB74A908CB92

Function 007BEB07 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 007BEB19

Strings

(, xrefs: 007BEB5F
|, xrefs: 007BEB49

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 8d62afca2d59f99a322cb004f81d9556d3dd3a1ff932f3f6bd9ad0f6ebe83b75
Instruction ID: 8acc2debce61e077d7702929392f7d68edf941ac8f4c87f24039c839f6f104bb
Opcode Fuzzy Hash: 8d62afca2d59f99a322cb004f81d9556d3dd3a1ff932f3f6bd9ad0f6ebe83b75
Instruction Fuzzy Hash: 13323675A00605DFD728DF19C481AAAB7F1FF48310B15C56EE89ADB3A1DB74E941CB40

Function 007D25E2 Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000), ref: 007D26D5
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 007D270C

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 398bc5f3ebf1ea9e92d80c056e0c017ec525295c8b45d3a7497cb77023a2eec4
Instruction ID: e1f0ac34aaa6b6a0d2cc2dfd3566f4365be98a54d1ad72d224fe203abef076c0
Opcode Fuzzy Hash: 398bc5f3ebf1ea9e92d80c056e0c017ec525295c8b45d3a7497cb77023a2eec4
Instruction Fuzzy Hash: 5341D371600309FFEB209A54DC85EBBB7BCEB50724F10406BF601A6642EA79DE439754

Function 007CB59E Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 007CB5AE
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 007CB608
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 007CB655

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 61fcf780e01f6d97b895aa6bef0908661db3670ad8425e576e68f8b43a4a8b42
Instruction ID: c1a0766464f8e47a13374d0526f21f53aa26706080edcaf28678c915a5106fad
Opcode Fuzzy Hash: 61fcf780e01f6d97b895aa6bef0908661db3670ad8425e576e68f8b43a4a8b42
Instruction Fuzzy Hash: F4219D35A00618EFCB00EFA5D884EEDBBB8FF48310F0480A9E906AB351CB35A905CB50

Function 007B8CC3 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00780FF6: std::exception::exception.LIBCMT ref: 0078102C
Part of subcall function 00780FF6: __CxxThrowException@8.LIBCMT ref: 00781041

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 007B8D0D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 007B8D3A
GetLastError.KERNEL32 ref: 007B8D47

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 1785e29d2eaff163cbe2f86746058fcb6e6d5e8081a899c609298b3148b37f1a
Instruction ID: e5e8d20849c7da6447e12a1215fe723f181df667384cef5be9efce07e984ef6c
Opcode Fuzzy Hash: 1785e29d2eaff163cbe2f86746058fcb6e6d5e8081a899c609298b3148b37f1a
Instruction Fuzzy Hash: 5011BCB1514208AFE728AF64DC89DABB7BCEB48710B20C52EF44687651EF34AC40CB60

Function 007C4021 Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 007C404B
DeviceIoControl.KERNEL32(00000000,002D1400,00000007,0000000C,?,0000000C,?,00000000), ref: 007C4088
CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 007C4091

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 9184ab00ec6bd895e23c7283fe714f7649b4c5c458ad0f29f71483eb3aa60fa4
Instruction ID: f1dd52e7ab625edbdc503d6bf479c47c6daafb763e443fc4189ea3ee16cb23c9
Opcode Fuzzy Hash: 9184ab00ec6bd895e23c7283fe714f7649b4c5c458ad0f29f71483eb3aa60fa4
Instruction Fuzzy Hash: DA1182B2D41228BEE7109BE8DC44FAFBBBCEB08710F00465AFA04E7190C2785D4587A1

Function 007C4C03 Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 007C4C2C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 007C4C43
FreeSid.ADVAPI32(?), ref: 007C4C53

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 948694df412cba8106d646ba2ec48bdc46851cff6d60d784c5c6604a591b3ab0
Instruction ID: a0499d856fb1941dd9b9a3e31c227369d6a292566aa65543039e355a70fa4263
Opcode Fuzzy Hash: 948694df412cba8106d646ba2ec48bdc46851cff6d60d784c5c6604a591b3ab0
Instruction Fuzzy Hash: E5F04975A1230CBFDF04DFF0DC89ABEBBBCEF08211F0084A9E901E6581E6746A048B54

Function 0076E060 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e2391cbfc2cae1fb4722208c104a680ba9cfb364fd3979a8c511311b241de01
Instruction ID: c7b6c87a25aef6fbf69d358cbfab07b03fd05e13d9bd0a886143e45ec24ecf9f
Opcode Fuzzy Hash: 3e2391cbfc2cae1fb4722208c104a680ba9cfb364fd3979a8c511311b241de01
Instruction Fuzzy Hash: 70229F78A00219CFDB24DF54C894AAEBBB1FF45310F148169EC57AB351E738AD85CBA1

Function 007CC93C Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 007CC966
FindClose.KERNEL32(00000000), ref: 007CC996

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: b78348b15e360b0298c68ced68143b91a76e21647e269607d021dcdb6c8f9680
Instruction ID: 4deb797aba6df6fd6b5a160d8da0234f9a98091f67c0d07421fcaeb639fd86b8
Opcode Fuzzy Hash: b78348b15e360b0298c68ced68143b91a76e21647e269607d021dcdb6c8f9680
Instruction Fuzzy Hash: AE1152716106009FD710EF29D859A6AF7E9FF84324F04C55EF9AADB291DB38AC00CB81

Function 007CA2D5 Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,007D977D,?,007EFB84,?), ref: 007CA302
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,007D977D,?,007EFB84,?), ref: 007CA314

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: e8432ae3db12f6f4d2a3517c7d6af87d604873a3e00f3ea72e62e8422541d857
Instruction ID: cc422681fe6f1c62b4a739634816683f9914709d7a5df1c25a828974a8cf087e
Opcode Fuzzy Hash: e8432ae3db12f6f4d2a3517c7d6af87d604873a3e00f3ea72e62e8422541d857
Instruction Fuzzy Hash: AEF0E23110522DFBDB10AFA4CC48FEA736DBF08361F008169F908D6181D6349900CBA1

Function 007B8713 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,007B8851), ref: 007B8728
CloseHandle.KERNEL32(?,?,007B8851), ref: 007B873A

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 5ee44d52bd57dd793c4dea6daf0fbfa5881e05ebd2d6aab38ea8a5b1989ad3b6
Instruction ID: 39cdcd161448f9b93a4b5410573d4f029bd4b89d15c1df17aa3c82c88d6ca099
Opcode Fuzzy Hash: 5ee44d52bd57dd793c4dea6daf0fbfa5881e05ebd2d6aab38ea8a5b1989ad3b6
Instruction Fuzzy Hash: 72E0EC76011650EFE7252B60ED09E777BEDEF04354B24C83DF49684870DB66AC91DB11

Function 0078A395 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00788F97,?,?,?,00000001), ref: 0078A39A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 0078A3A3

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: ad8f2f0684c060233638ee2fa7b423c4528b6b729d64e0c72f0fb564ad7922f7
Instruction ID: c40132af9b0c8921e75cf7caa9b423d55d5c656c2358a9ab9c1ec09bd885b7d1
Opcode Fuzzy Hash: ad8f2f0684c060233638ee2fa7b423c4528b6b729d64e0c72f0fb564ad7922f7
Instruction Fuzzy Hash: 48B09231055248ABCA002B99EC49B883F68EB48AA2F408020F60D88864CB6655508A99

Function 0078F419 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41a95e01887385f2761de0d461f2486b02f1fad0fc5056edfc409042745e9585
Instruction ID: df76b39d7f6bae594f559da1434e5f6e94b586702a9d4be8e097f4ecf61b2820
Opcode Fuzzy Hash: 41a95e01887385f2761de0d461f2486b02f1fad0fc5056edfc409042745e9585
Instruction Fuzzy Hash: BB320162DA9F414DD727A634D832336A748AFB73D4F14D737E819B59A6EB2CC4838204

Function 0079267E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 086ed34454666b400bbe71d471986da48ce5bc4e515a41d73239af34de39740b
Instruction ID: 63ece4e2b66fb898fad71e4556679eacb2301ec9c65eda12c96a991973abf5dd
Opcode Fuzzy Hash: 086ed34454666b400bbe71d471986da48ce5bc4e515a41d73239af34de39740b
Instruction Fuzzy Hash: E2B11260D2AF415DD723A6398831336BB4CAFBB2D5F51D71BFC2A70D22EB2585838141

Function 007C8B13 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 007C8B25

Part of subcall function 0078543A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,007C91F8,00000000,?,?,?,?,007C93A9,00000000,?), ref: 00785443
Part of subcall function 0078543A: __aulldiv.LIBCMT ref: 00785463

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: eaca9bb4cb4495ffd33778e232d09bf359158389f0a0033040635f058170beef
Instruction ID: 5fdbe12457e271d5740bb8cda5a053fc04e9e1ce0083272a53c286eb23da5952
Opcode Fuzzy Hash: eaca9bb4cb4495ffd33778e232d09bf359158389f0a0033040635f058170beef
Instruction Fuzzy Hash: 77218472635510CBC729CF29D841B52B3E1EFA5311B298E6CD1E5CB2D0CA74BD45CB94

Function 007D41FD Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 007D4218

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 15adeba9b96d5c3ec71c14cb9ee953996586be7968d41323bcb357ead11fcb59
Instruction ID: 7208960a60f778e56e74bce4521ed1ad426cdc8038edf75f7319718eb0d79d07
Opcode Fuzzy Hash: 15adeba9b96d5c3ec71c14cb9ee953996586be7968d41323bcb357ead11fcb59
Instruction Fuzzy Hash: EBE01A312402149FC710AF69D844A9AB7ECAF98760F048026FD4ADB352DA78A8408BA0

Function 007C4EF5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 007C4F18

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 28793c16479c6855182182b55b2007a46e5508d9857e1176ca12cea3a6d1b97f
Instruction ID: 87d1730b6a371259a3d4ae7ff606ab6434f30031be5ad4bc04f1a19773e2184a
Opcode Fuzzy Hash: 28793c16479c6855182182b55b2007a46e5508d9857e1176ca12cea3a6d1b97f
Instruction Fuzzy Hash: FBD09EB416460579FC184B20AC3FF761329E354791F9C598D7201994C2D8ED6850B035

Function 007B8C93 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,007B88D1), ref: 007B8CB3

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: cdd44b26213570cf29a08ac6029fa04a08736dee5ec368a018ba282f11e788c8
Instruction ID: 665ac5c1827f3197cf5bd5d9921d210526476b0e9a45bd068d75962236f8e843
Opcode Fuzzy Hash: cdd44b26213570cf29a08ac6029fa04a08736dee5ec368a018ba282f11e788c8
Instruction Fuzzy Hash: 30D05E3226050EABEF018EA4DC01EAE3B69EB04B01F40C111FE15C50A1C775D835AB60

Function 007A2230 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 007A2242

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 54192fbaddf0d82e640e5dc34353c8f60fe5b0b24d15fff036b99e845f0e1177
Instruction ID: 1d2abb084cd7339d9e4bf8cad7eb108314bc1feecbd35f40967b5221ba6406c3
Opcode Fuzzy Hash: 54192fbaddf0d82e640e5dc34353c8f60fe5b0b24d15fff036b99e845f0e1177
Instruction Fuzzy Hash: 3CC04CF1801109DBDB05DB90D988DFE77BCAB08304F104155E101F2140D7789B448A71

Function 0078A364 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 0078A36A

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7ff21f7609e0c481ab24d5b468ebb61a97f047ccfcd19a338903238a4c996baf
Instruction ID: d58d33e8332536139eead8cec98858c01bb476ba32baf456d841d0affc52137a
Opcode Fuzzy Hash: 7ff21f7609e0c481ab24d5b468ebb61a97f047ccfcd19a338903238a4c996baf
Instruction Fuzzy Hash: 02A0243000010CF7CF001F45FC044447F5CD7041D0700C030F40C44431C733541045C4

Function 00778A0E Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2d6110aac1e9320dbe178ff19aae8d145a70af347e73966b214125e527f1112
Instruction ID: b5db78f9118ebdc00ff30dfa140d91e2ec67efb9a38fbd2236455a4e49a06054
Opcode Fuzzy Hash: c2d6110aac1e9320dbe178ff19aae8d145a70af347e73966b214125e527f1112
Instruction Fuzzy Hash: 6D223970A41655CBDF698B24C59C7BD77A1FF01384F28C4AAD84A8B291DB3C9D81CB72

Function 00782405 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: ab407d30a9aa175324fbb2e41fbe1e741b23365cdddfd50ea46a52f6b83299ba
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: ACC1B7322460A30ADF1D563AD43403EBAE15EA27B235A0B5DE4B3CB5D5FF28D526D720

Function 0078283A Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 1a7f001c6788cc298e6297ade74b29b450facedd1fb1535c62bab2b2f4807279
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: AEC1B6322461A309DF2D5639C43403EBBE15FA27B235A0B6DE4B2DB4D5EF28D525D720

Function 007EA849 Relevance: 59.8, APIs: 33, Strings: 1, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 007EA89F
GetSysColorBrush.USER32(0000000F), ref: 007EA8D0
GetSysColor.USER32(0000000F), ref: 007EA8DC
SetBkColor.GDI32(?,000000FF), ref: 007EA8F6
SelectObject.GDI32(?,?), ref: 007EA905
InflateRect.USER32(?,000000FF,000000FF), ref: 007EA930
GetSysColor.USER32(00000010), ref: 007EA938
CreateSolidBrush.GDI32(00000000), ref: 007EA93F
FrameRect.USER32(?,?,00000000), ref: 007EA94E
DeleteObject.GDI32(00000000), ref: 007EA955
InflateRect.USER32(?,000000FE,000000FE), ref: 007EA9A0
FillRect.USER32(?,?,?), ref: 007EA9D2
GetWindowLongW.USER32(?,000000F0), ref: 007EA9FD

Part of subcall function 007EAB60: GetSysColor.USER32(00000012), ref: 007EAB99
Part of subcall function 007EAB60: SetTextColor.GDI32(?,?), ref: 007EAB9D
Part of subcall function 007EAB60: GetSysColorBrush.USER32(0000000F), ref: 007EABB3
Part of subcall function 007EAB60: GetSysColor.USER32(0000000F), ref: 007EABBE
Part of subcall function 007EAB60: GetSysColor.USER32(00000011), ref: 007EABDB
Part of subcall function 007EAB60: CreatePen.GDI32(00000000,00000001,00743C00), ref: 007EABE9
Part of subcall function 007EAB60: SelectObject.GDI32(?,00000000), ref: 007EABFA
Part of subcall function 007EAB60: SetBkColor.GDI32(?,00000000), ref: 007EAC03
Part of subcall function 007EAB60: SelectObject.GDI32(?,?), ref: 007EAC10
Part of subcall function 007EAB60: InflateRect.USER32(?,000000FF,000000FF), ref: 007EAC2F
Part of subcall function 007EAB60: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 007EAC46
Part of subcall function 007EAB60: GetWindowLongW.USER32(00000000,000000F0), ref: 007EAC5B

Strings

@U=u, xrefs: 007EAA4E

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID: @U=u
API String ID: 4124339563-2594219639
Opcode ID: b53a76aaab4e145d3ad8599a8cc1ffb93f7c9ca133b0089ed208aebc04e961d0
Instruction ID: 7dcb33d52cc0f02aa6f3b5fd2314e63d5d1b490e027e7c2eb4a1239029c2e1e6
Opcode Fuzzy Hash: b53a76aaab4e145d3ad8599a8cc1ffb93f7c9ca133b0089ed208aebc04e961d0
Instruction Fuzzy Hash: 7AA1B17100A385FFD7109F65DC48A5B7BA9FF8C320F108A29F962DA1A1D738E944CB56

Function 007E37F3 Relevance: 52.9, APIs: 6, Strings: 24, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,007EF910), ref: 007E38AF
IsWindowVisible.USER32(?), ref: 007E38D3

Strings

ISENABLED, xrefs: 007E38F3
GETSELECTED, xrefs: 007E3B2B
SETCURRENTSELECTION, xrefs: 007E3A3E
GETCURRENTLINE, xrefs: 007E3B75
GETCURRENTSELECTION, xrefs: 007E3A6B
EDITPASTE, xrefs: 007E3BE7
HIDEDROPDOWN, xrefs: 007E3988
ISCHECKED, xrefs: 007E3AC1
TABRIGHT, xrefs: 007E3925
CURRENTTAB, xrefs: 007E3945
TABLEFT, xrefs: 007E390F
@U=u, xrefs: 007E3B6B, 007E3B92, 007E3C1B
FINDSTRING, xrefs: 007E39FE
DELSTRING, xrefs: 007E39D1
SHOWDROPDOWN, xrefs: 007E3968
GETLINECOUNT, xrefs: 007E3B4E
UNCHECK, xrefs: 007E3B0B
CHECK, xrefs: 007E3AF5
ISVISIBLE, xrefs: 007E38BF
SELECTSTRING, xrefs: 007E3A8E
SENDCOMMANDID, xrefs: 007E3C62
GETCURRENTCOL, xrefs: 007E3BB0
GETLINE, xrefs: 007E3C23
ADDSTRING, xrefs: 007E399E

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: @U=u$ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-3469695742
Opcode ID: af0737bf306d16e4af43e506606f96c84c757209cdccd3d480be5a946f1abd1d
Instruction ID: e714f62df3d67e07805a873f2fdfd7062193e7278b3e4f265b90b81b74fc7bcd
Opcode Fuzzy Hash: af0737bf306d16e4af43e506606f96c84c757209cdccd3d480be5a946f1abd1d
Instruction Fuzzy Hash: 3AD1A730204345DBCB14EF61C459AAA77A5EF98344F148458F9869B3E2CB3DFE4ACB91

Function 00762C18 Relevance: 51.2, APIs: 27, Strings: 2, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00762CA2
DeleteObject.GDI32(00000000), ref: 00762CE8
DeleteObject.GDI32(00000000), ref: 00762CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00762CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00762D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 0079C68B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0079C6C4
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0079CAED

Part of subcall function 00761B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00762036,?,00000000,?,?,?,?,007616CB,00000000,?), ref: 00761B9A

SendMessageW.USER32(?,00001053), ref: 0079CB2A
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0079CB41
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0079CB57
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0079CB62

Strings

@U=u, xrefs: 0079C68B, 0079C792, 0079CA6D
0, xrefs: 0079C981

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0$@U=u
API String ID: 464785882-975001249
Opcode ID: 3abb0db9304185360f5e49c20fe6315d7fe357ed9d803432f51ff7d467a2250e
Instruction ID: 15a655f2ff5266ff99750d310316f161394bf665f2a74ce7eb5e3af69218f9d4
Opcode Fuzzy Hash: 3abb0db9304185360f5e49c20fe6315d7fe357ed9d803432f51ff7d467a2250e
Instruction Fuzzy Hash: F512BF30600641EFDF52CF24D888BA9BBE5FF49310F548569E986DB662C739EC42CB60

Function 007D77BE Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 007D77F1
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 007D78B0
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 007D78EE
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 007D7900
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 007D7946
GetClientRect.USER32(00000000,?), ref: 007D7952
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 007D7996
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 007D79A5
GetStockObject.GDI32(00000011), ref: 007D79B5
SelectObject.GDI32(00000000,00000000), ref: 007D79B9
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 007D79C9
GetDeviceCaps.GDI32(00000000,0000005A), ref: 007D79D2
DeleteDC.GDI32(00000000), ref: 007D79DB
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 007D7A07
SendMessageW.USER32(00000030,00000000,00000001), ref: 007D7A1E
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 007D7A59
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 007D7A6D
SendMessageW.USER32(00000404,00000001,00000000), ref: 007D7A7E
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 007D7AAE
GetStockObject.GDI32(00000011), ref: 007D7AB9
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 007D7AC4
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 007D7ACE

Strings

@U=u, xrefs: 007D7A0D
msctls_progress32, xrefs: 007D7A4F
AutoIt v3, xrefs: 007D793E
DISPLAY, xrefs: 007D799B
static, xrefs: 007D7990, 007D7AA8

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: @U=u$AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-2771358697
Opcode ID: f7a18ddb09bfeb768922f963d0e2a6f3c5e3af37f567f53cf6476bb471fd23cf
Instruction ID: 27982e740b0e7cd093f55ac7ddb31f20e4617b2895c667533a20bf06cc33f0b6
Opcode Fuzzy Hash: f7a18ddb09bfeb768922f963d0e2a6f3c5e3af37f567f53cf6476bb471fd23cf
Instruction Fuzzy Hash: 6BA19371A41209FFEB14DB64DC8AFAE7BB9EB48710F108115FA15AB2E0D774AD01CB64

Function 007EAB60 Relevance: 47.5, APIs: 26, Strings: 1, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 007EAB99
SetTextColor.GDI32(?,?), ref: 007EAB9D
GetSysColorBrush.USER32(0000000F), ref: 007EABB3
GetSysColor.USER32(0000000F), ref: 007EABBE
CreateSolidBrush.GDI32(?), ref: 007EABC3
GetSysColor.USER32(00000011), ref: 007EABDB
CreatePen.GDI32(00000000,00000001,00743C00), ref: 007EABE9
SelectObject.GDI32(?,00000000), ref: 007EABFA
SetBkColor.GDI32(?,00000000), ref: 007EAC03
SelectObject.GDI32(?,?), ref: 007EAC10
InflateRect.USER32(?,000000FF,000000FF), ref: 007EAC2F
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 007EAC46
GetWindowLongW.USER32(00000000,000000F0), ref: 007EAC5B
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 007EACA7
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 007EACCE
InflateRect.USER32(?,000000FD,000000FD), ref: 007EACEC
DrawFocusRect.USER32(?,?), ref: 007EACF7
GetSysColor.USER32(00000011), ref: 007EAD05
SetTextColor.GDI32(?,00000000), ref: 007EAD0D
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 007EAD21
SelectObject.GDI32(?,007EA869), ref: 007EAD38
DeleteObject.GDI32(?), ref: 007EAD43
SelectObject.GDI32(?,?), ref: 007EAD49
DeleteObject.GDI32(?), ref: 007EAD4E
SetTextColor.GDI32(?,?), ref: 007EAD54
SetBkColor.GDI32(?,?), ref: 007EAD5E

Strings

@U=u, xrefs: 007EACA7

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID: @U=u
API String ID: 1996641542-2594219639
Opcode ID: cc9d4dafd7ffd9ed41b36df707581f9e740886db8d2f8902a8f6ace716cf469f
Instruction ID: 8f2d46637dc1b189088775b62baeaa61d7f05c90c83e31d3169020472f049157
Opcode Fuzzy Hash: cc9d4dafd7ffd9ed41b36df707581f9e740886db8d2f8902a8f6ace716cf469f
Instruction Fuzzy Hash: 08616171902258FFDF119FA5DC88EAE7B79EB0C320F108125F915AB2A1D6799D40DB90

Function 007CAF7B Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 007CAF89
GetDriveTypeW.KERNEL32(?,007EFAC0,?,\\.\,007EF910), ref: 007CB066
SetErrorMode.KERNEL32(00000000,007EFAC0,?,\\.\,007EF910), ref: 007CB1C4

Strings

PhysicalDrive, xrefs: 007CB012
CDROM, xrefs: 007CB09A
ATAPI, xrefs: 007CB138
Virtual, xrefs: 007CB18C
Fibre, xrefs: 007CB154
RAID, xrefs: 007CB162
ATA, xrefs: 007CB13F
SCSI, xrefs: 007CB131
\\.\, xrefs: 007CAFDB
Unknown, xrefs: 007CB086, 007CB12A
FileBackedVirtual, xrefs: 007CB193
SAS, xrefs: 007CB170
RAMDisk, xrefs: 007CB090
MMC, xrefs: 007CB185
SATA, xrefs: 007CB177
SSD, xrefs: 007CB0F1
1394, xrefs: 007CB146
USB, xrefs: 007CB15B
iSCSI, xrefs: 007CB169
Fixed, xrefs: 007CB0AE
SSA, xrefs: 007CB14D
Network, xrefs: 007CB0A4
Removable, xrefs: 007CB0B8

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 02035378a7dd07424fe5c64ed424fba2b4af9584ed4093b0c3dd1d942573e7da
Instruction ID: b759a9f6c24a727c95889b35697b9d74c93c56f77a5f5290e03c9319d94d1441
Opcode Fuzzy Hash: 02035378a7dd07424fe5c64ed424fba2b4af9584ed4093b0c3dd1d942573e7da
Instruction Fuzzy Hash: 21519430A81249EB8B08DB20C997EB973B5FF14342F28841DF856E7291C73D9E81D642

Function 00766A3C Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00766A91
__wcsnicmp.LIBCMT ref: 00766AA9
__wcsnicmp.LIBCMT ref: 00766AC1
__wcsnicmp.LIBCMT ref: 00766AD9
__wcsnicmp.LIBCMT ref: 00766AF1
__wcsnicmp.LIBCMT ref: 00766B09
__wcsnicmp.LIBCMT ref: 00766B21
__wcsnicmp.LIBCMT ref: 00766B35
__wcsnicmp.LIBCMT ref: 00766B76
__wcsnicmp.LIBCMT ref: 00766B8A
__wcsnicmp.LIBCMT ref: 00766B9E
__wcsnicmp.LIBCMT ref: 00766BB2

Strings

Cannot parse #include, xrefs: 0079E819
Bad directive syntax error, xrefs: 0079E743
#OnAutoItStartRegister, xrefs: 00766AD3
#pragma compile, xrefs: 00766A8B
#comments-end, xrefs: 00766B98
#cs, xrefs: 00766B2F, 00766B84
Unterminated group of comments, xrefs: 0079E82C
#include-once, xrefs: 00766AEB
#requireadmin, xrefs: 00766ABB
#notrayicon, xrefs: 00766AA3
#ce, xrefs: 00766BAC
#comments-start, xrefs: 00766B1B, 00766B70
#include, xrefs: 00766B03

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: fde76ecff91cc283c027e8230f8182343d2ce527670e78032b5efba1a3fdd359
Instruction ID: be2afa429edfe0a148bb816960fb3a95971df76ef34d392ff6a5e2117242b5b0
Opcode Fuzzy Hash: fde76ecff91cc283c027e8230f8182343d2ce527670e78032b5efba1a3fdd359
Instruction Fuzzy Hash: D5813AB0640245FBCF24FBB4DC96FAE7758AF14700F548025FD46AA182EB6CEA45C792

Function 007E8C44 Relevance: 40.7, APIs: 21, Strings: 2, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 007E8D34
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 007E8D45
CharNextW.USER32(0000014E), ref: 007E8D74
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 007E8DB5
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 007E8DCB
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 007E8DDC
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 007E8DF9
SetWindowTextW.USER32(?,0000014E), ref: 007E8E45
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 007E8E5B
SendMessageW.USER32(?,00001002,00000000,?), ref: 007E8E8C
_memset.LIBCMT ref: 007E8EB1
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 007E8EFA
_memset.LIBCMT ref: 007E8F59
SendMessageW.USER32(?,00001053,000000FF,?), ref: 007E8F83
SendMessageW.USER32(?,00001074,?,00000001), ref: 007E8FDB
SendMessageW.USER32(?,0000133D,?,?), ref: 007E9088
InvalidateRect.USER32(?,00000000,00000001), ref: 007E90AA
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 007E90F4
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 007E9121
DrawMenuBar.USER32(?), ref: 007E9130
SetWindowTextW.USER32(?,0000014E), ref: 007E9158

Strings

@U=u, xrefs: 007E8D34, 007E8D45, 007E8D7A, 007E8DF9, 007E8E5B, 007E8E8C, 007E8EFA, 007E8F83, 007E8FDB, 007E9088
0, xrefs: 007E90C2

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0$@U=u
API String ID: 1073566785-975001249
Opcode ID: f55dbe05f2510efabc5951507e857bbf9a6a7170e2b902bb723caaf98cdf4f1e
Instruction ID: ee69f80d6550a9557a714ebd5bd30b71d955469e9cc6daf51611738c528cebf0
Opcode Fuzzy Hash: f55dbe05f2510efabc5951507e857bbf9a6a7170e2b902bb723caaf98cdf4f1e
Instruction Fuzzy Hash: 6FE19471902299EBDF10DF61CC88EEE7B79EF0D710F108155FA199A290DB788A81DF61

Function 007E4B16 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 007E4C51
GetDesktopWindow.USER32 ref: 007E4C66
GetWindowRect.USER32(00000000), ref: 007E4C6D
GetWindowLongW.USER32(?,000000F0), ref: 007E4CCF
DestroyWindow.USER32(?), ref: 007E4CFB
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 007E4D24
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 007E4D42
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 007E4D68
SendMessageW.USER32(?,00000421,?,?), ref: 007E4D7D
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 007E4D90
IsWindowVisible.USER32(?), ref: 007E4DB0
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 007E4DCB
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 007E4DDF
GetWindowRect.USER32(?,?), ref: 007E4DF7
MonitorFromPoint.USER32(?,?,00000002), ref: 007E4E1D
GetMonitorInfoW.USER32(00000000,?), ref: 007E4E37
CopyRect.USER32(?,?), ref: 007E4E4E
SendMessageW.USER32(?,00000412,00000000), ref: 007E4EB9

Strings

tooltips_class32, xrefs: 007E4D1D
(, xrefs: 007E4E2A
0, xrefs: 007E4BFC

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 3b21fa57d4bd573f14144bca3dde4e97f99f5739620d31b3fa21e8afdd2ed667
Instruction ID: 58090f056f1e70d2fccaed08eae93e0764a4aad8b63089aced841a7a46c4726f
Opcode Fuzzy Hash: 3b21fa57d4bd573f14144bca3dde4e97f99f5739620d31b3fa21e8afdd2ed667
Instruction Fuzzy Hash: D8B16D71605380AFDB04DF65C888B6ABBE4FF88314F00891CF9999B2A1D779EC05CB95

Function 007C46D6 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 007C46E8
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 007C470E
_wcscpy.LIBCMT ref: 007C473C
_wcscmp.LIBCMT ref: 007C4747
_wcscat.LIBCMT ref: 007C475D
_wcsstr.LIBCMT ref: 007C4768
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 007C4784
_wcscat.LIBCMT ref: 007C47CD
_wcscat.LIBCMT ref: 007C47D4
_wcsncpy.LIBCMT ref: 007C47FF

Strings

StringFileInfo\, xrefs: 007C4757
\VarFileInfo\Translation, xrefs: 007C477C
DefaultLangCodepage, xrefs: 007C47E7
%u.%u.%u.%u, xrefs: 007C4862
04090000, xrefs: 007C47BA

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: ae638b679fa0e76713c1f028cd905fd4c5fdeb7d810d62eb23f698e8cd04c930
Instruction ID: 807a4a36d0043496e7515feabc8e04c743d68f50142285c09854b1d3ef5aaca6
Opcode Fuzzy Hash: ae638b679fa0e76713c1f028cd905fd4c5fdeb7d810d62eb23f698e8cd04c930
Instruction Fuzzy Hash: FB41F771A44210BBDB10BB648C4AFBF77ACEF45720F00406DF904E6182EB7D994197A5

Function 007627D9 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 007628BC
GetSystemMetrics.USER32(00000007), ref: 007628C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 007628EF
GetSystemMetrics.USER32(00000008), ref: 007628F7
GetSystemMetrics.USER32(00000004), ref: 0076291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00762939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00762949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0076297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00762990
GetClientRect.USER32(00000000,000000FF), ref: 007629AE
GetStockObject.GDI32(00000011), ref: 007629CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 007629D5

Part of subcall function 00762344: GetCursorPos.USER32(?), ref: 00762357
Part of subcall function 00762344: ScreenToClient.USER32(008267B0,?), ref: 00762374
Part of subcall function 00762344: GetAsyncKeyState.USER32(00000001), ref: 00762399
Part of subcall function 00762344: GetAsyncKeyState.USER32(00000002), ref: 007623A7

SetTimer.USER32(00000000,00000000,00000028,00761256), ref: 007629FC

Strings

@U=u, xrefs: 007629D5
AutoIt v3 GUI, xrefs: 00762974

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: @U=u$AutoIt v3 GUI
API String ID: 1458621304-2077007950
Opcode ID: b6c15acae2e001064c8ee0146494b77ccf5ce4f37464a876198156673d27aa0c
Instruction ID: f5a7ec2327c2b026a9c051d180fa665c1f4e74fa78457b42c5bdf86ccf1ad1bf
Opcode Fuzzy Hash: b6c15acae2e001064c8ee0146494b77ccf5ce4f37464a876198156673d27aa0c
Instruction Fuzzy Hash: 47B16D7160164ADFDF14DFA8DC85BAE7BA4FB08310F108229FE16AB290DB789951CB54

Function 007BC4C1 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 007BC4D4
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 007BC4E6
SetWindowTextW.USER32(?,?), ref: 007BC4FD
GetDlgItem.USER32(?,000003EA), ref: 007BC512
SetWindowTextW.USER32(00000000,?), ref: 007BC518
GetDlgItem.USER32(?,000003E9), ref: 007BC528
SetWindowTextW.USER32(00000000,?), ref: 007BC52E
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 007BC54F
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 007BC569
GetWindowRect.USER32(?,?), ref: 007BC572
SetWindowTextW.USER32(?,?), ref: 007BC5DD
GetDesktopWindow.USER32 ref: 007BC5E3
GetWindowRect.USER32(00000000), ref: 007BC5EA
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 007BC636
GetClientRect.USER32(?,?), ref: 007BC643
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 007BC668
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 007BC693

Strings

@U=u, xrefs: 007BC4E6

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID: @U=u
API String ID: 3869813825-2594219639
Opcode ID: 67abf37538ad8474d6efa054979c9d01da105cb9436eaff5dc7d8cd3129307ae
Instruction ID: 8178d4946c0fcb4088db7d5232434a8d266781994834e5e5873e83a4d125238d
Opcode Fuzzy Hash: 67abf37538ad8474d6efa054979c9d01da105cb9436eaff5dc7d8cd3129307ae
Instruction Fuzzy Hash: 18517370900749EFDB21DFA8DD85BAEBBF5FF04704F108528E686A65A0C778B914CB50

Function 007E4069 Relevance: 30.0, APIs: 3, Strings: 14, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 007E40F6
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 007E41B6

Strings

GETSELECTED, xrefs: 007E42E4
SELECT, xrefs: 007E4250
VIEWCHANGE, xrefs: 007E4375
GETTEXT, xrefs: 007E415F
@U=u, xrefs: 007E41B6, 007E41E8
ISSELECTED, xrefs: 007E41C1
SELECTINVERT, xrefs: 007E4286
DESELECT, xrefs: 007E42A4
SELECTALL, xrefs: 007E421D
FINDITEM, xrefs: 007E4329
GETSELECTEDCOUNT, xrefs: 007E4199
GETITEMCOUNT, xrefs: 007E4128
GETSUBITEMCOUNT, xrefs: 007E4141
SELECTCLEAR, xrefs: 007E4235

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: @U=u$DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-1753161424
Opcode ID: e8acf8d743804631b536a6992669941e2ca88de90f131c591d2a7e1eea6dfd13
Instruction ID: 72c6597f3064279666f83c11282afaaba053cb1d698fdeb6463a2e5da9262ee3
Opcode Fuzzy Hash: e8acf8d743804631b536a6992669941e2ca88de90f131c591d2a7e1eea6dfd13
Instruction Fuzzy Hash: 88A19330215341DBCB14EF61C855AAAB3E9FF88314F14896CB9969B7D2DB38EC09CB51

Function 007D52F0 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 007D5309
LoadCursorW.USER32(00000000,00007F8A), ref: 007D5314
LoadCursorW.USER32(00000000,00007F00), ref: 007D531F
LoadCursorW.USER32(00000000,00007F03), ref: 007D532A
LoadCursorW.USER32(00000000,00007F8B), ref: 007D5335
LoadCursorW.USER32(00000000,00007F01), ref: 007D5340
LoadCursorW.USER32(00000000,00007F81), ref: 007D534B
LoadCursorW.USER32(00000000,00007F88), ref: 007D5356
LoadCursorW.USER32(00000000,00007F80), ref: 007D5361
LoadCursorW.USER32(00000000,00007F86), ref: 007D536C
LoadCursorW.USER32(00000000,00007F83), ref: 007D5377
LoadCursorW.USER32(00000000,00007F85), ref: 007D5382
LoadCursorW.USER32(00000000,00007F82), ref: 007D538D
LoadCursorW.USER32(00000000,00007F84), ref: 007D5398
LoadCursorW.USER32(00000000,00007F04), ref: 007D53A3
LoadCursorW.USER32(00000000,00007F02), ref: 007D53AE
GetCursorInfo.USER32(?), ref: 007D53BE
GetLastError.KERNEL32(00000001,00000000), ref: 007D53E9

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 445b222eb6664c0c7379a859c1f93f17732fc5cfee9aaa39ff35120df28c6430
Instruction ID: e35dffed0af081c42e279bfc6ab000d6eebb63b4b2adef1c7f2597b87cbba234
Opcode Fuzzy Hash: 445b222eb6664c0c7379a859c1f93f17732fc5cfee9aaa39ff35120df28c6430
Instruction Fuzzy Hash: 2D415170E04319ABDB109FBA8C4996EFFF8EF55B50B10452FE509E7290DAB8A501CE61

Function 007BAA64 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 007BAAA5
__swprintf.LIBCMT ref: 007BAB46
_wcscmp.LIBCMT ref: 007BAB59
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 007BABAE
_wcscmp.LIBCMT ref: 007BABEA
GetClassNameW.USER32(?,?,00000400), ref: 007BAC21
GetDlgCtrlID.USER32(?), ref: 007BAC73
GetWindowRect.USER32(?,?), ref: 007BACA9
GetParent.USER32(?), ref: 007BACC7
ScreenToClient.USER32(00000000), ref: 007BACCE
GetClassNameW.USER32(?,?,00000100), ref: 007BAD48
_wcscmp.LIBCMT ref: 007BAD5C
GetWindowTextW.USER32(?,?,00000400), ref: 007BAD82
_wcscmp.LIBCMT ref: 007BAD96

Part of subcall function 0078386C: _iswctype.LIBCMT ref: 00783874

Strings

%s%u, xrefs: 007BAB40

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: ca5997584773b392f9b8675c40e7afc1c7c48dadb985b5f7a33a34745f90bd9e
Instruction ID: a46b0645689101994d5249b2935ebf959b420b8d5f1fd4be0fd4911644439651
Opcode Fuzzy Hash: ca5997584773b392f9b8675c40e7afc1c7c48dadb985b5f7a33a34745f90bd9e
Instruction Fuzzy Hash: F2A1C071204246BBD714EF24C884BEAB7E8FF04315F008629F9A9C2591D738E945CBA2

Function 007BB397 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 007BB3DB
_wcscmp.LIBCMT ref: 007BB3EC
GetWindowTextW.USER32(00000001,?,00000400), ref: 007BB414
CharUpperBuffW.USER32(?,00000000), ref: 007BB431
_wcscmp.LIBCMT ref: 007BB44F
_wcsstr.LIBCMT ref: 007BB460
GetClassNameW.USER32(00000018,?,00000400), ref: 007BB498
_wcscmp.LIBCMT ref: 007BB4A8
GetWindowTextW.USER32(00000002,?,00000400), ref: 007BB4CF
GetClassNameW.USER32(00000018,?,00000400), ref: 007BB518
_wcscmp.LIBCMT ref: 007BB528
GetClassNameW.USER32(00000010,?,00000400), ref: 007BB550
GetWindowRect.USER32(00000004,?), ref: 007BB5B9

Strings

ThumbnailClass, xrefs: 007BB4A3, 007BB523
@, xrefs: 007BB3BC

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 8f48d2a9103431b56fdd131add58feb56a9188b2891c583113f3a1f23bfd6a76
Instruction ID: 67f37271af59c99b8604599541f3665c7cb2f756deeb6349aac6822df54f8b05
Opcode Fuzzy Hash: 8f48d2a9103431b56fdd131add58feb56a9188b2891c583113f3a1f23bfd6a76
Instruction Fuzzy Hash: 63818D710083459BDB14DF14C889FEA7BE8FF44718F048569FD899A092DBB8DE49CB61

Function 007EA428 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007EA4C8
DestroyWindow.USER32(?,?), ref: 007EA542

Part of subcall function 00767D2C: _memmove.LIBCMT ref: 00767D66

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 007EA5BC
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 007EA5DE
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 007EA5F1
DestroyWindow.USER32(00000000), ref: 007EA613
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00760000,00000000), ref: 007EA64A
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 007EA663
GetDesktopWindow.USER32 ref: 007EA67C
GetWindowRect.USER32(00000000), ref: 007EA683
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 007EA69B
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 007EA6B3

Part of subcall function 007625DB: GetWindowLongW.USER32(?,000000EB), ref: 007625EC

Strings

@U=u, xrefs: 007EA5DE, 007EA5F1, 007EA663, 007EA68D
tooltips_class32, xrefs: 007EA5B5, 007EA643
0, xrefs: 007EA4DE

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$@U=u$tooltips_class32
API String ID: 1297703922-1130792468
Opcode ID: dea8cd1385c8c78cfd6611a73f1b1d9d943959d22b7f8ad38df64a7e036cc5f3
Instruction ID: 99a489da8bac3b2bb0bc38a88eb46badac0dfcc3e5e242762825d87ed9168592
Opcode Fuzzy Hash: dea8cd1385c8c78cfd6611a73f1b1d9d943959d22b7f8ad38df64a7e036cc5f3
Instruction Fuzzy Hash: CD717971141285AFD720CF28CC49F667BE5FB8D304F08852DF9958B2A1D778E952CB16

Function 007EC8EE Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00762612: GetWindowLongW.USER32(?,000000EB), ref: 00762623

DragQueryPoint.SHELL32(?,?), ref: 007EC917

Part of subcall function 007EADF1: ClientToScreen.USER32(?,?), ref: 007EAE1A
Part of subcall function 007EADF1: GetWindowRect.USER32(?,?), ref: 007EAE90
Part of subcall function 007EADF1: PtInRect.USER32(?,?,007EC304), ref: 007EAEA0

SendMessageW.USER32(?,000000B0,?,?), ref: 007EC980
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 007EC98B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 007EC9AE
_wcscat.LIBCMT ref: 007EC9DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 007EC9F5
SendMessageW.USER32(?,000000B0,?,?), ref: 007ECA0E
SendMessageW.USER32(?,000000B1,?,?), ref: 007ECA25
SendMessageW.USER32(?,000000B1,?,?), ref: 007ECA47
DragFinish.SHELL32(?), ref: 007ECA4E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 007ECB41

Strings

@GUI_DROPID, xrefs: 007ECA6E
@U=u, xrefs: 007EC980, 007EC9F5, 007ECA0E, 007ECA25, 007ECA47
@GUI_DRAGFILE, xrefs: 007ECAF0
@GUI_DRAGID, xrefs: 007ECAB9

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$@U=u
API String ID: 169749273-762882726
Opcode ID: b4b6e733f16e7a10c2e7cbc92fe9990cb91491578c481e0f085fbdd83a0a3116
Instruction ID: be62e183260878a1c12966a2336cb3b86ba3d9c5f679a6aa406f999e4a32d43c
Opcode Fuzzy Hash: b4b6e733f16e7a10c2e7cbc92fe9990cb91491578c481e0f085fbdd83a0a3116
Instruction Fuzzy Hash: 04618C71109380AFC701DF64DC89D9FBBE8FF89710F004A2EF692961A1DB749A49CB52

Function 007BB1E0 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 007BB23F

Strings

[LAST, xrefs: 007BB2EC
[ACTIVE, xrefs: 007BB22C
HANDLE=, xrefs: 007BB238
[CLASS:, xrefs: 007BB28F
ACTIVE, xrefs: 007BB21A
REGEXP=, xrefs: 007BB254
ALL, xrefs: 007BB2D3
[ALL, xrefs: 007BB2E5
[HANDLE:, xrefs: 007BB24B
[REGEXPTITLE:, xrefs: 007BB267
LAST, xrefs: 007BB204
CLASSNAME=, xrefs: 007BB27C

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 9baa9dfffd4321c0c0dd18922f7303bbfd9d12491e9a1fd0b41617e1f56bce88
Instruction ID: ae62514093c3be99b861913143f0cc9ebe9a37c5cc9fb0cf3a5de6ed11087d52
Opcode Fuzzy Hash: 9baa9dfffd4321c0c0dd18922f7303bbfd9d12491e9a1fd0b41617e1f56bce88
Instruction Fuzzy Hash: 84316131A44205E6DB14FA60CD67FEE77A8BF20B50F600515F892B11D1EF9DAE44C651

Function 007E4619 Relevance: 24.8, APIs: 2, Strings: 12, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 007E46AB
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 007E46F6

Strings

@U=u, xrefs: 007E46F6
GETSELECTED, xrefs: 007E4806
EXPAND, xrefs: 007E47A8
UNCHECK, xrefs: 007E48D2
CHECK, xrefs: 007E4716
GETTOTALCOUNT, xrefs: 007E46DD
GETITEMCOUNT, xrefs: 007E47D8
SELECT, xrefs: 007E48A7
COLLAPSE, xrefs: 007E473C
ISCHECKED, xrefs: 007E4879
EXISTS, xrefs: 007E475F
GETTEXT, xrefs: 007E4849

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: @U=u$CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-383632319
Opcode ID: 7c92015d1856a89d60d488506ab53b9b460d8ee71f281751832b2572ceaf7685
Instruction ID: dad9957c090e5bb0c1422858ed02d69d947a1f0774c2027b59bf042630d7cf6f
Opcode Fuzzy Hash: 7c92015d1856a89d60d488506ab53b9b460d8ee71f281751832b2572ceaf7685
Instruction Fuzzy Hash: E9917D34204341DFCB14EF61C455AAAB7E6AF98314F04845CF9966B7A2CB38FD4ACB91

Function 007EBAB8 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 007EBB6E
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,007E6D80,?), ref: 007EBBCA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 007EBC03
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 007EBC46
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 007EBC7D
FreeLibrary.KERNEL32(?), ref: 007EBC89
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 007EBC99
DestroyIcon.USER32(?), ref: 007EBCA8
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 007EBCC5
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 007EBCD1

Part of subcall function 0078313D: __wcsicmp_l.LIBCMT ref: 007831C6

Strings

.exe, xrefs: 007EBB04
@U=u, xrefs: 007EBCB1
.dll, xrefs: 007EBB27
.icl, xrefs: 007EBAE4

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl$@U=u
API String ID: 1212759294-1639919054
Opcode ID: 161d2c783c14aed11bd78cbde024aad9ae708c4321a47c457e9f9f2cf5c75100
Instruction ID: 557a5b2d53edc320f3b00ec46dab8d28356cbe75e6f8bcc77ac58b8136fcc8e9
Opcode Fuzzy Hash: 161d2c783c14aed11bd78cbde024aad9ae708c4321a47c457e9f9f2cf5c75100
Instruction Fuzzy Hash: FB61E171501298FAEB14DF65CC89BBB7BACEB0CB10F108115F915DA1D0DB78A980CBA0

Function 007CA5BD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00769997: __itow.LIBCMT ref: 007699C2
Part of subcall function 00769997: __swprintf.LIBCMT ref: 00769A0C

CharLowerBuffW.USER32(?,?), ref: 007CA636
GetDriveTypeW.KERNEL32 ref: 007CA683
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 007CA6CB
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 007CA702
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 007CA730

Part of subcall function 00767D2C: _memmove.LIBCMT ref: 00767D66

Strings

open, xrefs: 007CA65D
closed, xrefs: 007CA64A, 007CA653
type cdaudio alias cd wait, xrefs: 007CA6AE
close cd wait, xrefs: 007CA71B
close, xrefs: 007CA63C
wait, xrefs: 007CA6ED
set cd door , xrefs: 007CA6D1
open , xrefs: 007CA692

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 38f7223be7db7adc37772b5e7016e8a6da7baa1ecfe327bfc15d44d3516d2737
Instruction ID: c237177929dcde73b534514f02efcc2ba3a0683203f492f68720b3c383e692aa
Opcode Fuzzy Hash: 38f7223be7db7adc37772b5e7016e8a6da7baa1ecfe327bfc15d44d3516d2737
Instruction Fuzzy Hash: E8513971104304DFC704EF20C8959AAB7E8FF98758F04896DF89697261DB39EE0ACB52

Function 007CA45A Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 007CA47A
__swprintf.LIBCMT ref: 007CA49C
CreateDirectoryW.KERNEL32(?,00000000), ref: 007CA4D9
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 007CA4FE
_memset.LIBCMT ref: 007CA51D
_wcsncpy.LIBCMT ref: 007CA559
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 007CA58E
CloseHandle.KERNEL32(00000000), ref: 007CA599
RemoveDirectoryW.KERNEL32(?), ref: 007CA5A2
CloseHandle.KERNEL32(00000000), ref: 007CA5AC

Strings

\??\%s, xrefs: 007CA496
:, xrefs: 007CA4BD
\, xrefs: 007CA4B2

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 3b099edd4fc0bd33a93e58ac5a89462ad297cc1f39a6c379a1b37ce7194f4ad8
Instruction ID: a457d1f722cc2ad0f121400e55eac17d2044c7a28b2561fa4fcf0858a9587082
Opcode Fuzzy Hash: 3b099edd4fc0bd33a93e58ac5a89462ad297cc1f39a6c379a1b37ce7194f4ad8
Instruction Fuzzy Hash: C931A271900149ABDB219FA0DC48FEB77BCEF88705F1080BAF908D6150E77897558B25

Function 007EC49C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00762612: GetWindowLongW.USER32(?,000000EB), ref: 00762623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 007EC4EC
GetFocus.USER32 ref: 007EC4FC
GetDlgCtrlID.USER32(00000000), ref: 007EC507
_memset.LIBCMT ref: 007EC632
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 007EC65D
GetMenuItemCount.USER32(?), ref: 007EC67D
GetMenuItemID.USER32(?,00000000), ref: 007EC690
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 007EC6C4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 007EC70C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 007EC744
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 007EC779

Strings

0, xrefs: 007EC62A

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 90e4c2f0b94b6ab6a1cd839c97dc107f91b4043e88928daa0077b6fe88e938f4
Instruction ID: c252858b438e532d86f39f7a344c79a8330ffc176b52161909de3bd1f4474620
Opcode Fuzzy Hash: 90e4c2f0b94b6ab6a1cd839c97dc107f91b4043e88928daa0077b6fe88e938f4
Instruction Fuzzy Hash: 9581CE7420A3819FD721DF15C884A6BBBE8FB8C314F10492DF99597291D738D916CFA2

Function 007B83F4 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 007B874A: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 007B8766
Part of subcall function 007B874A: GetLastError.KERNEL32(?,007B822A,?,?,?), ref: 007B8770
Part of subcall function 007B874A: GetProcessHeap.KERNEL32(00000008,?,?,007B822A,?,?,?), ref: 007B877F
Part of subcall function 007B874A: HeapAlloc.KERNEL32(00000000,?,007B822A,?,?,?), ref: 007B8786
Part of subcall function 007B874A: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 007B879D

Part of subcall function 007B87E7: GetProcessHeap.KERNEL32(00000008,007B8240,00000000,00000000,?,007B8240,?), ref: 007B87F3
Part of subcall function 007B87E7: HeapAlloc.KERNEL32(00000000,?,007B8240,?), ref: 007B87FA
Part of subcall function 007B87E7: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,007B8240,?), ref: 007B880B

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 007B8458
_memset.LIBCMT ref: 007B846D
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 007B848C
GetLengthSid.ADVAPI32(?), ref: 007B849D
GetAce.ADVAPI32(?,00000000,?), ref: 007B84DA
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 007B84F6
GetLengthSid.ADVAPI32(?), ref: 007B8513
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 007B8522
HeapAlloc.KERNEL32(00000000), ref: 007B8529
GetLengthSid.ADVAPI32(?,00000008,?), ref: 007B854A
CopySid.ADVAPI32(00000000), ref: 007B8551
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 007B8582
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 007B85A8
SetUserObjectSecurity.USER32(?,00000004,?), ref: 007B85BC

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 68cddea5598add7b642c266baaee865704de415d3690bb2872ddb53baf953866
Instruction ID: 312c8adf12ea607049ad4eb0d484df5a35ac17621c57c4614a058dc4e082b933
Opcode Fuzzy Hash: 68cddea5598add7b642c266baaee865704de415d3690bb2872ddb53baf953866
Instruction Fuzzy Hash: 7B613971900209EBDF50DFA4DC85AEEBBB9FF08304F148169F815AA291DB399A15CF61

Function 007D762D Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 007D76A2
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 007D76AE
CreateCompatibleDC.GDI32(?), ref: 007D76BA
SelectObject.GDI32(00000000,?), ref: 007D76C7
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 007D771B
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 007D7757
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 007D777B
SelectObject.GDI32(00000006,?), ref: 007D7783
DeleteObject.GDI32(?), ref: 007D778C
DeleteDC.GDI32(00000006), ref: 007D7793
ReleaseDC.USER32(00000000,?), ref: 007D779E

Strings

(, xrefs: 007D7723

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 97d35b630b7bb9ff08ac15314a406774c51a1e943e4bd2e39d412f6f12564d66
Instruction ID: 958ca6a8252b867acb0bd7f2e60ea8c3870c16c8b40ba5316fec75bcdeadf7be
Opcode Fuzzy Hash: 97d35b630b7bb9ff08ac15314a406774c51a1e943e4bd2e39d412f6f12564d66
Instruction Fuzzy Hash: 0D512975904249EFCB15CFA8CC85EAEBBB9EF48710F14C52AF94997310E635A940CB64

Function 007CA0B5 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,007EFB78), ref: 007CA0FC

Part of subcall function 00767F41: _memmove.LIBCMT ref: 00767F82

LoadStringW.USER32(?,?,00000FFF,?), ref: 007CA11E
__swprintf.LIBCMT ref: 007CA177
__swprintf.LIBCMT ref: 007CA190
_wprintf.LIBCMT ref: 007CA246
_wprintf.LIBCMT ref: 007CA264

Strings

^ ERROR, xrefs: 007CA1E8
"%s" (%d) : ==> %s:, xrefs: 007CA25F
Line %d (File "%s"):, xrefs: 007CA171, 007CA18A
Error: , xrefs: 007CA20E
"%s" (%d) : ==> %s:%s%s, xrefs: 007CA241

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: db7ebdeaf3a3726b7d225330b84e20acd693f8314a5b2d4042a583ce496903a8
Instruction ID: 846e4a9669d5b48c3d5c53bff681de993d8f0658a686183fe680a0d30764c625
Opcode Fuzzy Hash: db7ebdeaf3a3726b7d225330b84e20acd693f8314a5b2d4042a583ce496903a8
Instruction Fuzzy Hash: A6514E71900109FBCF19EBE0CD8AEEEB779BF04304F104169F916621A1EB396E59DB61

Function 007C5217 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 007C521C

Part of subcall function 00780719: timeGetTime.WINMM(?,753DB400,00770FF9), ref: 0078071D

Sleep.KERNEL32(0000000A), ref: 007C5248
EnumThreadWindows.USER32(?,Function_000651CA,00000000), ref: 007C526C
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 007C528E
SetActiveWindow.USER32 ref: 007C52AD
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 007C52BB
SendMessageW.USER32(00000010,00000000,00000000), ref: 007C52DA
Sleep.KERNEL32(000000FA), ref: 007C52E5
IsWindow.USER32 ref: 007C52F1
EndDialog.USER32(00000000), ref: 007C5302

Strings

@U=u, xrefs: 007C52BB, 007C52DA
BUTTON, xrefs: 007C5280

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: @U=u$BUTTON
API String ID: 1194449130-2582809321
Opcode ID: aa4c95549b392c4e8c59fd2a370e285cc47349334d23520fc824ff8627269f1e
Instruction ID: 15aed2744ba87d8a65d355e4f4fd64578699bd8270f1252d28abec16b9821921
Opcode Fuzzy Hash: aa4c95549b392c4e8c59fd2a370e285cc47349334d23520fc824ff8627269f1e
Instruction Fuzzy Hash: C421C6B0105B84EFE7105B30EDC8F257BA9FB59346F04842CF401865B1DB7EAD918725

Function 00766BEC Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00780B9B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00766C6C,?,00008000), ref: 00780BB7

Part of subcall function 007648AE: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007648A1,?,?,007637C0,?), ref: 007648CE

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00766D0D
SetCurrentDirectoryW.KERNEL32(?), ref: 00766E5A

Part of subcall function 007659CD: _wcscpy.LIBCMT ref: 00765A05

Part of subcall function 0078387D: _iswctype.LIBCMT ref: 00783885

Strings

Error opening the file, xrefs: 0079E866, 0079E8E1
Unterminated string, xrefs: 0079EC0D
#include depth exceeded. Make sure there are no recursive includes, xrefs: 0079E84A
>>>AUTOIT SCRIPT<<<, xrefs: 0079E8BF
Bad directive syntax error, xrefs: 0079EBC6
AU3!, xrefs: 00766CC1
EA06, xrefs: 0079E87B

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: 2cb26c709a1c92dc31f92fe7fde7a3ebf87a46031747f48e922c8ec4d4a286ca
Instruction ID: a920c36c4bbd56dbeb8515d603071109ce01eda9327f1ec21f9aa64495e4150e
Opcode Fuzzy Hash: 2cb26c709a1c92dc31f92fe7fde7a3ebf87a46031747f48e922c8ec4d4a286ca
Instruction Fuzzy Hash: 2A029B70108340DFCB24EF24C895AAFBBE5BF98354F44491DF886972A2DB39D949CB52

Function 007645DF Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007645F9
GetMenuItemCount.USER32(00826890), ref: 0079D7CD
GetMenuItemCount.USER32(00826890), ref: 0079D87D
GetCursorPos.USER32(?), ref: 0079D8C1
SetForegroundWindow.USER32(00000000), ref: 0079D8CA
TrackPopupMenuEx.USER32(00826890,00000000,?,00000000,00000000,00000000), ref: 0079D8DD
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 0079D8E9

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: 9d7f3ee62f5c0cc6745ba0035d8a4454bc6db914f25f676cf785b09de70a4408
Instruction ID: d80b2a68d72635d60e50b142533c13e589756eb60edae9a329d06853639c9cd9
Opcode Fuzzy Hash: 9d7f3ee62f5c0cc6745ba0035d8a4454bc6db914f25f676cf785b09de70a4408
Instruction Fuzzy Hash: CE710670601205BEEF308F54EC89FAABF65FF05364F204216F515AA1E1C7B96C20DB95

Function 007E10A5 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,007E0038,?,?), ref: 007E10BC

Strings

HKCR, xrefs: 007E1164
HKCC, xrefs: 007E118A
HKEY_CURRENT_CONFIG, xrefs: 007E1179
HKCU, xrefs: 007E11AC
HKEY_USERS, xrefs: 007E11BD
HKEY_CLASSES_ROOT, xrefs: 007E114F
HKLM, xrefs: 007E113A
HKU, xrefs: 007E11CE
HKEY_LOCAL_MACHINE, xrefs: 007E1125
HKEY_CURRENT_USER, xrefs: 007E119B

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 5f79c475b2466b268c0aa4ba1925b196a4928db77e48006104078e7d22ea8bba
Instruction ID: dca46495ef00fd9ccfd7c3eefbc3eb54ddd1deb1800a267915a14f73dd845cf8
Opcode Fuzzy Hash: 5f79c475b2466b268c0aa4ba1925b196a4928db77e48006104078e7d22ea8bba
Instruction Fuzzy Hash: 5A414F3035128EDBCF10EFA1DC96AEA3729FF19340F914454EE919B251D738AD5ACBA0

Function 007E772A Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 007E77CD
CreateCompatibleDC.GDI32(00000000), ref: 007E77D4
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 007E77E7
SelectObject.GDI32(00000000,00000000), ref: 007E77EF
GetPixel.GDI32(00000000,00000000,00000000), ref: 007E77FA
DeleteDC.GDI32(00000000), ref: 007E7803
GetWindowLongW.USER32(?,000000EC), ref: 007E780D
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 007E7821
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 007E782D

Strings

@U=u, xrefs: 007E77E7
static, xrefs: 007E7765

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: @U=u$static
API String ID: 2559357485-3553413495
Opcode ID: df145d15a3232b6e0f119297cfcdb9bd5431f1474951d2074bf4d316b33ea5f7
Instruction ID: c9190c85b737a02906e49a21d2550a07780cc5f38d0171ce3ca31c6a282ed4dc
Opcode Fuzzy Hash: df145d15a3232b6e0f119297cfcdb9bd5431f1474951d2074bf4d316b33ea5f7
Instruction Fuzzy Hash: E4318C31106199BBDF159FA5DC48FEA3B69FF0D324F114224FA15AA0A0C739D821DBA4

Function 007C5569 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00767D2C: _memmove.LIBCMT ref: 00767D66

Part of subcall function 00767A84: _memmove.LIBCMT ref: 00767B0D

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 007C55D2
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 007C55E8
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 007C55F9
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 007C560B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 007C561C

Strings

play PlayMe wait, xrefs: 007C5606
alias PlayMe, xrefs: 007C55AB
status PlayMe mode, xrefs: 007C55CD
open , xrefs: 007C5581
close PlayMe, xrefs: 007C55E3, 007C5610
play PlayMe, xrefs: 007C5617

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 983a5e01de3eb765e7233a91eeeb2b9e7381a467d7b80e01e3dc335d50240d54
Instruction ID: 2fced1eb5379ec026f5886bfe608dc622365f935f0f5efe799dddce728517c3f
Opcode Fuzzy Hash: 983a5e01de3eb765e7233a91eeeb2b9e7381a467d7b80e01e3dc335d50240d54
Instruction Fuzzy Hash: A2110830A51159B9D728B6A1CC49EFFBB7CFF91F44F40041DB822E21C2DE691D84C5A1

Function 007C48F3 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 007C490E
gethostname.WSOCK32(?,00000100), ref: 007C4928
gethostbyname.WSOCK32(?), ref: 007C4935
_wcscpy.LIBCMT ref: 007C495D
_memmove.LIBCMT ref: 007C4970
inet_ntoa.WSOCK32(?), ref: 007C497B
_strcat.LIBCMT ref: 007C4989
_wcscpy.LIBCMT ref: 007C49A0
WSACleanup.WSOCK32 ref: 007C49AE
_wcscpy.LIBCMT ref: 007C49BC

Strings

0.0.0.0, xrefs: 007C4957

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: cb66440c0ac06762a88cbfa0a24a14bf3e0b421fe7fcaefbc34977e735eef607
Instruction ID: c6ab23b2f81fb4bbf11808d7bc63094b30efd179b66b267126f9fb25b08bbb4b
Opcode Fuzzy Hash: cb66440c0ac06762a88cbfa0a24a14bf3e0b421fe7fcaefbc34977e735eef607
Instruction Fuzzy Hash: 7611D231904125EBCB24AB24DC4AFDB77ACDF44720F0441BEF94496092EF7DAA828B61

Function 007CD7F8 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00769997: __itow.LIBCMT ref: 007699C2
Part of subcall function 00769997: __swprintf.LIBCMT ref: 00769A0C

CoInitialize.OLE32(00000000), ref: 007CD855
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 007CD8E8
SHGetDesktopFolder.SHELL32(?), ref: 007CD8FC
CoCreateInstance.OLE32(007F2D7C,00000000,00000001,0081A89C,?), ref: 007CD948
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 007CD9B7
CoTaskMemFree.OLE32(?,?), ref: 007CDA0F
_memset.LIBCMT ref: 007CDA4C
SHBrowseForFolderW.SHELL32(?), ref: 007CDA88
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 007CDAAB
CoTaskMemFree.OLE32(00000000), ref: 007CDAB2
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 007CDAE9
CoUninitialize.OLE32(00000001,00000000), ref: 007CDAEB

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: c03ffa73388f89061d9631d927c55c801027f517df37b114511c68be16d448dd
Instruction ID: cfb8859fd34127dcffe1e5982193cae92818b93b2d468f2e57c6b1f434452757
Opcode Fuzzy Hash: c03ffa73388f89061d9631d927c55c801027f517df37b114511c68be16d448dd
Instruction Fuzzy Hash: F4B1EB75A00109EFDB14DFA5C888EAEBBF9EF48314B148469F90AEB251DB34ED45CB50

Function 007C052C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 007C05A7
SetKeyboardState.USER32(?), ref: 007C0612
GetAsyncKeyState.USER32(000000A0), ref: 007C0632
GetKeyState.USER32(000000A0), ref: 007C0649
GetAsyncKeyState.USER32(000000A1), ref: 007C0678
GetKeyState.USER32(000000A1), ref: 007C0689
GetAsyncKeyState.USER32(00000011), ref: 007C06B5
GetKeyState.USER32(00000011), ref: 007C06C3
GetAsyncKeyState.USER32(00000012), ref: 007C06EC
GetKeyState.USER32(00000012), ref: 007C06FA
GetAsyncKeyState.USER32(0000005B), ref: 007C0723
GetKeyState.USER32(0000005B), ref: 007C0731

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: f43ffd5bdd9c430bbbeaf9eeb99f48527d2bc6e8777f53fdd916394982a80e77
Instruction ID: 09f892753b235a7c9f7bc1a06eae9469231219d11dfe05ee2f80e0a903e5ddba
Opcode Fuzzy Hash: f43ffd5bdd9c430bbbeaf9eeb99f48527d2bc6e8777f53fdd916394982a80e77
Instruction Fuzzy Hash: 3951C920A047889AFF35DBA08454FEAAFB49F12380F48459DD5C25A5C2DA6CAB5CCBD1

Function 007BC72A Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 007BC746
GetWindowRect.USER32(00000000,?), ref: 007BC758
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 007BC7B6
GetDlgItem.USER32(?,00000002), ref: 007BC7C1
GetWindowRect.USER32(00000000,?), ref: 007BC7D3
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 007BC827
GetDlgItem.USER32(?,000003E9), ref: 007BC835
GetWindowRect.USER32(00000000,?), ref: 007BC846
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 007BC889
GetDlgItem.USER32(?,000003EA), ref: 007BC897
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 007BC8B4
InvalidateRect.USER32(?,00000000,00000001), ref: 007BC8C1

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: ca072e831f6d2606402aa05ac2bccd047b273c66a8db86e77671fb89df6c5b0f
Instruction ID: c2090961a0179097a14de6d8336451b257095118c4f2df11e56bad6a6397c4ad
Opcode Fuzzy Hash: ca072e831f6d2606402aa05ac2bccd047b273c66a8db86e77671fb89df6c5b0f
Instruction Fuzzy Hash: 7E513E71B00205AFDB18CFA9DD99BAEBBBAEB88311F14C12DF516D7290DB749D008B54

Function 0076201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00761B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00762036,?,00000000,?,?,?,?,007616CB,00000000,?), ref: 00761B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 007620D3
KillTimer.USER32(-00000001,?,?,?,?,007616CB,00000000,?,?,00761AE2,?,?), ref: 0076216E
DestroyAcceleratorTable.USER32(00000000), ref: 0079BEF6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,007616CB,00000000,?,?,00761AE2,?,?), ref: 0079BF27
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,007616CB,00000000,?,?,00761AE2,?,?), ref: 0079BF3E
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,007616CB,00000000,?,?,00761AE2,?,?), ref: 0079BF5A
DeleteObject.GDI32(00000000), ref: 0079BF6C

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: b0845a2904823b0267b496a017a6c2cc9ebfdf680d92015b8d96453cd930eaac
Instruction ID: 2de9532a88d9a9f6139e841045b5dff85e67d6b32146853d5acde0ed4d19aa04
Opcode Fuzzy Hash: b0845a2904823b0267b496a017a6c2cc9ebfdf680d92015b8d96453cd930eaac
Instruction Fuzzy Hash: EF61AC30105A50DFCB799F14EE88B29B7F2FF44312F148528E9439A962C77DA8A2DF50

Function 007621A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 007625DB: GetWindowLongW.USER32(?,000000EB), ref: 007625EC

GetSysColor.USER32(0000000F), ref: 007621D3

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 569632832d2f80e23d12101b2e93533ee9593f06184fc9760bca9db042efe88c
Instruction ID: 1b235aabe0dcd679a2c70d778931e68f119443cc848472464f2169cdc6428e59
Opcode Fuzzy Hash: 569632832d2f80e23d12101b2e93533ee9593f06184fc9760bca9db042efe88c
Instruction Fuzzy Hash: B141B1310015889FDF215F28EC98BB93765FB0A331F158265FE668E1E2C7398D52DB15

Function 007CAB12 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,007EF910), ref: 007CAB76
GetDriveTypeW.KERNEL32(00000061,0081A620,00000061), ref: 007CAC40
_wcscpy.LIBCMT ref: 007CAC6A

Strings

unknown, xrefs: 007CAC01
cdrom, xrefs: 007CAB92
network, xrefs: 007CABD4
ramdisk, xrefs: 007CABEA
all, xrefs: 007CAB7C
fixed, xrefs: 007CABBE
removable, xrefs: 007CABA8

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 721afc8ad9cd8b6ec41ba8e373b5dc2393d6c439547ca4ec85fde70b40d2bce3
Instruction ID: f24a11ed1b0f512313500ddc8194f2bca3a9dbc8ee2d0f152544f865cbdacecb
Opcode Fuzzy Hash: 721afc8ad9cd8b6ec41ba8e373b5dc2393d6c439547ca4ec85fde70b40d2bce3
Instruction Fuzzy Hash: A551D370208305EBC714EF54C885EAAB7AAFF84305F14481DF986972A2DB39ED49CB53

Function 007E88B4 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 007E896E

Strings

@U=u, xrefs: 007E89A4

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: InvalidateRect
String ID: @U=u
API String ID: 634782764-2594219639
Opcode ID: ba8ba7b072eb19e95d38b13d37a53f1e3db92a4636d3c0b7c733d289e0b43c66
Instruction ID: 7fef670b55a8c57c3c43c89b896040dcd34146540bd7d509d2b83481d2423741
Opcode Fuzzy Hash: ba8ba7b072eb19e95d38b13d37a53f1e3db92a4636d3c0b7c733d289e0b43c66
Instruction Fuzzy Hash: 7751B5305022C4FFDF609F26CC89B693B65FB0C310F508526F919EA5E1DF79A9909B82

Function 00762B72 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0079C547
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0079C569
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0079C581
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0079C59F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0079C5C0
DestroyIcon.USER32(00000000), ref: 0079C5CF
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0079C5EC
DestroyIcon.USER32(?), ref: 0079C5FB

Part of subcall function 007EA71E: DeleteObject.GDI32(00000000), ref: 007EA757

Strings

@U=u, xrefs: 0079C5C0, 0079C5EC

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID: @U=u
API String ID: 2819616528-2594219639
Opcode ID: abc1c0462325e9d9f80d3318eee27ebbde6226a752512aee7fb779097d9e6db3
Instruction ID: f6981c486da9b4e026c5159f076222f253b754f118c3740259e8044844faf057
Opcode Fuzzy Hash: abc1c0462325e9d9f80d3318eee27ebbde6226a752512aee7fb779097d9e6db3
Instruction Fuzzy Hash: CD514870600609EFDF24DF24DC85FAA37B5EB58350F104528F906AB6A0EB78ED91DB60

Function 00769997 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 007699C2
__swprintf.LIBCMT ref: 00769A0C
__i64tow.LIBCMT ref: 0079FA0F

Strings

True, xrefs: 0079F9D0
False, xrefs: 0079F9D7
%.15g, xrefs: 00769A06
0x%p, xrefs: 0079F9F1

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 226e600bd1cc92542f909d271cadbdad1d064380d990da35f488db0e129085b0
Instruction ID: ca267d2b17789c4f93dd8b95ba71b9491a5477716c956b3377e281a063f8ce1d
Opcode Fuzzy Hash: 226e600bd1cc92542f909d271cadbdad1d064380d990da35f488db0e129085b0
Instruction Fuzzy Hash: A641E371604305EFDF24AB38DC46E7A73E8EF44310F20446EEA4AD7291EA39A942CB11

Function 007E73C1 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007E73D9
CreateMenu.USER32 ref: 007E73F4
SetMenu.USER32(?,00000000), ref: 007E7403
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 007E7490
IsMenu.USER32(?), ref: 007E74A6
CreatePopupMenu.USER32 ref: 007E74B0
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 007E74DD
DrawMenuBar.USER32 ref: 007E74E5

Strings

0, xrefs: 007E73CF
F, xrefs: 007E74D1

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: b3e0681beb64b608b8a1d1cc3c3df2df32eaeb90b3d35ed72549ca50e2904899
Instruction ID: 56bb19ac3d77e70300e5dc672f89f65b66395edd0f017cdef432b47957f2955c
Opcode Fuzzy Hash: b3e0681beb64b608b8a1d1cc3c3df2df32eaeb90b3d35ed72549ca50e2904899
Instruction Fuzzy Hash: 73416A74A02285EFDB24DF65D884E9ABBB5FF4E300F148029E91597390D738A920DF50

Function 007B9471 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00767F41: _memmove.LIBCMT ref: 00767F82

Part of subcall function 007BB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 007BB0E7

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 007B94F6
GetDlgCtrlID.USER32 ref: 007B9501
GetParent.USER32 ref: 007B951D
SendMessageW.USER32(00000000,?,00000111,?), ref: 007B9520
GetDlgCtrlID.USER32(?), ref: 007B9529
GetParent.USER32(?), ref: 007B9545
SendMessageW.USER32(00000000,?,?,00000111), ref: 007B9548

Strings

@U=u, xrefs: 007B9548
ListBox, xrefs: 007B94B3
ComboBox, xrefs: 007B947E

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: @U=u$ComboBox$ListBox
API String ID: 1536045017-2258501812
Opcode ID: 6cd71218d79b3ae5ed60547b7eae3bd293ac420a3da26896d9b04996e7acc6ef
Instruction ID: 1429f9b41a2ef10c0dadcebd268f262b8a6a270ca2b4399ec33a83795adf9270
Opcode Fuzzy Hash: 6cd71218d79b3ae5ed60547b7eae3bd293ac420a3da26896d9b04996e7acc6ef
Instruction Fuzzy Hash: 5821B270900144FBCF05ABA4CCD9EFEBB69EF49300F104115FA629B2E2DB7D9919DA20

Function 007B955C Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00767F41: _memmove.LIBCMT ref: 00767F82

Part of subcall function 007BB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 007BB0E7

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 007B95DF
GetDlgCtrlID.USER32 ref: 007B95EA
GetParent.USER32 ref: 007B9606
SendMessageW.USER32(00000000,?,00000111,?), ref: 007B9609
GetDlgCtrlID.USER32(?), ref: 007B9612
GetParent.USER32(?), ref: 007B962E
SendMessageW.USER32(00000000,?,?,00000111), ref: 007B9631

Strings

@U=u, xrefs: 007B9631
ListBox, xrefs: 007B959E
ComboBox, xrefs: 007B9569

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: @U=u$ComboBox$ListBox
API String ID: 1536045017-2258501812
Opcode ID: 7bd1f835dec5032638b3279e4475697a4cc13a7ce60db48cf06058ab824a1ec6
Instruction ID: 43352eb3c24261aa22d9d9e5ca1646f4920e55193d8ae5fe391f67068c1ac24a
Opcode Fuzzy Hash: 7bd1f835dec5032638b3279e4475697a4cc13a7ce60db48cf06058ab824a1ec6
Instruction Fuzzy Hash: E221B674900144FBDF05AB64CCD5EFEBB79EF48300F104115FA629B2A1DB7D5959DA20

Function 007B9645 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 007B9651
GetClassNameW.USER32(00000000,?,00000100), ref: 007B9666
_wcscmp.LIBCMT ref: 007B9678
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 007B96F3

Strings

@U=u, xrefs: 007B96F3
details, xrefs: 007B96A1
largeicons, xrefs: 007B9687
SHELLDLL_DefView, xrefs: 007B9672
smallicons, xrefs: 007B96BB
list, xrefs: 007B96D5

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: @U=u$SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-1428604138
Opcode ID: e1dee2ae517c1a9aae4ad148c9c3f26e86b2453bdb85e8f72fc7669d730f110a
Instruction ID: 5125b7e6b87c9143fb7375fac20351e6132418acf857da2eb6bbf6c960fc801a
Opcode Fuzzy Hash: e1dee2ae517c1a9aae4ad148c9c3f26e86b2453bdb85e8f72fc7669d730f110a
Instruction Fuzzy Hash: A9110676688747FAFA013624DC1FEE6779CDF05B64B200026FB24E50D1FEAE69504A58

Function 00787040 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0078707B

Part of subcall function 00788D68: __getptd_noexit.LIBCMT ref: 00788D68

__gmtime64_s.LIBCMT ref: 00787114
__gmtime64_s.LIBCMT ref: 0078714A
__gmtime64_s.LIBCMT ref: 00787167
__allrem.LIBCMT ref: 007871BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007871D9
__allrem.LIBCMT ref: 007871F0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0078720E
__allrem.LIBCMT ref: 00787225
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00787243
__invoke_watson.LIBCMT ref: 007872B4

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction ID: 0b210ae8431d435c9a43c9a6a8f34d82c81a38213773b34b4c83c312cf573e56
Opcode Fuzzy Hash: 85949ae18b549cd2d12431497598bef6b028e5a4746e3945652a320069ef6a5a
Instruction Fuzzy Hash: 13711971A84716EBDB18FE79CC85B6AB3B8BF11324F24822AF415D7681E778D900C790

Function 007C2A16 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007C2A31
GetMenuItemInfoW.USER32(00826890,000000FF,00000000,00000030), ref: 007C2A92
SetMenuItemInfoW.USER32(00826890,00000004,00000000,00000030), ref: 007C2AC8
Sleep.KERNEL32(000001F4), ref: 007C2ADA
GetMenuItemCount.USER32(?), ref: 007C2B1E
GetMenuItemID.USER32(?,00000000), ref: 007C2B3A
GetMenuItemID.USER32(?,-00000001), ref: 007C2B64
GetMenuItemID.USER32(?,?), ref: 007C2BA9
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 007C2BEF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 007C2C03
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 007C2C24

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 1e972fb23f7af60752503b1adb1c7147ce0d4883c42d597639fbbf3a28a126c1
Instruction ID: acf4aa903c5f234731f4a761f2a2280ddeff43a6d33e1af0b3c5c0da5ce164c2
Opcode Fuzzy Hash: 1e972fb23f7af60752503b1adb1c7147ce0d4883c42d597639fbbf3a28a126c1
Instruction Fuzzy Hash: 76618EB0900249EFDB21CF64C888FBE7BB8EB45304F14455DE841A7252E739AD56DB21

Function 007E7192 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 007E7214
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 007E7217
GetWindowLongW.USER32(?,000000F0), ref: 007E723B
_memset.LIBCMT ref: 007E724C
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 007E725E
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 007E72D6

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: fa58bd781d2a5ac48ff36019e4923dbd48f3b8e4750408294d4ceeb2eb5d88a9
Instruction ID: a38a1da5327d313ca6d1a503e3394b278892cb71a1371b6f01f46d84244157f9
Opcode Fuzzy Hash: fa58bd781d2a5ac48ff36019e4923dbd48f3b8e4750408294d4ceeb2eb5d88a9
Instruction Fuzzy Hash: A3616B75900288AFDB20DFA4CC81EEE77B8FB09710F14416AFA14AB2A1D774AD55DB60

Function 007B710E Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 007B7135
SafeArrayAllocData.OLEAUT32(?), ref: 007B718E
VariantInit.OLEAUT32(?), ref: 007B71A0
SafeArrayAccessData.OLEAUT32(?,?), ref: 007B71C0
VariantCopy.OLEAUT32(?,?), ref: 007B7213
SafeArrayUnaccessData.OLEAUT32(?), ref: 007B7227
VariantClear.OLEAUT32(?), ref: 007B723C
SafeArrayDestroyData.OLEAUT32(?), ref: 007B7249
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 007B7252
VariantClear.OLEAUT32(?), ref: 007B7264
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 007B726F

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 5ec5af3050c84b4d5780f8a870ec28728814990c5a8528595ed9512836115bf4
Instruction ID: 73df60661360b68657437394babfead3f191fa395451962c50ef2f3b1ad9c0b0
Opcode Fuzzy Hash: 5ec5af3050c84b4d5780f8a870ec28728814990c5a8528595ed9512836115bf4
Instruction Fuzzy Hash: 7F413F35900159DFCB049F64D888EEEBBB8FF48354F008065F915AB661CB38A945CB90

Function 007ED74C Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00762612: GetWindowLongW.USER32(?,000000EB), ref: 00762623

GetSystemMetrics.USER32(0000000F), ref: 007ED78A
GetSystemMetrics.USER32(0000000F), ref: 007ED7AA
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 007ED9E5
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 007EDA03
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 007EDA24
ShowWindow.USER32(00000003,00000000), ref: 007EDA43
InvalidateRect.USER32(?,00000000,00000001), ref: 007EDA68
DefDlgProcW.USER32(?,00000005,?,?), ref: 007EDA8B

Strings

@U=u, xrefs: 007EDA03, 007EDA24

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID: @U=u
API String ID: 1211466189-2594219639
Opcode ID: d1c64223ea0bd8a4c3ea58f1208fd9b2f3d3befcb73dbef66e17d9c16b669264
Instruction ID: 59071b5a56a2d3c147b3ec9e0ae8e8f24b74e26b4fad0fbbe57d4c5fe7191aa2
Opcode Fuzzy Hash: d1c64223ea0bd8a4c3ea58f1208fd9b2f3d3befcb73dbef66e17d9c16b669264
Instruction Fuzzy Hash: 13B167716012A5AFDF24CF6AC9897B97BB1FF08701F08C079EC489A295D738AE50CB50

Function 007D86D0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00769997: __itow.LIBCMT ref: 007699C2
Part of subcall function 00769997: __swprintf.LIBCMT ref: 00769A0C

CoInitialize.OLE32 ref: 007D8718
CoUninitialize.OLE32 ref: 007D8723
CoCreateInstance.OLE32(?,00000000,00000017,007F2BEC,?), ref: 007D8783
IIDFromString.OLE32(?,?), ref: 007D87F6
VariantInit.OLEAUT32(?), ref: 007D8890
VariantClear.OLEAUT32(?), ref: 007D88F1

Strings

NULL Pointer assignment, xrefs: 007D87C8
Invalid parameter, xrefs: 007D880F
Failed to create object, xrefs: 007D878E, 007D8844

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 66652e67f62d54ba3f1c3cdb064afa7d1af695eff595b292a787180895787997
Instruction ID: 6790d3a2849b0d487b494b375f067fd5c052e633977cbe4352a4bc8bcaaaf828
Opcode Fuzzy Hash: 66652e67f62d54ba3f1c3cdb064afa7d1af695eff595b292a787180895787997
Instruction Fuzzy Hash: BE617A706083019FC750DF64C888B6ABBF8AF88724F14481AF9859B391DB78ED44DB93

Function 00762E26 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00762EAE

Part of subcall function 00761DB3: GetClientRect.USER32(?,?), ref: 00761DDC
Part of subcall function 00761DB3: GetWindowRect.USER32(?,?), ref: 00761E1D
Part of subcall function 00761DB3: ScreenToClient.USER32(?,?), ref: 00761E45

GetDC.USER32 ref: 0079CF82
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0079CF95
SelectObject.GDI32(00000000,00000000), ref: 0079CFA3
SelectObject.GDI32(00000000,00000000), ref: 0079CFB8
ReleaseDC.USER32(?,00000000), ref: 0079CFC0
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0079D04B

Strings

@U=u, xrefs: 0079CF95
U, xrefs: 0079CF20

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: @U=u$U
API String ID: 4009187628-4110099822
Opcode ID: 6f267ee250567e8d15187fdc01840bee0e265925b8f13e274bb24c28cce82da6
Instruction ID: 81778d393b8e6f0ca393ae1206dc7fbfa4d630a71d0a6a9a6f4ef770e09c7f2f
Opcode Fuzzy Hash: 6f267ee250567e8d15187fdc01840bee0e265925b8f13e274bb24c28cce82da6
Instruction Fuzzy Hash: 6471D431500205DFCF31CF68D888ABA7BB6FF48350F14827AED565A2A6D7398C52DB60

Function 007D5A45 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 007D5AA6
inet_addr.WSOCK32(?,?,?), ref: 007D5AEB
gethostbyname.WSOCK32(?), ref: 007D5AF7
IcmpCreateFile.IPHLPAPI ref: 007D5B05
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 007D5B75
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 007D5B8B
IcmpCloseHandle.IPHLPAPI(00000000), ref: 007D5C00
WSACleanup.WSOCK32 ref: 007D5C06

Strings

Ping, xrefs: 007D5B29

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 1b7a72b4100281fbca852d4f8909bf90360d53f61350c0262df72b7f6635a6ed
Instruction ID: 7c7daa8f8d8ca382438e32f55b3dbc511d602f939cd57676538f5932545c46d7
Opcode Fuzzy Hash: 1b7a72b4100281fbca852d4f8909bf90360d53f61350c0262df72b7f6635a6ed
Instruction Fuzzy Hash: AC516D71604701DFDB10AF24CC89B2ABBE4EF48710F14892BF956DB2A1DB78E940DB55

Function 007EC27C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00762612: GetWindowLongW.USER32(?,000000EB), ref: 00762623

Part of subcall function 00762344: GetCursorPos.USER32(?), ref: 00762357
Part of subcall function 00762344: ScreenToClient.USER32(008267B0,?), ref: 00762374
Part of subcall function 00762344: GetAsyncKeyState.USER32(00000001), ref: 00762399
Part of subcall function 00762344: GetAsyncKeyState.USER32(00000002), ref: 007623A7

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 007EC2E4
ImageList_EndDrag.COMCTL32 ref: 007EC2EA
ReleaseCapture.USER32 ref: 007EC2F0
SetWindowTextW.USER32(?,00000000), ref: 007EC39A
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 007EC3AD
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 007EC48F

Strings

@GUI_DROPID, xrefs: 007EC3E1
@U=u, xrefs: 007EC3AD
@GUI_DRAGFILE, xrefs: 007EC424

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID$@U=u
API String ID: 1924731296-2104563098
Opcode ID: bbff81c60ed457cdac1366d375164913d8524ca45804af677183e64e65ebef63
Instruction ID: b0ce3595705eca928af208372655709b3f6f3139ad0d357ca94b1790716d46ba
Opcode Fuzzy Hash: bbff81c60ed457cdac1366d375164913d8524ca45804af677183e64e65ebef63
Instruction Fuzzy Hash: 95519F74204384EFD710DF14CC99F6A7BE5FB88310F048529F9969B2E1DB389959CB52

Function 007CB72E Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 007CB73B
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 007CB7B1
GetLastError.KERNEL32 ref: 007CB7BB
SetErrorMode.KERNEL32(00000000,READY), ref: 007CB828

Strings

NOTREADY, xrefs: 007CB7E7
UNKNOWN, xrefs: 007CB7E0
READY, xrefs: 007CB801
READONLY, xrefs: 007CB7F3
INVALID, xrefs: 007CB7FA

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 31f84a41f62348472066ce2f5171614728f13c9ca40191f899c88589910167df
Instruction ID: 6f0c4a03f8e49b0c3cf0c4c754b6315a0bdb0f5545bfdaff4e564a37fcceb7fb
Opcode Fuzzy Hash: 31f84a41f62348472066ce2f5171614728f13c9ca40191f899c88589910167df
Instruction Fuzzy Hash: 9F316135A012099FDB04EF64C886FAA7BB8FF84710F14802EF906DB291D7799942C691

Function 007E6442 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 007E645A
GetDC.USER32(00000000), ref: 007E6462
GetDeviceCaps.GDI32(00000000,0000005A), ref: 007E646D
ReleaseDC.USER32(00000000,00000000), ref: 007E6479
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 007E64B5
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 007E64C6
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,007E9299,?,?,000000FF,00000000,?,000000FF,?), ref: 007E6500
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 007E6520

Strings

@U=u, xrefs: 007E64C6, 007E6520

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID: @U=u
API String ID: 3864802216-2594219639
Opcode ID: c9510e11c573d7e557539538c80700818ab1cd447db9757ce4a52158a1b216be
Instruction ID: 19227400dbd65dbe82832fe6011d195d0467f22de3b412bef82c11dbf7e05fbb
Opcode Fuzzy Hash: c9510e11c573d7e557539538c80700818ab1cd447db9757ce4a52158a1b216be
Instruction Fuzzy Hash: 3931AD72202294BFEB108F11CC8AFEA3FA9EF0D764F044065FE089E191D6799951CB64

Function 007D8BC0 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 007D8BEC
CoInitialize.OLE32(00000000), ref: 007D8C19
CoUninitialize.OLE32 ref: 007D8C23
GetRunningObjectTable.OLE32(00000000,?), ref: 007D8D23
SetErrorMode.KERNEL32(00000001,00000029), ref: 007D8E50
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,007F2C0C), ref: 007D8E84
CoGetObject.OLE32(?,00000000,007F2C0C,?), ref: 007D8EA7
SetErrorMode.KERNEL32(00000000), ref: 007D8EBA
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 007D8F3A
VariantClear.OLEAUT32(?), ref: 007D8F4A

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 678145edbd208379bf464027f2b157963f3243911047d0fda7b2fd83687b45c7
Instruction ID: 45fa45f06eb8e6066d616e6624844dade86d943402bd6f2c05c97ed73e118938
Opcode Fuzzy Hash: 678145edbd208379bf464027f2b157963f3243911047d0fda7b2fd83687b45c7
Instruction Fuzzy Hash: 76C114B1208305EFC740DF64C88492AB7E9BF89748F04496EF98A9B351DB75ED05CB62

Function 007C4189 Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 007C419D
__swprintf.LIBCMT ref: 007C41AA

Part of subcall function 007838D8: __woutput_l.LIBCMT ref: 00783931

FindResourceW.KERNEL32(?,?,0000000E), ref: 007C41D4
LoadResource.KERNEL32(?,00000000), ref: 007C41E0
LockResource.KERNEL32(00000000), ref: 007C41ED
FindResourceW.KERNEL32(?,?,00000003), ref: 007C420D
LoadResource.KERNEL32(?,00000000), ref: 007C421F
SizeofResource.KERNEL32(?,00000000), ref: 007C422E
LockResource.KERNEL32(?), ref: 007C423A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 007C429B

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: e8a4ead5b230fdfeb721ee08678b125742de76852df214014fb3bd09cafb14ec
Instruction ID: 027b839bd9dba811b55f5c66b29babcf5fa691fc9faf31226899c012c1a61e64
Opcode Fuzzy Hash: e8a4ead5b230fdfeb721ee08678b125742de76852df214014fb3bd09cafb14ec
Instruction Fuzzy Hash: FB31AE71A0224AABCB119F60DD99EBF7BACFF08301F048529F901D6150E738DA51CBA4

Function 007C16DE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 007C1700
GetForegroundWindow.USER32(00000000,?,?,?,?,?,007C0778,?,00000001), ref: 007C1714
GetWindowThreadProcessId.USER32(00000000), ref: 007C171B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,007C0778,?,00000001), ref: 007C172A
GetWindowThreadProcessId.USER32(?,00000000), ref: 007C173C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,007C0778,?,00000001), ref: 007C1755
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,007C0778,?,00000001), ref: 007C1767
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,007C0778,?,00000001), ref: 007C17AC
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,007C0778,?,00000001), ref: 007C17C1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,007C0778,?,00000001), ref: 007C17CC

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: f5ecf8a19948cac0e4b1dd980dc272b60fac8292026d54055ec7505fdae43fb5
Instruction ID: 1052df3d5bc29b3bab672b0d68619d9f5b65a6547449e46c44e2729e4ee58883
Opcode Fuzzy Hash: f5ecf8a19948cac0e4b1dd980dc272b60fac8292026d54055ec7505fdae43fb5
Instruction Fuzzy Hash: 6231BF75609204BBEB219F25DD84F697BF9BB5A721F51C02CF800CA2A1DB789D40CB60

Function 007BA693 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,007BAA64), ref: 007BA9A2

Strings

CLASSNN, xrefs: 007BA744
REGEXPCLASS, xrefs: 007BA767
NAME, xrefs: 007BA7D4
CLASS, xrefs: 007BA721
TEXT, xrefs: 007BA8D9
INSTANCE, xrefs: 007BA8B0

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: c84f1d529d8e7969780d09a80f1de8bd4ee34a1258f6db4eb42dce34815cb87b
Instruction ID: 6ac5b692d155eb2a417329318be0b67050b6bcb63cac9840036a379d88bad70b
Opcode Fuzzy Hash: c84f1d529d8e7969780d09a80f1de8bd4ee34a1258f6db4eb42dce34815cb87b
Instruction Fuzzy Hash: 65919270A00206FBDB18FFA0C485BE9FB75BF14354F108119D99AA7141DF387A99DBA1

Function 007EB60B Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00E35810), ref: 007EB6A5
IsWindowEnabled.USER32(00E35810), ref: 007EB6B1
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 007EB795
SendMessageW.USER32(00E35810,000000B0,?,?), ref: 007EB7CC
IsDlgButtonChecked.USER32(?,?), ref: 007EB809
GetWindowLongW.USER32(00E35810,000000EC), ref: 007EB82B
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 007EB843

Strings

@U=u, xrefs: 007EB795, 007EB7CC, 007EB843

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID: @U=u
API String ID: 4072528602-2594219639
Opcode ID: d16495555e3cddc07fb21932681ee4a7b10e4bfdbc4333f45993cabafa2e0567
Instruction ID: 0f4e6f4be9ebeab0a840cf4463c3bf04eb76d44d85fe98a2b1e1b61f38ac0306
Opcode Fuzzy Hash: d16495555e3cddc07fb21932681ee4a7b10e4bfdbc4333f45993cabafa2e0567
Instruction Fuzzy Hash: EE717A74602284EFDB209F66C8D4FAB7FB9FB4D300F14406AE9469B2A1C739A951CB50

Function 007E6FEF Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 007E7093
SendMessageW.USER32(?,00001036,00000000,?), ref: 007E70A7
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 007E70C1
_wcscat.LIBCMT ref: 007E711C
SendMessageW.USER32(?,00001057,00000000,?), ref: 007E7133
SendMessageW.USER32(?,00001061,?,0000000F), ref: 007E7161

Strings

SysListView32, xrefs: 007E7065
@U=u, xrefs: 007E7093, 007E70A7

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: @U=u$SysListView32
API String ID: 307300125-1908207174
Opcode ID: e5872135bdc36c4dde879470618c7ce68f57c7bca1c780138f910e25fd638d02
Instruction ID: 1f79a0a4efb5ac0e911308913f7d78938b29b6e2ba806bebfb464ea374d92c34
Opcode Fuzzy Hash: e5872135bdc36c4dde879470618c7ce68f57c7bca1c780138f910e25fd638d02
Instruction Fuzzy Hash: BE41B470905388EFEB259F64CC89BEE77A8EF0C350F10452AF944E7292D6799D85CB50

Function 007E653C Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 007E655B
GetWindowLongW.USER32(00E35810,000000F0), ref: 007E658E
GetWindowLongW.USER32(00E35810,000000F0), ref: 007E65C3
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 007E65F5
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 007E661F
GetWindowLongW.USER32(00000000,000000F0), ref: 007E6630
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 007E664A

Strings

@U=u, xrefs: 007E655B, 007E65F5, 007E661F

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID: @U=u
API String ID: 2178440468-2594219639
Opcode ID: 4344199f4bbfa628b8c3c04ec1d47bc905e1d7e86b7327be4b430ab79b71ac6c
Instruction ID: deda78142b121bedb252c75f7630525e7fa5b78625bff230293bdb1128ee69ae
Opcode Fuzzy Hash: 4344199f4bbfa628b8c3c04ec1d47bc905e1d7e86b7327be4b430ab79b71ac6c
Instruction Fuzzy Hash: 11310230706290AFDB208F1ADC88F553BE1FB6E390F1841A8F5118F2B5CB69E860DB41

Function 007D8F5B Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,007EF910), ref: 007D903D
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,007EF910), ref: 007D9071
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 007D91EB
SysFreeString.OLEAUT32(?), ref: 007D9215

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: eff5f8f3d5c85acfbfd95f76765e15b653a974bbb5ef49214d6d75090ebf455b
Instruction ID: c226d86951eadbd91b3a260891280ccebfeb228729251baa895071b5e7fe96c1
Opcode Fuzzy Hash: eff5f8f3d5c85acfbfd95f76765e15b653a974bbb5ef49214d6d75090ebf455b
Instruction Fuzzy Hash: C9F14E71A00109EFDF04DF94C888EAEB7B9FF49314F14815AFA16AB251DB35AE46CB50

Function 007DF9A8 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007DF9C9
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 007DFB5C
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 007DFB80
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 007DFBC0
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 007DFBE2
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 007DFD5E
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 007DFD90
CloseHandle.KERNEL32(?), ref: 007DFDBF
CloseHandle.KERNEL32(?), ref: 007DFE36

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 542d60df78d3b48c348305098406ecc48dfba2c8a3b7d1d30501adeb135e1c80
Instruction ID: 887e4fbb194bcd15ac633520b26f236072bf3144b506df6c0f3f9444ef04da4d
Opcode Fuzzy Hash: 542d60df78d3b48c348305098406ecc48dfba2c8a3b7d1d30501adeb135e1c80
Instruction Fuzzy Hash: D9E1A031204341DFCB14EF24C895A6ABBF5AF85350F14846EF89A8B3A2DB38DC41CB52

Function 007C4F63 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 007C48AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,007C38D3,?), ref: 007C48C7

Part of subcall function 007C48AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,007C38D3,?), ref: 007C48E0

Part of subcall function 007C4CD3: GetFileAttributesW.KERNEL32(?,007C3947), ref: 007C4CD4

lstrcmpiW.KERNEL32(?,?), ref: 007C4FE2
_wcscmp.LIBCMT ref: 007C4FFC
MoveFileW.KERNEL32(?,?), ref: 007C5017

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 7c1db1ed523356c580b85e1512d21ec1ac29a44b7c293fd94b8728e6de3b3d70
Instruction ID: ea18a56e6956bed705af561919ddae5a16ac6dca3c7aa5c698389e39835d3143
Opcode Fuzzy Hash: 7c1db1ed523356c580b85e1512d21ec1ac29a44b7c293fd94b8728e6de3b3d70
Instruction Fuzzy Hash: 235174B20087859BC724EB60C895EDFB3DCAF84351F04492EF585D7152EE79B1888766

Function 007B9B50 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 007BAE57: GetWindowThreadProcessId.USER32(?,00000000), ref: 007BAE77
Part of subcall function 007BAE57: GetCurrentThreadId.KERNEL32 ref: 007BAE7E
Part of subcall function 007BAE57: AttachThreadInput.USER32(00000000,?,007B9B65,?,00000001), ref: 007BAE85

MapVirtualKeyW.USER32(00000025,00000000), ref: 007B9B70
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 007B9B8D
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 007B9B90
MapVirtualKeyW.USER32(00000025,00000000), ref: 007B9B99
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 007B9BB7
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 007B9BBA
MapVirtualKeyW.USER32(00000025,00000000), ref: 007B9BC3
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 007B9BDA
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 007B9BDD

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 672817553aa9e6eca880c3d69265b8fbd652c92e3a0eeba2f36f269abf899e1d
Instruction ID: 2bba6a7e6e3495290aae3601037f57ffa81bb3d6ac82b865919a89570f6e1966
Opcode Fuzzy Hash: 672817553aa9e6eca880c3d69265b8fbd652c92e3a0eeba2f36f269abf899e1d
Instruction Fuzzy Hash: 3F11CEB1550258FFFA106B64DC8AFAA3B2DEB4D751F104425F354AF4E0C9F65C109AA8

Function 007B8E03 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,007B8A84,00000B00,?,?), ref: 007B8E0C
HeapAlloc.KERNEL32(00000000,?,007B8A84,00000B00,?,?), ref: 007B8E13
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,007B8A84,00000B00,?,?), ref: 007B8E28
GetCurrentProcess.KERNEL32(?,00000000,?,007B8A84,00000B00,?,?), ref: 007B8E30
DuplicateHandle.KERNEL32(00000000,?,007B8A84,00000B00,?,?), ref: 007B8E33
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,007B8A84,00000B00,?,?), ref: 007B8E43
GetCurrentProcess.KERNEL32(007B8A84,00000000,?,007B8A84,00000B00,?,?), ref: 007B8E4B
DuplicateHandle.KERNEL32(00000000,?,007B8A84,00000B00,?,?), ref: 007B8E4E
CreateThread.KERNEL32(00000000,00000000,007B8E74,00000000,00000000,00000000), ref: 007B8E68

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: bbdf9f1edc463886bc6b99a49a57b227747673f32e93651e7dc49739dd04a6a3
Instruction ID: 7b57833f6122da643e801b2af0f67bf4aca9b15e74a6ba50f5dbe80ee4e970a4
Opcode Fuzzy Hash: bbdf9f1edc463886bc6b99a49a57b227747673f32e93651e7dc49739dd04a6a3
Instruction Fuzzy Hash: F001A8B524134CFFE610ABA5DC89F6B3BACEB89711F018421FA05DF5A1CA749C00CA24

Function 007D9428 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007D947C
VariantInit.OLEAUT32(?), ref: 007D954D
VariantInit.OLEAUT32(?), ref: 007D964E
VariantClear.OLEAUT32(?), ref: 007D9658
VariantClear.OLEAUT32(?), ref: 007D96B5

Strings

Incorrect Object type in FOR..IN loop, xrefs: 007D9631
Null Object assignment in FOR..IN loop, xrefs: 007D94DD, 007D960B, 007D96C3

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 4c71d7558870f713e0b5e90096c0cb16ee239eb2e72c3f155dd04b1925738ac1
Instruction ID: 747dd79f4c5d7084640ed589ffb27ed2ac49d423332192419950f5ffc204ecf6
Opcode Fuzzy Hash: 4c71d7558870f713e0b5e90096c0cb16ee239eb2e72c3f155dd04b1925738ac1
Instruction Fuzzy Hash: 2F91B070A00215ABDF24DFA5D848FAEBBB8EF45720F10815AF615AB380D778D945CFA0

Function 007D9A72 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 007B7652: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,007B758C,80070057,?,?,?,007B799D), ref: 007B766F
Part of subcall function 007B7652: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,007B758C,80070057,?,?), ref: 007B768A
Part of subcall function 007B7652: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,007B758C,80070057,?,?), ref: 007B7698
Part of subcall function 007B7652: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,007B758C,80070057,?), ref: 007B76A8

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 007D9B1B
_memset.LIBCMT ref: 007D9B28
_memset.LIBCMT ref: 007D9C6B
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 007D9C97
CoTaskMemFree.OLE32(?), ref: 007D9CA2

Strings

NULL Pointer assignment, xrefs: 007D9CF0

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 923348971d3ed14d252cfb4144553dcae271239bfb20a51d8cdb112e0ab2b187
Instruction ID: 86a77ea7c6cd557d10acd07fea18e0a47e8005be0124ebbd6d526b798a351e90
Opcode Fuzzy Hash: 923348971d3ed14d252cfb4144553dcae271239bfb20a51d8cdb112e0ab2b187
Instruction Fuzzy Hash: DC912971D00219EBDB10DFA5DC85EDEBBB9EF08710F20815AF919A7281DB759A44CFA0

Function 007DEC47 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 007C3E91: CreateToolhelp32Snapshot.KERNEL32 ref: 007C3EB6
Part of subcall function 007C3E91: Process32FirstW.KERNEL32(00000000,?), ref: 007C3EC4
Part of subcall function 007C3E91: CloseHandle.KERNEL32(00000000), ref: 007C3F8E

OpenProcess.KERNEL32(00000001,00000000,?), ref: 007DECB8
GetLastError.KERNEL32 ref: 007DECCB
OpenProcess.KERNEL32(00000001,00000000,?), ref: 007DECFA
TerminateProcess.KERNEL32(00000000,00000000), ref: 007DED77
GetLastError.KERNEL32(00000000), ref: 007DED82
CloseHandle.KERNEL32(00000000), ref: 007DEDB7

Strings

SeDebugPrivilege, xrefs: 007DECD6

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: efabe6ba3faf7623e353d543dcf58c6ef3962c04ac4b826b53ec7f829993f750
Instruction ID: 8573bbcd6ae5d5068e0f226e30239048adcf496b5be6195e82f3c90ccd41eb5d
Opcode Fuzzy Hash: efabe6ba3faf7623e353d543dcf58c6ef3962c04ac4b826b53ec7f829993f750
Instruction Fuzzy Hash: DB4168712002019FDB15EF24C899FAEB7A5AF84714F08C459F9469F3D2DB7DA804CB96

Function 007EB958 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(008267B0,00000000,00E35810,?,?,008267B0,?,007EB862,?,?), ref: 007EB9CC
EnableWindow.USER32(00000000,00000000), ref: 007EB9F0
ShowWindow.USER32(008267B0,00000000,00E35810,?,?,008267B0,?,007EB862,?,?), ref: 007EBA50
ShowWindow.USER32(00000000,00000004,?,007EB862,?,?), ref: 007EBA62
EnableWindow.USER32(00000000,00000001), ref: 007EBA86
SendMessageW.USER32(?,0000130C,?,00000000), ref: 007EBAA9

Strings

@U=u, xrefs: 007EBAA9

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID: @U=u
API String ID: 642888154-2594219639
Opcode ID: ea6c1aa9daefc6246393882d8d8d2554906eb63aabda0945a591f22cc4410947
Instruction ID: 0cd99fba2785e3f209cb519867b3707a37d57dd4cbca82456aa915fece70bbaf
Opcode Fuzzy Hash: ea6c1aa9daefc6246393882d8d8d2554906eb63aabda0945a591f22cc4410947
Instruction Fuzzy Hash: 47413434602181EFDB25CF55C489BA67FE1BB0D314F1881B9EA488F6A3C735A855CB51

Function 007C3226 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 007C32C5

Strings

stop, xrefs: 007C3296
warning, xrefs: 007C32AE
info, xrefs: 007C3266
blank, xrefs: 007C3247
question, xrefs: 007C327E

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: b67e768e00936878b08e26cb2432c64981dc40d4c79e75d3954702dc789381e3
Instruction ID: eeb996a8ed3a959303dc8d1c39dc822df418043d25a124a4a7215f096e583039
Opcode Fuzzy Hash: b67e768e00936878b08e26cb2432c64981dc40d4c79e75d3954702dc789381e3
Instruction Fuzzy Hash: A2116D31649346BBEF055B54DC87EAAB39CFF0AB70F10402EF404962C1D7BD5B4006A5

Function 007C4534 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 007C454E
LoadStringW.USER32(00000000), ref: 007C4555
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 007C456B
LoadStringW.USER32(00000000), ref: 007C4572
_wprintf.LIBCMT ref: 007C4598
MessageBoxW.USER32(00000000,?,?,00011010), ref: 007C45B6

Strings

%s (%d) : ==> %s: %s %s, xrefs: 007C4593

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 745364f8ab2e1a173d2627ed8b66015503bc386c2f990c5d9678500a5b88d54b
Instruction ID: f9978803af6a63421b51855707f2ba46df40b4fd74260da3607ff57fdb25df25
Opcode Fuzzy Hash: 745364f8ab2e1a173d2627ed8b66015503bc386c2f990c5d9678500a5b88d54b
Instruction Fuzzy Hash: 36014FF290124CBFE720A7A4DD89EE6776CEB08301F0045A5FB49D6051EA789E858B74

Function 00762A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0079C417,00000004,00000000,00000000,00000000), ref: 00762ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,0079C417,00000004,00000000,00000000,00000000,000000FF), ref: 00762B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,0079C417,00000004,00000000,00000000,00000000), ref: 0079C46A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0079C417,00000004,00000000,00000000,00000000), ref: 0079C4D6

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: d3d5a85aa0ea9ae380cc7fdc13f7e541abcb67b994fd6e3c832c45b3711005da
Instruction ID: 6673bbb5068760d8180d63dbde1e97dd4573743ad022acc8440fc0aea7aec68a
Opcode Fuzzy Hash: d3d5a85aa0ea9ae380cc7fdc13f7e541abcb67b994fd6e3c832c45b3711005da
Instruction Fuzzy Hash: 4D41D730704BC0AACBB68B689C9CB7A7B92AB45300F58C91DED8786572D6BD9843D710

Function 007C7368 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 007C737F

Part of subcall function 00780FF6: std::exception::exception.LIBCMT ref: 0078102C
Part of subcall function 00780FF6: __CxxThrowException@8.LIBCMT ref: 00781041

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 007C73B6
EnterCriticalSection.KERNEL32(?), ref: 007C73D2
_memmove.LIBCMT ref: 007C7420
_memmove.LIBCMT ref: 007C743D
LeaveCriticalSection.KERNEL32(?), ref: 007C744C
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 007C7461
InterlockedExchange.KERNEL32(?,000001F6), ref: 007C7480

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: e86658b166d4c09f0be7e2461b9b468030cd881c6582a1822e796ae69b693a86
Instruction ID: d96e062368f77a31c94b82364487f495dd971f62272ab57fd34314ce95c19c5c
Opcode Fuzzy Hash: e86658b166d4c09f0be7e2461b9b468030cd881c6582a1822e796ae69b693a86
Instruction Fuzzy Hash: 27318131904245EFCF10EF54DC89EAE7B78FF44710B1481A9F9049B256DB349A15CBA4

Function 007BC072 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 007BC087
_memcmp.LIBCMT ref: 007BC0A9
_memcmp.LIBCMT ref: 007BC0C1
_memcmp.LIBCMT ref: 007BC0D4
_memcmp.LIBCMT ref: 007BC0EE
_memcmp.LIBCMT ref: 007BC101
_memcmp.LIBCMT ref: 007BC119
_memcmp.LIBCMT ref: 007BC134

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: d945ec4dd76fa355606507720efcce48b63b34c60e324e0155fca06a053c371a
Instruction ID: 42a36f7b96bf9db1a2b2ecb9881431c01d76e40d112570ab8a5f23059f0aec38
Opcode Fuzzy Hash: d945ec4dd76fa355606507720efcce48b63b34c60e324e0155fca06a053c371a
Instruction Fuzzy Hash: 202153B174120DF79616B5259D46FFB235CAE103A4B448021FF0596393FB5DDD12C2A5

Function 007CED8E Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00769997: __itow.LIBCMT ref: 007699C2
Part of subcall function 00769997: __swprintf.LIBCMT ref: 00769A0C

Part of subcall function 0077FEC6: _wcscpy.LIBCMT ref: 0077FEE9

_wcstok.LIBCMT ref: 007CEEFF
_wcscpy.LIBCMT ref: 007CEF8E
_memset.LIBCMT ref: 007CEFC1

Strings

X, xrefs: 007CEFFE

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: a411615c94905b6cc2f9e017024f2be8c7dce8e045f0b856329ead125ea240e6
Instruction ID: 3223913497aed19448eeebaa4854bb3fa2db43fb8e1cf2effcb182ca729e8300
Opcode Fuzzy Hash: a411615c94905b6cc2f9e017024f2be8c7dce8e045f0b856329ead125ea240e6
Instruction Fuzzy Hash: E3C15D71508300DFC724EF24C889E5AB7E5EF84354F04492DF99A9B2A2DB38ED45CB92

Function 007D6E17 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 007D6F14
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 007D6F35
WSAGetLastError.WSOCK32(00000000), ref: 007D6F48
htons.WSOCK32(?,?,?,00000000,?), ref: 007D6FFE
inet_ntoa.WSOCK32(?), ref: 007D6FBB

Part of subcall function 007BAE14: _strlen.LIBCMT ref: 007BAE1E
Part of subcall function 007BAE14: _memmove.LIBCMT ref: 007BAE40

_strlen.LIBCMT ref: 007D7058
_memmove.LIBCMT ref: 007D70C1

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: d697b9e53418a5510f6f9a65f2382fedc97fe97b6163459d67cab5bbca695562
Instruction ID: a90ba7e1b9fcecb71ba5b4f4ecad082e4755ab601be1bc3125cadeb06147c0c4
Opcode Fuzzy Hash: d697b9e53418a5510f6f9a65f2382fedc97fe97b6163459d67cab5bbca695562
Instruction Fuzzy Hash: 2281D171104300EBD714EB24CC89E6BB7F9AF84714F14891EF9569B2D2EA79AD04C792

Function 00761424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f118f203eea368712eb3b3ad53b1a48e95fb8fecec0abb113df5c0f44cd4d3b
Instruction ID: 9dfa582b1b63127801b3cc5722cb031529f73c6bb640640e692d5fb57800ae95
Opcode Fuzzy Hash: 7f118f203eea368712eb3b3ad53b1a48e95fb8fecec0abb113df5c0f44cd4d3b
Instruction Fuzzy Hash: 26715D30900149EFCB04CF98CC89ABEBB79FF85314F588159F916AB251C738AA51CBA4

Function 007DF732 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007DF75C
_memset.LIBCMT ref: 007DF825
ShellExecuteExW.SHELL32(?), ref: 007DF86A

Part of subcall function 00769997: __itow.LIBCMT ref: 007699C2
Part of subcall function 00769997: __swprintf.LIBCMT ref: 00769A0C

Part of subcall function 0077FEC6: _wcscpy.LIBCMT ref: 0077FEE9

GetProcessId.KERNEL32(00000000), ref: 007DF8E1
CloseHandle.KERNEL32(00000000), ref: 007DF910

Strings

@, xrefs: 007DF839

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: c7f08d5b2350ab934012c085dafc560806dd0df6888ec918ea3015673fe82236
Instruction ID: 739dba5c28446cf6f38f81c3bfd2319b41311e2a181c8f5adf8d41dc52062938
Opcode Fuzzy Hash: c7f08d5b2350ab934012c085dafc560806dd0df6888ec918ea3015673fe82236
Instruction Fuzzy Hash: 9D619E75A00619DFCF14EF54C9859AEBBF9FF48310F14846AE84AAB351CB38AD41CB90

Function 007C145D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 007C149C
GetKeyboardState.USER32(?), ref: 007C14B1
SetKeyboardState.USER32(?), ref: 007C1512
PostMessageW.USER32(?,00000101,00000010,?), ref: 007C1540
PostMessageW.USER32(?,00000101,00000011,?), ref: 007C155F
PostMessageW.USER32(?,00000101,00000012,?), ref: 007C15A5
PostMessageW.USER32(?,00000101,0000005B,?), ref: 007C15C8

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 2529b5e1b143d2061a2f8f97872242bf55342b1441e1bac831e29f03bb1b310c
Instruction ID: 868f8b3a01a84b17d331942ebdd8d966103760bcbfa0c066a69a7b3a73f2d5cf
Opcode Fuzzy Hash: 2529b5e1b143d2061a2f8f97872242bf55342b1441e1bac831e29f03bb1b310c
Instruction Fuzzy Hash: 5B51F1A0A047D53EFB3642248C45FBABFA95B47304F4884ADE1D59A8C3C79CED94D750

Function 007C1276 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 007C12B5
GetKeyboardState.USER32(?), ref: 007C12CA
SetKeyboardState.USER32(?), ref: 007C132B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 007C1357
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 007C1374
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 007C13B8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 007C13D9

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: b1f746d9f8ed6d0ad93eb6e73aa14545a85903e0a5d6894b29d635e25136d938
Instruction ID: ced488f1f7aeeb0337aab70cd32a6b7c3d0c460692dd311b7a2cb8ddf57e8ac2
Opcode Fuzzy Hash: b1f746d9f8ed6d0ad93eb6e73aa14545a85903e0a5d6894b29d635e25136d938
Instruction Fuzzy Hash: AF51E0A0A046D57DFB3683248C45FBABFA96B07304F4885ADE1D44A8C3D39CEC98D760

Function 007C589F Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 007C58AC
_wcsncpy.LIBCMT ref: 007C58E1
_wcsncpy.LIBCMT ref: 007C5913
_wcsncpy.LIBCMT ref: 007C5946
_wcsncpy.LIBCMT ref: 007C5988
_wcsncpy.LIBCMT ref: 007C59C2
_wcsncpy.LIBCMT ref: 007C59F1

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 44ddb565c03b0f316842165d9cee675b730e5f2aecd8eb3cd8f0445ab125333c
Instruction ID: 1b4902b75e3364daf3e0f0c4d67e657177da6e6b2a635a35104b4d38a8a7d410
Opcode Fuzzy Hash: 44ddb565c03b0f316842165d9cee675b730e5f2aecd8eb3cd8f0445ab125333c
Instruction Fuzzy Hash: 84417265C60518B6CB10FBB4888EACF77B8AF04720F50855AF918E3122F739E755C7A9

Function 007EA2C5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

@U=u, xrefs: 007EA3BE

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID:
String ID: @U=u
API String ID: 0-2594219639
Opcode ID: 5a5e0bcd5b65121debb403af2d1530855e3a55c02195413e5d4c32fcdf60cee5
Instruction ID: e41e45674bfdc0557572970b068993f981f1e753fc3fe37e248d0efc35dcec76
Opcode Fuzzy Hash: 5a5e0bcd5b65121debb403af2d1530855e3a55c02195413e5d4c32fcdf60cee5
Instruction Fuzzy Hash: 8B41F3359022C4BFC720DB29CC88FA9BBA4FB0D310F144165F855A72E1D778BE51DA51

Function 007C38AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 007C48AA: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,007C38D3,?), ref: 007C48C7

Part of subcall function 007C48AA: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,007C38D3,?), ref: 007C48E0

lstrcmpiW.KERNEL32(?,?), ref: 007C38F3
_wcscmp.LIBCMT ref: 007C390F
MoveFileW.KERNEL32(?,?), ref: 007C3927
_wcscat.LIBCMT ref: 007C396F
SHFileOperationW.SHELL32(?), ref: 007C39DB

Strings

\*.*, xrefs: 007C3969

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 0172d3ea1daeb296d621b70a7d374a59f7ea942035a272653247cc0bb32d8910
Instruction ID: f1e51ca3f35ef482b26de04b15cda7edf2fc619bab17c4875dd2ea41876e6c6c
Opcode Fuzzy Hash: 0172d3ea1daeb296d621b70a7d374a59f7ea942035a272653247cc0bb32d8910
Instruction Fuzzy Hash: 814181B240D3849AC751EF64C485EDFB7E8AF88344F00492EF49AC3161EA7CD688C756

Function 007E7500 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007E7519
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 007E75C0
IsMenu.USER32(?), ref: 007E75D8
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 007E7620
DrawMenuBar.USER32 ref: 007E7633

Strings

0, xrefs: 007E750D

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: a1d31ff51346d3301c6adce13bdbebcebd4c49aaad83b79db35750b78bdaa769
Instruction ID: 01c93df0f6cc392ad4d6628cf265ff9aab9be308c6e36035ddb2d29f94f9b2a5
Opcode Fuzzy Hash: a1d31ff51346d3301c6adce13bdbebcebd4c49aaad83b79db35750b78bdaa769
Instruction Fuzzy Hash: BC415975A06688EFDB24DF55D884EAABBF8FF48314F048129F9159B250D734AD60CFA0

Function 007E122D Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 007E125C
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 007E1286
FreeLibrary.KERNEL32(00000000), ref: 007E133D

Part of subcall function 007E122D: RegCloseKey.ADVAPI32(?), ref: 007E12A3
Part of subcall function 007E122D: FreeLibrary.KERNEL32(?), ref: 007E12F5
Part of subcall function 007E122D: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 007E1318

RegDeleteKeyW.ADVAPI32(?,?), ref: 007E12E0

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: d3aa9ca6121a7a2b99f475bb10231a4c115670afccd2006ae77a3d42fcf83084
Instruction ID: 73c050b7f48eda33113b6a577d8579a5662ff36f86963a46f7d473ada0df7cd2
Opcode Fuzzy Hash: d3aa9ca6121a7a2b99f475bb10231a4c115670afccd2006ae77a3d42fcf83084
Instruction Fuzzy Hash: BD314BB1902149BFDB14DB91DC8AAFEB7BCEF0C300F40416AE502E2541EA789F459BA4

Function 007D6486 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 007D80A0: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 007D80CB

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 007D64D9
WSAGetLastError.WSOCK32(00000000), ref: 007D64E8
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 007D6521
connect.WSOCK32(00000000,?,00000010), ref: 007D652A
WSAGetLastError.WSOCK32 ref: 007D6534
closesocket.WSOCK32(00000000), ref: 007D655D
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 007D6576

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 7556927c41f5f5077468a595cdf16de99f02be86d679d8185ad2745f4323bccb
Instruction ID: 2b26c1fd5407ee175417bbd8a292edf63d7bac176d4eafe0c6e4291b98fb790f
Opcode Fuzzy Hash: 7556927c41f5f5077468a595cdf16de99f02be86d679d8185ad2745f4323bccb
Instruction Fuzzy Hash: 97317571600118AFDB109F64DC89BBE77BDEB49714F04806AFD069B391DB78AD44CB61

Function 007B9372 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00767F41: _memmove.LIBCMT ref: 00767F82

Part of subcall function 007BB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 007BB0E7

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 007B93F6
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 007B9409
SendMessageW.USER32(?,00000189,?,00000000), ref: 007B9439

Part of subcall function 00767D2C: _memmove.LIBCMT ref: 00767D66

Strings

@U=u, xrefs: 007B93F6, 007B9409, 007B9439
ListBox, xrefs: 007B93B5
ComboBox, xrefs: 007B9380

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: @U=u$ComboBox$ListBox
API String ID: 365058703-2258501812
Opcode ID: 8892839324687058d74c8b69b0d0fb549566a9309cc3602719a8a76574245928
Instruction ID: 0a27aca5f1dbfd45b2add9bca68dc138bdfdaed0a2d9a4afbf867f0d584c5794
Opcode Fuzzy Hash: 8892839324687058d74c8b69b0d0fb549566a9309cc3602719a8a76574245928
Instruction Fuzzy Hash: C421D5B1900144BBDB18AB70DC89DFFB768DF05350B108119FA36A72E1DB3D4A0A9610

Function 007BE0B5 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 007BE0FA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 007BE120
SysAllocString.OLEAUT32(00000000), ref: 007BE123
SysAllocString.OLEAUT32 ref: 007BE144
SysFreeString.OLEAUT32 ref: 007BE14D
StringFromGUID2.OLE32(?,?,00000028), ref: 007BE167
SysAllocString.OLEAUT32(?), ref: 007BE175

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 4d314ebc096c85636ccf3ab08674cc12f27baf9d98e9abf78f0203ef5bc8ae2a
Instruction ID: e1e1a34269049b67240b4779b036a20624b3a7d4db7ab90b49362b8544d344e2
Opcode Fuzzy Hash: 4d314ebc096c85636ccf3ab08674cc12f27baf9d98e9abf78f0203ef5bc8ae2a
Instruction Fuzzy Hash: FF213D7560524CAF9B10AFACDC88DEB77ECEB09760B60C135F915CB2A0DA78DD418B64

Function 007BFB6E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 007BFB81
__wcsnicmp.LIBCMT ref: 007BFBA2
__wcsnicmp.LIBCMT ref: 007BFBBC

Strings

#requireadmin, xrefs: 007BFB9C
#notrayicon, xrefs: 007BFB79
#OnAutoItStartRegister, xrefs: 007BFBB6

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 3b44e271f2254bb19b558b4979bac131d374f8eababf63dc0cb4549fedcdb3e0
Instruction ID: b573125b6a7bfeccba9a0f96488c8eace8148964a66981486cc1258d3b851b0d
Opcode Fuzzy Hash: 3b44e271f2254bb19b558b4979bac131d374f8eababf63dc0cb4549fedcdb3e0
Instruction Fuzzy Hash: 952167B2244614E6D334B634DC16FF77798DF51B40F108036F88687142EB5DAA82C3A5

Function 007BB6AF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 007BB6C7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 007BB6E4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 007BB71C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 007BB742
_wcsstr.LIBCMT ref: 007BB74C

Strings

@U=u, xrefs: 007BB6E4, 007BB71C

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID: @U=u
API String ID: 3902887630-2594219639
Opcode ID: 7a5ce3300197ef8bd038ccae3297f3f095eb8772a2cef9109423874e827aca79
Instruction ID: d918a7ae61be746b9466cbbbcbe81f6192c9f0bee9a1ab54e1c3e48f9358fb58
Opcode Fuzzy Hash: 7a5ce3300197ef8bd038ccae3297f3f095eb8772a2cef9109423874e827aca79
Instruction Fuzzy Hash: B8210731244244BBEB255B399C49FBB7B9CDF89710F00802AFC05CA1A1EFA9DC4193A0

Function 007B97E9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 007B9802

Part of subcall function 00767D2C: _memmove.LIBCMT ref: 00767D66

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 007B9834
__itow.LIBCMT ref: 007B984C
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 007B9874
__itow.LIBCMT ref: 007B9885

Strings

@U=u, xrefs: 007B9802, 007B9834, 007B9874

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID: @U=u
API String ID: 2983881199-2594219639
Opcode ID: 1ade1b0e9b1af74c318e9633fa15adee67927dd968647bc1a4c380be33207040
Instruction ID: ad2290c259d12a87250336bb244b9683c1b6e8ad578597357f0bfd26ae033c8a
Opcode Fuzzy Hash: 1ade1b0e9b1af74c318e9633fa15adee67927dd968647bc1a4c380be33207040
Instruction Fuzzy Hash: C6210431B01248EBDB10AA658C8AFEE3BA8EF4A710F044028FF15EB291D679CD45C791

Function 007E783C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00761D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00761D73
Part of subcall function 00761D35: GetStockObject.GDI32(00000011), ref: 00761D87
Part of subcall function 00761D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00761D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 007E78A1
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 007E78AE
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 007E78B9
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 007E78C8
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 007E78D4

Strings

Msctls_Progress32, xrefs: 007E7872

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 3bf252a5bc3a646d59e31a2ea96da8895e17e177aa771ce5348565a24d0453e7
Instruction ID: 0afce49257c690608c2b8b40aa429575ad39cefd778f39fcf77481ee01cb486c
Opcode Fuzzy Hash: 3bf252a5bc3a646d59e31a2ea96da8895e17e177aa771ce5348565a24d0453e7
Instruction Fuzzy Hash: 17118EB2110219BFEF159E61CC85EE77F6DEF0C758F014114FA04A6090C7769C21DBA4

Function 007841C9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00784292,?), ref: 007841E3
GetProcAddress.KERNEL32(00000000), ref: 007841EA
EncodePointer.KERNEL32(00000000), ref: 007841F6
DecodePointer.KERNEL32(00000001,00784292,?), ref: 00784213

Strings

RoInitialize, xrefs: 007841D2
combase.dll, xrefs: 007841DE

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: acfcedc813351e6373f91303890c2109178699c3110ef9331d3b66737166b4cb
Instruction ID: f12f0b1e2b7da30a34b53b82422da837108f14516dfdfb97fbdb3b551ee64d65
Opcode Fuzzy Hash: acfcedc813351e6373f91303890c2109178699c3110ef9331d3b66737166b4cb
Instruction Fuzzy Hash: 44E012B0691345EEDB206B70EC4DB143594B764B02F50D434F511D95E0D7BE40A28F14

Function 0078429E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,007841B8), ref: 007842B8
GetProcAddress.KERNEL32(00000000), ref: 007842BF
EncodePointer.KERNEL32(00000000), ref: 007842CA
DecodePointer.KERNEL32(007841B8), ref: 007842E5

Strings

RoUninitialize, xrefs: 007842A7
combase.dll, xrefs: 007842B3

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 0c9fefb851d8f7d7e4c40af1e49b74a4eba60c8ae880327ed75328f691c90e50
Instruction ID: 7b075547302e5f21e61a395170bb54c21adc7cc41d4d5f2acd42a1f8c014449b
Opcode Fuzzy Hash: 0c9fefb851d8f7d7e4c40af1e49b74a4eba60c8ae880327ed75328f691c90e50
Instruction Fuzzy Hash: 49E0ECBC786345EFEB20AF60EC4DB143AA4B728742F50D02AF511E95A0CBBC4552DF28

Function 007C675A Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007C68AD
_memmove.LIBCMT ref: 007C67E8

Part of subcall function 00769997: __itow.LIBCMT ref: 007699C2
Part of subcall function 00769997: __swprintf.LIBCMT ref: 00769A0C

_memmove.LIBCMT ref: 007C685B
_memmove.LIBCMT ref: 007C6942
_memmove.LIBCMT ref: 007C695B
_memmove.LIBCMT ref: 007C6977

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 9bd310fd09ae2354bcac085273aa9b4df644df47a2912129c0e3355fe0b9d60c
Instruction ID: cc063ba9b3ab60aedb8df628baf372c9f69d4cdcb57688184d4f7e1142d961e3
Opcode Fuzzy Hash: 9bd310fd09ae2354bcac085273aa9b4df644df47a2912129c0e3355fe0b9d60c
Instruction Fuzzy Hash: 9061673050065ADBCF15EF60CC8AFFE37A8AF44308F44455DF95A5B292DA38AD46CB91

Function 007E046F Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00767F41: _memmove.LIBCMT ref: 00767F82

Part of subcall function 007E10A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,007E0038,?,?), ref: 007E10BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007E0548
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 007E0588
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 007E05AB
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 007E05D4
RegCloseKey.ADVAPI32(?,?,00000000), ref: 007E0617
RegCloseKey.ADVAPI32(00000000), ref: 007E0624

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: a906001b43cd3d148e242941efc96c7eb5b51f8507f6aa25ee725c00bdc8461e
Instruction ID: 0c429231f35a058a235bec7882718bbd71c1bb59f02804b101dcc0d365332709
Opcode Fuzzy Hash: a906001b43cd3d148e242941efc96c7eb5b51f8507f6aa25ee725c00bdc8461e
Instruction Fuzzy Hash: 3B516B31109240DFCB14EB25C889E6ABBE8FF88314F04891DF986971A1DB79E955CB92

Function 007E5A20 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 007E5A82
GetMenuItemCount.USER32(00000000), ref: 007E5AB9
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 007E5AE1
GetMenuItemID.USER32(?,?), ref: 007E5B50
GetSubMenu.USER32(?,?), ref: 007E5B5E
PostMessageW.USER32(?,00000111,?,00000000), ref: 007E5BAF

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: b5f838d351236a5f29e984c0e17019c068109b9cd85d2521f72295fd5ce3e214
Instruction ID: 50ceddbe06eff53c8d2b35d48af661caf06e2b86c3ed321e1b80afd1c69711f4
Opcode Fuzzy Hash: b5f838d351236a5f29e984c0e17019c068109b9cd85d2521f72295fd5ce3e214
Instruction Fuzzy Hash: E8518171A01659EFCF11EF65C845AAEB7B4EF48314F148469ED02BB351CB38AE418B90

Function 007BF3DD Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 007BF3F7
VariantClear.OLEAUT32(00000013), ref: 007BF469
VariantClear.OLEAUT32(00000000), ref: 007BF4C4
_memmove.LIBCMT ref: 007BF4EE
VariantClear.OLEAUT32(?), ref: 007BF53B
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 007BF569

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: f7b5756219fcf8b443ff4a7cd1fc0560fdd049b2da98fbf7dbabae5cc1cfc95c
Instruction ID: e5e4e191d74097e48a7a32630ca8f6dc222812c53d5ef09e25b83ec1a58cd917
Opcode Fuzzy Hash: f7b5756219fcf8b443ff4a7cd1fc0560fdd049b2da98fbf7dbabae5cc1cfc95c
Instruction Fuzzy Hash: 265168B5A00249EFCB20CF58D884EAAB7B8FF4C314B158169ED59DB341D734E911CBA0

Function 007C26F9 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007C2747
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 007C2792
IsMenu.USER32(00000000), ref: 007C27B2
CreatePopupMenu.USER32 ref: 007C27E6
GetMenuItemCount.USER32(000000FF), ref: 007C2844
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 007C2875

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: dd9d27b49ed2d1576f59e7189743b5ef0f233c3b29ce42350645cecc4c347d8d
Instruction ID: 0de036f905c3777fd4a3d4066e3004a5532adcef7122b60136c4967f42917421
Opcode Fuzzy Hash: dd9d27b49ed2d1576f59e7189743b5ef0f233c3b29ce42350645cecc4c347d8d
Instruction Fuzzy Hash: 0651A070A0034AEFDF25DF68D888FAEBBF5AF44314F20416DE8119B292D7789946CB51

Function 00761765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00762612: GetWindowLongW.USER32(?,000000EB), ref: 00762623

BeginPaint.USER32(?,?,?,?,?,?), ref: 0076179A
GetWindowRect.USER32(?,?), ref: 007617FE
ScreenToClient.USER32(?,?), ref: 0076181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0076182C
EndPaint.USER32(?,?), ref: 00761876

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 66843a88242a8501d61041051f352952cb53021b552cd16bf20f93366de6444c
Instruction ID: 7ba2e983c3cc9f93580e48574a7425138aecce485c024aaa79b708c79dd1aad4
Opcode Fuzzy Hash: 66843a88242a8501d61041051f352952cb53021b552cd16bf20f93366de6444c
Instruction Fuzzy Hash: 6841A070100341EFDB11DF25DC88BB67BE8FB49734F088668F9A68B1A1D7389845DB61

Function 007D73B1 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,007D5134,?,?,00000000,00000001), ref: 007D73BF

Part of subcall function 007D3C94: GetWindowRect.USER32(?,?), ref: 007D3CA7

GetDesktopWindow.USER32 ref: 007D73E9
GetWindowRect.USER32(00000000), ref: 007D73F0
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 007D7422

Part of subcall function 007C54E6: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 007C555E

GetCursorPos.USER32(?), ref: 007D744E
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 007D74AC

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: cbd034a13e4ccd89e378be30b1b0e07b9876928bec55f52f8e9123104b7a99fd
Instruction ID: 9411a78e01369038bccca90c4f8e145504aff2c150ef56aebac4535c9f9e1d83
Opcode Fuzzy Hash: cbd034a13e4ccd89e378be30b1b0e07b9876928bec55f52f8e9123104b7a99fd
Instruction Fuzzy Hash: CC310632509385ABC724DF14C849F5BBBE9FF88314F00491EF48897191D778EA48CB92

Function 007B8D5B Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 007B85F1: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 007B8608
Part of subcall function 007B85F1: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 007B8612
Part of subcall function 007B85F1: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 007B8621
Part of subcall function 007B85F1: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 007B8628
Part of subcall function 007B85F1: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 007B863E

GetLengthSid.ADVAPI32(?,00000000,007B8977), ref: 007B8DAC
GetProcessHeap.KERNEL32(00000008,00000000), ref: 007B8DB8
HeapAlloc.KERNEL32(00000000), ref: 007B8DBF
CopySid.ADVAPI32(00000000,00000000,?), ref: 007B8DD8
GetProcessHeap.KERNEL32(00000000,00000000,007B8977), ref: 007B8DEC
HeapFree.KERNEL32(00000000), ref: 007B8DF3

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 2333eb91cd0f55738f211672176718b389bb5ceccc2837f9d330e568ee86d976
Instruction ID: ddfd4740e5747f03152dcd0af5d42a6745398f9a5fb17280b07a2b88968b858e
Opcode Fuzzy Hash: 2333eb91cd0f55738f211672176718b389bb5ceccc2837f9d330e568ee86d976
Instruction Fuzzy Hash: 7011B131601609FFDF949F64CC49BEE776DEF59316F10802AE8459B290DB399D00CB65

Function 007B8AF9 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 007B8B2A
OpenProcessToken.ADVAPI32(00000000), ref: 007B8B31
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 007B8B40
CloseHandle.KERNEL32(00000004), ref: 007B8B4B
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 007B8B7A
DestroyEnvironmentBlock.USERENV(00000000), ref: 007B8B8E

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: fff9c416c61366fed23b484eb37e85437c81ab0783d2e6607da4bca0022d6be7
Instruction ID: 41472a6c6c669e8132681cd500a82bb2762dd350fd9705824e9c495600f7eea8
Opcode Fuzzy Hash: fff9c416c61366fed23b484eb37e85437c81ab0783d2e6607da4bca0022d6be7
Instruction Fuzzy Hash: 6F112CB2501249ABDF01DFA4ED49FDE7BADEF48304F044065FE04A6160C7799E60DB61

Function 007EC19A Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 007612F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0076134D
Part of subcall function 007612F3: SelectObject.GDI32(?,00000000), ref: 0076135C
Part of subcall function 007612F3: BeginPath.GDI32(?), ref: 00761373
Part of subcall function 007612F3: SelectObject.GDI32(?,00000000), ref: 0076139C

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 007EC1C4
LineTo.GDI32(00000000,00000003,?), ref: 007EC1D8
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 007EC1E6
LineTo.GDI32(00000000,00000000,?), ref: 007EC1F6
EndPath.GDI32(00000000), ref: 007EC206
StrokePath.GDI32(00000000), ref: 007EC216

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: cb99b7e830b93082ce25611545225a63462323c9c045d735f5bbcb1c64609cf5
Instruction ID: 833a8d3c15e24748261f9798df5238b9d1ca241664c7ce99a90e6950843324ff
Opcode Fuzzy Hash: cb99b7e830b93082ce25611545225a63462323c9c045d735f5bbcb1c64609cf5
Instruction Fuzzy Hash: BE11097640114CFFDB129F91DC88EAA7FADFB08354F048025FA184A161D7759E55DBA0

Function 007803A2 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 007803D3
MapVirtualKeyW.USER32(00000010,00000000), ref: 007803DB
MapVirtualKeyW.USER32(000000A0,00000000), ref: 007803E6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 007803F1
MapVirtualKeyW.USER32(00000011,00000000), ref: 007803F9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00780401

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: d2f65e4a3664268c08192fa088976a7a319ed297559724eefae4c755f0b246f0
Instruction ID: 4af1d0cff05386224daf1b966730c59e4a0f23a0c1b720a23cbc9b6d36ebd858
Opcode Fuzzy Hash: d2f65e4a3664268c08192fa088976a7a319ed297559724eefae4c755f0b246f0
Instruction Fuzzy Hash: BE016CB0902759BDE3008F5A8C85B52FFA8FF19354F00411BE15C4B941C7F5A864CBE5

Function 007C568B Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 007C569B
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 007C56B1
GetWindowThreadProcessId.USER32(?,?), ref: 007C56C0
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 007C56CF
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 007C56D9
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 007C56E0

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 736ad2037f4be42f98b7ae5652f521fab10c75e32ab137704faeb5a6938e7f0e
Instruction ID: ffc3dd7b1a5c23f09981eae1334348a61f3993d56c8524340a906df982467bf8
Opcode Fuzzy Hash: 736ad2037f4be42f98b7ae5652f521fab10c75e32ab137704faeb5a6938e7f0e
Instruction Fuzzy Hash: 3EF0303224219CBBE7215BA2DC4DEEF7F7CEFCAB11F004169FA04D5490D7A91A0186B9

Function 007C74D2 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 007C74E5
EnterCriticalSection.KERNEL32(?,?,00771044,?,?), ref: 007C74F6
TerminateThread.KERNEL32(00000000,000001F6,?,00771044,?,?), ref: 007C7503
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00771044,?,?), ref: 007C7510

Part of subcall function 007C6ED7: CloseHandle.KERNEL32(00000000,?,007C751D,?,00771044,?,?), ref: 007C6EE1

InterlockedExchange.KERNEL32(?,000001F6), ref: 007C7523
LeaveCriticalSection.KERNEL32(?,?,00771044,?,?), ref: 007C752A

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: ab1b64d00041c8be1f3e28a1bc30b367f486f3e0b0018b58f2eb64c7c985f0a5
Instruction ID: 02c5b0510ffa0248512c70bbd85aa8068ca15cd6cd8289d614c797f68c271689
Opcode Fuzzy Hash: ab1b64d00041c8be1f3e28a1bc30b367f486f3e0b0018b58f2eb64c7c985f0a5
Instruction Fuzzy Hash: F3F03A7A542652EBDB111B64FCCCAEE772ABF49302B01453AF202998A0CB795911CA54

Function 007B8E74 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 007B8E7F
UnloadUserProfile.USERENV(?,?), ref: 007B8E8B
CloseHandle.KERNEL32(?), ref: 007B8E94
CloseHandle.KERNEL32(?), ref: 007B8E9C
GetProcessHeap.KERNEL32(00000000,?), ref: 007B8EA5
HeapFree.KERNEL32(00000000), ref: 007B8EAC

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 96b09c813bec79f1b3325cdafd3c177699b264528d0f245f5812542360a68f71
Instruction ID: caab06c3ce2697f3c85573b3e5597746f3724d8799c33bb123e6b8fdb95d9a14
Opcode Fuzzy Hash: 96b09c813bec79f1b3325cdafd3c177699b264528d0f245f5812542360a68f71
Instruction Fuzzy Hash: 99E0C236005049FBDA011FE1EC4C90ABF69FB8D322B50C230F219898B0CB3A9860DB58

Function 007D8902 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 007D8928
CharUpperBuffW.USER32(?,?), ref: 007D8A37
VariantClear.OLEAUT32(?), ref: 007D8BAF

Part of subcall function 007C7804: VariantInit.OLEAUT32(00000000), ref: 007C7844
Part of subcall function 007C7804: VariantCopy.OLEAUT32(00000000,?), ref: 007C784D
Part of subcall function 007C7804: VariantClear.OLEAUT32(00000000), ref: 007C7859

Strings

AUTOIT.ERROR, xrefs: 007D8A3D
Incorrect Parameter format, xrefs: 007D8960, 007D8B22

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: db3e67a57648765fbe186801a1010c8b57f3f769d292513be8c753d5cc0fd93e
Instruction ID: 7d39be4717ad75b904cc018c1abbfd89606d05500ba48b047c463fdaf67f67d7
Opcode Fuzzy Hash: db3e67a57648765fbe186801a1010c8b57f3f769d292513be8c753d5cc0fd93e
Instruction Fuzzy Hash: 8A918EB1608301DFC750DF24C48495ABBF8EF89314F04896EF99A8B361DB35E945CB52

Function 007C2F86 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0077FEC6: _wcscpy.LIBCMT ref: 0077FEE9

_memset.LIBCMT ref: 007C3077
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 007C30A6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 007C3159
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 007C3187

Strings

0, xrefs: 007C3063

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 38fa61bfd3423e9211de54890fad4b2e1d9d306ff200ba740e704d87084884ef
Instruction ID: 4486f2e04ce9878c0bbda0d38427b735ca694433bd0801a8d54798e757192bd2
Opcode Fuzzy Hash: 38fa61bfd3423e9211de54890fad4b2e1d9d306ff200ba740e704d87084884ef
Instruction Fuzzy Hash: 2D51E1716083049FD725AF28D849F6BB7E8EF45320F088A2DF895D3191DB78CE448792

Function 007E9A63 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00E3E7A8,?), ref: 007E9AD2
ScreenToClient.USER32(00000002,00000002), ref: 007E9B05
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 007E9B72

Strings

@U=u, xrefs: 007E9BCD

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID: @U=u
API String ID: 3880355969-2594219639
Opcode ID: a1fa39f6afb23f61302881be354136a9ec1354c8cf1636620b9efa7ab212bbc3
Instruction ID: a9cf7822d24fb20ac601e3fdf0e302914ae0875eef878a3013b5db36b4f66bbf
Opcode Fuzzy Hash: a1fa39f6afb23f61302881be354136a9ec1354c8cf1636620b9efa7ab212bbc3
Instruction Fuzzy Hash: 73515275A01289EFCF20DF59D8849AE7BB5FF48320F148169F915DB290D734AD51CB50

Function 007BDA5D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 007BDAC5
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 007BDAFB
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 007BDB0C
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 007BDB8E

Strings

DllGetClassObject, xrefs: 007BDB01

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: bf153ee93cd43dd325d3c20e2ba6a7f3af0d154b12b0cb3613293855590a08cd
Instruction ID: 50d973b06d293b9a8505de5bdfd3025d2ebfac7078281a9632fa770a7f8b7e61
Opcode Fuzzy Hash: bf153ee93cd43dd325d3c20e2ba6a7f3af0d154b12b0cb3613293855590a08cd
Instruction Fuzzy Hash: B3414FB1601208DFDB25CF54C888BDB7BA9EF48350F1580ADE9099F205E7B9DD44DBA0

Function 007C2C42 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007C2CAF
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 007C2CCB
DeleteMenu.USER32(?,00000007,00000000), ref: 007C2D11
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00826890,00000000), ref: 007C2D5A

Strings

0, xrefs: 007C2CA4

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: bda345bed60f20b6f73bedd135227388acc74987682975a86a8c1453a9d758c4
Instruction ID: 39f2b3cee125b8269553ac9c1c47d8897c7476eec58e0d823b540d89a6231a22
Opcode Fuzzy Hash: bda345bed60f20b6f73bedd135227388acc74987682975a86a8c1453a9d758c4
Instruction Fuzzy Hash: F541A270205341DFD724DF28C884F1AB7E4EF95320F14466DF96697292DB78E906CBA2

Function 007E8AC0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 007E8B4D

Strings

@U=u, xrefs: 007E8B9C

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: InvalidateRect
String ID: @U=u
API String ID: 634782764-2594219639
Opcode ID: 1164df6a15634dd0503652069673aaea4c4263cccf4a267f916714aeaba4691a
Instruction ID: b0e55e8f4a9d6f5024470a364e9766c1cade9b34ec7998ca89c8f3af3e8e9e56
Opcode Fuzzy Hash: 1164df6a15634dd0503652069673aaea4c4263cccf4a267f916714aeaba4691a
Instruction Fuzzy Hash: 4B31D6F4602284BFEBA09B1ACC85FA93765FB0D310F148612FA59DA2E0DE3999509642

Function 007DDAB9 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 007DDAD9

Part of subcall function 007679AB: _memmove.LIBCMT ref: 007679F9

Strings

cdecl, xrefs: 007DDB30
stdcall, xrefs: 007DDB5B
winapi, xrefs: 007DDB4A
none, xrefs: 007DDBB4

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 920699676bd91ae499cee043d51e35242e1db843fd7bd7f827e278ce91d16304
Instruction ID: 45ec2b8586d85fcf38ad8b6c2c2f075e3f8f3038f33c3656d9e8fd102e055bf6
Opcode Fuzzy Hash: 920699676bd91ae499cee043d51e35242e1db843fd7bd7f827e278ce91d16304
Instruction Fuzzy Hash: BB318370600619EFCF10EFA4CC959EEB7B5FF05314B10862AE866A7791DB35AD09CB90

Function 007E6656 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00761D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00761D73
Part of subcall function 00761D35: GetStockObject.GDI32(00000011), ref: 00761D87
Part of subcall function 00761D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00761D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 007E66D0
LoadLibraryW.KERNEL32(?), ref: 007E66D7
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 007E66EC
DestroyWindow.USER32(?), ref: 007E66F4

Strings

SysAnimate32, xrefs: 007E66AB

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 45ec1f67ea1c67521698380c18bd0cb9499d182901c159ea48e58b288f656821
Instruction ID: 543a2499fd298690f79920e4ba2a6d205de3cc625ce73e8b2e8e4245db6972f3
Opcode Fuzzy Hash: 45ec1f67ea1c67521698380c18bd0cb9499d182901c159ea48e58b288f656821
Instruction Fuzzy Hash: 2621CD71211286EFEF104F66EC80EBB37ADEF6D3A8F104229F91096190D779CC519760

Function 007C703E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 007C705E
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 007C7091
GetStdHandle.KERNEL32(0000000C), ref: 007C70A3
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 007C70DD

Strings

nul, xrefs: 007C70D8

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 61d4aff14a84c0bbea17c1b382449a34ee7fe7c68eb063c1ea5e23f617416428
Instruction ID: 80f69997fba4c7c02ebfafe4f58666e7a2bc654238abfb45fe0a9b861519f038
Opcode Fuzzy Hash: 61d4aff14a84c0bbea17c1b382449a34ee7fe7c68eb063c1ea5e23f617416428
Instruction Fuzzy Hash: 64215174604209ABDB249F39DC45FAA77A8BF44720F20861DFDA1DB2D0DB749890CF51

Function 007C710C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 007C712B
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 007C715D
GetStdHandle.KERNEL32(000000F6), ref: 007C716E
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 007C71A8

Strings

nul, xrefs: 007C71A3

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 14cd629435a65c5f35f66e113966699125a7ae8fad734dd0c7c95445fe2709c5
Instruction ID: 783d8d5d0b053814d8dea14fabbe823e087662c51cd81b2ba082fe4f203a6e21
Opcode Fuzzy Hash: 14cd629435a65c5f35f66e113966699125a7ae8fad734dd0c7c95445fe2709c5
Instruction Fuzzy Hash: 9921CF7560420DABDB249F689C44FAAB7A8BF85320F244A1DFDA0D72D0DB789841CF64

Function 007CAEAB Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 007CAEBF
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 007CAF13
__swprintf.LIBCMT ref: 007CAF2C
SetErrorMode.KERNEL32(00000000,00000001,00000000,007EF910), ref: 007CAF6A

Strings

%lu, xrefs: 007CAF26

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 562a9b3acff22c5845a2dd8dfde5d87b66c6571b7c09afcb3c84b8ea1ce41665
Instruction ID: 8de6f717a91037768732521d4c69d1005ee02ff0a0773d44e24841abb9f37a5f
Opcode Fuzzy Hash: 562a9b3acff22c5845a2dd8dfde5d87b66c6571b7c09afcb3c84b8ea1ce41665
Instruction Fuzzy Hash: F4214470A0014DEFCB10EF55C989EEE7BB8EF89704B148069F909EB251DB35EA41CB61

Function 007BA52F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00767D2C: _memmove.LIBCMT ref: 00767D66

Part of subcall function 007BA37C: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 007BA399
Part of subcall function 007BA37C: GetWindowThreadProcessId.USER32(?,00000000), ref: 007BA3AC
Part of subcall function 007BA37C: GetCurrentThreadId.KERNEL32 ref: 007BA3B3
Part of subcall function 007BA37C: AttachThreadInput.USER32(00000000), ref: 007BA3BA

GetFocus.USER32 ref: 007BA554

Part of subcall function 007BA3C5: GetParent.USER32(?), ref: 007BA3D3

GetClassNameW.USER32(?,?,00000100), ref: 007BA59D
EnumChildWindows.USER32(?,007BA615), ref: 007BA5C5
__swprintf.LIBCMT ref: 007BA5DF

Strings

%s%d, xrefs: 007BA5D9

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 78f5e75792a7e9bb214fad58bad3cf8ad9a4959ff8fe5bb385800cdc2a970b66
Instruction ID: 2403583766cba6d22ef9edd21208e130e0eee240cc1039de7034a24fd0b758ff
Opcode Fuzzy Hash: 78f5e75792a7e9bb214fad58bad3cf8ad9a4959ff8fe5bb385800cdc2a970b66
Instruction Fuzzy Hash: DF11AFB1600208BBDF10BF64DC89FEA37B8AF49704F044075FE18AA192DA789A458B75

Function 007C2017 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 007C2048

Strings

KEYS, xrefs: 007C205F
REMOVE, xrefs: 007C204E
APPEND, xrefs: 007C2081
EXISTS, xrefs: 007C2070

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 0c6c71af8d251718732e90ab645fdc8c39379fb0341da569844dff3aa2e9cb5a
Instruction ID: bdb36b5cf248baa289ce8673d800b3048d6cc2f6e7e18c4724ac9bcff61bfdfc
Opcode Fuzzy Hash: 0c6c71af8d251718732e90ab645fdc8c39379fb0341da569844dff3aa2e9cb5a
Instruction Fuzzy Hash: 05115B30A40109DFCF44EFA4D8919FEB7B5FF15304B20846DD856AB252EB36694BCB50

Function 007DEE69 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 007DEF1B
GetProcessIoCounters.KERNEL32(00000000,?), ref: 007DEF4B
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 007DF07E
CloseHandle.KERNEL32(?), ref: 007DF0FF

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 39bdeab98bf17ed8c774c3e9de4a8bc64630be92883d9d1a1b4433ec7f32dcab
Instruction ID: 8f7e3156b2c80c6beffb80b3a99fe5a3e72e448b77e9ba87ed5e7f41ffc86688
Opcode Fuzzy Hash: 39bdeab98bf17ed8c774c3e9de4a8bc64630be92883d9d1a1b4433ec7f32dcab
Instruction Fuzzy Hash: 14814271604301DFD720EF24C88AB6AB7E5AF48710F14891DFA96DB392DB79AC40CB51

Function 007E02C2 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00767F41: _memmove.LIBCMT ref: 00767F82

Part of subcall function 007E10A5: CharUpperBuffW.USER32(?,?,?,?,?,?,?,007E0038,?,?), ref: 007E10BC

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007E0388
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 007E03C7
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 007E040E
RegCloseKey.ADVAPI32(?,?), ref: 007E043A
RegCloseKey.ADVAPI32(00000000), ref: 007E0447

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 0de3fb1ba1f9b26c7aae20fcb74429fed04975a42a70b3d52b8ee34e333f13d9
Instruction ID: a201abefdb4085b299051390627c10c6638b83d64a14e0a9fc95d522e64bea6a
Opcode Fuzzy Hash: 0de3fb1ba1f9b26c7aae20fcb74429fed04975a42a70b3d52b8ee34e333f13d9
Instruction Fuzzy Hash: 3E517A31208240EFD704EF65C885E6EB7E8FF88304F04892DF59687292DB78E904CB92

Function 007CE7DC Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 007CE88A
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 007CE8B3
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 007CE8F2

Part of subcall function 00769997: __itow.LIBCMT ref: 007699C2
Part of subcall function 00769997: __swprintf.LIBCMT ref: 00769A0C

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 007CE917
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 007CE91F

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 9b3dbff07c4abd42157637ff86c01f868d067e5f011f4a9b0b8a2879466125d8
Instruction ID: 8c84fed01e103de03cfc97d32f6589c97dadca820fa6d529571cc15bcccef0ef
Opcode Fuzzy Hash: 9b3dbff07c4abd42157637ff86c01f868d067e5f011f4a9b0b8a2879466125d8
Instruction Fuzzy Hash: 62512E35A00205DFCF01EF64C985AADBBF9FF48310B188099E94AAB361CB39ED11DB51

Function 00762344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00762357
ScreenToClient.USER32(008267B0,?), ref: 00762374
GetAsyncKeyState.USER32(00000001), ref: 00762399
GetAsyncKeyState.USER32(00000002), ref: 007623A7

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: cad76c625a370420182fcf4793f79fd3a2aa36b604d0640f5856360b5926cfcb
Instruction ID: 9d14e70d460b8379424a945145d430f114ef6adafcc701b6cb456b99af0dbb76
Opcode Fuzzy Hash: cad76c625a370420182fcf4793f79fd3a2aa36b604d0640f5856360b5926cfcb
Instruction Fuzzy Hash: CF41E331504259FBCF168F69C848AEDBB74FF09360F20432AF829962A0C7385D50DF91

Function 007B6920 Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 007B695D
TranslateAcceleratorW.USER32(?,?,?), ref: 007B69A9
TranslateMessage.USER32(?), ref: 007B69D2
DispatchMessageW.USER32(?), ref: 007B69DC
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 007B69EB

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: 8936a4335d7c9e16ff42e9beeb1af27b39422006f8e211ee73f056b0e7979715
Instruction ID: 7dee839471dec4bd4b16044a7a721bee14da680ada12bf64d6bd29fa4e440c1d
Opcode Fuzzy Hash: 8936a4335d7c9e16ff42e9beeb1af27b39422006f8e211ee73f056b0e7979715
Instruction Fuzzy Hash: 4531A171901246EFDB30CF749C84BF67BA8FB15304F148169E621D61A1E73DA89ADBA0

Function 007B8F01 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 007B8F12
PostMessageW.USER32(?,00000201,00000001), ref: 007B8FBC
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 007B8FC4
PostMessageW.USER32(?,00000202,00000000), ref: 007B8FD2
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 007B8FDA

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: d2ccef7e84a0cf738728d22bcd008735746c498a5e868a89feedbcd46b11a859
Instruction ID: e58e9d00718dcf8eaa356d9366a088f847fd57351c3b63102870a84f8bd54f6c
Opcode Fuzzy Hash: d2ccef7e84a0cf738728d22bcd008735746c498a5e868a89feedbcd46b11a859
Instruction Fuzzy Hash: 9E31E071500219EFDF00CF68D98CBEE7BBAEB44315F108229F924EA2D0C7B89914CB91

Function 007EB405 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00762612: GetWindowLongW.USER32(?,000000EB), ref: 00762623

GetWindowLongW.USER32(?,000000F0), ref: 007EB44C
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 007EB471
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 007EB489
GetSystemMetrics.USER32(00000004), ref: 007EB4B2
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,007D1184,00000000), ref: 007EB4D0

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: e8ac57c2262e765c7a3536b9cea7c503696e195907e24326effcabb3fb845614
Instruction ID: e239709954ba05205d99c5eed61b32669bbec0fa110361c2f15a46fb719015af
Opcode Fuzzy Hash: e8ac57c2262e765c7a3536b9cea7c503696e195907e24326effcabb3fb845614
Instruction Fuzzy Hash: F621A3715126E5AFCB208F39DC44A6B3BA4FB0A720F148738F926D75E1E7349921DB80

Function 007612F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0076134D
SelectObject.GDI32(?,00000000), ref: 0076135C
BeginPath.GDI32(?), ref: 00761373
SelectObject.GDI32(?,00000000), ref: 0076139C

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 14760d0a30b5e040226b26c47d4106fec3ebf28eeafff859790ab486bdef05e7
Instruction ID: b5533a602aab7f2752c17b489194e6a7c99440f9536821fc894f6a8fbe8b4a52
Opcode Fuzzy Hash: 14760d0a30b5e040226b26c47d4106fec3ebf28eeafff859790ab486bdef05e7
Instruction Fuzzy Hash: 0F215870801348EFDB219F26DD497697BB8F704321F54C235F812966A0E7799962DF90

Function 007BC161 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 007BC176
_memcmp.LIBCMT ref: 007BC194
_memcmp.LIBCMT ref: 007BC1A7
_memcmp.LIBCMT ref: 007BC1BF
_memcmp.LIBCMT ref: 007BC1D7

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 7ec54f3149712f7ccf770e01b25aa86b7bdbb6d6cef68ef9e31307d9e7f5cacb
Instruction ID: 632bfb3e87eff955de2271940946304ca82ae765edeaf2807ca39d165a5ed626
Opcode Fuzzy Hash: 7ec54f3149712f7ccf770e01b25aa86b7bdbb6d6cef68ef9e31307d9e7f5cacb
Instruction Fuzzy Hash: 150192F174510E7BE205B6285D4AFFB635C9F213A4B448021FE04B6283FA5C9E12C2B1

Function 007C4D35 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 007C4D5C
__beginthreadex.LIBCMT ref: 007C4D7A
MessageBoxW.USER32(?,?,?,?), ref: 007C4D8F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 007C4DA5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 007C4DAC

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: aab39d86d52619a59d04b095d986ad02e2a4ddb82c52dcd7db902b0c7d9d5573
Instruction ID: 81844b2bdaca1a67f6602d645701fb6f4a5dd96487672af7e274ebd72538f1d6
Opcode Fuzzy Hash: aab39d86d52619a59d04b095d986ad02e2a4ddb82c52dcd7db902b0c7d9d5573
Instruction Fuzzy Hash: DE1108B2A04248FBC7219BA89C48F9B7FACFB49320F14826DF915D7250D6798D4087A0

Function 007B874A Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 007B8766
GetLastError.KERNEL32(?,007B822A,?,?,?), ref: 007B8770
GetProcessHeap.KERNEL32(00000008,?,?,007B822A,?,?,?), ref: 007B877F
HeapAlloc.KERNEL32(00000000,?,007B822A,?,?,?), ref: 007B8786
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 007B879D

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 1f8444bb5cd1bf9ee06c02c09a6cfe64d3f1bd986974849f427214ea1f8f287d
Instruction ID: 797c459a81409061950447cf3ca6b124c9fe683026f222bbde20d33c55193114
Opcode Fuzzy Hash: 1f8444bb5cd1bf9ee06c02c09a6cfe64d3f1bd986974849f427214ea1f8f287d
Instruction Fuzzy Hash: 54016D71201248FFDB204FA6DC88DAB7BACFF8A3557204439F849CA260DE358C00CA60

Function 007C54E6 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 007C5502
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 007C5510
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 007C5518
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 007C5522
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 007C555E

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 0957986d5f93cb1fcf0e39a2f73927e5c42484e5b68143a5a6542ea703681573
Instruction ID: 5fedc6e60874d889899f7c3ccf3aa4b13a26a3012f33f4e872b5ae0d3e26955f
Opcode Fuzzy Hash: 0957986d5f93cb1fcf0e39a2f73927e5c42484e5b68143a5a6542ea703681573
Instruction Fuzzy Hash: 4E015E31D01A1DDBCF00DFE5E888AEDBB79BB0D711F40415AE501B6540DB3965A0C7A5

Function 007B7652 Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,007B758C,80070057,?,?,?,007B799D), ref: 007B766F
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,007B758C,80070057,?,?), ref: 007B768A
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,007B758C,80070057,?,?), ref: 007B7698
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,007B758C,80070057,?), ref: 007B76A8
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,007B758C,80070057,?,?), ref: 007B76B4

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: aa00f55084d5ffc8c0224cb2a7c41a113d074a6c210a5824a2216ac2e1cec4d3
Instruction ID: 9c5844c867144542093c8c3777246e4b7462262c1cdfb6923d706a9c159cd9ad
Opcode Fuzzy Hash: aa00f55084d5ffc8c0224cb2a7c41a113d074a6c210a5824a2216ac2e1cec4d3
Instruction Fuzzy Hash: E2018472602604BBDB145F58DC84BEA7BADEB88765F148028FD04D7211E739DE40DBA0

Function 007B85F1 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 007B8608
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 007B8612
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 007B8621
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 007B8628
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 007B863E

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: e86fb12cb29b3852e4e52f96d83ba7ebaca6c8dbb59a945e2e23cd43bee645f4
Instruction ID: afee1820f817d1450fecc8428e41a7b04f6f6bf49c1f7a511f42c46d513f2a3e
Opcode Fuzzy Hash: e86fb12cb29b3852e4e52f96d83ba7ebaca6c8dbb59a945e2e23cd43bee645f4
Instruction Fuzzy Hash: 26F06831201244AFD7101FA5DCCDFAB3BACEF8A758B084425F545C6551CB759C41DA65

Function 007B8652 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 007B8669
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 007B8673
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 007B8682
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 007B8689
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 007B869F

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: c45d47b1eadf6927b64620ea0b909a43744ebed939cf5b0d6d9594d3566fa3d0
Instruction ID: 1e7bad864df38bec18b568c8b1d28e60c6c7a01c42d469c82b73ddfa345a02ea
Opcode Fuzzy Hash: c45d47b1eadf6927b64620ea0b909a43744ebed939cf5b0d6d9594d3566fa3d0
Instruction Fuzzy Hash: A4F0C270201348AFEB111FA4ECC8FA73BACEF8A758B104029F905CA1A1DB78DD00DA61

Function 007BC6A6 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 007BC6BA
GetWindowTextW.USER32(00000000,?,00000100), ref: 007BC6D1
MessageBeep.USER32(00000000), ref: 007BC6E9
KillTimer.USER32(?,0000040A), ref: 007BC705
EndDialog.USER32(?,00000001), ref: 007BC71F

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 0a2bac23c32dd18659402c847bf3bf5cd5797af6f7937db4170b267b18dfa849
Instruction ID: cac5bb4a8f415b50a058e43f20bdb1d2ac0f321866361e23f02c0ba349388a35
Opcode Fuzzy Hash: 0a2bac23c32dd18659402c847bf3bf5cd5797af6f7937db4170b267b18dfa849
Instruction Fuzzy Hash: CA018630501704ABEB315B20DD8EFD677B8FF04745F008669F546A54E1DBF8A9548F84

Function 007613B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 007613BF
StrokeAndFillPath.GDI32(?,?,0079BAD8,00000000,?), ref: 007613DB
SelectObject.GDI32(?,00000000), ref: 007613EE
DeleteObject.GDI32 ref: 00761401
StrokePath.GDI32(?), ref: 0076141C

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 29d6bac69ff4288a778dbea35c73c04877e40fc5b49a17a268fcf0c97ea5f275
Instruction ID: 54fafd180ff9656f4f68638637667cacf56068c1d3ea89d80a68feb7c2e0f155
Opcode Fuzzy Hash: 29d6bac69ff4288a778dbea35c73c04877e40fc5b49a17a268fcf0c97ea5f275
Instruction Fuzzy Hash: A1F0EC30005388EBDB225F26EC4D7683FA4B705326F58C235E82A895F1D73989A6DF54

Function 00772E5B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00780FF6: std::exception::exception.LIBCMT ref: 0078102C
Part of subcall function 00780FF6: __CxxThrowException@8.LIBCMT ref: 00781041

Part of subcall function 00767F41: _memmove.LIBCMT ref: 00767F82

Part of subcall function 00767BB1: _memmove.LIBCMT ref: 00767C0B

__swprintf.LIBCMT ref: 0077302D

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00772EC6

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 82caadd1f932e22aa16b14df77d628e98a2232e92c723e2ec37097c463833b66
Instruction ID: 8978b798361393951bcde6d187420c4d51bffcaa9d626ae1e5fc70ec5adf7452
Opcode Fuzzy Hash: 82caadd1f932e22aa16b14df77d628e98a2232e92c723e2ec37097c463833b66
Instruction Fuzzy Hash: 33919071108301DFCB18EF24D899C6EB7A9EF85780F04491DF99A972A1DB38EE44DB52

Function 0078524D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 007852DD

Part of subcall function 00790340: __87except.LIBCMT ref: 0079037B

Strings

pow, xrefs: 007852B5, 007852D2

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: f5321147b44b47f00c381d5fc4b7190d6a4517afbbc16049ae6f8901c9e03b36
Instruction ID: ad7888176d1d697d9e22e4c7178fe0fb581a28698a93b4bd31dbd7349d5c0b8c
Opcode Fuzzy Hash: f5321147b44b47f00c381d5fc4b7190d6a4517afbbc16049ae6f8901c9e03b36
Instruction Fuzzy Hash: 2A517961A6CA01CBCF15B724E94137E2B94AB01750F208D68E095866F6EF7C8CD4DBC6

Function 0078023B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

+, xrefs: 00780277
#, xrefs: 00780280

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: e21c35ccb3c27b9cd61de8c15adfc79ec7f30671e6bd0fe351b7fc28bdd92e91
Instruction ID: 17c1d6b14bc96701da9de65d01e2d34a143ca95212fe8a06ef0199cd1c7622fb
Opcode Fuzzy Hash: e21c35ccb3c27b9cd61de8c15adfc79ec7f30671e6bd0fe351b7fc28bdd92e91
Instruction Fuzzy Hash: CA512175204646DFDF25AF28D8887FA7BA4EF1A310F144159EC919B2A0D73C9C46CBA0

Function 00773297 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007733D7
_memmove.LIBCMT ref: 00773470
_free.LIBCMT ref: 00773496
_memmove.LIBCMT ref: 00773549

Strings

Oaw, xrefs: 00773482

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: _memmove$_free
String ID: Oaw
API String ID: 2620147621-906014102
Opcode ID: f0b06e58dfc7309c32886688e36c641108f7438afe55ee7cc931aef3ede07490
Instruction ID: e2caabf529bd6a652f08512c1f5620ba4228840d0188358041bf7cc1ff232fda
Opcode Fuzzy Hash: f0b06e58dfc7309c32886688e36c641108f7438afe55ee7cc931aef3ede07490
Instruction Fuzzy Hash: DF5139716083419FDB24CF28C841B6ABBE5BF85354F44892DE989C7351EB39D901CB92

Function 007762F2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007763A8
_memmove.LIBCMT ref: 00776446
_memset.LIBCMT ref: 0077646A

Strings

ERCP, xrefs: 00776313

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 7c5fa3c4787d2585d596582fed70e4b7d7f1e444ab9541429b280c17ff5e4c4c
Instruction ID: 66f92cdfba0c2bc33fa999a740184b003a508902e3801e4fa88c1fa25725c764
Opcode Fuzzy Hash: 7c5fa3c4787d2585d596582fed70e4b7d7f1e444ab9541429b280c17ff5e4c4c
Instruction Fuzzy Hash: 9F51AF71900709DBDB24CF65C895BEABBF8FF04754F20856EEA4ECA245E7789684CB40

Function 007C99BE Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 0076506B: __fread_nolock.LIBCMT ref: 00765089

_wcscmp.LIBCMT ref: 007C9AAE
_wcscmp.LIBCMT ref: 007C9AC1

Strings

FILE, xrefs: 007C99FA
, xrefs: 007C99C8

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: $FILE
API String ID: 4029003684-2489923803
Opcode ID: 61f5ba96d0d1c4f57a0ac691a40652549222107f10cebd729561e0cf7ca9d084
Instruction ID: 57423decbd844276e293faa9bdddb3491b3ed0e072886dca4279540de337ecbf
Opcode Fuzzy Hash: 61f5ba96d0d1c4f57a0ac691a40652549222107f10cebd729561e0cf7ca9d084
Instruction Fuzzy Hash: 2A41B6B1A00619FADF209EA4DC89FEFB7BDDF45710F00006DBA01B7181D6799E0497A1

Function 007E7648 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 007E76D0
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 007E76E4
SendMessageW.USER32(?,00001002,00000000,?), ref: 007E7708

Strings

SysMonthCal32, xrefs: 007E769B

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 316dad5da36bdc43b629d558a68dad83bc4d714c213da476adff3d9b07bd00a5
Instruction ID: c891fae61e09ff74e44f1e81e96ebaf5a0789889576623ad83cb52941c7932e3
Opcode Fuzzy Hash: 316dad5da36bdc43b629d558a68dad83bc4d714c213da476adff3d9b07bd00a5
Instruction Fuzzy Hash: 6621A132601259BBDF15CF65CC86FEA3B69EF4C714F110214FE15AB1D0D6B9A851CBA0

Function 007E6F1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 007E6FAA
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 007E6FBA
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 007E6FDF

Strings

Listbox, xrefs: 007E6F77

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 0ed244eba5b0df7d54e3d40b89508e3e0653c9d898afb335fae91a134643b359
Instruction ID: bcdad312836cd3cfa26c61e2fafa2f8f15a89a052fe896dd63cdc4227b28c88e
Opcode Fuzzy Hash: 0ed244eba5b0df7d54e3d40b89508e3e0653c9d898afb335fae91a134643b359
Instruction Fuzzy Hash: 91210432612158BFDF118F55DC84FBB3BAAEF9D7A0F018124F9049B190CA75AC51CBA0

Function 007B912D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 007B914F
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 007B9166
SendMessageW.USER32(?,0000000D,?,00000000), ref: 007B919E

Strings

@U=u, xrefs: 007B919E

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: 4669bd21506498004370bfbc1e16990a7bef902ba5160e766a02971369612c97
Instruction ID: 53cc6da0eb5c334d293ed32d240a53b07bf1424d625fabe4482de3f7ea58140c
Opcode Fuzzy Hash: 4669bd21506498004370bfbc1e16990a7bef902ba5160e766a02971369612c97
Instruction Fuzzy Hash: B021923260010DFBDF20DBACDC45AEEB7BDAF44350F11045AEA15E72A0DA75AE449BA0

Function 007D60EC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000402,00000000,00000000), ref: 007D613B
SendMessageW.USER32(0000000C,00000000,?), ref: 007D617C
SendMessageW.USER32(0000000C,00000000,?), ref: 007D61A4

Strings

@U=u, xrefs: 007D613B, 007D617C, 007D61A4

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: fb7b89dc6a53d3f3957f875bad3377cfe6bf9074b91373cefde593b148fbb3df
Instruction ID: 0da68980e84fe4d9c9f798235ea81a1d6010537efdfed838834772e1b8d93709
Opcode Fuzzy Hash: fb7b89dc6a53d3f3957f875bad3377cfe6bf9074b91373cefde593b148fbb3df
Instruction Fuzzy Hash: F8211735201601EFDB10EB24DD89D2AB7FAFB49310B018055F90A9BA72DB35FC51CB90

Function 007E797D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 007E79E1
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 007E79F6
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 007E7A03

Strings

msctls_trackbar32, xrefs: 007E79B8

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 0b1ccd2666db9dfc5e21962f991fdfa1ee87c3e9e561de24ceb6508334326da1
Instruction ID: 3be594e8936f6eecf8c9f5b3a9efe89a753dec1e84575652c2acd6548cfb5f0e
Opcode Fuzzy Hash: 0b1ccd2666db9dfc5e21962f991fdfa1ee87c3e9e561de24ceb6508334326da1
Instruction Fuzzy Hash: 34112372240288BBEF249F75CC05FEB3BA9EF8D764F014528FA01A6090D275A811CB60

Function 007E6B8F Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 007E6C11
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 007E6C20

Strings

@U=u, xrefs: 007E6C20
edit, xrefs: 007E6BF5

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: @U=u$edit
API String ID: 2978978980-590756393
Opcode ID: 3dbb3cb8af873a8215cc8761dd40d1f5579ef033ccc0ed28269b7a7609ec5e28
Instruction ID: 86211307d6295a0eed073c2e6ae56d78234af814a948c6b14a521f130c0408ae
Opcode Fuzzy Hash: 3dbb3cb8af873a8215cc8761dd40d1f5579ef033ccc0ed28269b7a7609ec5e28
Instruction Fuzzy Hash: 4C11BFB1102188ABEB104F65DC45AFB3B69EB293B8F204724F961D71E0C739EC919760

Function 007B92E7 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00767F41: _memmove.LIBCMT ref: 00767F82

Part of subcall function 007BB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 007BB0E7

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 007B9355

Strings

@U=u, xrefs: 007B9355
ListBox, xrefs: 007B931F
ComboBox, xrefs: 007B92F4

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: @U=u$ComboBox$ListBox
API String ID: 372448540-2258501812
Opcode ID: 314d4f83a6ca98b1e8f9a015b4e057f77e89a18fa089d5d1807d0139f2556494
Instruction ID: 205b3bc665d6b0d575a288374ce23ef6d363f5f0a16b6648a47bd524ada4671b
Opcode Fuzzy Hash: 314d4f83a6ca98b1e8f9a015b4e057f77e89a18fa089d5d1807d0139f2556494
Instruction Fuzzy Hash: B9019271A05214EB8B08EBA4CC96DFE77A9FF06320B140619FA72A72D2DA39590C9650

Function 007B91DF Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00767F41: _memmove.LIBCMT ref: 00767F82

Part of subcall function 007BB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 007BB0E7

SendMessageW.USER32(?,00000180,00000000,?), ref: 007B924D

Strings

@U=u, xrefs: 007B924D
ListBox, xrefs: 007B9217
ComboBox, xrefs: 007B91EC

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: @U=u$ComboBox$ListBox
API String ID: 372448540-2258501812
Opcode ID: b5a4ccfea82150c11f1f63e1fe1916da3ce382d9d0a866b102454dbe15aee99c
Instruction ID: 133b0203bd5862b050aa8eab76566def332e5376744c07206ef62d487842f6d8
Opcode Fuzzy Hash: b5a4ccfea82150c11f1f63e1fe1916da3ce382d9d0a866b102454dbe15aee99c
Instruction Fuzzy Hash: 50018471E41104BBCB08EBA0C9A6FFF77ADEF05340F140119BA6267292EA195F1C9661

Function 007B9264 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00767F41: _memmove.LIBCMT ref: 00767F82

Part of subcall function 007BB0C4: GetClassNameW.USER32(?,?,000000FF), ref: 007BB0E7

SendMessageW.USER32(?,00000182,?,00000000), ref: 007B92D0

Strings

@U=u, xrefs: 007B92D0
ListBox, xrefs: 007B929C
ComboBox, xrefs: 007B9271

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: @U=u$ComboBox$ListBox
API String ID: 372448540-2258501812
Opcode ID: 6aaba9adcb0a3fc0154648014c782b2ef459901610810cc09ab992b8e8598681
Instruction ID: 80b016532dc7a20d8448e33f052fe9aaa13a10ff3d74049ac793ffef27c3d3e6
Opcode Fuzzy Hash: 6aaba9adcb0a3fc0154648014c782b2ef459901610810cc09ab992b8e8598681
Instruction Fuzzy Hash: 3E01A271E41108B7CB04EBA0C996FFF77ACAF15340F240115BE62B7282DA295F0C9271

Function 007EAF89 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,008267B0,007EDB17,000000FC,?,00000000,00000000,?,?,?,0079BBB9,?,?,?,?,?), ref: 007EAF8B
GetFocus.USER32 ref: 007EAF93

Part of subcall function 00762612: GetWindowLongW.USER32(?,000000EB), ref: 00762623

Part of subcall function 007625DB: GetWindowLongW.USER32(?,000000EB), ref: 007625EC

SendMessageW.USER32(00E3E7A8,000000B0,000001BC,000001C0), ref: 007EB005

Strings

@U=u, xrefs: 007EB005

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Window$Long$FocusForegroundMessageSend
String ID: @U=u
API String ID: 3601265619-2594219639
Opcode ID: fbab879a9ba8ddd95810fca07d2ae6a9895860c824aac908ad9ceb6392184ece
Instruction ID: d718bc14160e378420acda138bdbc61dd511bc0fe7184b9da4412fb61d2495da
Opcode Fuzzy Hash: fbab879a9ba8ddd95810fca07d2ae6a9895860c824aac908ad9ceb6392184ece
Instruction Fuzzy Hash: C10196312025408FC7249B29D8D8A6737E5FB8D324B184679E4228B2A1DB356C57CB50

Function 007761C3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0077619A: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 007761B1

SendMessageW.USER32(?,0000000C,00000000,?), ref: 007761DF
GetParent.USER32(?), ref: 007B111F
InvalidateRect.USER32(00000000,?,00773BAF,?,00000000,00000001), ref: 007B1126

Strings

@U=u, xrefs: 007761DF

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend$InvalidateParentRectTimeout
String ID: @U=u
API String ID: 3648793173-2594219639
Opcode ID: 7c782f5343fc9413c7703dbdfd3388375c25036f34221e6f8c0d168db46931bb
Instruction ID: 882aaa0849bb3664db438e778b3b3f72e583912c7961b24124dab99e96c3e267
Opcode Fuzzy Hash: 7c782f5343fc9413c7703dbdfd3388375c25036f34221e6f8c0d168db46931bb
Instruction Fuzzy Hash: E9F0A03110228CFBEF201F60DC4DFE17B68AB19380F60D435F6859E4A6C6AE5850AB50

Function 00764C95 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00764C2E), ref: 00764CA3
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00764CB5

Strings

kernel32.dll, xrefs: 00764C9E
GetNativeSystemInfo, xrefs: 00764CAF

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 7db4eb0809af0593f27bad5d0ea1aed5da726a644996f51dc8ce6350748b4a0f
Instruction ID: d6200a0f5e177518a5d40a3fac1ce76b84da9a29b4128a64568e005ebef2ed54
Opcode Fuzzy Hash: 7db4eb0809af0593f27bad5d0ea1aed5da726a644996f51dc8ce6350748b4a0f
Instruction Fuzzy Hash: D6D02BB050272BCFC7204F31CD4860272D6AF08740B10C83DDC82CAA50D77CC480C620

Function 00764D61 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00764D2E,?,00764F4F,?, ,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00764D6F
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00764D81

Strings

Wow64DisableWow64FsRedirection, xrefs: 00764D7B
kernel32.dll, xrefs: 00764D6A

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 3946368bebeca12df1790d4677fedf056e76760534117a8ba7dec7842e0ef730
Instruction ID: 2d30c25e651037ef919a7fe64cf55e1aa987e2831780f9d0f9105d4f37696f9d
Opcode Fuzzy Hash: 3946368bebeca12df1790d4677fedf056e76760534117a8ba7dec7842e0ef730
Instruction Fuzzy Hash: BDD0C770A01B57CFC7208F31C84820272E8BF08392B10C83ED883CAA90E778C880CA10

Function 00764D94 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00764CE1,?), ref: 00764DA2
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00764DB4

Strings

Wow64RevertWow64FsRedirection, xrefs: 00764DAE
kernel32.dll, xrefs: 00764D9D

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 0adf972efac522fc940ac5a41408d2215a5b87143fb860135860d54f214d8fc9
Instruction ID: 81e35d158f321151fb791116abea97fb2e1e24a12afab13d03e29027fd6e4270
Opcode Fuzzy Hash: 0adf972efac522fc940ac5a41408d2215a5b87143fb860135860d54f214d8fc9
Instruction Fuzzy Hash: B1D0C7B0A01B17DFC7208F31C848A8672E9AF08340B00C83ED8C6CAA50E778C880CA10

Function 007E1072 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,007E12C1), ref: 007E1080
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 007E1092

Strings

RegDeleteKeyExW, xrefs: 007E108C
advapi32.dll, xrefs: 007E107B

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: c707855d3bda3d1a1d99296f2abd0484d80a44b651bc5fd1b57b6ecb5abd203e
Instruction ID: d9bc42783410bfc57634a63bdaf1c7436d535c15731c77d206b234fc5491277b
Opcode Fuzzy Hash: c707855d3bda3d1a1d99296f2abd0484d80a44b651bc5fd1b57b6ecb5abd203e
Instruction Fuzzy Hash: 26D0C230401756CFC3204F39C85955672E8FF4C351B00CC3DE499CA650D7B8C4C0C600

Function 007D93F5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,007D9009,?,007EF910), ref: 007D9403
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 007D9415

Strings

GetModuleHandleExW, xrefs: 007D940F
kernel32.dll, xrefs: 007D93FE

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: e25e0d99f9c0aa95f235eae044143ab456e1e6e3d775f2ef52315574f118c251
Instruction ID: 0602be10d8b3a94a0c98ca2e5445c999359f581b26445abfda224ac295831f5c
Opcode Fuzzy Hash: e25e0d99f9c0aa95f235eae044143ab456e1e6e3d775f2ef52315574f118c251
Instruction Fuzzy Hash: 44D02B7050175BCFC7204F31C94810372E5AF08341B10C83ED482DAA50D77CC4C0C760

Function 007B76C5 Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f269cf51c86b1cb781499f3e1fd1ee6eb847aa6fdb0c79cd322d0d0915c57e1b
Instruction ID: 5654ebbde269b49e3ab8d15b467fcd4c1ec1b16b955b6bbaf30d683db2dd9ed0
Opcode Fuzzy Hash: f269cf51c86b1cb781499f3e1fd1ee6eb847aa6fdb0c79cd322d0d0915c57e1b
Instruction Fuzzy Hash: 4AC17475A04216EFCB18CFA4C884EAEB7F5FF88714B118599E805EB251D734ED41DB90

Function 007DE33E Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 007DE3D2
CharLowerBuffW.USER32(?,?), ref: 007DE415

Part of subcall function 007DDAB9: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 007DDAD9

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 007DE615
_memmove.LIBCMT ref: 007DE628

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 08ea241eb34ca6dfd47e338c3ed55fcdfa87ba1b2c93d8530750bfe4bb20170e
Instruction ID: bcec61b1f6a87e39c3f07e701d548abc4ac80ed61baa4dd72e883b8a22a4d924
Opcode Fuzzy Hash: 08ea241eb34ca6dfd47e338c3ed55fcdfa87ba1b2c93d8530750bfe4bb20170e
Instruction Fuzzy Hash: 2AC12571608341CFC715EF28C48496ABBF4BF88318F14896EF99A9B351D739E945CB82

Function 007D83A8 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 007D83D8
CoUninitialize.OLE32 ref: 007D83E3

Part of subcall function 007BDA5D: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 007BDAC5

VariantInit.OLEAUT32(?), ref: 007D83EE
VariantClear.OLEAUT32(?), ref: 007D86BF

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 7f67cf432cdd03fab5e89813012f3c590dd39cc73691c1a7390f9cdc119b280e
Instruction ID: b6af363a1e3641791437bab4a6ac14307c5d0c93a34a8369f4fe069b5f1fcff8
Opcode Fuzzy Hash: 7f67cf432cdd03fab5e89813012f3c590dd39cc73691c1a7390f9cdc119b280e
Instruction Fuzzy Hash: 55A11875204701DFCB50DF24C495A1AB7F8BF88324F188459FA9A9B3A2CB38ED04CB56

Function 007B7A78 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,007F2C7C,?), ref: 007B7C32
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,007F2C7C,?), ref: 007B7C4A
CLSIDFromProgID.OLE32(?,?,00000000,007EFB80,000000FF,?,00000000,00000800,00000000,?,007F2C7C,?), ref: 007B7C6F
_memcmp.LIBCMT ref: 007B7C90

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 0159b81bce58fe9a35a014559e04207cebae6952e8e43fb9e09b82439d5c71f6
Instruction ID: d8cfd52a9190798b932f449fa72bc24bc5fbcafae0be440db843d41d3d4fe43b
Opcode Fuzzy Hash: 0159b81bce58fe9a35a014559e04207cebae6952e8e43fb9e09b82439d5c71f6
Instruction Fuzzy Hash: 98810E75A00109EFCB04DF94C988EEEB7B9FF89315F204598F516AB250DB75AE06CB60

Function 007B6DF3 Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 007B6E04
SysAllocString.OLEAUT32(00000000), ref: 007B6EAD
VariantCopy.OLEAUT32 ref: 007B6EDC
VariantClear.OLEAUT32(?), ref: 007B6F03

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 78bd8bfd7f1648859728e1162a873cbfe50da8c3b63e78337c7fc6f4a107ddf2
Instruction ID: 5e58f825649af15527eaab841613129771ad107dcc099110651e095aaed21611
Opcode Fuzzy Hash: 78bd8bfd7f1648859728e1162a873cbfe50da8c3b63e78337c7fc6f4a107ddf2
Instruction Fuzzy Hash: EC519630604301DEDB24AF65D895BBAB3E5AF88310F20981FF656CB691EF7C9844DB15

Function 007D6CBD Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 007D6CE4
WSAGetLastError.WSOCK32(00000000), ref: 007D6CF4

Part of subcall function 00769997: __itow.LIBCMT ref: 007699C2
Part of subcall function 00769997: __swprintf.LIBCMT ref: 00769A0C

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 007D6D58
WSAGetLastError.WSOCK32(00000000), ref: 007D6D64

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: c0c4422fd9593d586698e00c5a957796811befba648b6f0f42853b51b3911a4f
Instruction ID: 12163470bc2d9a3e277b0a9c8e5b22ce7dc36293f68267f7baa898cbdf2ec606
Opcode Fuzzy Hash: c0c4422fd9593d586698e00c5a957796811befba648b6f0f42853b51b3911a4f
Instruction Fuzzy Hash: 76418274740200AFEB10AF24DC8AF7A77E99B48B14F44C119FE5AAF3D2DA799D008791

Function 007D672D Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,007EF910), ref: 007D67BA
_strlen.LIBCMT ref: 007D67EC

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 32b0a2f9124c003ad793a87b936f5caf5759d89ddb60962916a7f052b63beafd
Instruction ID: ce40aee4cb28e059abc4c3829963a51092d977c0c17d774a14e4e23775f1aac6
Opcode Fuzzy Hash: 32b0a2f9124c003ad793a87b936f5caf5759d89ddb60962916a7f052b63beafd
Instruction Fuzzy Hash: 5A419371A00104EBCB14EBA4DCD9FAEB7B9AF48314F148166F91A9B392DB38AD04D750

Function 007CBA5F Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 007CBB09
GetLastError.KERNEL32(?,00000000), ref: 007CBB2F
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 007CBB54
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 007CBB80

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: d25c99f474e868f60487f0f30fe2bc4bf9625d2b837e6e8ca8d605145e12ce25
Instruction ID: 0bd515f12d5073748a62e1aa5f59000bb9ad2233533215042923901a2539e4aa
Opcode Fuzzy Hash: d25c99f474e868f60487f0f30fe2bc4bf9625d2b837e6e8ca8d605145e12ce25
Instruction Fuzzy Hash: 6E411639600650DFCB10EF55C589A5DBBE9AF89310B09C498FD4AAB762CB38FD01CB91

Function 007EADF1 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 007EAE1A
GetWindowRect.USER32(?,?), ref: 007EAE90
PtInRect.USER32(?,?,007EC304), ref: 007EAEA0
MessageBeep.USER32(00000000), ref: 007EAF11

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: a2a2a25ace1fc53bc9f463855bb5f2bc8df434e15c59e29e1f07723fd3d6367a
Instruction ID: 745762634888b45db4619a62ecf5b01edb4660994c40d7a3e1f3ebe791d43f10
Opcode Fuzzy Hash: a2a2a25ace1fc53bc9f463855bb5f2bc8df434e15c59e29e1f07723fd3d6367a
Instruction Fuzzy Hash: 78417C70601299EFCB21CF6AC885A697BF5FF4D350F1881B9E414DB251D734E802DB92

Function 007C0FE6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 007C1037
SetKeyboardState.USER32(00000080,?,00000001), ref: 007C1053
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 007C10B9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 007C110B

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 210804008a9aa0c889820c7b810cb6a5f8a93e3d26301c290f6cd04dfff0829a
Instruction ID: badc4ec7270da57f6ebcdd2bc880a06bbfc9480d39b4a01e6567f8a705fd58b2
Opcode Fuzzy Hash: 210804008a9aa0c889820c7b810cb6a5f8a93e3d26301c290f6cd04dfff0829a
Instruction Fuzzy Hash: 81314D30E40688AEFF308B658C05FF9BBA5AB47310F88423EE580565D3C37C89D197A5

Function 007C1121 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,753DC0D0,?,00008000), ref: 007C1176
SetKeyboardState.USER32(00000080,?,00008000), ref: 007C1192
PostMessageW.USER32(00000000,00000101,00000000), ref: 007C11F1
SendInput.USER32(00000001,?,0000001C,753DC0D0,?,00008000), ref: 007C1243

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 7edafe8ef74ffc9eddf36e35123a78a7943a2e3c41e1d14f16e40e4d204cb98e
Instruction ID: 83e0eeb396a4b26aecfd271d2498071810dd395f938c6105d74328b9c5d3a5ed
Opcode Fuzzy Hash: 7edafe8ef74ffc9eddf36e35123a78a7943a2e3c41e1d14f16e40e4d204cb98e
Instruction Fuzzy Hash: C8312D30A4064C9BEF348A658C08FFA7B69AB4A310F98837EE550915D2C33C89559795

Function 00796415 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0079644B
__isleadbyte_l.LIBCMT ref: 00796479
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 007964A7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 007964DD

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: fb2c25295132190956af8b56adac0a04d26f95e8355af44f04ff91829364049a
Instruction ID: 2aed47f03e4d6bf051b946471e17df1f19d2debfbe27227c63bf31ed8a345e8d
Opcode Fuzzy Hash: fb2c25295132190956af8b56adac0a04d26f95e8355af44f04ff91829364049a
Instruction Fuzzy Hash: 4931C13160028AEFDF219FB5D849BAA7BA5FF40350F154229E8548B1A1E739DA50DB90

Function 007E5175 Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 007E5189

Part of subcall function 007C387D: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 007C3897
Part of subcall function 007C387D: GetCurrentThreadId.KERNEL32 ref: 007C389E
Part of subcall function 007C387D: AttachThreadInput.USER32(00000000,?,007C52A7), ref: 007C38A5

GetCaretPos.USER32(?), ref: 007E519A
ClientToScreen.USER32(00000000,?), ref: 007E51D5
GetForegroundWindow.USER32 ref: 007E51DB

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 9a257d9c41bd345c19ef323f41c85ed6c1e5adc6cdf21ae831fa22a0a091cf0b
Instruction ID: e1749f66cafaaf011727f133f47114f172b2d274aaea48bc771cca52f242e92b
Opcode Fuzzy Hash: 9a257d9c41bd345c19ef323f41c85ed6c1e5adc6cdf21ae831fa22a0a091cf0b
Instruction Fuzzy Hash: CE311471900148AFDB00EFA5C885DEFB7FDEF98304F10806AE916E7241DA799E45CBA1

Function 007EC788 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00762612: GetWindowLongW.USER32(?,000000EB), ref: 00762623

GetCursorPos.USER32(?), ref: 007EC7C2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0079BBFB,?,?,?,?,?), ref: 007EC7D7
GetCursorPos.USER32(?), ref: 007EC824
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0079BBFB,?,?,?), ref: 007EC85E

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 0347a7bc26d64b19df40f689b9bf0c75224edf477b30edc3f5bbb8141b571213
Instruction ID: 23fc10fe0cc515ac580a399eedf3be5c9f10f53374fd38e15f7dc8dac7acd3e5
Opcode Fuzzy Hash: 0347a7bc26d64b19df40f689b9bf0c75224edf477b30edc3f5bbb8141b571213
Instruction Fuzzy Hash: 0A31A539601098AFCB26CF59C898EEE7BB5FB0D310F044069F9058B261C7395D62DF60

Function 00780BD0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00780BF2

Part of subcall function 00765B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,007C7B20,?,?,00000000), ref: 00765B8C
Part of subcall function 00765B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,007C7B20,?,?,00000000,?,?), ref: 00765BB0

_fprintf.LIBCMT ref: 00780C29
OutputDebugStringW.KERNEL32(?), ref: 007B6331

Part of subcall function 00784CDA: _flsall.LIBCMT ref: 00784CF3

__setmode.LIBCMT ref: 00780C5E

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: b41cd7788ec9dcd67eb836b15d2d05b27fd292a870c14c77639579b7bc0c39b4
Instruction ID: b750b6f534f6a5c1d333955fb9688c58eaf9b99a4acf65494e4f9015c7e15b8a
Opcode Fuzzy Hash: b41cd7788ec9dcd67eb836b15d2d05b27fd292a870c14c77639579b7bc0c39b4
Instruction Fuzzy Hash: CE112432944209EECB05B7B49C4AAFE7B6D9F41320F14411AF20597192DE7C2D4693A5

Function 007B8B9E Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 007B8652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 007B8669
Part of subcall function 007B8652: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 007B8673
Part of subcall function 007B8652: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 007B8682
Part of subcall function 007B8652: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 007B8689
Part of subcall function 007B8652: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 007B869F

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 007B8BEB
_memcmp.LIBCMT ref: 007B8C0E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 007B8C44
HeapFree.KERNEL32(00000000), ref: 007B8C4B

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: c18bb642963664c2caf5feea5d60a673b6eb0529ccabd52adad2c56d140a4c97
Instruction ID: 68fb61c093da380a304f09fa3e838ee646f84a9d5a02e89c0c95a5a6b884b9c4
Opcode Fuzzy Hash: c18bb642963664c2caf5feea5d60a673b6eb0529ccabd52adad2c56d140a4c97
Instruction Fuzzy Hash: DB2195B1D41109EFDB10DF94C945BEEBBB8EF44354F144099E454A7241DB35AE05CB71

Function 007D1A5B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 007D1A97

Part of subcall function 007D1B21: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 007D1B40
Part of subcall function 007D1B21: InternetCloseHandle.WININET(00000000), ref: 007D1BDD

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 673e9260dd2b013b4bb835e3e6b3eef7be6d01be72dffc2db8bc904e45420b2d
Instruction ID: 10c489f86863bf2cf721b4f158bc7b2130ca1a8f95fdde54aa8aed56c266c43d
Opcode Fuzzy Hash: 673e9260dd2b013b4bb835e3e6b3eef7be6d01be72dffc2db8bc904e45420b2d
Instruction Fuzzy Hash: 8D21CF71201A00BFDB119F608C04FBAB7BAFF98700F50401BFA4196751EB7998119BA4

Function 007BE1AF Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 007BF5AD: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,007BE1C4,?,?,?,007BEFB7,00000000,000000EF,00000119,?,?), ref: 007BF5BC
Part of subcall function 007BF5AD: lstrcpyW.KERNEL32(00000000,?), ref: 007BF5E2
Part of subcall function 007BF5AD: lstrcmpiW.KERNEL32(00000000,?,007BE1C4,?,?,?,007BEFB7,00000000,000000EF,00000119,?,?), ref: 007BF613

lstrlenW.KERNEL32(?,00000002,?,?,?,?,007BEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 007BE1DD
lstrcpyW.KERNEL32(00000000,?), ref: 007BE203
lstrcmpiW.KERNEL32(00000002,cdecl,?,007BEFB7,00000000,000000EF,00000119,?,?,00000000), ref: 007BE237

Strings

cdecl, xrefs: 007BE22E

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: d3dc917abd02627caff18e87e02df20c975aa83ca200d10a2712eacfd99f0af5
Instruction ID: 49e1ebe54e2bb5978dbd35ce624c392d51c2e30d20edd674c7222cba87d099e1
Opcode Fuzzy Hash: d3dc917abd02627caff18e87e02df20c975aa83ca200d10a2712eacfd99f0af5
Instruction Fuzzy Hash: 2211D336200345EFCB25AF64DC49EFA77B8FF88350B40802AF816CB260EB799851C790

Function 00795332 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00795351

Part of subcall function 0078594C: __FF_MSGBANNER.LIBCMT ref: 00785963
Part of subcall function 0078594C: __NMSG_WRITE.LIBCMT ref: 0078596A
Part of subcall function 0078594C: RtlAllocateHeap.NTDLL(00E20000,00000000,00000001,00000000,?,?,?,00781013,?), ref: 0078598F

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: fcb896ad52f40d5f4843e7ecd8e8c7454a810ed7bfb4194975b9fee321673539
Instruction ID: 4b9a78b1c4582c4fccf79fa15769ffba992ce7bac20dc4534eed4784da04d3f9
Opcode Fuzzy Hash: fcb896ad52f40d5f4843e7ecd8e8c7454a810ed7bfb4194975b9fee321673539
Instruction Fuzzy Hash: 2E11E332545A25EFCF323F74BC4966D3B98AF183A4B20852AF9049A191DE7D8D4187A0

Function 00764531 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00764560

Part of subcall function 0076410D: _memset.LIBCMT ref: 0076418D
Part of subcall function 0076410D: _wcscpy.LIBCMT ref: 007641E1
Part of subcall function 0076410D: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 007641F1

KillTimer.USER32(?,00000001,?,?), ref: 007645B5
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 007645C4
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0079D6CE

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: cf01f546c383117bd792bccae10332de927d69008b5d5bf0ac233bb5356fb815
Instruction ID: 4853aa1c08dde09d45f5552f13ff62d80ae351f9b4e7e1ff4826bba6c8345cb7
Opcode Fuzzy Hash: cf01f546c383117bd792bccae10332de927d69008b5d5bf0ac233bb5356fb815
Instruction Fuzzy Hash: 7421A770904784AFEB328B24DC59BE7BBEC9F05308F04409DE69F56282C77C5E958B51

Function 007C40B1 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 007C40D1
_memset.LIBCMT ref: 007C40F2
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 007C4144
CloseHandle.KERNEL32(00000000), ref: 007C414D

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 1c0be74cb99f3334417e193d616b49c050d52721dceabe5e86e4947eae9d7f9d
Instruction ID: 681e85381d9dd795a83c18f2e22f459904f4644f3ac1096ec1475f5470790b39
Opcode Fuzzy Hash: 1c0be74cb99f3334417e193d616b49c050d52721dceabe5e86e4947eae9d7f9d
Instruction Fuzzy Hash: 1911AB7594122C7AD7305BA59C4DFABBB7CEF44760F10419AF908D7180D6744E808BA4

Function 007D667C Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00765B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,007C7B20,?,?,00000000), ref: 00765B8C
Part of subcall function 00765B75: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,007C7B20,?,?,00000000,?,?), ref: 00765BB0

gethostbyname.WSOCK32(?,?,?), ref: 007D66AC
WSAGetLastError.WSOCK32(00000000), ref: 007D66B7
_memmove.LIBCMT ref: 007D66E4
inet_ntoa.WSOCK32(?), ref: 007D66EF

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 70a50e1e40cadfcd2bca280876d7a4b1fffabe7c0a8057254830222364b795f7
Instruction ID: c4f4f0637d0c5597bb67916a9201b0a3506c832889ff5bf83d6ba86087e896a3
Opcode Fuzzy Hash: 70a50e1e40cadfcd2bca280876d7a4b1fffabe7c0a8057254830222364b795f7
Instruction Fuzzy Hash: D3116075500509EFCB00FBA4DD9ADEEB7B8EF48310B148165F906A7261DF38AE04DB61

Function 007B9023 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 007B9043
SendMessageW.USER32(?,000000C9,?,00000000), ref: 007B9055
SendMessageW.USER32(?,000000C9,?,00000000), ref: 007B906B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 007B9086

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: e612dc572ea2040434ef1f17163e70fb741736acb5fd5906d3795d027ea99389
Instruction ID: 17b77473751ab0931bfcf1c28312db551aa95c59daa9d1eb2602841bba50b8d4
Opcode Fuzzy Hash: e612dc572ea2040434ef1f17163e70fb741736acb5fd5906d3795d027ea99389
Instruction Fuzzy Hash: 36114C79901219FFDB10DFA5C884FEDBB74FB48310F2040A5EA14B7250D6716E10DB94

Function 00761290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00762612: GetWindowLongW.USER32(?,000000EB), ref: 00762623

DefDlgProcW.USER32(?,00000020,?), ref: 007612D8
GetClientRect.USER32(?,?), ref: 0079B84B
GetCursorPos.USER32(?), ref: 0079B855
ScreenToClient.USER32(?,?), ref: 0079B860

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 3551d9289b9252723ed3566ada793df4568820c9df167154a70b3b2ae5022274
Instruction ID: fca36144ab651c5d2b5063761c56b7dc4a3d3a7768e1d52acc120f7e8fba56d4
Opcode Fuzzy Hash: 3551d9289b9252723ed3566ada793df4568820c9df167154a70b3b2ae5022274
Instruction Fuzzy Hash: DB116A75A01059EFCB00DF98D8999FE77B8FB09300F408465FA02E7140C738BA51CBA9

Function 007C1652 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,007C01FD,?,007C1250,?,00008000), ref: 007C166F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,007C01FD,?,007C1250,?,00008000), ref: 007C1694
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,007C01FD,?,007C1250,?,00008000), ref: 007C169E
Sleep.KERNEL32(?,?,?,?,?,?,?,007C01FD,?,007C1250,?,00008000), ref: 007C16D1

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 3f4b3dbb27652d0e18c5981af927cd6d0d80fb6c5fc5d9f7b32f10ed6cfe60ef
Instruction ID: 871217334f4af85450c4c7b2077cd11f513778cef0b0733aa5d4a9c1e53f259c
Opcode Fuzzy Hash: 3f4b3dbb27652d0e18c5981af927cd6d0d80fb6c5fc5d9f7b32f10ed6cfe60ef
Instruction Fuzzy Hash: 89113C31C0152DDBCF00AFA5D988BEEBB78FF0A751F45806DE941B6241CF3895608B96

Function 00797207 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0079722B

Part of subcall function 00797912: __fltout2.LIBCMT ref: 0079793B

__cftog_l.LIBCMT ref: 00797251
__cftoe_l.LIBCMT ref: 00797283

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 35dac8f0c13e217d7b8b52193bbd8a4a1cb77f40d725faa9621c7e615441129c
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 28017E3206414AFBCF1A5F84EC058EE3F32BF19350B488515FA1898131C23AD9B1EB81

Function 007EB57F Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 007EB59E
ScreenToClient.USER32(?,?), ref: 007EB5B6
ScreenToClient.USER32(?,?), ref: 007EB5DA
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 007EB5F5

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: dc7405fbed636969dffcd1d64dd4097a01a6f4e3ec8c838568d6bbb5da7564ca
Instruction ID: 96e6c25fbad38a6cc737d870db9cb45cfa18d71c6b8d93bd3cac07747e0d1af7
Opcode Fuzzy Hash: dc7405fbed636969dffcd1d64dd4097a01a6f4e3ec8c838568d6bbb5da7564ca
Instruction Fuzzy Hash: DC1146B5D01249EFDB41CF99D4849EEFBB5FB0C310F108166E914E3620D735AA658F54

Function 007EB8EF Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007EB8FE
_memset.LIBCMT ref: 007EB90D
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00827F20,00827F64), ref: 007EB93C
CloseHandle.KERNEL32 ref: 007EB94E

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 314a0162a5a982423c7005271485b2e5485bfbf6c7523f14eb5057c22804dc01
Instruction ID: 3b554cf1740ffa9c158661fb71c041bddd53be7447c1dd558a47fa27838f7569
Opcode Fuzzy Hash: 314a0162a5a982423c7005271485b2e5485bfbf6c7523f14eb5057c22804dc01
Instruction Fuzzy Hash: 4EF082B2549350BBF2202766BD49FBB3A5CFB08754F008021FB08D95A6DB795D0187B8

Function 007C6E7C Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 007C6E88

Part of subcall function 007C794E: _memset.LIBCMT ref: 007C7983

_memmove.LIBCMT ref: 007C6EAB
_memset.LIBCMT ref: 007C6EB8
LeaveCriticalSection.KERNEL32(?), ref: 007C6EC8

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 3c3c4b79e80aa364e272742c549fb5896560f75aacff30f857b7f657c8c2a6e8
Instruction ID: 3da61d6543bd695c290dd6562d480bc6c5a2c979ab5963ed5be6d4808a87d4b1
Opcode Fuzzy Hash: 3c3c4b79e80aa364e272742c549fb5896560f75aacff30f857b7f657c8c2a6e8
Instruction Fuzzy Hash: 57F0543A100200EBCF016F55DC89F49BB2EEF49320B14C065FE085E216C735A911CBB5

Function 007EC00C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 007612F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0076134D
Part of subcall function 007612F3: SelectObject.GDI32(?,00000000), ref: 0076135C
Part of subcall function 007612F3: BeginPath.GDI32(?), ref: 00761373
Part of subcall function 007612F3: SelectObject.GDI32(?,00000000), ref: 0076139C

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 007EC030
LineTo.GDI32(00000000,?,?), ref: 007EC03D
EndPath.GDI32(00000000), ref: 007EC04D
StrokePath.GDI32(00000000), ref: 007EC05B

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 000160cea6c9cc31f0adeec944f147179360e2dbd5e69bba7cdc9373cd4d55ce
Instruction ID: d7e73a78e7d214ffdf8b1c0b24ceffc5d4b5ef9237d52b814e6ff6641cd8cf7c
Opcode Fuzzy Hash: 000160cea6c9cc31f0adeec944f147179360e2dbd5e69bba7cdc9373cd4d55ce
Instruction Fuzzy Hash: 7AF05E36102299FBDB226F55AC0DFCE3F59BF09311F148010FB11654E287795662CB99

Function 007BA37C Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 007BA399
GetWindowThreadProcessId.USER32(?,00000000), ref: 007BA3AC
GetCurrentThreadId.KERNEL32 ref: 007BA3B3
AttachThreadInput.USER32(00000000), ref: 007BA3BA

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 9271646bc87664dcc4e64865a7eab4d0971c1b4a12f2850e1ec085e8f30644c2
Instruction ID: b4b7b3c0d225174223e05aa0741e2a29bff1894d19010db03a42bbf2b6b68b86
Opcode Fuzzy Hash: 9271646bc87664dcc4e64865a7eab4d0971c1b4a12f2850e1ec085e8f30644c2
Instruction Fuzzy Hash: 70E0C931546368BBDB206BA2DC4DFDB7F6CEF1A7A1F00C025F509994A0C6798540DBA5

Function 00762218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00762231
SetTextColor.GDI32(?,000000FF), ref: 0076223B
SetBkMode.GDI32(?,00000001), ref: 00762250
GetStockObject.GDI32(00000005), ref: 00762258
GetWindowDC.USER32(?,00000000), ref: 0079C0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 0079C0E0
GetPixel.GDI32(00000000,?,00000000), ref: 0079C0F9
GetPixel.GDI32(00000000,00000000,?), ref: 0079C112
GetPixel.GDI32(00000000,?,?), ref: 0079C132
ReleaseDC.USER32(?,00000000), ref: 0079C13D

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 413b63de2a7080d052bc8310eb57126031de3b064ac48ce7da69f7453b8434e9
Instruction ID: 4f8d4d5e066e006c3472f49b13736abca67534b347bdba82a9c455b27da5494f
Opcode Fuzzy Hash: 413b63de2a7080d052bc8310eb57126031de3b064ac48ce7da69f7453b8434e9
Instruction Fuzzy Hash: DDE06D32101288EEEF215FA8FC4D7D83B24EB19332F00C366FA698C0E187794A90DB11

Function 007B8C5A Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 007B8C63
OpenThreadToken.ADVAPI32(00000000,?,?,?,007B882E), ref: 007B8C6A
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,007B882E), ref: 007B8C77
OpenProcessToken.ADVAPI32(00000000,?,?,?,007B882E), ref: 007B8C7E

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 60a574aee06faaab5cafdb2ebabda477ca34eeccef2192e4514f8acf845eb705
Instruction ID: 9361818126690f3fb66da43948f52842ce731db0ad31acbb223f5039ffff3b40
Opcode Fuzzy Hash: 60a574aee06faaab5cafdb2ebabda477ca34eeccef2192e4514f8acf845eb705
Instruction Fuzzy Hash: F9E04F76643251DBD7605FB06E4CB9A3BACAF58792F058868E245CD440DA388441CB65

Function 007A2187 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 007A2187
GetDC.USER32(00000000), ref: 007A2191
GetDeviceCaps.GDI32(00000000,0000000C), ref: 007A21B1
ReleaseDC.USER32(?), ref: 007A21D2

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 29851888203d14ad2d491b960032b6dc933700bf2203ac1e0b8e6e2f497d2b34
Instruction ID: bb8d725378837f028af8a8d0d0f7750fa14b00af421bcf4171ceb56c4d05a876
Opcode Fuzzy Hash: 29851888203d14ad2d491b960032b6dc933700bf2203ac1e0b8e6e2f497d2b34
Instruction Fuzzy Hash: BEE0E575801208EFDB019FA0C848AAD7BF5EB4C350F10C425FD5AAB620CB3C81429F45

Function 007A219B Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 007A219B
GetDC.USER32(00000000), ref: 007A21A5
GetDeviceCaps.GDI32(00000000,0000000C), ref: 007A21B1
ReleaseDC.USER32(?), ref: 007A21D2

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 7500b6d8cc11e5a4402eb8a31334b6f2c08323be4f36b34739ba225d3e451dc4
Instruction ID: c0ff9ef17d51fbc7c79f12621fdac4d179aace1e69be43eb04cb2e8cc07fe88a
Opcode Fuzzy Hash: 7500b6d8cc11e5a4402eb8a31334b6f2c08323be4f36b34739ba225d3e451dc4
Instruction Fuzzy Hash: 05E0EEB5801208EFDB01AFA0C8886AD7BE6AB4C320F10C029F95AAB620CB3C91419F45

Function 007BB7B6 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 007BB981

Strings

AutoIt3GUI, xrefs: 007BB8F9
Container, xrefs: 007BB8FE

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: e7ef53b4790f7ad7337b2476c8255d3a971ddea0bd3d8b4a98c6fe4c36fd9460
Instruction ID: e29c3736a5ca29898a39bd05c43db0ba66dbf35197208573b41318670c75e92a
Opcode Fuzzy Hash: e7ef53b4790f7ad7337b2476c8255d3a971ddea0bd3d8b4a98c6fe4c36fd9460
Instruction Fuzzy Hash: 73914970600201DFDB64DF68C884BAABBE8FF48710F14856DF94ADB291DBB4E845CB50

Function 007CB217 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 0077FEC6: _wcscpy.LIBCMT ref: 0077FEE9

Part of subcall function 00769997: __itow.LIBCMT ref: 007699C2
Part of subcall function 00769997: __swprintf.LIBCMT ref: 00769A0C

__wcsnicmp.LIBCMT ref: 007CB298
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 007CB361

Strings

LPT, xrefs: 007CB292

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: b4a01e45e780657cb65da0b2adc7b05deabb3dd5853aaa1bc4b073bd0a93e371
Instruction ID: e5ea5583da8e1b5642419f56abd8e95a88b574af9bd5f36481eb99d202555985
Opcode Fuzzy Hash: b4a01e45e780657cb65da0b2adc7b05deabb3dd5853aaa1bc4b073bd0a93e371
Instruction Fuzzy Hash: 9F616175A00215EFCB14DF94C886FAEB7B8EF48310F15805EF946AB291DB78AE40CB51

Function 007A8A77 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 007A8B1E
_memmove.LIBCMT ref: 007A8B78

Strings

Oaw, xrefs: 007A8BF2, 007AE39A, 007AE3B6

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: _memmove
String ID: Oaw
API String ID: 4104443479-906014102
Opcode ID: f63fdaccf1bd16b4816b8786c8f92bc23c0fae86041cdceff4b4f48a1742b6ba
Instruction ID: 05074a4155b0afface1cb7c3564ddd8c5f12ea69e93b8faa482ec68c3353f238
Opcode Fuzzy Hash: f63fdaccf1bd16b4816b8786c8f92bc23c0fae86041cdceff4b4f48a1742b6ba
Instruction Fuzzy Hash: B4514FB0A00609DFCF64CF68C884AAEB7B1FF85304F14862AE85AD7250EB35AD55CB51

Function 00772AB7 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00772AC8
GlobalMemoryStatusEx.KERNEL32(?), ref: 00772AE1

Strings

@, xrefs: 00772AD5

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 8b9ebf74f22edaa408c141e809c3a59a19b984c9b901718f0c5c006f1c6cd7fd
Instruction ID: 5f4569b6343305c93880bdd68e5b3d255470bcc050434b785c2590f295459bdf
Opcode Fuzzy Hash: 8b9ebf74f22edaa408c141e809c3a59a19b984c9b901718f0c5c006f1c6cd7fd
Instruction Fuzzy Hash: 71514672418745DBD320AF50D88ABAFBBECFF84310F42885DF6DA511A5DB348529CB26

Function 007D2882 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007D2892
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 007D28C8

Strings

|, xrefs: 007D2899

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 47d645a3e61cfcd1cb5eaa7bf1d66e13c44bdd309decc5ef927484d27f8da6de
Instruction ID: 44aa19c1bdcfeca26d7c8f9522a878429aa2164c90bf192b77fa62878e20cb69
Opcode Fuzzy Hash: 47d645a3e61cfcd1cb5eaa7bf1d66e13c44bdd309decc5ef927484d27f8da6de
Instruction Fuzzy Hash: D8311971800119EFCF05AFA1CC89EEEBFB9FF18350F10402AEC15A6266DA355A56DB60

Function 007E6CD2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 007E6D86
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 007E6DC2

Strings

static, xrefs: 007E6D22

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: d72979584c35d7d7d948b46842e1c6d81ccab9d9726df0f71570ead6c03f85fc
Instruction ID: d7433ba5e75ce572838002a3398475ff2bb97cd56c1636f7bf82f9c5280853af
Opcode Fuzzy Hash: d72979584c35d7d7d948b46842e1c6d81ccab9d9726df0f71570ead6c03f85fc
Instruction Fuzzy Hash: D531BE71200244AEDF10DF69CC84AFB77A9FF48764F508619F9A6C7190DB38AC91CB60

Function 007C2D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007C2E00
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 007C2E3B

Strings

0, xrefs: 007C2DF9

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: ea07aa6a6948740dc4a97ba0c5ea2ece9cb50f6bb618efd587ef63a846606131
Instruction ID: 62dad9e04d770b36bcd9fe19ae2865a7e4bbc7451fbc6ffcc6aa06f7d272ac64
Opcode Fuzzy Hash: ea07aa6a6948740dc4a97ba0c5ea2ece9cb50f6bb618efd587ef63a846606131
Instruction Fuzzy Hash: CD31EB31600309DBDB24DF58D849FDE7BB5FF05350F24402DE985B61A2D7789946CB50

Function 007BAFDC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0077619A: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 007761B1

SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 007BB03B
_strlen.LIBCMT ref: 007BB046

Strings

@U=u, xrefs: 007BB03B

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend$Timeout_strlen
String ID: @U=u
API String ID: 2777139624-2594219639
Opcode ID: 40d614235f87b889d12d343fe62a9cfacf8e1efe8e3bfefee45d7933fa01314c
Instruction ID: f2117d9068902fa77217ee272d939fa3be4bd0f779b24bedaabb0eec8b3f2097
Opcode Fuzzy Hash: 40d614235f87b889d12d343fe62a9cfacf8e1efe8e3bfefee45d7933fa01314c
Instruction Fuzzy Hash: 9311D831204205AACB14BA78DCCABFF7B699F45744F00007DFE169A193DF6DD9458360

Function 007E6AD4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007C589F: GetLocalTime.KERNEL32 ref: 007C58AC
Part of subcall function 007C589F: _wcsncpy.LIBCMT ref: 007C58E1
Part of subcall function 007C589F: _wcsncpy.LIBCMT ref: 007C5913
Part of subcall function 007C589F: _wcsncpy.LIBCMT ref: 007C5946
Part of subcall function 007C589F: _wcsncpy.LIBCMT ref: 007C5988

SendMessageW.USER32(?,00001002,00000000,?), ref: 007E6B6E

Strings

@U=u, xrefs: 007E6B6E
SysDateTimePick32, xrefs: 007E6B2C

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: _wcsncpy$LocalMessageSendTime
String ID: @U=u$SysDateTimePick32
API String ID: 2466184910-2530228043
Opcode ID: dec43ab7b5332f247c6cad1c84a2ecb29961c9ff728fb52026d109bf1eca0c87
Instruction ID: a234650f911de906ddfff2c3de4e2a49770c7a1c806e5886c94e9c428faa28b5
Opcode Fuzzy Hash: dec43ab7b5332f247c6cad1c84a2ecb29961c9ff728fb52026d109bf1eca0c87
Instruction Fuzzy Hash: 7F212971341248BFEF219E14DC86FEF7369EB587A4F204519F950EB1D0D6B9AC9087A0

Function 007B9707 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 007B9720

Part of subcall function 007C18EE: GetWindowThreadProcessId.USER32(?,?), ref: 007C1919
Part of subcall function 007C18EE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,007B973C,00000034,?,?,00001004,00000000,00000000), ref: 007C1929
Part of subcall function 007C18EE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,007B973C,00000034,?,?,00001004,00000000,00000000), ref: 007C193F

Part of subcall function 007C19CC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,007B9778,?,?,00000034,00000800,?,00000034), ref: 007C19F6

SendMessageW.USER32(?,00001073,00000000,?), ref: 007B9787

Part of subcall function 007C1997: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,007B97A7,?,?,00000800,?,00001073,00000000,?,?), ref: 007C19C1

Strings

@U=u, xrefs: 007B9720, 007B9787

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Process$MemoryMessageSend$AllocOpenReadThreadVirtualWindowWrite
String ID: @U=u
API String ID: 1045663743-2594219639
Opcode ID: 4f84a799c86eb39fe2ff2c20af162566f334120d8a554367cf66360853bc1cdb
Instruction ID: 953891291e0ee20d4a2d2aa636a94970d49fcb10c50ebc83b0687af4bf9f7507
Opcode Fuzzy Hash: 4f84a799c86eb39fe2ff2c20af162566f334120d8a554367cf66360853bc1cdb
Instruction Fuzzy Hash: 8F216231901119EBDF11AFA4CC45FDDBBB8FF09350F1041A9F658A7191DA745A44DFA0

Function 007E6943 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 007E69D0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 007E69DB

Strings

Combobox, xrefs: 007E699D

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 082dda2abaca6839bc79f9c1d72ac09843bf7536c75ed7ca3a8cd07151646812
Instruction ID: 8ea47fa76607657938cbfe33a8a1d8ef1224f5999e37e22e1c2d8cca3cc57817
Opcode Fuzzy Hash: 082dda2abaca6839bc79f9c1d72ac09843bf7536c75ed7ca3a8cd07151646812
Instruction Fuzzy Hash: 11110471301248AFEF118F15CC84EFB376EEBAC3E4F104128F9589B291D639AC9187A0

Function 007E9962 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

@U=u, xrefs: 007E99E7, 007E9A10

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID:
String ID: @U=u
API String ID: 0-2594219639
Opcode ID: 28271bd443286af3e179baeb24a922bda213d564489977f449fa8a779c8bb9d8
Instruction ID: ad2e8b002f447e0e2c6081c407651dd34dc1d1c2d9c92b05c9467ef8df2e79f8
Opcode Fuzzy Hash: 28271bd443286af3e179baeb24a922bda213d564489977f449fa8a779c8bb9d8
Instruction Fuzzy Hash: 5E218E72105298BFDB108F668C45FBA37A4EB0D310F008169FB12EB1D2D678A950DB60

Function 007E6E76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00761D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00761D73
Part of subcall function 00761D35: GetStockObject.GDI32(00000011), ref: 00761D87
Part of subcall function 00761D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00761D91

GetWindowRect.USER32(00000000,?), ref: 007E6EE0
GetSysColor.USER32(00000012), ref: 007E6EFA

Strings

static, xrefs: 007E6EBD

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 4368e5c68941594f1544e6499b071dbccfded120defff22a428a798abb38b5c1
Instruction ID: 2a88faf00e956f7db2dd8e49b42171f31ca69f7550a318f03c07746ebf0ed43f
Opcode Fuzzy Hash: 4368e5c68941594f1544e6499b071dbccfded120defff22a428a798abb38b5c1
Instruction Fuzzy Hash: EC21567261024AAFDB04DFA8DC45AFA7BB8FB1C354F044628FD55D3251E738E8619B60

Function 007C2E9E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007C2F11
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 007C2F30

Strings

0, xrefs: 007C2F07

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: bc60eceabfeddb528eb212f30c1f687428b8d39600e9523047c513f33295c642
Instruction ID: 85b6596bf1a7d4707d74b914a12f00bfe7bc9896eaf6cbccfc240b492c5df4d0
Opcode Fuzzy Hash: bc60eceabfeddb528eb212f30c1f687428b8d39600e9523047c513f33295c642
Instruction Fuzzy Hash: 5611C431901228ABDB21DB58DC48FA977B9EB05310F1440BDEC55B72A2E7B8ED06C795

Function 007D24CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 007D2520
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 007D2549

Strings

<local>, xrefs: 007D2511

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 6562d2983fbe498c8055995c2e584dc3c03edca3eaab0a82ace262883ff47dc2
Instruction ID: 696c417332e83244ee8103fdcaee335854e5d42d23cc764c1e75ad1ddd96dfca
Opcode Fuzzy Hash: 6562d2983fbe498c8055995c2e584dc3c03edca3eaab0a82ace262883ff47dc2
Instruction Fuzzy Hash: E411E070201265BADB258F519C98EFBFF78FF26351F10816BF90646241D27869A3DAF0

Function 007E8752 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 007E879F

Strings

@U=u, xrefs: 007E879F, 007E87DB

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: a8315e48091e3a1bad6f580a730149447feffaabd6e7f1bdf352a6f88a0a6820
Instruction ID: d046bccb58c4bd921c0889dd1f1b3390575b8f8199c15d4281eb68dfe40da301
Opcode Fuzzy Hash: a8315e48091e3a1bad6f580a730149447feffaabd6e7f1bdf352a6f88a0a6820
Instruction Fuzzy Hash: 52211479601149EF8B55CF98D8808AA7BB5FB4C340B104159FE05A7360DA35AD61DBA1

Function 007E6825 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000401,?,00000000), ref: 007E689B

Strings

@U=u, xrefs: 007E689B
button, xrefs: 007E6872

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend
String ID: @U=u$button
API String ID: 3850602802-1762282863
Opcode ID: b55cec3648c508e2afad5da762575a98e258b704283bae58b5a09bc768d3a31a
Instruction ID: f9c6e6873d3f0f5a2a2f8705196ef5275e55c5ab30d9d4d92f41e238858ae6c6
Opcode Fuzzy Hash: b55cec3648c508e2afad5da762575a98e258b704283bae58b5a09bc768d3a31a
Instruction Fuzzy Hash: 60110432141245ABDF118FA0CC41FEA376AFF2C354F154618FE54AB190C73AE8A19B50

Function 007E7AFB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000133E,00000000,?), ref: 007E7B47

Strings

@U=u, xrefs: 007E7B47

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: 38e9f103d99d582c1966e0e9f925c840470d2716af5ebff2bce31206062abb4f
Instruction ID: ef69cd0f437464f9b4e123d8143b361d8488ab5a4123272c0f266ee3d26ac6d2
Opcode Fuzzy Hash: 38e9f103d99d582c1966e0e9f925c840470d2716af5ebff2bce31206062abb4f
Instruction Fuzzy Hash: B5112670505384EFD721CF34C891AE7B7E8FF09310F10851DE9AA9B281D7352940DB60

Function 007D80A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 007D830B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,007D80C8,?,00000000,?,?), ref: 007D8322

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 007D80CB
htons.WSOCK32(00000000,?,00000000), ref: 007D8108

Strings

255.255.255.255, xrefs: 007D80E3

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: 2cffb1135dfd4bf97153cff61f8ada93bbc942d84ff090273590271a9122add0
Instruction ID: 3b7c87bbdd6b4bee29afc86f2d92ba74da0fbeaf00cf893dd43f728a3ab511ec
Opcode Fuzzy Hash: 2cffb1135dfd4bf97153cff61f8ada93bbc942d84ff090273590271a9122add0
Instruction Fuzzy Hash: 3E11A574500209ABDB20AF64CC86FEDB774FF04320F10851BE91197391DA76A815D696

Function 007B9989 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007C19CC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,007B9778,?,?,00000034,00000800,?,00000034), ref: 007C19F6

SendMessageW.USER32(?,0000102B,?,00000000), ref: 007B99EB
SendMessageW.USER32(?,0000102B,?,00000000), ref: 007B9A10

Strings

@U=u, xrefs: 007B99EB, 007B9A10

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend$MemoryProcessWrite
String ID: @U=u
API String ID: 1195347164-2594219639
Opcode ID: 553c45218c46ed3ae0cef70c2fea139d8d534ac3dee3445695505e01d1a128aa
Instruction ID: 561505ecedbbfaddac5b63bdf066c9c6909030751c00f4caf29701c4c76bcf86
Opcode Fuzzy Hash: 553c45218c46ed3ae0cef70c2fea139d8d534ac3dee3445695505e01d1a128aa
Instruction Fuzzy Hash: 8501DF31501118EBDB11AB64DC89FEAB778DB04360F10816AF655A70D1DB746D54CB60

Function 00770A8D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00763C26, ,?,?,?), ref: 00770ACE

Part of subcall function 00767D2C: _memmove.LIBCMT ref: 00767D66

_wcscat.LIBCMT ref: 007A50E1

Strings

H@, xrefs: 00770ADA

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: FullNamePath_memmove_wcscat
String ID: H@
API String ID: 257928180-1099322995
Opcode ID: bdd640a18a8aa05ba5e0ab733a8f6a5054c4be517f5909683f92f09be143fdbd
Instruction ID: 3d39184b43945e045b09e402c9622cca156793b1af93e3c10f4d77ac8c87e16e
Opcode Fuzzy Hash: bdd640a18a8aa05ba5e0ab733a8f6a5054c4be517f5909683f92f09be143fdbd
Instruction Fuzzy Hash: 9411A175A04218DB8F10EBB4DC09E9973B8FF08394B0085A5BA4DD7251EA78DB888B51

Function 007B9AB7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000406,00000000,00000000), ref: 007B9ADD
SendMessageW.USER32(?,0000040D,?,00000000), ref: 007B9B10

Part of subcall function 007C1997: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,007B97A7,?,?,00000800,?,00001073,00000000,?,?), ref: 007C19C1

Part of subcall function 00767D2C: _memmove.LIBCMT ref: 00767D66

Strings

@U=u, xrefs: 007B9ADD, 007B9B10

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend$MemoryProcessRead_memmove
String ID: @U=u
API String ID: 339422723-2594219639
Opcode ID: 42ab08748c3b894b2ca5ac53cb97a01bea80ca3fe182f82c3746a8ffff6311aa
Instruction ID: ecd14fb5e9394c7a30c6c020ffef0612a0657398567a9f6117810143a4f4a795
Opcode Fuzzy Hash: 42ab08748c3b894b2ca5ac53cb97a01bea80ca3fe182f82c3746a8ffff6311aa
Instruction Fuzzy Hash: A2015B71901118EFDB54EE60DC85EEA77BCFB18340F80C0AAFA89A6151DE355E99CB90

Function 007EC86D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00762612: GetWindowLongW.USER32(?,000000EB), ref: 00762623

DefDlgProcW.USER32(?,0000002B,?,?,?,?,?,?,?,0079BB8A,?,?,?), ref: 007EC8E1

Part of subcall function 007625DB: GetWindowLongW.USER32(?,000000EB), ref: 007625EC

SendMessageW.USER32(?,00000401,00000000,00000000), ref: 007EC8C7

Strings

@U=u, xrefs: 007EC8C7

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: LongWindow$MessageProcSend
String ID: @U=u
API String ID: 982171247-2594219639
Opcode ID: 6a0fab817a516b777a018589d566673a8c4b6e8212fa57c07d4e625bb86c69e5
Instruction ID: 463acd84fc56c37e5835587b40e8a1c691143087ed9f9899a28c5b0190b88db7
Opcode Fuzzy Hash: 6a0fab817a516b777a018589d566673a8c4b6e8212fa57c07d4e625bb86c69e5
Instruction Fuzzy Hash: 2B01F535201284EFCB225F15DC88E663BA6FB89320F144024F9524B6A1C7396813EB91

Function 007B9A1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 007B9A2E
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 007B9A46

Strings

@U=u, xrefs: 007B9A2E, 007B9A46

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: f78c02bb89907aa82e72103f107595f2ccb2c05849a55b08028656abcd0bea95
Instruction ID: 194b09cc134c5959bd0677b99146a560f18a99a91d12b4665615ff171b2da3bf
Opcode Fuzzy Hash: f78c02bb89907aa82e72103f107595f2ccb2c05849a55b08028656abcd0bea95
Instruction Fuzzy Hash: D6E092353423A1B7F6305A258C8EFD76F59DB8DB61F114039FB11AD1E1CAD64C81C2A0

Function 007BA1A8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 007BA1BA
SendMessageW.USER32(?,0000110A,00000000,00000000), ref: 007BA1EA

Strings

@U=u, xrefs: 007BA1BA, 007BA1EA

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: 75f95eb09621c0c6eea9b447459891f12ce0eab4c3af65655079992f17a75c62
Instruction ID: 59acb9727244dcf6faabe24221b26ffc98109317013ff3e4a69444be3d8347a6
Opcode Fuzzy Hash: 75f95eb09621c0c6eea9b447459891f12ce0eab4c3af65655079992f17a75c62
Instruction Fuzzy Hash: 60F0A035341348FFEA162A94DC8AFEA3B2DEF0CBA1F004024F7059E0E1DAE65D409790

Function 007BA327 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30windowCOMMON

Download Yara Rule

APIs

Part of subcall function 007B9E2E: SendMessageW.USER32(?,0000110A,00000000,00000000), ref: 007B9E47
Part of subcall function 007B9E2E: SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 007B9E81

SendMessageW.USER32(?,0000110B,00000005,00000000), ref: 007BA34B
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 007BA35B

Strings

@U=u, xrefs: 007BA34B, 007BA35B

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: 3dc5ee58e548058f9c8f6f5a811e5bef4b39880b1c14ac7a6b13a4dad3ac9b73
Instruction ID: 4b9548a31dd4b545bf90349490bed84b2469071ad37d9239c85c222d72ed78fa
Opcode Fuzzy Hash: 3dc5ee58e548058f9c8f6f5a811e5bef4b39880b1c14ac7a6b13a4dad3ac9b73
Instruction Fuzzy Hash: 16E0D875209305BFF6251A619C8BFD73B5CDB4C751F114039F300490A0EEA68C506524

Function 007C51CA Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 007C51E8
_wcscmp.LIBCMT ref: 007C51FA

Strings

#32770, xrefs: 007C51F4

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 5075513e4f901c070cb654bf07a9a37384ec469c3ac1d67dfacf2785b880f6b4
Instruction ID: 73f77ee816908b2b058f4f11441f1fd3452a063bee5e8c436fc3714a732ef87d
Opcode Fuzzy Hash: 5075513e4f901c070cb654bf07a9a37384ec469c3ac1d67dfacf2785b880f6b4
Instruction Fuzzy Hash: F1E02272A012282AE320AA99AC49FA7F7ACFB44B21F00006AF910D3040E574AA458BE0

Function 007B81BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 007B81CA

Part of subcall function 00783598: _doexit.LIBCMT ref: 007835A2

Strings

Error allocating memory., xrefs: 007B81C3
AutoIt, xrefs: 007B81BE

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 7805243570ae3d8afc0f389fe995423e7f5e911d4169f1f62d23b68a9087414a
Instruction ID: a3d293c3f0c9dfbd475e5948d23df207fdff98bbc91ec406f1bbbfa35db59ee0
Opcode Fuzzy Hash: 7805243570ae3d8afc0f389fe995423e7f5e911d4169f1f62d23b68a9087414a
Instruction Fuzzy Hash: B1D012323C536C72D21432A86C0ABC6764C4B05F51F404015FB08955D389DD55D282ED

Function 0079B511 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0079B564: _memset.LIBCMT ref: 0079B571

Part of subcall function 00780B84: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,0079B540,?,?,?,0076100A), ref: 00780B89

IsDebuggerPresent.KERNEL32(?,?,?,0076100A), ref: 0079B544
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0076100A), ref: 0079B553

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0079B54E

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 05eed7078cc1ac4a88cbb04f53bbd42f16176ce20b4512245267d2156222633b
Instruction ID: 2c8cdf7cf0970341244903ef08cad1fb119bccc84537cc4f724019939136d768
Opcode Fuzzy Hash: 05eed7078cc1ac4a88cbb04f53bbd42f16176ce20b4512245267d2156222633b
Instruction Fuzzy Hash: EEE039B0200750CBD760EF28E9483427AE4BB08754F01892CE456C6691E7BCD408CBA1

Function 007B98BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 007B98CB
SendMessageW.USER32(00000000,00001200,00000000,00000000), ref: 007B98D9

Strings

@U=u, xrefs: 007B98CB, 007B98D9

Memory Dump Source

Source File: 00000000.00000002.1354536325.0000000000761000.00000020.00000001.01000000.00000003.sdmp, Offset: 00760000, based on PE: true

Associated: 00000000.00000002.1354516815.0000000000760000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.00000000007EF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354594734.0000000000815000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354645894.000000000081F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1354669915.0000000000828000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_760000_6bdudXAsQW.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: b6031ae3050ad50c011f015ead580d2c3338c92fb23fcd9f520bcb0cdfcccfb3
Instruction ID: a24c5ce23a4618e3aec215db8801e9c9193317f6d4f8c860637d6e904704f032
Opcode Fuzzy Hash: b6031ae3050ad50c011f015ead580d2c3338c92fb23fcd9f520bcb0cdfcccfb3
Instruction Fuzzy Hash: 9DC002311421C0BBEA211B77AC4DD873E3DE7CEF52711416CF2119D4B5C6690195D628

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 6bdudXAsQW.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Agenttesla

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ZUHFqcY.exe.log

C:\Users\user\AppData\Local\Temp\Marquand

C:\Users\user\AppData\Local\Temp\autD26F.tmp

C:\Users\user\AppData\Local\Temp\autD2BE.tmp

C:\Users\user\AppData\Local\Temp\incalculable

C:\Users\user\AppData\Roaming\ZUHFqcY\ZUHFqcY.exe

\Device\ConDrv

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Windows Analysis Report
6bdudXAsQW.exe

Function 00763B4C Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowCOMMON

Function 00764FE9 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 62
COMMON

Function 00764AFE Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 007C93DF Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 007671EB Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 201
registryCOMMON

Function 00763015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 75
windowregistryCOMMON

Function 00763041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 00763A58 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00763778 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Function 00763633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 0076F8CF Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168
comCOMMON

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre