Edit tour

Windows Analysis Report
7056ZCiFdE.exe

Overview

General Information

Sample name:	7056ZCiFdE.exe renamed because original name is a hash value
Original sample name:	6f0604f8a16b94b61d714dfec11d0358.exe
Analysis ID:	1570884
MD5:	6f0604f8a16b94b61d714dfec11d0358
SHA1:	558828c2ead68ea5883655299a3f0bfad1981ae5
SHA256:	28331e2705bf58bd76a9f8ba0f0a431b762eaf6e4284dbf12f1453dd3fecf281
Tags:	exeuser-abuse_ch
Infos:

Detection

Remcos

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Contains functionality to bypass UAC (CMSTPLUA)

Detected Remcos RAT

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Sigma detected: Remcos

Suricata IDS alerts for network traffic

Yara detected Remcos RAT

Yara detected UAC Bypass using CMSTP

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Contains functionality to register a low level keyboard hook

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Firefox passwords or cookies

Contains functionalty to change the wallpaper

Delayed program exit found

Drops VBS files to the startup folder

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: WScript or CScript Dropper

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to download and launch executables

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to enumerate running services

Contains functionality to execute programs as a different user

Contains functionality to launch a control a shell (cmd.exe)

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

7056ZCiFdE.exe (PID: 6992 cmdline: "C:\Users\user\Desktop\7056ZCiFdE.exe" MD5: 6F0604F8A16B94B61D714DFEC11D0358)

Allene.exe (PID: 7132 cmdline: "C:\Users\user\Desktop\7056ZCiFdE.exe" MD5: 6F0604F8A16B94B61D714DFEC11D0358)

wscript.exe (PID: 5812 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Allene.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

Allene.exe (PID: 2872 cmdline: "C:\Users\user\AppData\Local\Milburr\Allene.exe" MD5: 6F0604F8A16B94B61D714DFEC11D0358)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Remcos, RemcosRAT	Remcos (acronym of Remote Control & Surveillance Software) is a commercial Remote Access Tool to remotely control computers.Remcos is advertised as legitimate software which can be used for surveillance and penetration testing purposes, but has been used in numerous hacking campaigns.Remcos, once installed, opens a backdoor on the computer, granting full access to the remote user.Remcos is developed by the cybersecurity company BreakingSecurity.	APT33 The Gorgon Group UAC-0050	http://malware-traffic-analysis.net/2017/12/22/index.html https://0xmrmagnezi.github.io/malware%20analysis/RemcosRAT/ https://asec.ahnlab.com/en/32376/ https://asec.ahnlab.com/ko/25837/ https://asec.ahnlab.com/ko/32101/	https://malpedia.caad.fkie.fraunhofer.de/details/win.remcos

Malware Configuration

Threatname: Remcos

{"Host:Port:Password": ["192.210.150.26:8787:0"], "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-R1T905", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos", "Keylog file max size": ""}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\ProgramData\remcos\logs.dat	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.4155512160.0000000000400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000001.00000002.4155512160.0000000000400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000001.00000002.4155512160.0000000000400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000001.00000002.4155512160.0000000000400000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6b6f8:$a1: Remcos restarted by watchdog! 0x6bc70:$a3: %02i:%02i:%02i:%03i
00000001.00000002.4155512160.0000000000400000.00000040.00001000.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x65994:$str_a1: C:\Windows\System32\cmd.exe 0x65910:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65910:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65e10:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x66410:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x65a04:$str_b2: Executing file: 0x6683c:$str_b3: GetDirectListeningPort 0x66200:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x66380:$str_b7: \update.vbs 0x65a2c:$str_b9: Downloaded file: 0x65a18:$str_b10: Downloading file: 0x65abc:$str_b12: Failed to upload file: 0x66804:$str_b13: StartForward 0x66824:$str_b14: StopForward 0x662d8:$str_b15: fso.DeleteFile " 0x6626c:$str_b16: On Error Resume Next 0x66308:$str_b17: fso.DeleteFolder " 0x65aac:$str_b18: Uploaded file: 0x65a6c:$str_b19: Unable to delete: 0x662a0:$str_b20: while fso.FileExists(" 0x65f49:$str_c0: [Firefox StoredLogins not found]
00000001.00000002.4155512160.0000000000400000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x65880:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x65810:$s1: CoGetObject 0x65824:$s1: CoGetObject 0x65840:$s1: CoGetObject 0x6f470:$s1: CoGetObject 0x657d0:$s2: Elevation:Administrator!new:
00000004.00000002.1920045593.0000000001948000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000001.00000002.4156569703.00000000012B3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000002.1919987718.00000000018B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000004.00000002.1919987718.00000000018B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000002.1919987718.00000000018B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000004.00000002.1919987718.00000000018B0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaf8:$a1: Remcos restarted by watchdog! 0x6b070:$a3: %02i:%02i:%02i:%03i
00000004.00000002.1919987718.00000000018B0000.00000004.00001000.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x64d94:$str_a1: C:\Windows\System32\cmd.exe 0x64d10:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64d10:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65210:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x65810:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64e04:$str_b2: Executing file: 0x65c3c:$str_b3: GetDirectListeningPort 0x65600:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65780:$str_b7: \update.vbs 0x64e2c:$str_b9: Downloaded file: 0x64e18:$str_b10: Downloading file: 0x64ebc:$str_b12: Failed to upload file: 0x65c04:$str_b13: StartForward 0x65c24:$str_b14: StopForward 0x656d8:$str_b15: fso.DeleteFile " 0x6566c:$str_b16: On Error Resume Next 0x65708:$str_b17: fso.DeleteFolder " 0x64eac:$str_b18: Uploaded file: 0x64e6c:$str_b19: Unable to delete: 0x656a0:$str_b20: while fso.FileExists(" 0x65349:$str_c0: [Firefox StoredLogins not found]
00000004.00000002.1919987718.00000000018B0000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x64c80:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64c10:$s1: CoGetObject 0x64c24:$s1: CoGetObject 0x64c40:$s1: CoGetObject 0x6e870:$s1: CoGetObject 0x64bd0:$s2: Elevation:Administrator!new:
00000004.00000002.1919363155.0000000000400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000004.00000002.1919363155.0000000000400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000004.00000002.1919363155.0000000000400000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000004.00000002.1919363155.0000000000400000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6b6f8:$a1: Remcos restarted by watchdog! 0x6bc70:$a3: %02i:%02i:%02i:%03i
00000004.00000002.1919363155.0000000000400000.00000040.00001000.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x65994:$str_a1: C:\Windows\System32\cmd.exe 0x65910:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65910:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65e10:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x66410:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x65a04:$str_b2: Executing file: 0x6683c:$str_b3: GetDirectListeningPort 0x66200:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x66380:$str_b7: \update.vbs 0x65a2c:$str_b9: Downloaded file: 0x65a18:$str_b10: Downloading file: 0x65abc:$str_b12: Failed to upload file: 0x66804:$str_b13: StartForward 0x66824:$str_b14: StopForward 0x662d8:$str_b15: fso.DeleteFile " 0x6626c:$str_b16: On Error Resume Next 0x66308:$str_b17: fso.DeleteFolder " 0x65aac:$str_b18: Uploaded file: 0x65a6c:$str_b19: Unable to delete: 0x662a0:$str_b20: while fso.FileExists(" 0x65f49:$str_c0: [Firefox StoredLogins not found]
00000004.00000002.1919363155.0000000000400000.00000040.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x65880:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x65810:$s1: CoGetObject 0x65824:$s1: CoGetObject 0x65840:$s1: CoGetObject 0x6f470:$s1: CoGetObject 0x657d0:$s2: Elevation:Administrator!new:
00000001.00000002.4156176304.0000000001058000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000001.00000002.4157121061.0000000003DDE000.00000004.00000010.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000001.00000002.4157009146.0000000003920000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000001.00000002.4157009146.0000000003920000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
00000001.00000002.4157009146.0000000003920000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
00000001.00000002.4157009146.0000000003920000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaf8:$a1: Remcos restarted by watchdog! 0x6b070:$a3: %02i:%02i:%02i:%03i
00000001.00000002.4157009146.0000000003920000.00000004.00001000.00020000.00000000.sdmp	REMCOS_RAT_variants	unknown	unknown	0x64d94:$str_a1: C:\Windows\System32\cmd.exe 0x64d10:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64d10:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65210:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x65810:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64e04:$str_b2: Executing file: 0x65c3c:$str_b3: GetDirectListeningPort 0x65600:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65780:$str_b7: \update.vbs 0x64e2c:$str_b9: Downloaded file: 0x64e18:$str_b10: Downloading file: 0x64ebc:$str_b12: Failed to upload file: 0x65c04:$str_b13: StartForward 0x65c24:$str_b14: StopForward 0x656d8:$str_b15: fso.DeleteFile " 0x6566c:$str_b16: On Error Resume Next 0x65708:$str_b17: fso.DeleteFolder " 0x64eac:$str_b18: Uploaded file: 0x64e6c:$str_b19: Unable to delete: 0x656a0:$str_b20: while fso.FileExists(" 0x65349:$str_c0: [Firefox StoredLogins not found]
00000001.00000002.4157009146.0000000003920000.00000004.00001000.00020000.00000000.sdmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x64c80:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64c10:$s1: CoGetObject 0x64c24:$s1: CoGetObject 0x64c40:$s1: CoGetObject 0x6e870:$s1: CoGetObject 0x64bd0:$s2: Elevation:Administrator!new:
00000001.00000002.4156339648.00000000010FD000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: Allene.exe PID: 7132	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: Allene.exe PID: 7132	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: Allene.exe PID: 7132	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: Allene.exe PID: 7132	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x4e8228:$a1: Remcos restarted by watchdog! 0x12376a7:$a1: Remcos restarted by watchdog! 0x4e8785:$a3: %02i:%02i:%02i:%03i 0x4e8b3d:$a3: %02i:%02i:%02i:%03i 0x1237c04:$a3: %02i:%02i:%02i:%03i 0x1237fbc:$a3: %02i:%02i:%02i:%03i
Process Memory Space: Allene.exe PID: 2872	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: Allene.exe PID: 2872	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
Process Memory Space: Allene.exe PID: 2872	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
Process Memory Space: Allene.exe PID: 2872	Windows_Trojan_Remcos_b296e965	unknown	unknown	0xb52c45:$a1: Remcos restarted by watchdog! 0xdc19a8:$a1: Remcos restarted by watchdog! 0xb531a2:$a3: %02i:%02i:%02i:%03i 0xb5355a:$a3: %02i:%02i:%02i:%03i 0xdc1f05:$a3: %02i:%02i:%02i:%03i 0xdc22bd:$a3: %02i:%02i:%02i:%03i
Click to see the 32 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.Allene.exe.400000.0.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
4.2.Allene.exe.400000.0.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
4.2.Allene.exe.400000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
4.2.Allene.exe.400000.0.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6b6f8:$a1: Remcos restarted by watchdog! 0x6bc70:$a3: %02i:%02i:%02i:%03i
4.2.Allene.exe.400000.0.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x65994:$str_a1: C:\Windows\System32\cmd.exe 0x65910:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65910:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65e10:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x66410:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x65a04:$str_b2: Executing file: 0x6683c:$str_b3: GetDirectListeningPort 0x66200:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x66380:$str_b7: \update.vbs 0x65a2c:$str_b9: Downloaded file: 0x65a18:$str_b10: Downloading file: 0x65abc:$str_b12: Failed to upload file: 0x66804:$str_b13: StartForward 0x66824:$str_b14: StopForward 0x662d8:$str_b15: fso.DeleteFile " 0x6626c:$str_b16: On Error Resume Next 0x66308:$str_b17: fso.DeleteFolder " 0x65aac:$str_b18: Uploaded file: 0x65a6c:$str_b19: Unable to delete: 0x662a0:$str_b20: while fso.FileExists(" 0x65f49:$str_c0: [Firefox StoredLogins not found]
4.2.Allene.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x65880:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x65810:$s1: CoGetObject 0x65824:$s1: CoGetObject 0x65840:$s1: CoGetObject 0x6f470:$s1: CoGetObject 0x657d0:$s2: Elevation:Administrator!new:
4.2.Allene.exe.400000.0.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
4.2.Allene.exe.400000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
4.2.Allene.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
4.2.Allene.exe.400000.0.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaf8:$a1: Remcos restarted by watchdog! 0x6b070:$a3: %02i:%02i:%02i:%03i
4.2.Allene.exe.400000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x64d94:$str_a1: C:\Windows\System32\cmd.exe 0x64d10:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64d10:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65210:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x65810:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64e04:$str_b2: Executing file: 0x65c3c:$str_b3: GetDirectListeningPort 0x65600:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65780:$str_b7: \update.vbs 0x64e2c:$str_b9: Downloaded file: 0x64e18:$str_b10: Downloading file: 0x64ebc:$str_b12: Failed to upload file: 0x65c04:$str_b13: StartForward 0x65c24:$str_b14: StopForward 0x656d8:$str_b15: fso.DeleteFile " 0x6566c:$str_b16: On Error Resume Next 0x65708:$str_b17: fso.DeleteFolder " 0x64eac:$str_b18: Uploaded file: 0x64e6c:$str_b19: Unable to delete: 0x656a0:$str_b20: while fso.FileExists(" 0x65349:$str_c0: [Firefox StoredLogins not found]
4.2.Allene.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x64c80:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64c10:$s1: CoGetObject 0x64c24:$s1: CoGetObject 0x64c40:$s1: CoGetObject 0x6e870:$s1: CoGetObject 0x64bd0:$s2: Elevation:Administrator!new:
1.2.Allene.exe.3920000.2.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
1.2.Allene.exe.3920000.2.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
1.2.Allene.exe.3920000.2.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
1.2.Allene.exe.3920000.2.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x69ef8:$a1: Remcos restarted by watchdog! 0x6a470:$a3: %02i:%02i:%02i:%03i
1.2.Allene.exe.3920000.2.unpack	REMCOS_RAT_variants	unknown	unknown	0x64194:$str_a1: C:\Windows\System32\cmd.exe 0x64110:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64110:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64610:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x64c10:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64204:$str_b2: Executing file: 0x6503c:$str_b3: GetDirectListeningPort 0x64a00:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x64b80:$str_b7: \update.vbs 0x6422c:$str_b9: Downloaded file: 0x64218:$str_b10: Downloading file: 0x642bc:$str_b12: Failed to upload file: 0x65004:$str_b13: StartForward 0x65024:$str_b14: StopForward 0x64ad8:$str_b15: fso.DeleteFile " 0x64a6c:$str_b16: On Error Resume Next 0x64b08:$str_b17: fso.DeleteFolder " 0x642ac:$str_b18: Uploaded file: 0x6426c:$str_b19: Unable to delete: 0x64aa0:$str_b20: while fso.FileExists(" 0x64749:$str_c0: [Firefox StoredLogins not found]
1.2.Allene.exe.3920000.2.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x64080:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64010:$s1: CoGetObject 0x64024:$s1: CoGetObject 0x64040:$s1: CoGetObject 0x6dc70:$s1: CoGetObject 0x63fd0:$s2: Elevation:Administrator!new:
1.2.Allene.exe.3920000.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
1.2.Allene.exe.3920000.2.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
1.2.Allene.exe.3920000.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
1.2.Allene.exe.3920000.2.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaf8:$a1: Remcos restarted by watchdog! 0x6b070:$a3: %02i:%02i:%02i:%03i
1.2.Allene.exe.3920000.2.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x64d94:$str_a1: C:\Windows\System32\cmd.exe 0x64d10:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64d10:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65210:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x65810:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64e04:$str_b2: Executing file: 0x65c3c:$str_b3: GetDirectListeningPort 0x65600:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65780:$str_b7: \update.vbs 0x64e2c:$str_b9: Downloaded file: 0x64e18:$str_b10: Downloading file: 0x64ebc:$str_b12: Failed to upload file: 0x65c04:$str_b13: StartForward 0x65c24:$str_b14: StopForward 0x656d8:$str_b15: fso.DeleteFile " 0x6566c:$str_b16: On Error Resume Next 0x65708:$str_b17: fso.DeleteFolder " 0x64eac:$str_b18: Uploaded file: 0x64e6c:$str_b19: Unable to delete: 0x656a0:$str_b20: while fso.FileExists(" 0x65349:$str_c0: [Firefox StoredLogins not found]
1.2.Allene.exe.3920000.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x64c80:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64c10:$s1: CoGetObject 0x64c24:$s1: CoGetObject 0x64c40:$s1: CoGetObject 0x6e870:$s1: CoGetObject 0x64bd0:$s2: Elevation:Administrator!new:
4.2.Allene.exe.18b0000.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
4.2.Allene.exe.18b0000.2.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
4.2.Allene.exe.18b0000.2.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
4.2.Allene.exe.18b0000.2.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaf8:$a1: Remcos restarted by watchdog! 0x6b070:$a3: %02i:%02i:%02i:%03i
4.2.Allene.exe.18b0000.2.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x64d94:$str_a1: C:\Windows\System32\cmd.exe 0x64d10:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64d10:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65210:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x65810:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64e04:$str_b2: Executing file: 0x65c3c:$str_b3: GetDirectListeningPort 0x65600:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65780:$str_b7: \update.vbs 0x64e2c:$str_b9: Downloaded file: 0x64e18:$str_b10: Downloading file: 0x64ebc:$str_b12: Failed to upload file: 0x65c04:$str_b13: StartForward 0x65c24:$str_b14: StopForward 0x656d8:$str_b15: fso.DeleteFile " 0x6566c:$str_b16: On Error Resume Next 0x65708:$str_b17: fso.DeleteFolder " 0x64eac:$str_b18: Uploaded file: 0x64e6c:$str_b19: Unable to delete: 0x656a0:$str_b20: while fso.FileExists(" 0x65349:$str_c0: [Firefox StoredLogins not found]
4.2.Allene.exe.18b0000.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x64c80:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64c10:$s1: CoGetObject 0x64c24:$s1: CoGetObject 0x64c40:$s1: CoGetObject 0x6e870:$s1: CoGetObject 0x64bd0:$s2: Elevation:Administrator!new:
1.2.Allene.exe.400000.0.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
1.2.Allene.exe.400000.0.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
1.2.Allene.exe.400000.0.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
1.2.Allene.exe.400000.0.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6aaf8:$a1: Remcos restarted by watchdog! 0x6b070:$a3: %02i:%02i:%02i:%03i
1.2.Allene.exe.400000.0.unpack	REMCOS_RAT_variants	unknown	unknown	0x64d94:$str_a1: C:\Windows\System32\cmd.exe 0x64d10:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64d10:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65210:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x65810:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64e04:$str_b2: Executing file: 0x65c3c:$str_b3: GetDirectListeningPort 0x65600:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x65780:$str_b7: \update.vbs 0x64e2c:$str_b9: Downloaded file: 0x64e18:$str_b10: Downloading file: 0x64ebc:$str_b12: Failed to upload file: 0x65c04:$str_b13: StartForward 0x65c24:$str_b14: StopForward 0x656d8:$str_b15: fso.DeleteFile " 0x6566c:$str_b16: On Error Resume Next 0x65708:$str_b17: fso.DeleteFolder " 0x64eac:$str_b18: Uploaded file: 0x64e6c:$str_b19: Unable to delete: 0x656a0:$str_b20: while fso.FileExists(" 0x65349:$str_c0: [Firefox StoredLogins not found]
1.2.Allene.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x64c80:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64c10:$s1: CoGetObject 0x64c24:$s1: CoGetObject 0x64c40:$s1: CoGetObject 0x6e870:$s1: CoGetObject 0x64bd0:$s2: Elevation:Administrator!new:
4.2.Allene.exe.18b0000.2.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
4.2.Allene.exe.18b0000.2.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
4.2.Allene.exe.18b0000.2.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
4.2.Allene.exe.18b0000.2.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x69ef8:$a1: Remcos restarted by watchdog! 0x6a470:$a3: %02i:%02i:%02i:%03i
4.2.Allene.exe.18b0000.2.unpack	REMCOS_RAT_variants	unknown	unknown	0x64194:$str_a1: C:\Windows\System32\cmd.exe 0x64110:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64110:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x64610:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x64c10:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x64204:$str_b2: Executing file: 0x6503c:$str_b3: GetDirectListeningPort 0x64a00:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x64b80:$str_b7: \update.vbs 0x6422c:$str_b9: Downloaded file: 0x64218:$str_b10: Downloading file: 0x642bc:$str_b12: Failed to upload file: 0x65004:$str_b13: StartForward 0x65024:$str_b14: StopForward 0x64ad8:$str_b15: fso.DeleteFile " 0x64a6c:$str_b16: On Error Resume Next 0x64b08:$str_b17: fso.DeleteFolder " 0x642ac:$str_b18: Uploaded file: 0x6426c:$str_b19: Unable to delete: 0x64aa0:$str_b20: while fso.FileExists(" 0x64749:$str_c0: [Firefox StoredLogins not found]
4.2.Allene.exe.18b0000.2.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x64080:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x64010:$s1: CoGetObject 0x64024:$s1: CoGetObject 0x64040:$s1: CoGetObject 0x6dc70:$s1: CoGetObject 0x63fd0:$s2: Elevation:Administrator!new:
1.2.Allene.exe.400000.0.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
1.2.Allene.exe.400000.0.raw.unpack	JoeSecurity_Remcos	Yara detected Remcos RAT	Joe Security
1.2.Allene.exe.400000.0.raw.unpack	JoeSecurity_UACBypassusingCMSTP	Yara detected UAC Bypass using CMSTP	Joe Security
1.2.Allene.exe.400000.0.raw.unpack	Windows_Trojan_Remcos_b296e965	unknown	unknown	0x6b6f8:$a1: Remcos restarted by watchdog! 0x6bc70:$a3: %02i:%02i:%02i:%03i
1.2.Allene.exe.400000.0.raw.unpack	REMCOS_RAT_variants	unknown	unknown	0x65994:$str_a1: C:\Windows\System32\cmd.exe 0x65910:$str_a3: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65910:$str_a4: /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWOR 0x65e10:$str_a5: \AppData\Local\Google\Chrome\User Data\Default\Login Data 0x66410:$str_b1: CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName) 0x65a04:$str_b2: Executing file: 0x6683c:$str_b3: GetDirectListeningPort 0x66200:$str_b4: Set fso = CreateObject("Scripting.FileSystemObject") 0x66380:$str_b7: \update.vbs 0x65a2c:$str_b9: Downloaded file: 0x65a18:$str_b10: Downloading file: 0x65abc:$str_b12: Failed to upload file: 0x66804:$str_b13: StartForward 0x66824:$str_b14: StopForward 0x662d8:$str_b15: fso.DeleteFile " 0x6626c:$str_b16: On Error Resume Next 0x66308:$str_b17: fso.DeleteFolder " 0x65aac:$str_b18: Uploaded file: 0x65a6c:$str_b19: Unable to delete: 0x662a0:$str_b20: while fso.FileExists(" 0x65f49:$str_c0: [Firefox StoredLogins not found]
1.2.Allene.exe.400000.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)	ditekSHen	0x65880:$guid1: {3E5FC7F9-9A51-4367-9063-A120244FBEC7} 0x65810:$s1: CoGetObject 0x65824:$s1: CoGetObject 0x65840:$s1: CoGetObject 0x6f470:$s1: CoGetObject 0x657d0:$s2: Elevation:Administrator!new:
Click to see the 43 entries

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Allene.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Allene.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Allene.vbs" , ProcessId: 5812, ProcessName: wscript.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Allene.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Allene.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 2580, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Allene.vbs" , ProcessId: 5812, ProcessName: wscript.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Milburr\Allene.exe, ProcessId: 7132, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Allene.vbs

Stealing of Sensitive Information

Sigma detected: Remcos

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Milburr\Allene.exe, ProcessId: 7132, TargetFilename: C:\ProgramData\remcos\logs.dat

Suricata Signatures

ET MALWARE Remcos 3.x Unencrypted Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-08T09:31:26.528944+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49730	192.210.150.26	8787	TCP
2024-12-08T09:31:29.595606+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49731	192.210.150.26	8787	TCP
2024-12-08T09:31:32.658119+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49732	192.210.150.26	8787	TCP
2024-12-08T09:31:35.728229+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49733	192.210.150.26	8787	TCP
2024-12-08T09:31:38.807210+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49736	192.210.150.26	8787	TCP
2024-12-08T09:31:42.470921+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49740	192.210.150.26	8787	TCP
2024-12-08T09:31:45.532904+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49742	192.210.150.26	8787	TCP
2024-12-08T09:31:48.611483+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49743	192.210.150.26	8787	TCP
2024-12-08T09:31:51.674579+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49744	192.210.150.26	8787	TCP
2024-12-08T09:31:54.751937+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49745	192.210.150.26	8787	TCP
2024-12-08T09:31:57.815944+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49746	192.210.150.26	8787	TCP
2024-12-08T09:32:00.892399+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49747	192.210.150.26	8787	TCP
2024-12-08T09:32:03.956617+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49748	192.210.150.26	8787	TCP
2024-12-08T09:32:07.017381+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49749	192.210.150.26	8787	TCP
2024-12-08T09:32:10.079703+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49750	192.210.150.26	8787	TCP
2024-12-08T09:32:13.142325+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49751	192.210.150.26	8787	TCP
2024-12-08T09:32:16.210805+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49752	192.210.150.26	8787	TCP
2024-12-08T09:32:19.345352+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49760	192.210.150.26	8787	TCP
2024-12-08T09:32:22.519261+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49766	192.210.150.26	8787	TCP
2024-12-08T09:32:25.635191+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49772	192.210.150.26	8787	TCP
2024-12-08T09:32:28.695256+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49783	192.210.150.26	8787	TCP
2024-12-08T09:32:31.772488+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49789	192.210.150.26	8787	TCP
2024-12-08T09:32:34.829535+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49800	192.210.150.26	8787	TCP
2024-12-08T09:32:37.893227+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49806	192.210.150.26	8787	TCP
2024-12-08T09:32:40.970662+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49813	192.210.150.26	8787	TCP
2024-12-08T09:32:44.079602+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49823	192.210.150.26	8787	TCP
2024-12-08T09:32:47.174339+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49829	192.210.150.26	8787	TCP
2024-12-08T09:32:50.238550+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49839	192.210.150.26	8787	TCP
2024-12-08T09:32:53.298839+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49845	192.210.150.26	8787	TCP
2024-12-08T09:32:56.363081+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49855	192.210.150.26	8787	TCP
2024-12-08T09:32:59.424194+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49862	192.210.150.26	8787	TCP
2024-12-08T09:33:02.486513+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49869	192.210.150.26	8787	TCP
2024-12-08T09:33:05.561051+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49879	192.210.150.26	8787	TCP
2024-12-08T09:33:08.596635+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49885	192.210.150.26	8787	TCP
2024-12-08T09:33:11.595406+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49895	192.210.150.26	8787	TCP
2024-12-08T09:33:14.591199+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49902	192.210.150.26	8787	TCP
2024-12-08T09:33:17.543987+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49909	192.210.150.26	8787	TCP
2024-12-08T09:33:20.492642+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49918	192.210.150.26	8787	TCP
2024-12-08T09:33:23.393036+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49925	192.210.150.26	8787	TCP
2024-12-08T09:33:26.251580+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49931	192.210.150.26	8787	TCP
2024-12-08T09:33:29.079820+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49940	192.210.150.26	8787	TCP
2024-12-08T09:33:31.892555+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49947	192.210.150.26	8787	TCP
2024-12-08T09:33:34.675406+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49953	192.210.150.26	8787	TCP
2024-12-08T09:33:37.427204+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49961	192.210.150.26	8787	TCP
2024-12-08T09:33:40.158584+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49968	192.210.150.26	8787	TCP
2024-12-08T09:33:42.991371+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49973	192.210.150.26	8787	TCP
2024-12-08T09:33:45.673458+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49978	192.210.150.26	8787	TCP
2024-12-08T09:33:48.346729+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49986	192.210.150.26	8787	TCP
2024-12-08T09:33:50.986374+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49991	192.210.150.26	8787	TCP
2024-12-08T09:33:53.611415+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	49997	192.210.150.26	8787	TCP
2024-12-08T09:33:56.220343+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50003	192.210.150.26	8787	TCP
2024-12-08T09:33:58.814855+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50012	192.210.150.26	8787	TCP
2024-12-08T09:34:01.392010+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50019	192.210.150.26	8787	TCP
2024-12-08T09:34:03.956621+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50025	192.210.150.26	8787	TCP
2024-12-08T09:34:06.503965+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50032	192.210.150.26	8787	TCP
2024-12-08T09:34:09.037256+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50038	192.210.150.26	8787	TCP
2024-12-08T09:34:11.609211+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50045	192.210.150.26	8787	TCP
2024-12-08T09:34:14.050024+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50052	192.210.150.26	8787	TCP
2024-12-08T09:34:16.533571+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50060	192.210.150.26	8787	TCP
2024-12-08T09:34:19.006642+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50061	192.210.150.26	8787	TCP
2024-12-08T09:34:21.455208+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50062	192.210.150.26	8787	TCP
2024-12-08T09:34:23.908152+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50063	192.210.150.26	8787	TCP
2024-12-08T09:34:26.488643+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50064	192.210.150.26	8787	TCP
2024-12-08T09:34:28.961193+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50065	192.210.150.26	8787	TCP
2024-12-08T09:34:31.362755+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50066	192.210.150.26	8787	TCP
2024-12-08T09:34:33.754813+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50067	192.210.150.26	8787	TCP
2024-12-08T09:34:36.160734+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50068	192.210.150.26	8787	TCP
2024-12-08T09:34:38.536759+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50069	192.210.150.26	8787	TCP
2024-12-08T09:34:40.892652+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50070	192.210.150.26	8787	TCP
2024-12-08T09:34:43.251648+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50071	192.210.150.26	8787	TCP
2024-12-08T09:34:45.596680+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50072	192.210.150.26	8787	TCP
2024-12-08T09:34:47.942712+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50073	192.210.150.26	8787	TCP
2024-12-08T09:34:50.318837+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50074	192.210.150.26	8787	TCP
2024-12-08T09:34:52.628203+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50075	192.210.150.26	8787	TCP
2024-12-08T09:34:54.938754+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50076	192.210.150.26	8787	TCP
2024-12-08T09:34:57.236910+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50077	192.210.150.26	8787	TCP
2024-12-08T09:34:59.532736+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50078	192.210.150.26	8787	TCP
2024-12-08T09:35:01.814358+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50079	192.210.150.26	8787	TCP
2024-12-08T09:35:04.099809+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50080	192.210.150.26	8787	TCP
2024-12-08T09:35:06.362784+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50081	192.210.150.26	8787	TCP
2024-12-08T09:35:08.628706+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50082	192.210.150.26	8787	TCP
2024-12-08T09:35:10.892259+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50083	192.210.150.26	8787	TCP
2024-12-08T09:35:13.142100+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50084	192.210.150.26	8787	TCP
2024-12-08T09:35:15.394803+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50085	192.210.150.26	8787	TCP
2024-12-08T09:35:17.627081+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50086	192.210.150.26	8787	TCP
2024-12-08T09:35:19.860754+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50087	192.210.150.26	8787	TCP
2024-12-08T09:35:22.095104+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50088	192.210.150.26	8787	TCP
2024-12-08T09:35:24.329740+0100	2032776	1	Malware Command and Control Activity Detected	192.168.2.4	50089	192.210.150.26	8787	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000004.00000002.1920045593.0000000001948000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Remcos {"Host:Port:Password": ["192.210.150.26:8787:0"], "Assigned name": "RemoteHost", "Connect interval": "1", "Install flag": "Disable", "Setup HKCU\\Run": "Enable", "Setup HKLM\\Run": "Enable", "Install path": "Application path", "Copy file": "remcos.exe", "Startup value": "Disable", "Hide file": "Disable", "Mutex": "Rmc-R1T905", "Keylog flag": "1", "Keylog path": "Application path", "Keylog file": "logs.dat", "Keylog crypt": "Disable", "Hide keylog file": "Disable", "Screenshot flag": "Disable", "Screenshot time": "1", "Take Screenshot option": "Disable", "Take screenshot title": "", "Take screenshot time": "5", "Screenshot path": "AppData", "Screenshot file": "Screenshots", "Screenshot crypt": "Disable", "Mouse option": "Disable", "Delete file": "Disable", "Audio record time": "5", "Audio folder": "MicRecords", "Connect delay": "0", "Copy folder": "Remcos", "Keylog folder": "remcos", "Keylog file max size": ""}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Virustotal: Detection: 66%			Perma Link

Multi AV Scanner detection for submitted file

Source: 7056ZCiFdE.exe	ReversingLabs: Detection: 55%
Source: 7056ZCiFdE.exe	Virustotal: Detection: 66%			Perma Link

Yara detected Remcos RAT

Source: Yara match	File source: 4.2.Allene.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Allene.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Allene.exe.3920000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Allene.exe.3920000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Allene.exe.18b0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Allene.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Allene.exe.18b0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Allene.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4155512160.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1920045593.0000000001948000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4156569703.00000000012B3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1919987718.00000000018B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1919363155.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4156176304.0000000001058000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4157121061.0000000003DDE000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4157009146.0000000003920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4156339648.00000000010FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Allene.exe PID: 7132, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Allene.exe PID: 2872, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.5% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Milburr\Allene.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: 7056ZCiFdE.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Milburr\Allene.exe

Code function: 1_2_0043293A CryptAcquireContextA,CryptGenRandom,CryptReleaseContext,

1_2_0043293A

Source: Allene.exe

Binary or memory string: -----BEGIN PUBLIC KEY-----

Exploits

Yara detected UAC Bypass using CMSTP

Source: Yara match	File source: 4.2.Allene.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Allene.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Allene.exe.3920000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Allene.exe.3920000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Allene.exe.18b0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Allene.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Allene.exe.18b0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Allene.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4155512160.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1919987718.00000000018B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1919363155.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4157009146.0000000003920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Allene.exe PID: 7132, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Allene.exe PID: 2872, type: MEMORYSTR

Privilege Escalation

Contains functionality to bypass UAC (CMSTPLUA)

Source: C:\Users\user\AppData\Local\Milburr\Allene.exe

Code function: 1_2_00406764 _wcslen,CoGetObject,

1_2_00406764

Source: 7056ZCiFdE.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008E445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_008E445A
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008EC6D1 FindFirstFileW,FindClose,	0_2_008EC6D1
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008EC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_008EC75C
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008EEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_008EEF95
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008EF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_008EF0F2
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008EF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_008EF3F3
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008E37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_008E37EF
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008E3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_008E3B12
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008EBCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_008EBCBC
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	1_2_0040B335
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0041B42F FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	1_2_0041B42F
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	1_2_0040B53A
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	1_2_004089A9
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00406AC2 FindFirstFileW,FindNextFileW,	1_2_00406AC2
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	1_2_00407A8C
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00418C69 FindFirstFileW,FindNextFileW,FindNextFileW,	1_2_00418C69
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	1_2_00408DA7
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0063445A GetFileAttributesW,FindFirstFileW,FindClose,	1_2_0063445A
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0063C6D1 FindFirstFileW,FindClose,	1_2_0063C6D1
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0063C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	1_2_0063C75C
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0063EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_0063EF95
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0063F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_0063F0F2
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0063F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	1_2_0063F3F3
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_006337EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	1_2_006337EF
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00633B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	1_2_00633B12
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0063BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	1_2_0063BCBC

Source: C:\Users\user\AppData\Local\Milburr\Allene.exe

Code function: 1_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

1_2_00406F06

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49730 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49736 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49746 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49747 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49733 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49750 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49744 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49745 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49743 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49731 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49742 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49766 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49749 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49772 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49789 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49752 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49748 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49823 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49760 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49800 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49806 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49829 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49839 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49862 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49751 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49732 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49740 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49869 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49879 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49885 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49783 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49845 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49813 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49895 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49902 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49909 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49925 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49947 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49931 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49918 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49953 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49940 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49973 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49991 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49997 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49986 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49968 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49855 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50019 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50025 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49961 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:49978 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50045 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50032 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50067 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50052 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50065 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50064 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50077 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50063 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50078 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50072 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50003 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50061 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50084 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50083 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50070 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50075 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50060 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50038 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50086 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50071 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50087 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50088 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50089 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50062 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50079 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50068 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50073 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50080 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50012 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50082 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50081 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50066 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50069 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50074 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50076 -> 192.210.150.26:8787
Source: Network traffic	Suricata IDS: 2032776 - Severity 1 - ET MALWARE Remcos 3.x Unencrypted Checkin : 192.168.2.4:50085 -> 192.210.150.26:8787

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 192.210.150.26

Source: Joe Sandbox View

IP Address: 192.210.150.26 192.210.150.26

Source: Joe Sandbox View

ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_008F22EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_008F22EE

Source: Allene.exe	String found in binary or memory: http://geoplugin.net/json.gp
Source: Allene.exe, 00000001.00000002.4155512160.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Allene.exe, 00000001.00000002.4157009146.0000000003920000.00000004.00001000.00020000.00000000.sdmp, Allene.exe, 00000004.00000002.1919987718.00000000018B0000.00000004.00001000.00020000.00000000.sdmp, Allene.exe, 00000004.00000002.1919363155.0000000000400000.00000040.00001000.00020000.00000000.sdmp	String found in binary or memory: http://geoplugin.net/json.gp/C

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Users\user\AppData\Local\Milburr\Allene.exe

Code function: 1_2_004099E4 SetWindowsHookExA 0000000D,004099D0,00000000

1_2_004099E4

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_008F4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_008F4164

Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008F4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	0_2_008F4164
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_004159C6 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,	1_2_004159C6
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00644164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	1_2_00644164

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_008F3F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_008F3F66

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_008E001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_008E001C

Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_0090CABC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		0_2_0090CABC
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0065CABC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		1_2_0065CABC

Source: Yara match	File source: 4.2.Allene.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Allene.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Allene.exe.3920000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Allene.exe.3920000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Allene.exe.18b0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Allene.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Allene.exe.18b0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Allene.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4155512160.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1919987718.00000000018B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1919363155.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4157009146.0000000003920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Allene.exe PID: 7132, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Allene.exe PID: 2872, type: MEMORYSTR

E-Banking Fraud

Yara detected Remcos RAT

Source: Yara match	File source: 4.2.Allene.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Allene.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Allene.exe.3920000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Allene.exe.3920000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Allene.exe.18b0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Allene.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Allene.exe.18b0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Allene.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4155512160.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1920045593.0000000001948000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4156569703.00000000012B3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1919987718.00000000018B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1919363155.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4156176304.0000000001058000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4157121061.0000000003DDE000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4157009146.0000000003920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4156339648.00000000010FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Allene.exe PID: 7132, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Allene.exe PID: 2872, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Spam, unwanted Advertisements and Ransom Demands

Contains functionalty to change the wallpaper

Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0041BB71 SystemParametersInfoW,		1_2_0041BB71
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0041BB77 SystemParametersInfoW,		1_2_0041BB77

System Summary

Malicious sample detected (through community Yara rule)

Source: 4.2.Allene.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 4.2.Allene.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 4.2.Allene.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 4.2.Allene.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 4.2.Allene.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 4.2.Allene.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 1.2.Allene.exe.3920000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 1.2.Allene.exe.3920000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 1.2.Allene.exe.3920000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 1.2.Allene.exe.3920000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 1.2.Allene.exe.3920000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 1.2.Allene.exe.3920000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 4.2.Allene.exe.18b0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 4.2.Allene.exe.18b0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 4.2.Allene.exe.18b0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 1.2.Allene.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 1.2.Allene.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 1.2.Allene.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 4.2.Allene.exe.18b0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 4.2.Allene.exe.18b0000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 4.2.Allene.exe.18b0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 1.2.Allene.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 1.2.Allene.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 1.2.Allene.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000001.00000002.4155512160.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000001.00000002.4155512160.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000001.00000002.4155512160.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000004.00000002.1919987718.00000000018B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000004.00000002.1919987718.00000000018B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000004.00000002.1919987718.00000000018B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000004.00000002.1919363155.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000004.00000002.1919363155.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000004.00000002.1919363155.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: 00000001.00000002.4157009146.0000000003920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: 00000001.00000002.4157009146.0000000003920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Author: unknown
Source: 00000001.00000002.4157009146.0000000003920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003) Author: ditekSHen
Source: Process Memory Space: Allene.exe PID: 7132, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown
Source: Process Memory Space: Allene.exe PID: 2872, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 Author: unknown

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00883B3A
Source: 7056ZCiFdE.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: 7056ZCiFdE.exe, 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_5802f912-5
Source: 7056ZCiFdE.exe, 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_e5fa5dba-5
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: This is a third-party compiled AutoIt script.	1_2_005D3B3A
Source: Allene.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: Allene.exe, 00000001.00000002.4155616853.0000000000684000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_3654c9d2-4
Source: Allene.exe, 00000001.00000002.4155616853.0000000000684000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_6f9caac4-8
Source: Allene.exe, 00000004.00000002.1919469392.0000000000684000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_64b6de13-5
Source: Allene.exe, 00000004.00000002.1919469392.0000000000684000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_880d2325-c

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\AppData\Local\Milburr\Allene.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_00883633 NtdllDefWindowProc_W,KillTimer,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,PostQuitMessage,SetFocus,MoveWindow,	0_2_00883633
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_0090C1AC PostMessageW,GetFocus,GetDlgCtrlID,_memset,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W,	0_2_0090C1AC
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_0090C498 GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,	0_2_0090C498
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_0090C5FE DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	0_2_0090C5FE
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_0090C57D SendMessageW,NtdllDialogWndProc_W,	0_2_0090C57D
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_0090C88F NtdllDialogWndProc_W,	0_2_0090C88F
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_0090C8BE NtdllDialogWndProc_W,	0_2_0090C8BE
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_0090C860 NtdllDialogWndProc_W,	0_2_0090C860
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_0090C909 NtdllDialogWndProc_W,	0_2_0090C909
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_0090C93E ClientToScreen,NtdllDialogWndProc_W,	0_2_0090C93E
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_0090CABC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	0_2_0090CABC
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_0090CA7C GetWindowLongW,NtdllDialogWndProc_W,	0_2_0090CA7C
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_00881287 NtdllDialogWndProc_W,GetSysColor,SetBkColor,745EC8D0,NtdllDialogWndProc_W,	0_2_00881287
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_00881290 NtdllDialogWndProc_W,GetClientRect,GetCursorPos,ScreenToClient,	0_2_00881290
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_0090D3B8 NtdllDialogWndProc_W,	0_2_0090D3B8
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_0090D43E GetSystemMetrics,GetSystemMetrics,MoveWindow,SendMessageW,SendMessageW,ShowWindow,InvalidateRect,NtdllDialogWndProc_W,	0_2_0090D43E
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008816B5 NtdllDialogWndProc_W,	0_2_008816B5
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008816DE GetParent,NtdllDialogWndProc_W,	0_2_008816DE
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_0088167D NtdllDialogWndProc_W,	0_2_0088167D
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_0090D78C NtdllDialogWndProc_W,	0_2_0090D78C
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_0088189B NtdllDialogWndProc_W,	0_2_0088189B
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_0090BC5D NtdllDialogWndProc_W,CallWindowProcW,	0_2_0090BC5D
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_0090BF8C ReleaseCapture,ChrCmpIA,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W,	0_2_0090BF8C
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_0090BF30 NtdllDialogWndProc_W,	0_2_0090BF30
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0041CA9E NtdllDefWindowProc_A,GetCursorPos,SetForegroundWindow,TrackPopupMenu,IsWindowVisible,ShowWindow,ShowWindow,SetForegroundWindow,Shell_NotifyIcon,ExitProcess,CreatePopupMenu,AppendMenuA,	1_2_0041CA9E
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0041ACC1 OpenProcess,NtSuspendProcess,CloseHandle,	1_2_0041ACC1
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0041ACED OpenProcess,NtResumeProcess,CloseHandle,	1_2_0041ACED
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005D3633 NtdllDefWindowProc_W,KillTimer,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,PostQuitMessage,SetFocus,MoveWindow,	1_2_005D3633
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0065C1AC PostMessageW,GetFocus,GetDlgCtrlID,_memset,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W,	1_2_0065C1AC
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0065C498 GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,	1_2_0065C498
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0065C57D SendMessageW,NtdllDialogWndProc_W,	1_2_0065C57D
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0065C5FE DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	1_2_0065C5FE
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0065C860 NtdllDialogWndProc_W,	1_2_0065C860
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0065C8BE NtdllDialogWndProc_W,	1_2_0065C8BE
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0065C88F NtdllDialogWndProc_W,	1_2_0065C88F
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0065C93E ClientToScreen,NtdllDialogWndProc_W,	1_2_0065C93E
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0065C909 NtdllDialogWndProc_W,	1_2_0065C909
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0065CA7C GetWindowLongW,NtdllDialogWndProc_W,	1_2_0065CA7C
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0065CABC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	1_2_0065CABC
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005D1290 NtdllDialogWndProc_W,GetClientRect,GetCursorPos,ScreenToClient,	1_2_005D1290
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005D1287 NtdllDialogWndProc_W,GetSysColor,SetBkColor,745EC8D0,NtdllDialogWndProc_W,	1_2_005D1287
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0065D3B8 NtdllDialogWndProc_W,	1_2_0065D3B8
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0065D43E GetSystemMetrics,GetSystemMetrics,MoveWindow,SendMessageW,SendMessageW,ShowWindow,InvalidateRect,NtdllDialogWndProc_W,	1_2_0065D43E
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005D167D NtdllDialogWndProc_W,	1_2_005D167D
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005D16DE GetParent,NtdllDialogWndProc_W,	1_2_005D16DE
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005D16B5 NtdllDialogWndProc_W,	1_2_005D16B5
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0065D78C NtdllDialogWndProc_W,	1_2_0065D78C
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005D189B NtdllDialogWndProc_W,	1_2_005D189B
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0065BC5D NtdllDialogWndProc_W,CallWindowProcW,	1_2_0065BC5D
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0065BF30 NtdllDialogWndProc_W,	1_2_0065BF30
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0065BF8C ReleaseCapture,ChrCmpIA,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W,	1_2_0065BF8C

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_008EA1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_008EA1EF

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_008D8310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,74AF5590,CreateProcessAsUserW,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,

0_2_008D8310

Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008E51BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	0_2_008E51BD
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_004158B9 ExitWindowsEx,LoadLibraryA,GetProcAddress,	1_2_004158B9
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_006351BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,	1_2_006351BD

Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_0088E6A0	0_2_0088E6A0
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008AD975	0_2_008AD975
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_0088FCE0	0_2_0088FCE0
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008A21C5	0_2_008A21C5
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008B62D2	0_2_008B62D2
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_009003DA	0_2_009003DA
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008B242E	0_2_008B242E
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008A25FA	0_2_008A25FA
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008966E1	0_2_008966E1
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008DE616	0_2_008DE616
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008B878F	0_2_008B878F
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008E8889	0_2_008E8889
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_00898808	0_2_00898808
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_00900857	0_2_00900857
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008B6844	0_2_008B6844
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008ACB21	0_2_008ACB21
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008B6DB6	0_2_008B6DB6
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_00896F9E	0_2_00896F9E
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_00893030	0_2_00893030
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008A3187	0_2_008A3187
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008AF1D9	0_2_008AF1D9
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_00881287	0_2_00881287
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008A1484	0_2_008A1484
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_00895520	0_2_00895520
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008A7696	0_2_008A7696
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_00895760	0_2_00895760
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008A1978	0_2_008A1978
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008B9AB5	0_2_008B9AB5
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008A1D90	0_2_008A1D90
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008ABDA6	0_2_008ABDA6
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_00907DDB	0_2_00907DDB
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_00893FE0	0_2_00893FE0
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_0088DF00	0_2_0088DF00
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_015FBF30	0_2_015FBF30
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0041D071	1_2_0041D071
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_004520D2	1_2_004520D2
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0043D098	1_2_0043D098
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00437150	1_2_00437150
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_004361AA	1_2_004361AA
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00426254	1_2_00426254
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0043651C	1_2_0043651C
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0044C739	1_2_0044C739
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_004367C6	1_2_004367C6
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_004267CB	1_2_004267CB
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0043C9DD	1_2_0043C9DD
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00432A49	1_2_00432A49
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00436A8D	1_2_00436A8D
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0043CC0C	1_2_0043CC0C
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00436D48	1_2_00436D48
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00434D22	1_2_00434D22
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00426E73	1_2_00426E73
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00440E20	1_2_00440E20
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0043CE3B	1_2_0043CE3B
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00412F45	1_2_00412F45
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00452F00	1_2_00452F00
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00426FAD	1_2_00426FAD
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005DE6A0	1_2_005DE6A0
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005FD975	1_2_005FD975
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005DFCE0	1_2_005DFCE0
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005F21C5	1_2_005F21C5
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_006062D2	1_2_006062D2
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_006503DA	1_2_006503DA
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0060242E	1_2_0060242E
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005F25FA	1_2_005F25FA
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0062E616	1_2_0062E616
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005E66E1	1_2_005E66E1
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0060878F	1_2_0060878F
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00606844	1_2_00606844
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00650857	1_2_00650857
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005E8808	1_2_005E8808
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00638889	1_2_00638889
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005FCB21	1_2_005FCB21
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00606DB6	1_2_00606DB6
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005E6F9E	1_2_005E6F9E
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005E3030	1_2_005E3030
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005FF1D9	1_2_005FF1D9
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005F3187	1_2_005F3187
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005D1287	1_2_005D1287
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005F1484	1_2_005F1484
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005E5520	1_2_005E5520
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005F7696	1_2_005F7696
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005E5760	1_2_005E5760
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005F1978	1_2_005F1978
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00609AB5	1_2_00609AB5
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00657DDB	1_2_00657DDB
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005F1D90	1_2_005F1D90
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005FBDA6	1_2_005FBDA6
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005DDF00	1_2_005DDF00
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005E3FE0	1_2_005E3FE0
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_010FBE90	1_2_010FBE90

Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: String function: 00887DE1 appears 35 times
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: String function: 008A0AE3 appears 70 times
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: String function: 008A8900 appears 42 times
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: String function: 004020E7 appears 40 times
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: String function: 005F0AE3 appears 70 times
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: String function: 005D7DE1 appears 36 times
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: String function: 00401F66 appears 50 times
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: String function: 005F8900 appears 42 times
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: String function: 004338A5 appears 41 times
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: String function: 00433FB0 appears 55 times

Source: 7056ZCiFdE.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 4.2.Allene.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 4.2.Allene.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 4.2.Allene.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 4.2.Allene.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 4.2.Allene.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 4.2.Allene.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 1.2.Allene.exe.3920000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 1.2.Allene.exe.3920000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 1.2.Allene.exe.3920000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 1.2.Allene.exe.3920000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 1.2.Allene.exe.3920000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 1.2.Allene.exe.3920000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 4.2.Allene.exe.18b0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 4.2.Allene.exe.18b0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 4.2.Allene.exe.18b0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 1.2.Allene.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 1.2.Allene.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 1.2.Allene.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 4.2.Allene.exe.18b0000.2.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 4.2.Allene.exe.18b0000.2.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 4.2.Allene.exe.18b0000.2.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 1.2.Allene.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 1.2.Allene.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 1.2.Allene.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000001.00000002.4155512160.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000001.00000002.4155512160.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000001.00000002.4155512160.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000004.00000002.1919987718.00000000018B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000004.00000002.1919987718.00000000018B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000004.00000002.1919987718.00000000018B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000004.00000002.1919363155.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000004.00000002.1919363155.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000004.00000002.1919363155.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: 00000001.00000002.4157009146.0000000003920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: 00000001.00000002.4157009146.0000000003920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: REMCOS_RAT_variants Description = Detects multiple variants of REMCOS seen in the wild. Created by modifying and combining several of Florian\'s recent REMCOS ruleset. This rule aims for broader detection than the original ruleset, which used separate rules for each variant. If you do decide to break it into individual rules, the YARA strings variable names are grouped by the REMCOS variant type., Website = https://www.deadbits.org, Date = 2019-07-18, Repo = https://github.com/deadbits/yara-rules, Author = Adam M. Swanda
Source: 00000001.00000002.4157009146.0000000003920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM author = ditekSHen, description = Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Source: Process Memory Space: Allene.exe PID: 7132, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23
Source: Process Memory Space: Allene.exe PID: 2872, type: MEMORYSTR	Matched rule: Windows_Trojan_Remcos_b296e965 reference_sample = 0ebeffa44bd1c3603e30688ace84ea638fbcf485ca55ddcfd6fbe90609d4f3ed, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Remcos, fingerprint = a5267bc2dee28a3ef58beeb7e4a151699e3e561c16ce0ab9eb27de33c122664d, id = b296e965-a99e-4446-b969-ba233a2a8af4, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winEXE@6/7@0/1

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_008EA06A GetLastError,FormatMessageW,

0_2_008EA06A

Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008D81CB AdjustTokenPrivileges,CloseHandle,	0_2_008D81CB
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008D87E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	0_2_008D87E1
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00416AB7 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,	1_2_00416AB7
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_006281CB AdjustTokenPrivileges,CloseHandle,	1_2_006281CB
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_006287E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	1_2_006287E1

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_008EB3FB SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_008EB3FB

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_008FEE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_008FEE0D

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_008EC397 CoInitialize,CoCreateInstance,CoUninitialize,

0_2_008EC397

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_00884E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00884E89

Source: C:\Users\user\AppData\Local\Milburr\Allene.exe

Code function: 1_2_00419BC4 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

1_2_00419BC4

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

File created: C:\Users\user\AppData\Local\Milburr

Jump to behavior

Source: C:\Users\user\AppData\Local\Milburr\Allene.exe

Mutant created: \Sessions\1\BaseNamedObjects\Rmc-R1T905

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

File created: C:\Users\user\AppData\Local\Temp\autE914.tmp

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Allene.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 7056ZCiFdE.exe	ReversingLabs: Detection: 55%
Source: 7056ZCiFdE.exe	Virustotal: Detection: 66%

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

File read: C:\Users\user\Desktop\7056ZCiFdE.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\7056ZCiFdE.exe "C:\Users\user\Desktop\7056ZCiFdE.exe"
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Process created: C:\Users\user\AppData\Local\Milburr\Allene.exe "C:\Users\user\Desktop\7056ZCiFdE.exe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Allene.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Milburr\Allene.exe "C:\Users\user\AppData\Local\Milburr\Allene.exe"
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Process created: C:\Users\user\AppData\Local\Milburr\Allene.exe "C:\Users\user\Desktop\7056ZCiFdE.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\Milburr\Allene.exe "C:\Users\user\AppData\Local\Milburr\Allene.exe"	Jump to behavior

Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_009D9A50 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_009D9A50

Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008E848F push FFFFFF8Bh; iretd	0_2_008E8491
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008AE70F push edi; ret	0_2_008AE711
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008AE828 push esi; ret	0_2_008AE82A
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008A8945 push ecx; ret	0_2_008A8958
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008AEAEC push edi; ret	0_2_008AEAEE
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008AEA03 push esi; ret	0_2_008AEA05
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_004567E0 push eax; ret	1_2_004567FE
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00455EAF push ecx; ret	1_2_00455EC2
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00433FF6 push ecx; ret	1_2_00434009
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005DC4C6 push A3005DBAh; retn 005Dh	1_2_005DC50D
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0063848F push FFFFFF8Bh; iretd	1_2_00638491
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005FE70F push edi; ret	1_2_005FE711
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005FE828 push esi; ret	1_2_005FE82A
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005F8945 push ecx; ret	1_2_005F8958
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005FEA03 push esi; ret	1_2_005FEA05
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005FEAEC push edi; ret	1_2_005FEAEE
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005D2F12 push es; retf	1_2_005D2F13

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\AppData\Local\Milburr\Allene.exe

Code function: 1_2_00406128 ShellExecuteW,URLDownloadToFileW,

1_2_00406128

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

File created: C:\Users\user\AppData\Local\Milburr\Allene.exe

Jump to dropped file

Boot Survival

Drops VBS files to the startup folder

Source: C:\Users\user\AppData\Local\Milburr\Allene.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Allene.vbs

Jump to dropped file

Source: C:\Users\user\AppData\Local\Milburr\Allene.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Allene.vbs

Jump to behavior

Source: C:\Users\user\AppData\Local\Milburr\Allene.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Allene.vbs

Jump to behavior

Source: C:\Users\user\AppData\Local\Milburr\Allene.exe

Code function: 1_2_00419BC4 OpenSCManagerW,OpenServiceW,CloseServiceHandle,StartServiceW,CloseServiceHandle,CloseServiceHandle,CloseServiceHandle,

1_2_00419BC4

Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008848D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	0_2_008848D7
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_00905376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	0_2_00905376
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005D48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	1_2_005D48D7
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00655376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	1_2_00655376

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_008A3187 RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_008A3187

Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Delayed program exit found

Source: C:\Users\user\AppData\Local\Milburr\Allene.exe

Code function: 1_2_0040E54F Sleep,ExitProcess,

1_2_0040E54F

Source: C:\Users\user\AppData\Local\Milburr\Allene.exe

Code function: OpenSCManagerA,EnumServicesStatusW,GetLastError,EnumServicesStatusW,OpenServiceW,QueryServiceConfigW,GetLastError,QueryServiceConfigW,CloseServiceHandle,CloseServiceHandle,

1_2_004198C2

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Window / User API: threadDelayed 9431			Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Window / User API: foregroundWindowGot 1745			Jump to behavior

Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes			graph_0-106518

Source: C:\Users\user\Desktop\7056ZCiFdE.exe	API coverage: 4.8 %
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	API coverage: 6.3 %

Source: C:\Users\user\AppData\Local\Milburr\Allene.exe TID: 6180	Thread sleep count: 189 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe TID: 6180	Thread sleep time: -94500s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe TID: 6324	Thread sleep count: 73 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe TID: 6324	Thread sleep time: -219000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe TID: 6324	Thread sleep count: 9431 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe TID: 6324	Thread sleep time: -28293000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008E445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_008E445A
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008EC6D1 FindFirstFileW,FindClose,	0_2_008EC6D1
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008EC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_008EC75C
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008EEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_008EEF95
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008EF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_008EF0F2
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008EF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_008EF3F3
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008E37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_008E37EF
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008E3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_008E3B12
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008EBCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_008EBCBC
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0040B335 FindFirstFileA,FindClose,DeleteFileA,GetLastError,DeleteFileA,GetLastError,FindNextFileA,FindClose,	1_2_0040B335
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0041B42F FindFirstFileW,FindNextFileW,RemoveDirectoryW,SetFileAttributesW,DeleteFileW,FindClose,RemoveDirectoryW,GetLastError,FindClose,	1_2_0041B42F
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0040B53A FindFirstFileA,FindClose,DeleteFileA,GetLastError,FindNextFileA,FindClose,FindClose,	1_2_0040B53A
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_004089A9 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,FindClose,__CxxThrowException@8,	1_2_004089A9
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00406AC2 FindFirstFileW,FindNextFileW,	1_2_00406AC2
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00407A8C __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,__CxxThrowException@8,	1_2_00407A8C
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00418C69 FindFirstFileW,FindNextFileW,FindNextFileW,	1_2_00418C69
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00408DA7 __EH_prolog,FindFirstFileW,FindNextFileW,FindClose,	1_2_00408DA7
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0063445A GetFileAttributesW,FindFirstFileW,FindClose,	1_2_0063445A
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0063C6D1 FindFirstFileW,FindClose,	1_2_0063C6D1
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0063C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	1_2_0063C75C
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0063EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_0063EF95
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0063F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_0063F0F2
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0063F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	1_2_0063F3F3
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_006337EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	1_2_006337EF
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00633B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	1_2_00633B12
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0063BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	1_2_0063BCBC

Source: C:\Users\user\AppData\Local\Milburr\Allene.exe

Code function: 1_2_00406F06 SetEvent,GetFileAttributesW,DeleteFileW,ShellExecuteW,GetLogicalDriveStringsA,SetFileAttributesW,DeleteFileA,Sleep,StrToIntA,CreateDirectoryW,

1_2_00406F06

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_008849A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_008849A0

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior

Source: wscript.exe, 00000003.00000002.1879008239.000002A92EFA5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: wscript.exe, 00000003.00000002.1879008239.000002A92EFA5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}%
Source: wscript.exe, 00000003.00000002.1879008239.000002A92EFA5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Allene.exe, 00000001.00000002.4156569703.00000000012B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\7056ZCiFdE.exe	API call chain: ExitProcess graph end node	graph_0-103978
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	API call chain: ExitProcess graph end node	graph_0-106759
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	API call chain: ExitProcess graph end node	graph_0-104044

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_008F3F09 BlockInput,

0_2_008F3F09

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_00883B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00883B3A

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_008B5A7C RtlEncodePointer,RtlEncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

0_2_008B5A7C

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_009D9A50 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_009D9A50

Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_015FA75E mov eax, dword ptr fs:[00000030h]	0_2_015FA75E
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_015FA770 mov eax, dword ptr fs:[00000030h]	0_2_015FA770
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_015FBDC0 mov eax, dword ptr fs:[00000030h]	0_2_015FBDC0
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_015FBE20 mov eax, dword ptr fs:[00000030h]	0_2_015FBE20
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00442554 mov eax, dword ptr fs:[00000030h]	1_2_00442554
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_010FA6BE mov eax, dword ptr fs:[00000030h]	1_2_010FA6BE
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_010FA6D0 mov eax, dword ptr fs:[00000030h]	1_2_010FA6D0
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_010FBD20 mov eax, dword ptr fs:[00000030h]	1_2_010FBD20
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_010FBD80 mov eax, dword ptr fs:[00000030h]	1_2_010FBD80

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_008D80A9 GetTokenInformation,GetLastError,GetProcessHeap,RtlAllocateHeap,GetTokenInformation,

0_2_008D80A9

Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008AA124 SetUnhandledExceptionFilter,	0_2_008AA124
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008AA155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_008AA155
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00434168 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00434168
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_0043A65D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0043A65D
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00433B44 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00433B44
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00433CD7 SetUnhandledExceptionFilter,	1_2_00433CD7
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005FA155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_005FA155
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_005FA124 SetUnhandledExceptionFilter,	1_2_005FA124

Source: C:\Users\user\AppData\Local\Milburr\Allene.exe

Code function: GetCurrentProcessId,OpenMutexA,CloseHandle,CreateThread,CloseHandle,Sleep,OpenProcess, svchost.exe

1_2_00410F36

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_008D87B1 LogonUserW,

0_2_008D87B1

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_00883B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00883B3A

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_008848D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_008848D7

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_008E4C27 mouse_event,

0_2_008E4C27

Source: C:\Windows\System32\wscript.exe

Process created: C:\Users\user\AppData\Local\Milburr\Allene.exe "C:\Users\user\AppData\Local\Milburr\Allene.exe"

Jump to behavior

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_008D7CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,RtlAllocateHeap,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_008D7CAF

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_008D874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_008D874B

Source: 7056ZCiFdE.exe, 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmp, Allene.exe, 00000001.00000002.4155616853.0000000000684000.00000040.00000001.01000000.00000004.sdmp, Allene.exe, 00000004.00000002.1919469392.0000000000684000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: Allene.exe, 00000001.00000002.4156339648.00000000010FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager0.26:8787
Source: Allene.exe, 00000001.00000002.4156569703.000000000121A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: 7056ZCiFdE.exe, Allene.exe	Binary or memory string: Shell_TrayWnd
Source: Allene.exe, 00000001.00000002.4156339648.00000000010FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager05\
Source: Allene.exe, 00000001.00000002.4156339648.00000000010FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager0.26
Source: Allene.exe, 00000001.00000002.4156339648.00000000010FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manageres\|
Source: Allene.exe, 00000001.00000002.4156569703.00000000012B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager0006689P
Source: Allene.exe, 00000001.00000002.4156569703.000000000121A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Managerv
Source: Allene.exe, 00000001.00000002.4156339648.00000000010FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Program Manager05\7GB
Source: Allene.exe, 00000001.00000002.4156569703.00000000012B3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|Program Manager\|
Source: Allene.exe, 00000001.00000002.4156176304.0000000001058000.00000004.00000020.00020000.00000000.sdmp, logs.dat.1.dr	Binary or memory string: [Program Manager]

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_008A862B cpuid

0_2_008A862B

Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: EnumSystemLocalesW,	1_2_004470AE
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: GetLocaleInfoW,	1_2_004510BA
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_004511E3
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: GetLocaleInfoW,	1_2_004512EA
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	1_2_004513B7
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: GetLocaleInfoW,	1_2_00447597
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: GetLocaleInfoA,	1_2_0040E679
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	1_2_00450A7F
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: EnumSystemLocalesW,	1_2_00450CF7
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: EnumSystemLocalesW,	1_2_00450D42
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: EnumSystemLocalesW,	1_2_00450DDD
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	1_2_00450E6A

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_008B4E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_008B4E87

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_008C1E06 GetUserNameW,

0_2_008C1E06

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_008B3F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_008B3F3A

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Code function: 0_2_008849A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_008849A0

Source: C:\Users\user\Desktop\7056ZCiFdE.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Remcos RAT

Source: Yara match	File source: 4.2.Allene.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Allene.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Allene.exe.3920000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Allene.exe.3920000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Allene.exe.18b0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Allene.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Allene.exe.18b0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Allene.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4155512160.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1920045593.0000000001948000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4156569703.00000000012B3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1919987718.00000000018B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1919363155.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4156176304.0000000001058000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4157121061.0000000003DDE000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4157009146.0000000003920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4156339648.00000000010FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Allene.exe PID: 7132, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Allene.exe PID: 2872, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Contains functionality to steal Chrome passwords or cookies

Source: C:\Users\user\AppData\Local\Milburr\Allene.exe

Code function: \AppData\Local\Google\Chrome\User Data\Default\Login Data

1_2_0040B21B

Contains functionality to steal Firefox passwords or cookies

Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: \AppData\Roaming\Mozilla\Firefox\Profiles\		1_2_0040B335
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: \key3.db		1_2_0040B335

Source: Allene.exe	Binary or memory string: WIN_81
Source: Allene.exe	Binary or memory string: WIN_XP
Source: Allene.exe	Binary or memory string: WIN_XPe
Source: Allene.exe	Binary or memory string: WIN_VISTA
Source: Allene.exe	Binary or memory string: WIN_7
Source: Allene.exe	Binary or memory string: WIN_8
Source: Allene.exe, 00000004.00000002.1919469392.0000000000684000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Detected Remcos RAT

Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-R1T905			Jump to behavior
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Mutex created: \Sessions\1\BaseNamedObjects\Rmc-R1T905			Jump to behavior

Yara detected Remcos RAT

Source: Yara match	File source: 4.2.Allene.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Allene.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Allene.exe.3920000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Allene.exe.3920000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Allene.exe.18b0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Allene.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.Allene.exe.18b0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Allene.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.4155512160.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1920045593.0000000001948000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4156569703.00000000012B3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1919987718.00000000018B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1919363155.0000000000400000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4156176304.0000000001058000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4157121061.0000000003DDE000.00000004.00000010.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4157009146.0000000003920000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.4156339648.00000000010FD000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Allene.exe PID: 7132, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Allene.exe PID: 2872, type: MEMORYSTR
Source: Yara match	File source: C:\ProgramData\remcos\logs.dat, type: DROPPED

Source: C:\Users\user\AppData\Local\Milburr\Allene.exe

Code function: cmd.exe

1_2_00405042

Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008F6283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	0_2_008F6283
Source: C:\Users\user\Desktop\7056ZCiFdE.exe	Code function: 0_2_008F6747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_008F6747
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00646283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	1_2_00646283
Source: C:\Users\user\AppData\Local\Milburr\Allene.exe	Code function: 1_2_00646747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	1_2_00646747

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	2 Valid Accounts	2 Native API	111 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	11 Archive Collected Data	11 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	121 Input Capture	1 Account Discovery	Remote Desktop Protocol	121 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	1 Defacement
Email Addresses	DNS Server	Domain Accounts	2 Service Execution	2 Valid Accounts	1 Bypass User Account Control	21 Obfuscated Files or Information	2 Credentials In Files	1 System Service Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Windows Service	2 Valid Accounts	1 Software Packing	NTDS	4 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	2 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	26 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Windows Service	1 Bypass User Account Control	Cached Domain Credentials	131 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	22 Process Injection	1 Masquerading	DCSync	1 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	2 Registry Run Keys / Startup Folder	2 Valid Accounts	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	11 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	21 Access Token Manipulation	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	22 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
7056ZCiFdE.exe	55%	ReversingLabs	Win32.Trojan.AutoitInject
7056ZCiFdE.exe	67%	Virustotal		Browse
7056ZCiFdE.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Milburr\Allene.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Milburr\Allene.exe	55%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\Milburr\Allene.exe	67%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
http://geoplugin.net/json.gp	Allene.exe	false		high
http://geoplugin.net/json.gp/C	Allene.exe, 00000001.00000002.4155512160.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Allene.exe, 00000001.00000002.4157009146.0000000003920000.00000004.00001000.00020000.00000000.sdmp, Allene.exe, 00000004.00000002.1919987718.00000000018B0000.00000004.00001000.00020000.00000000.sdmp, Allene.exe, 00000004.00000002.1919363155.0000000000400000.00000040.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
192.210.150.26	unknown	United States		36352	AS-COLOCROSSINGUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570884
Start date and time:	2024-12-08 09:30:25 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	7056ZCiFdE.exe renamed because original name is a hash value
Original Sample Name:	6f0604f8a16b94b61d714dfec11d0358.exe
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winEXE@6/7@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 57 Number of non-executed functions: 282
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
03:31:57	API Interceptor	6353343x Sleep call for process: Allene.exe modified
08:31:27	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Allene.vbs

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
192.210.150.26	uIarPolvHR.exe	Get hash	malicious	Remcos	Browse
	IB9876789000.bat.exe	Get hash	malicious	Remcos	Browse
	z49FACTURA-0987678.exe	Get hash	malicious	Remcos	Browse
	FAT6789098700900.scr.exe	Get hash	malicious	Remcos	Browse
	Rgh99876k7e.exe	Get hash	malicious	Remcos	Browse
	SALKI098765R400.exe	Get hash	malicious	Remcos	Browse
	FTE98767800000.bat.exe	Get hash	malicious	Remcos	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-COLOCROSSINGUS	uIarPolvHR.exe	Get hash	malicious	Remcos	Browse	192.210.150.26
	IB9876789000.bat.exe	Get hash	malicious	Remcos	Browse	192.210.150.26
	meerkat.x86.elf	Get hash	malicious	Mirai	Browse	104.168.61.38
	CGDL.doc	Get hash	malicious	Unknown	Browse	192.3.172.208
	seemejkiss.hta	Get hash	malicious	Cobalt Strike, FormBook, HTMLPhisher	Browse	107.175.113.196
	seemybestdayguvenu.hta	Get hash	malicious	Cobalt Strike, FormBook, HTMLPhisher	Browse	172.245.123.29
	k4PAIh16E6.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	192.3.118.10
	scan_241205-801_draft_PO.exe	Get hash	malicious	Remcos, GuLoader	Browse	104.168.7.16
	Transferencia de pago.xlam.xlsx	Get hash	malicious	AgentTesla	Browse	192.3.243.136
	LdSbZG1iH6.exe	Get hash	malicious	Remcos, PureLog Stealer	Browse	192.3.64.152

Process:	C:\Users\user\AppData\Local\Milburr\Allene.exe
File Type:	data
Category:	dropped
Size (bytes):	204
Entropy (8bit):	3.3573372569087336
Encrypted:	false
SSDEEP:	3:rhlKlyK1uflfT5JWRal2Jl+7R0DAlBG45klovDl64oojklovDl6v:6lZEfp5YcIeeDAlOWA41gWAv
MD5:	CB176B70DAA2CC265D36380D483E945F
SHA1:	CDA860866DC427EF3FD6BF09234812931D8470AD
SHA-256:	309E1CA9340FF21BF92AB0216B9C6E45B4F61A43CA5A4EF636A508CE56D423D4
SHA-512:	29129381A9F3608C789E908DD1659F5CD9A0057485D789E550CF3E3D6C53BDAF0B1CCE8EDDFD02F031A0684089AC2335430AFCCF3A659F317D9F96F86211ACC2
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: C:\ProgramData\remcos\logs.dat, Author: Joe Security
Reputation:	low
Preview:	....[.2.0.2.4./.1.2./.0.8. .0.3.:.3.1.:.2.5. .O.f.f.l.i.n.e. .K.e.y.l.o.g.g.e.r. .S.t.a.r.t.e.d.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].........[.R.u.n.].........[.P.r.o.g.r.a.m. .M.a.n.a.g.e.r.].....

C:\Users\user\AppData\Local\Milburr\Allene.exe

Download File

Process:	C:\Users\user\Desktop\7056ZCiFdE.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	885760
Entropy (8bit):	7.96449026748468
Encrypted:	false
SSDEEP:	24576:drl6kD68JmlotQfAVnxag+/zxRlk4t4p5G5wJm1wr:Zl328U2yfAVnsgSWpg5km
MD5:	6F0604F8A16B94B61D714DFEC11D0358
SHA1:	558828C2EAD68EA5883655299A3F0BFAD1981AE5
SHA-256:	28331E2705BF58BD76A9F8BA0F0A431B762EAF6E4284DBF12F1453DD3FECF281
SHA-512:	76EBD74EC7B965FF20AAD25AA6C0DFC5B7EFEF087F6BD4BF6F0B2F08427AC65BF320305DB16FF00CEBC5BFC98C8F22014ED5E7C9CEDD37A05721B330326C4EB3
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55% Antivirus: Virustotal, Detection: 67%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}.r}.r}.4,".p}.....s}../..A}../#..}../".G}.{.@.{}.{.P.W}.r}.R....)."}.....s}../..s}.r}T.s}.....s}.Richr}.................PE..L....eRg.........."......`...0...0..P....@........@.......................................@...@.......@........................$...................................................................4...H...........................................UPX0.....0..............................UPX1.....`...@...^..................@....rsrc....0......."...b..............@..............................................................................................................................................................................................................................................................................................................................................................3.91.UPX!....

C:\Users\user\AppData\Local\Temp\Anglophile

Download File

Process:	C:\Users\user\Desktop\7056ZCiFdE.exe
File Type:	data
Category:	dropped
Size (bytes):	492544
Entropy (8bit):	7.63343625326173
Encrypted:	false
SSDEEP:	12288:X2BF3zOqNhLkZUidJm1/Inj15y1KojPGdn:XuZviS1/v1Odn
MD5:	3CB6ABD40FBA1EDDD8A7DDA9994BA7F7
SHA1:	2C563FAD704A5E5407F38AFF2E47C72138944106
SHA-256:	4B2E35D8CD82164975B338E118EBFBD621D1AFB5E768A12936F7F9D0B6C1B9E0
SHA-512:	CA9C2B1DEAF0DA7DB93AD63CF98010EF28D5B07E50213984842996A14796AE88E774583F487510F1860CBDD5B58CF51523F928C8FDE6622F80352CAC6BA7B77F
Malicious:	false
Reputation:	low
Preview:	}..4D67BAUE5..0O.WU0RI4Gv7BEUE5NC0OMWU0RI4G67BEUE5NC0OMWU0RI<F67LZ.K5.J.n.V..s.\.E.27:"G/..,,9;_&iV".E7+u,[n...m::T7g9J<.BEUE5NC.f...x..........9.k.....<.c.T~.I.n.....g.......\.........................................\l......T.......]b...... W/....UE5NC0OM..0R.5B6\.a2E5NC0OMW.0PH?F8'B%PE5nA0OMWU.iJ4G&7BE%@5NCpOMGU0RK4G37CEUE5NF0NMWU0RI.@67FEUE5NC2OM.U0BI4W67BEEE5^C0OMWU RI4G67BEUE5n.6OIVU0R)3G..BEUE5NC0OMWU0RI4G67.BU..NC .KWm0RI4G67BEUE5NC0OMWU.O4_67B..C5.C0OMWU0RI4G6GGE.A5NC0OMWU0RI4G67BEUE5NC0OMW{D71@G67_.PE5^C0O-RU0VI4G67BEUE5NC0OmWUP\|;P&BVBEU.4NC@JMW.1RIPB67BEUE5NC0OMW.0R..#WC#EUEY.C0OMPU0\I4G.1BEUE5NC0OMWU0.I4..E176E5N.xOMW57RI~G67.CUE5NC0OMWU0RItG6wl70)Z-C0.vWU0.N4G.7BE.B5NC0OMWU0RI4Gv7B.UE5NC0OMWU0RI4G67BEUE5NC0OMWU0RI4G67BEUE5NC0OMWU0RI4G67BEUE5NC0OMWU0RI4G67BEUE5NC0OMWU0RI4G67BEUE5NC0OMWU0RI4G67BEUE5NC0OMWU0RI4G67BEUE5NC0OMWU0RI4G67BEUE5NC0OMWU0RI4G67BEUE5NC0OMWU0RI4G67BEUE5NC0OMWU0RI4G67BEUE5NC0OMWU0RI4G67BEUE5NC0OMWU0RI4G67BEUE5NC0OMWU0RI4G67BEUE5NC0OMWU0RI4G67BEUE5

C:\Users\user\AppData\Local\Temp\aut30FA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Milburr\Allene.exe
File Type:	data
Category:	dropped
Size (bytes):	423980
Entropy (8bit):	7.985815089552733
Encrypted:	false
SSDEEP:	6144:25V/D8z7yiqubuaLDja6J0YeeJ50+YPJc043YBYc/B7k4vhozdky5ly26tqlrxuO:2z7il3Y7eJ5nYPJoYBTlkohOqakSlOK9
MD5:	CBDEE7E56FE6E632838A31ADF1435807
SHA1:	9AC24BD12E4369785742E075F81B9B6A50EBABBD
SHA-256:	DC44AEE08535CFCA123FE35EC2EE62E4D0457A82A370F709E6BDC95B9F26F11C
SHA-512:	E058194D24BCBB56638E3E63E0E50D2F4FA2A6956DC57EAAC73E11F215190940B5AB3744DF567FFE1A29B7D324422B3DED9E339E1188F910BBC6EC32496E72A9
Malicious:	false
Reputation:	low
Preview:	EA06......;3J$.oB..h.]..aO.....&iG.M.TP.2.C.S..y....s.4.oL.{.s_.+.n..?.v.....Sy../.D%....&..Qj,.Wu.V..{.r.:.U&.y.y..L.2....o...2...~....5k.. .....c../..'.n.z!~........>.C.\.{...!...c....)..k.Y...+....M.....e@.,n...q..>....p.x.....p../^....q.........4u..LPY..m\..f@........q'.Ij.Y.....B.4...L..Ih....M.......g7..h.i.8.w.J..oF....M..f.L....h.Z...$..h...MX...........Ux..u.A....1.7c/O.W...nB.5.....G..h 9.m.7......j..1.mJ.0...\|6.V.\|..$.....S.t.U6...5...g...T.1..^.#..+10.6.U.W...4..G..Rf.x..c7........5..7..#yC.....y...7.JkR...v..<T.....Gh@.?..a.........t.....!..[...)....W.\|.s.L.m..R..Z.._u..e..J!..h.PZ..c:.P....J...f.{..Q.........D...._..P...ef.C.B.J..##.....,&..rk..[.......S]5..O.....'.Q.M(Q...p.L4.*.Va:.. Sn...V..1....Ki.L7T.%.m_.Jb.^..3..2....4..u4:,..X.r3...,...F~4..Wd..G....qm@.G.\|..Rk..G."..kn .GB...[. .G2...........,....9b...r+3..B(......N..9...&(.....%..9. .&`...@..}..9.....&.rk..V..0....2i...(4Xf..b.L).YL..R..3Y.o.?..?.+.?KU.L

C:\Users\user\AppData\Local\Temp\autE914.tmp

Download File

Process:	C:\Users\user\Desktop\7056ZCiFdE.exe
File Type:	data
Category:	dropped
Size (bytes):	423980
Entropy (8bit):	7.985815089552733
Encrypted:	false
SSDEEP:	6144:25V/D8z7yiqubuaLDja6J0YeeJ50+YPJc043YBYc/B7k4vhozdky5ly26tqlrxuO:2z7il3Y7eJ5nYPJoYBTlkohOqakSlOK9
MD5:	CBDEE7E56FE6E632838A31ADF1435807
SHA1:	9AC24BD12E4369785742E075F81B9B6A50EBABBD
SHA-256:	DC44AEE08535CFCA123FE35EC2EE62E4D0457A82A370F709E6BDC95B9F26F11C
SHA-512:	E058194D24BCBB56638E3E63E0E50D2F4FA2A6956DC57EAAC73E11F215190940B5AB3744DF567FFE1A29B7D324422B3DED9E339E1188F910BBC6EC32496E72A9
Malicious:	false
Reputation:	low
Preview:	EA06......;3J$.oB..h.]..aO.....&iG.M.TP.2.C.S..y....s.4.oL.{.s_.+.n..?.v.....Sy../.D%....&..Qj,.Wu.V..{.r.:.U&.y.y..L.2....o...2...~....5k.. .....c../..'.n.z!~........>.C.\.{...!...c....)..k.Y...+....M.....e@.,n...q..>....p.x.....p../^....q.........4u..LPY..m\..f@........q'.Ij.Y.....B.4...L..Ih....M.......g7..h.i.8.w.J..oF....M..f.L....h.Z...$..h...MX...........Ux..u.A....1.7c/O.W...nB.5.....G..h 9.m.7......j..1.mJ.0...\|6.V.\|..$.....S.t.U6...5...g...T.1..^.#..+10.6.U.W...4..G..Rf.x..c7........5..7..#yC.....y...7.JkR...v..<T.....Gh@.?..a.........t.....!..[...)....W.\|.s.L.m..R..Z.._u..e..J!..h.PZ..c:.P....J...f.{..Q.........D...._..P...ef.C.B.J..##.....,&..rk..[.......S]5..O.....'.Q.M(Q...p.L4.*.Va:.. Sn...V..1....Ki.L7T.%.m_.Jb.^..3..2....4..u4:,..X.r3...,...F~4..Wd..G....qm@.G.\|..Rk..G."..kn .GB...[. .G2...........,....9b...r+3..B(......N..9...&(.....%..9. .&`...@..}..9.....&.rk..V..0....2i...(4Xf..b.L).YL..R..3Y.o.?..?.+.?KU.L

C:\Users\user\AppData\Local\Temp\autF7AA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Milburr\Allene.exe
File Type:	data
Category:	dropped
Size (bytes):	423980
Entropy (8bit):	7.985815089552733
Encrypted:	false
SSDEEP:	6144:25V/D8z7yiqubuaLDja6J0YeeJ50+YPJc043YBYc/B7k4vhozdky5ly26tqlrxuO:2z7il3Y7eJ5nYPJoYBTlkohOqakSlOK9
MD5:	CBDEE7E56FE6E632838A31ADF1435807
SHA1:	9AC24BD12E4369785742E075F81B9B6A50EBABBD
SHA-256:	DC44AEE08535CFCA123FE35EC2EE62E4D0457A82A370F709E6BDC95B9F26F11C
SHA-512:	E058194D24BCBB56638E3E63E0E50D2F4FA2A6956DC57EAAC73E11F215190940B5AB3744DF567FFE1A29B7D324422B3DED9E339E1188F910BBC6EC32496E72A9
Malicious:	false
Reputation:	low
Preview:	EA06......;3J$.oB..h.]..aO.....&iG.M.TP.2.C.S..y....s.4.oL.{.s_.+.n..?.v.....Sy../.D%....&..Qj,.Wu.V..{.r.:.U&.y.y..L.2....o...2...~....5k.. .....c../..'.n.z!~........>.C.\.{...!...c....)..k.Y...+....M.....e@.,n...q..>....p.x.....p../^....q.........4u..LPY..m\..f@........q'.Ij.Y.....B.4...L..Ih....M.......g7..h.i.8.w.J..oF....M..f.L....h.Z...$..h...MX...........Ux..u.A....1.7c/O.W...nB.5.....G..h 9.m.7......j..1.mJ.0...\|6.V.\|..$.....S.t.U6...5...g...T.1..^.#..+10.6.U.W...4..G..Rf.x..c7........5..7..#yC.....y...7.JkR...v..<T.....Gh@.?..a.........t.....!..[...)....W.\|.s.L.m..R..Z.._u..e..J!..h.PZ..c:.P....J...f.{..Q.........D...._..P...ef.C.B.J..##.....,&..rk..[.......S]5..O.....'.Q.M(Q...p.L4.*.Va:.. Sn...V..1....Ki.L7T.%.m_.Jb.^..3..2....4..u4:,..X.r3...,...F~4..Wd..G....qm@.G.\|..Rk..G."..kn .GB...[. .G2...........,....9b...r+3..B(......N..9...&(.....%..9. .&`...@..}..9.....&.rk..V..0....2i...(4Xf..b.L).YL..R..3Y.o.?..?.+.?KU.L

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Allene.vbs

Download File

Process:	C:\Users\user\AppData\Local\Milburr\Allene.exe
File Type:	data
Category:	dropped
Size (bytes):	268
Entropy (8bit):	3.3984013364689636
Encrypted:	false
SSDEEP:	6:DMM8lfm3OOQdUfcloRKUEZ+lX1olFgAD76nriIM8lfQVn:DsO+vNloRKQ1olvDcmA2n
MD5:	9ADBEDC65F332D0F3CB23DF19C449A76
SHA1:	C8BCEB35573CAB38C15BCF700483AD757ACB35CD
SHA-256:	CF46956B53F2A99BB538A9E6F04B3086ECDDE52A903B9ED61C9FDCF96E8E45C0
SHA-512:	593057C22675DCB5B372B93ACA759178339EFCEEA0DD68C6B03214CACE876BAA0FBCD7F6B7D79947B989D7011805E8BC5A23B6D1881F78641D9741A297455844
Malicious:	true
Reputation:	low
Preview:	S.e.t. .W.s.h.S.h.e.l.l. .=. .C.r.e.a.t.e.O.b.j.e.c.t.(.".W.S.c.r.i.p.t...S.h.e.l.l.".)...W.s.h.S.h.e.l.l...R.u.n. .".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.l.b.u.r.r.\.A.l.l.e.n.e...e.x.e.".,. .1...S.e.t. .W.s.h.S.h.e.l.l. .=. .N.o.t.h.i.n.g...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.96449026748468
TrID:	Win32 Executable (generic) a (10002005/4) 99.39% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	7056ZCiFdE.exe
File size:	885'760 bytes
MD5:	6f0604f8a16b94b61d714dfec11d0358
SHA1:	558828c2ead68ea5883655299a3f0bfad1981ae5
SHA256:	28331e2705bf58bd76a9f8ba0f0a431b762eaf6e4284dbf12f1453dd3fecf281
SHA512:	76ebd74ec7b965ff20aad25aa6c0dfc5b7efef087f6bd4bf6f0b2f08427ac65bf320305db16ff00cebc5bfc98c8f22014ed5e7c9cedd37a05721b330326c4eb3
SSDEEP:	24576:drl6kD68JmlotQfAVnxag+/zxRlk4t4p5G5wJm1wr:Zl328U2yfAVnsgSWpg5km
TLSH:	99152352CDC1D923C9FD6B348036CD5009A93471AEA6272EC719E64FFC31347A85BB99
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x559a50
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67526584 [Fri Dec 6 02:46:28 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	fc6683d30d9f25244a50fd5357825e79

Entrypoint Preview

Instruction
pushad
mov esi, 00504000h
lea edi, dword ptr [esi-00103000h]
push edi
jmp 00007F93651125ADh
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007F93651125A9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F936511258Fh
mov eax, 00000001h
add ebx, ebx
jne 00007F93651125A9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007F93651125ADh
jne 00007F93651125CAh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F93651125C1h
dec eax
add ebx, ebx
jne 00007F93651125A9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
jmp 00007F9365112576h
add ebx, ebx
jne 00007F93651125A9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jmp 00007F93651125F4h
xor ecx, ecx
sub eax, 03h
jc 00007F93651125B3h
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007F9365112617h
sar eax, 1
mov ebp, eax
jmp 00007F93651125ADh
add ebx, ebx
jne 00007F93651125A9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F936511256Eh
inc ecx
add ebx, ebx
jne 00007F93651125A9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F9365112560h
add ebx, ebx
jne 00007F93651125A9h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007F9365112591h
jne 00007F93651125ABh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F9365112586h
add ecx, 02h
cmp ebp, FFFFFB00h
adc ecx, 02h
lea edx, dword ptr [edi+ebp]
cmp ebp, FFFFFFFCh
jbe 00007F93651125B0h
mov al, byte ptr [edx]

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1dbcf0	0x424	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x15a000	0x81cf0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1dc114	0xc	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x159c34	0x48	UPX1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x103000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x104000	0x56000	0x55e00	2571fa5ea53c45ae1cc31e27c28ac18d	False	0.9871270014556041	data	7.935470490154811	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x15a000	0x83000	0x82200	a4da39dbe4592de5fc21c4317176cba9	False	0.960808042146974	data	7.959535071153083	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x15a5ac	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0x15a6d8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0x15a804	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0x15a930	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0x15ac1c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0x15ad48	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0x15bbf4	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0x15c4a0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0x15ca0c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0x15efb8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0x160064	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	empty	English	Great Britain	0
RT_STRING	0xcd4f0	0x594	empty	English	Great Britain	0
RT_STRING	0xcda84	0x68a	empty	English	Great Britain	0
RT_STRING	0xce110	0x490	empty	English	Great Britain	0
RT_STRING	0xce5a0	0x5fc	empty	English	Great Britain	0
RT_STRING	0xceb9c	0x65c	empty	English	Great Britain	0
RT_STRING	0xcf1f8	0x466	empty	English	Great Britain	0
RT_STRING	0xcf660	0x158	empty	English	Great Britain	0
RT_RCDATA	0x1604d0	0x7b287	data			1.0003191563172136
RT_GROUP_ICON	0x1db75c	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x1db7d8	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x1db7f0	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x1db808	0x14	data	English	Great Britain	1.25
RT_VERSION	0x1db820	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x1db900	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
ADVAPI32.dll	GetAce
COMCTL32.dll	ImageList_Remove
COMDLG32.dll	GetOpenFileNameW
GDI32.dll	LineTo
IPHLPAPI.DLL	IcmpSendEcho
MPR.dll	WNetUseConnectionW
ole32.dll	CoGetObject
OLEAUT32.dll	VariantInit
PSAPI.DLL	GetProcessMemoryInfo
SHELL32.dll	DragFinish
USER32.dll	GetDC
USERENV.dll	LoadUserProfileW
UxTheme.dll	IsThemeActive
VERSION.dll	VerQueryValueW
WININET.dll	FtpOpenFileW
WINMM.dll	timeGetTime
WSOCK32.dll	connect

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 8, 2024 09:31:26.408710957 CET	49730	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:26.528172970 CET	8787	49730	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:26.528354883 CET	49730	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:26.528944016 CET	49730	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:26.648148060 CET	8787	49730	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:28.467376947 CET	8787	49730	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:28.467538118 CET	49730	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:28.467648029 CET	49730	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:28.587414980 CET	8787	49730	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:29.475307941 CET	49731	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:29.594912052 CET	8787	49731	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:29.595016003 CET	49731	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:29.595606089 CET	49731	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:29.714903116 CET	8787	49731	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:31.530651093 CET	8787	49731	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:31.530822039 CET	49731	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:31.530921936 CET	49731	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:31.650335073 CET	8787	49731	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:32.538069010 CET	49732	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:32.657479048 CET	8787	49732	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:32.657592058 CET	49732	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:32.658118963 CET	49732	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:32.777432919 CET	8787	49732	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:34.592327118 CET	8787	49732	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:34.592415094 CET	49732	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:34.592474937 CET	49732	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:34.713279963 CET	8787	49732	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:35.605792046 CET	49733	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:35.725260019 CET	8787	49733	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:35.725771904 CET	49733	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:35.728229046 CET	49733	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:35.848681927 CET	8787	49733	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:37.670509100 CET	8787	49733	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:37.670588970 CET	49733	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:37.670674086 CET	49733	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:37.790642977 CET	8787	49733	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:38.684047937 CET	49736	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:38.805792093 CET	8787	49736	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:38.806071997 CET	49736	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:38.807209969 CET	49736	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:38.926691055 CET	8787	49736	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:41.098274946 CET	8787	49736	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:41.098332882 CET	49736	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:41.098407030 CET	49736	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:41.142117023 CET	8787	49736	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:41.142163992 CET	49736	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:41.218240976 CET	8787	49736	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:42.100241899 CET	49740	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:42.470206976 CET	8787	49740	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:42.470371008 CET	49740	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:42.470921040 CET	49740	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:42.590168953 CET	8787	49740	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:44.408803940 CET	8787	49740	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:44.408935070 CET	49740	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:44.409050941 CET	49740	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:44.528430939 CET	8787	49740	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:45.412977934 CET	49742	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:45.532253981 CET	8787	49742	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:45.532382011 CET	49742	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:45.532903910 CET	49742	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:45.652203083 CET	8787	49742	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:47.487263918 CET	8787	49742	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:47.487371922 CET	49742	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:47.487426043 CET	49742	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:47.606797934 CET	8787	49742	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:48.491081953 CET	49743	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:48.610651016 CET	8787	49743	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:48.610812902 CET	49743	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:48.611483097 CET	49743	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:48.730813980 CET	8787	49743	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:50.549973011 CET	8787	49743	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:50.550101995 CET	49743	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:50.550218105 CET	49743	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:50.669493914 CET	8787	49743	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:51.553592920 CET	49744	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:51.673557997 CET	8787	49744	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:51.673717976 CET	49744	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:51.674578905 CET	49744	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:51.793994904 CET	8787	49744	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:53.623752117 CET	8787	49744	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:53.623867989 CET	49744	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:53.623966932 CET	49744	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:53.743483067 CET	8787	49744	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:54.631829023 CET	49745	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:54.751193047 CET	8787	49745	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:54.751336098 CET	49745	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:54.751936913 CET	49745	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:54.871385098 CET	8787	49745	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:56.687107086 CET	8787	49745	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:56.687236071 CET	49745	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:56.687336922 CET	49745	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:56.806765079 CET	8787	49745	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:57.695982933 CET	49746	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:57.815279961 CET	8787	49746	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:57.815434933 CET	49746	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:57.815943956 CET	49746	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:57.935286045 CET	8787	49746	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:59.764508963 CET	8787	49746	192.210.150.26	192.168.2.4
Dec 8, 2024 09:31:59.764564991 CET	49746	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:59.764632940 CET	49746	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:31:59.884322882 CET	8787	49746	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:00.772095919 CET	49747	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:00.891486883 CET	8787	49747	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:00.891845942 CET	49747	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:00.892399073 CET	49747	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:01.011775017 CET	8787	49747	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:02.827013969 CET	8787	49747	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:02.827081919 CET	49747	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:02.827187061 CET	49747	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:02.946587086 CET	8787	49747	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:03.834789038 CET	49748	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:03.954200983 CET	8787	49748	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:03.956127882 CET	49748	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:03.956617117 CET	49748	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:04.075918913 CET	8787	49748	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:05.889717102 CET	8787	49748	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:05.889862061 CET	49748	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:05.889946938 CET	49748	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:06.010740042 CET	8787	49748	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:06.897221088 CET	49749	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:07.016556025 CET	8787	49749	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:07.016783953 CET	49749	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:07.017380953 CET	49749	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:07.136823893 CET	8787	49749	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:08.953000069 CET	8787	49749	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:08.953176975 CET	49749	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:08.953295946 CET	49749	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:09.072618961 CET	8787	49749	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:09.959532976 CET	49750	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:10.078915119 CET	8787	49750	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:10.079050064 CET	49750	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:10.079703093 CET	49750	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:10.199970961 CET	8787	49750	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:12.014738083 CET	8787	49750	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:12.014863014 CET	49750	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:12.014993906 CET	49750	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:12.134294033 CET	8787	49750	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:13.022237062 CET	49751	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:13.141577959 CET	8787	49751	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:13.141746998 CET	49751	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:13.142324924 CET	49751	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:13.261663914 CET	8787	49751	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:15.081214905 CET	8787	49751	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:15.081367016 CET	49751	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:15.081459999 CET	49751	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:15.200726986 CET	8787	49751	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:16.090046883 CET	49752	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:16.210218906 CET	8787	49752	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:16.210314989 CET	49752	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:16.210804939 CET	49752	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:16.330099106 CET	8787	49752	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:18.212445974 CET	8787	49752	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:18.212512016 CET	49752	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:18.212596893 CET	49752	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:18.331799984 CET	8787	49752	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:19.225203991 CET	49760	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:19.344552040 CET	8787	49760	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:19.344652891 CET	49760	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:19.345351934 CET	49760	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:19.465447903 CET	8787	49760	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:21.316139936 CET	8787	49760	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:21.316297054 CET	49760	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:21.316519976 CET	49760	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:21.435796022 CET	8787	49760	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:22.319597006 CET	49766	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:22.518547058 CET	8787	49766	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:22.518675089 CET	49766	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:22.519260883 CET	49766	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:22.638487101 CET	8787	49766	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:24.493659019 CET	8787	49766	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:24.493802071 CET	49766	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:24.493901014 CET	49766	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:24.613360882 CET	8787	49766	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:25.514667988 CET	49772	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:25.634012938 CET	8787	49772	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:25.634130001 CET	49772	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:25.635190964 CET	49772	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:25.754533052 CET	8787	49772	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:27.562943935 CET	8787	49772	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:27.563097000 CET	49772	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:27.563230038 CET	49772	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:27.684879065 CET	8787	49772	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:28.575330973 CET	49783	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:28.694596052 CET	8787	49783	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:28.694696903 CET	49783	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:28.695255995 CET	49783	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:28.814752102 CET	8787	49783	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:30.644603968 CET	8787	49783	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:30.644664049 CET	49783	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:30.644700050 CET	49783	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:30.764122963 CET	8787	49783	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:31.647417068 CET	49789	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:31.768342972 CET	8787	49789	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:31.772139072 CET	49789	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:31.772488117 CET	49789	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:31.893503904 CET	8787	49789	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:33.703562975 CET	8787	49789	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:33.703619957 CET	49789	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:33.703712940 CET	49789	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:33.822968006 CET	8787	49789	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:34.709608078 CET	49800	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:34.829042912 CET	8787	49800	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:34.829157114 CET	49800	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:34.829535007 CET	49800	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:34.948769093 CET	8787	49800	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:36.769028902 CET	8787	49800	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:36.769151926 CET	49800	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:36.769232035 CET	49800	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:36.888555050 CET	8787	49800	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:37.772955894 CET	49806	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:37.892250061 CET	8787	49806	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:37.892556906 CET	49806	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:37.893227100 CET	49806	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:38.012439013 CET	8787	49806	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:39.837166071 CET	8787	49806	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:39.840148926 CET	49806	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:39.840218067 CET	49806	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:39.960299015 CET	8787	49806	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:40.850291967 CET	49813	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:40.969721079 CET	8787	49813	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:40.969830990 CET	49813	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:40.970662117 CET	49813	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:41.090121984 CET	8787	49813	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:42.953005075 CET	8787	49813	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:42.953074932 CET	49813	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:42.953160048 CET	49813	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:43.072623014 CET	8787	49813	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:43.959538937 CET	49823	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:44.079046965 CET	8787	49823	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:44.079144001 CET	49823	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:44.079602003 CET	49823	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:44.199292898 CET	8787	49823	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:46.050798893 CET	8787	49823	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:46.052190065 CET	49823	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:46.052383900 CET	49823	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:46.171608925 CET	8787	49823	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:47.053422928 CET	49829	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:47.172715902 CET	8787	49829	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:47.173718929 CET	49829	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:47.174339056 CET	49829	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:47.293524027 CET	8787	49829	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:49.113449097 CET	8787	49829	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:49.113543987 CET	49829	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:49.113543987 CET	49829	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:49.233192921 CET	8787	49829	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:50.115983009 CET	49839	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:50.235296011 CET	8787	49839	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:50.238231897 CET	49839	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:50.238549948 CET	49839	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:50.357784033 CET	8787	49839	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:52.176213980 CET	8787	49839	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:52.176280975 CET	49839	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:52.176323891 CET	49839	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:52.295605898 CET	8787	49839	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:53.178464890 CET	49845	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:53.298187971 CET	8787	49845	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:53.298440933 CET	49845	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:53.298839092 CET	49845	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:53.418157101 CET	8787	49845	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:55.234391928 CET	8787	49845	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:55.236128092 CET	49845	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:55.239387035 CET	49845	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:55.358649015 CET	8787	49845	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:56.240880013 CET	49855	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:56.362500906 CET	8787	49855	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:56.362577915 CET	49855	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:56.363080978 CET	49855	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:56.482435942 CET	8787	49855	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:58.296840906 CET	8787	49855	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:58.296896935 CET	49855	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:58.298662901 CET	49855	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:58.418153048 CET	8787	49855	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:59.304344893 CET	49862	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:59.423695087 CET	8787	49862	192.210.150.26	192.168.2.4
Dec 8, 2024 09:32:59.423804045 CET	49862	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:59.424194098 CET	49862	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:32:59.543531895 CET	8787	49862	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:01.363646984 CET	8787	49862	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:01.363801003 CET	49862	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:01.363801003 CET	49862	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:01.483195066 CET	8787	49862	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:02.366664886 CET	49869	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:02.486120939 CET	8787	49869	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:02.486203909 CET	49869	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:02.486512899 CET	49869	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:02.605815887 CET	8787	49869	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:04.423086882 CET	8787	49869	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:04.423244953 CET	49869	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:04.423244953 CET	49869	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:04.542675972 CET	8787	49869	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:05.440476894 CET	49879	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:05.560199976 CET	8787	49879	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:05.560293913 CET	49879	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:05.561050892 CET	49879	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:05.680351019 CET	8787	49879	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:07.501308918 CET	8787	49879	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:07.501431942 CET	49879	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:07.501478910 CET	49879	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:07.620820999 CET	8787	49879	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:08.476731062 CET	49885	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:08.596193075 CET	8787	49885	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:08.596273899 CET	49885	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:08.596635103 CET	49885	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:08.715915918 CET	8787	49885	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:10.532605886 CET	8787	49885	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:10.536220074 CET	49885	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:10.536221027 CET	49885	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:10.655644894 CET	8787	49885	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:11.475552082 CET	49895	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:11.594964981 CET	8787	49895	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:11.595058918 CET	49895	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:11.595406055 CET	49895	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:11.715557098 CET	8787	49895	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:13.535861015 CET	8787	49895	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:13.535923004 CET	49895	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:13.536003113 CET	49895	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:13.655260086 CET	8787	49895	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:14.470380068 CET	49902	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:14.589826107 CET	8787	49902	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:14.590264082 CET	49902	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:14.591198921 CET	49902	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:14.710549116 CET	8787	49902	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:16.532749891 CET	8787	49902	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:16.536187887 CET	49902	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:16.536267042 CET	49902	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:16.655647993 CET	8787	49902	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:17.420438051 CET	49909	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:17.539813995 CET	8787	49909	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:17.539901972 CET	49909	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:17.543987036 CET	49909	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:17.663294077 CET	8787	49909	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:19.510231972 CET	8787	49909	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:19.512193918 CET	49909	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:19.516243935 CET	49909	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:19.635569096 CET	8787	49909	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:20.368369102 CET	49918	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:20.488444090 CET	8787	49918	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:20.492207050 CET	49918	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:20.492641926 CET	49918	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:20.611951113 CET	8787	49918	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:22.441973925 CET	8787	49918	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:22.442039967 CET	49918	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:22.442128897 CET	49918	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:22.664119005 CET	8787	49918	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:23.272100925 CET	49925	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:23.392564058 CET	8787	49925	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:23.392654896 CET	49925	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:23.393035889 CET	49925	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:23.512743950 CET	8787	49925	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:25.333112001 CET	8787	49925	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:25.333178997 CET	49925	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:25.333259106 CET	49925	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:25.452630997 CET	8787	49925	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:26.131702900 CET	49931	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:26.251063108 CET	8787	49931	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:26.251255035 CET	49931	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:26.251580000 CET	49931	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:26.370887995 CET	8787	49931	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:28.191987991 CET	8787	49931	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:28.192081928 CET	49931	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:28.192177057 CET	49931	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:28.311520100 CET	8787	49931	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:28.959827900 CET	49940	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:29.079207897 CET	8787	49940	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:29.079293966 CET	49940	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:29.079819918 CET	49940	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:29.199146032 CET	8787	49940	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:31.020364046 CET	8787	49940	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:31.020500898 CET	49940	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:31.020543098 CET	49940	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:31.139858961 CET	8787	49940	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:31.772048950 CET	49947	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:31.891473055 CET	8787	49947	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:31.892179966 CET	49947	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:31.892554998 CET	49947	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:32.011902094 CET	8787	49947	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:33.829690933 CET	8787	49947	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:33.829750061 CET	49947	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:33.829791069 CET	49947	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:33.949105978 CET	8787	49947	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:34.553756952 CET	49953	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:34.673111916 CET	8787	49953	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:34.675051928 CET	49953	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:34.675405979 CET	49953	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:34.794919014 CET	8787	49953	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:36.610183001 CET	8787	49953	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:36.610435009 CET	49953	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:36.610435009 CET	49953	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:36.729823112 CET	8787	49953	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:37.303814888 CET	49961	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:37.423754930 CET	8787	49961	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:37.426899910 CET	49961	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:37.427203894 CET	49961	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:37.546614885 CET	8787	49961	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:39.364537954 CET	8787	49961	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:39.364633083 CET	49961	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:39.364718914 CET	49961	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:39.483977079 CET	8787	49961	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:40.037902117 CET	49968	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:40.157316923 CET	8787	49968	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:40.158236980 CET	49968	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:40.158584118 CET	49968	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:40.277842045 CET	8787	49968	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:42.207593918 CET	8787	49968	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:42.207664967 CET	49968	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:42.207788944 CET	49968	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:42.450251102 CET	8787	49968	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:42.871392965 CET	49973	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:42.990798950 CET	8787	49973	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:42.990926027 CET	49973	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:42.991370916 CET	49973	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:43.110878944 CET	8787	49973	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:44.926826000 CET	8787	49973	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:44.926966906 CET	49973	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:44.926966906 CET	49973	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:45.046309948 CET	8787	49973	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:45.553623915 CET	49978	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:45.672869921 CET	8787	49978	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:45.673038006 CET	49978	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:45.673458099 CET	49978	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:45.792743921 CET	8787	49978	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:47.610308886 CET	8787	49978	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:47.610377073 CET	49978	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:47.610413074 CET	49978	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:47.730007887 CET	8787	49978	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:48.225275040 CET	49986	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:48.344917059 CET	8787	49986	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:48.346309900 CET	49986	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:48.346729040 CET	49986	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:48.465977907 CET	8787	49986	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:50.282869101 CET	8787	49986	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:50.282939911 CET	49986	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:50.282995939 CET	49986	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:50.402873993 CET	8787	49986	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:50.866286993 CET	49991	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:50.985745907 CET	8787	49991	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:50.985965014 CET	49991	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:50.986373901 CET	49991	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:51.105808020 CET	8787	49991	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:52.927443027 CET	8787	49991	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:52.927508116 CET	49991	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:52.927552938 CET	49991	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:53.047919989 CET	8787	49991	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:53.491123915 CET	49997	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:53.610965014 CET	8787	49997	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:53.611119032 CET	49997	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:53.611414909 CET	49997	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:53.730707884 CET	8787	49997	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:55.548932076 CET	8787	49997	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:55.549479961 CET	49997	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:55.549531937 CET	49997	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:55.668764114 CET	8787	49997	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:56.100353003 CET	50003	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:56.219885111 CET	8787	50003	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:56.219986916 CET	50003	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:56.220343113 CET	50003	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:56.339575052 CET	8787	50003	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:58.161431074 CET	8787	50003	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:58.161540985 CET	50003	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:58.161595106 CET	50003	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:58.280890942 CET	8787	50003	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:58.694076061 CET	50012	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:58.813338995 CET	8787	50012	192.210.150.26	192.168.2.4
Dec 8, 2024 09:33:58.814619064 CET	50012	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:58.814855099 CET	50012	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:33:58.934045076 CET	8787	50012	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:00.751205921 CET	8787	50012	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:00.751338005 CET	50012	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:00.751391888 CET	50012	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:00.870676041 CET	8787	50012	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:01.272341013 CET	50019	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:01.391622066 CET	8787	50019	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:01.391704082 CET	50019	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:01.392009974 CET	50019	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:01.511284113 CET	8787	50019	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:03.329407930 CET	8787	50019	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:03.331738949 CET	50019	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:03.331788063 CET	50019	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:03.451421976 CET	8787	50019	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:03.834780931 CET	50025	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:03.954149961 CET	8787	50025	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:03.956273079 CET	50025	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:03.956620932 CET	50025	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:04.075905085 CET	8787	50025	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:05.895773888 CET	8787	50025	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:05.896306038 CET	50025	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:05.896342039 CET	50025	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:06.015665054 CET	8787	50025	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:06.384102106 CET	50032	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:06.503531933 CET	8787	50032	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:06.503622055 CET	50032	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:06.503964901 CET	50032	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:06.623229027 CET	8787	50032	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:08.442800999 CET	8787	50032	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:08.442878962 CET	50032	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:08.442926884 CET	50032	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:08.562206984 CET	8787	50032	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:08.917506933 CET	50038	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:09.036845922 CET	8787	50038	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:09.037086010 CET	50038	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:09.037256002 CET	50038	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:09.156776905 CET	8787	50038	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:10.970292091 CET	8787	50038	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:10.972323895 CET	50038	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:10.972393036 CET	50038	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:11.091744900 CET	8787	50038	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:11.428426027 CET	50045	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:11.547799110 CET	8787	50045	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:11.550729990 CET	50045	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:11.609210968 CET	50045	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:11.728574038 CET	8787	50045	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:13.486058950 CET	8787	50045	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:13.486193895 CET	50045	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:13.486195087 CET	50045	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:13.605742931 CET	8787	50045	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:13.930177927 CET	50052	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:14.049624920 CET	8787	50052	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:14.049710989 CET	50052	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:14.050024033 CET	50052	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:14.169262886 CET	8787	50052	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:15.985797882 CET	8787	50052	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:15.985852957 CET	50052	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:15.985898972 CET	50052	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:16.105103016 CET	8787	50052	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:16.413897038 CET	50060	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:16.533211946 CET	8787	50060	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:16.533301115 CET	50060	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:16.533571005 CET	50060	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:16.652865887 CET	8787	50060	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:18.471347094 CET	8787	50060	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:18.471476078 CET	50060	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:18.471476078 CET	50060	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:18.590791941 CET	8787	50060	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:18.886725903 CET	50061	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:19.006103039 CET	8787	50061	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:19.006232023 CET	50061	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:19.006642103 CET	50061	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:19.125921011 CET	8787	50061	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:20.939253092 CET	8787	50061	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:20.939359903 CET	50061	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:20.939359903 CET	50061	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:21.058707952 CET	8787	50061	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:21.335154057 CET	50062	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:21.454591990 CET	8787	50062	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:21.454675913 CET	50062	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:21.455208063 CET	50062	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:21.574467897 CET	8787	50062	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:23.396691084 CET	8787	50062	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:23.396784067 CET	50062	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:23.398566008 CET	50062	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:23.517885923 CET	8787	50062	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:23.788120031 CET	50063	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:23.907587051 CET	8787	50063	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:23.907675028 CET	50063	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:23.908152103 CET	50063	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:24.027575970 CET	8787	50063	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:25.958887100 CET	8787	50063	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:25.959171057 CET	50063	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:25.992577076 CET	50063	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:26.111962080 CET	8787	50063	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:26.366365910 CET	50064	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:26.485817909 CET	8787	50064	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:26.488326073 CET	50064	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:26.488642931 CET	50064	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:26.608123064 CET	8787	50064	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:28.423391104 CET	8787	50064	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:28.423444986 CET	50064	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:28.423526049 CET	50064	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:28.542742968 CET	8787	50064	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:28.787926912 CET	50065	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:28.960716963 CET	8787	50065	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:28.960887909 CET	50065	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:28.961193085 CET	50065	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:29.080601931 CET	8787	50065	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:30.893151045 CET	8787	50065	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:30.893237114 CET	50065	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:30.893332958 CET	50065	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:31.012636900 CET	8787	50065	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:31.241466999 CET	50066	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:31.360721111 CET	8787	50066	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:31.362466097 CET	50066	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:31.362755060 CET	50066	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:31.482079029 CET	8787	50066	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:33.300158024 CET	8787	50066	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:33.300214052 CET	50066	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:33.300282001 CET	50066	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:33.419548035 CET	8787	50066	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:33.631808043 CET	50067	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:33.751131058 CET	8787	50067	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:33.754450083 CET	50067	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:33.754812956 CET	50067	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:33.875596046 CET	8787	50067	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:35.704866886 CET	8787	50067	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:35.707335949 CET	50067	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:35.707509995 CET	50067	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:35.827707052 CET	8787	50067	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:36.038065910 CET	50068	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:36.157399893 CET	8787	50068	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:36.160379887 CET	50068	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:36.160733938 CET	50068	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:36.280051947 CET	8787	50068	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:38.099796057 CET	8787	50068	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:38.099891901 CET	50068	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:38.100078106 CET	50068	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:38.219337940 CET	8787	50068	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:38.413768053 CET	50069	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:38.533046961 CET	8787	50069	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:38.536401033 CET	50069	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:38.536758900 CET	50069	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:38.656284094 CET	8787	50069	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:40.471410036 CET	8787	50069	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:40.471524000 CET	50069	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:40.471524000 CET	50069	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:40.590930939 CET	8787	50069	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:40.772630930 CET	50070	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:40.891973019 CET	8787	50070	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:40.892353058 CET	50070	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:40.892652035 CET	50070	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:41.011950970 CET	8787	50070	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:42.834309101 CET	8787	50070	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:42.834405899 CET	50070	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:42.834405899 CET	50070	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:42.953661919 CET	8787	50070	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:43.131819010 CET	50071	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:43.251214981 CET	8787	50071	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:43.251317978 CET	50071	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:43.251647949 CET	50071	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:43.371133089 CET	8787	50071	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:45.193448067 CET	8787	50071	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:45.193804979 CET	50071	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:45.193852901 CET	50071	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:45.313148022 CET	8787	50071	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:45.476201057 CET	50072	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:45.595479012 CET	8787	50072	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:45.596375942 CET	50072	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:45.596679926 CET	50072	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:45.716195107 CET	8787	50072	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:47.537748098 CET	8787	50072	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:47.540302038 CET	50072	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:47.540353060 CET	50072	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:47.659615993 CET	8787	50072	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:47.819411039 CET	50073	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:47.939933062 CET	8787	50073	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:47.942528009 CET	50073	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:47.942712069 CET	50073	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:48.063385963 CET	8787	50073	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:49.918701887 CET	8787	50073	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:49.922435045 CET	50073	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:49.922511101 CET	50073	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:50.041686058 CET	8787	50073	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:50.196580887 CET	50074	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:50.316595078 CET	8787	50074	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:50.318466902 CET	50074	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:50.318836927 CET	50074	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:50.438604116 CET	8787	50074	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:52.252012014 CET	8787	50074	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:52.252079010 CET	50074	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:52.252132893 CET	50074	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:52.371392965 CET	8787	50074	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:52.506797075 CET	50075	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:52.626235008 CET	8787	50075	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:52.627896070 CET	50075	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:52.628202915 CET	50075	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:52.747675896 CET	8787	50075	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:54.568891048 CET	8787	50075	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:54.570583105 CET	50075	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:54.570632935 CET	50075	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:54.690018892 CET	8787	50075	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:54.819089890 CET	50076	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:54.938333988 CET	8787	50076	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:54.938427925 CET	50076	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:54.938754082 CET	50076	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:55.058320999 CET	8787	50076	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:56.877409935 CET	8787	50076	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:56.877475977 CET	50076	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:56.877507925 CET	50076	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:56.998473883 CET	8787	50076	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:57.115879059 CET	50077	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:57.236548901 CET	8787	50077	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:57.236639977 CET	50077	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:57.236910105 CET	50077	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:57.358103991 CET	8787	50077	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:59.175117016 CET	8787	50077	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:59.176393032 CET	50077	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:59.176438093 CET	50077	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:59.296029091 CET	8787	50077	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:59.412781000 CET	50078	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:59.532160997 CET	8787	50078	192.210.150.26	192.168.2.4
Dec 8, 2024 09:34:59.532288074 CET	50078	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:59.532736063 CET	50078	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:34:59.651962996 CET	8787	50078	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:01.471962929 CET	8787	50078	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:01.472151041 CET	50078	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:01.472210884 CET	50078	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:01.591475010 CET	8787	50078	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:01.694453001 CET	50079	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:01.813796043 CET	8787	50079	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:01.813874006 CET	50079	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:01.814357996 CET	50079	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:01.933610916 CET	8787	50079	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:03.756493092 CET	8787	50079	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:03.756721973 CET	50079	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:03.756721973 CET	50079	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:03.876205921 CET	8787	50079	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:03.979304075 CET	50080	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:04.098841906 CET	8787	50080	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:04.099061966 CET	50080	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:04.099808931 CET	50080	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:04.219125986 CET	8787	50080	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:06.035995960 CET	8787	50080	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:06.036075115 CET	50080	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:06.036217928 CET	50080	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:06.155452013 CET	8787	50080	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:06.241213083 CET	50081	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:06.360769033 CET	8787	50081	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:06.362459898 CET	50081	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:06.362783909 CET	50081	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:06.482068062 CET	8787	50081	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:08.299350023 CET	8787	50081	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:08.299436092 CET	50081	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:08.299478054 CET	50081	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:08.418791056 CET	8787	50081	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:08.506599903 CET	50082	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:08.625953913 CET	8787	50082	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:08.628371954 CET	50082	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:08.628705978 CET	50082	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:08.748159885 CET	8787	50082	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:10.565876961 CET	8787	50082	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:10.568381071 CET	50082	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:10.568414927 CET	50082	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:10.687870979 CET	8787	50082	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:10.772202969 CET	50083	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:10.891572952 CET	8787	50083	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:10.891660929 CET	50083	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:10.892258883 CET	50083	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:11.011559010 CET	8787	50083	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:12.831654072 CET	8787	50083	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:12.834511995 CET	50083	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:12.834594011 CET	50083	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:12.953903913 CET	8787	50083	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:13.022254944 CET	50084	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:13.141644001 CET	8787	50084	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:13.141735077 CET	50084	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:13.142100096 CET	50084	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:13.261450052 CET	8787	50084	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:15.081691980 CET	8787	50084	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:15.082474947 CET	50084	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:15.083146095 CET	50084	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:15.202497005 CET	8787	50084	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:15.272247076 CET	50085	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:15.391768932 CET	8787	50085	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:15.394481897 CET	50085	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:15.394803047 CET	50085	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:15.514065981 CET	8787	50085	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:17.331422091 CET	8787	50085	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:17.331533909 CET	50085	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:17.331533909 CET	50085	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:17.450922012 CET	8787	50085	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:17.507210970 CET	50086	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:17.626554012 CET	8787	50086	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:17.626641035 CET	50086	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:17.627080917 CET	50086	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:17.746788979 CET	8787	50086	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:19.565198898 CET	8787	50086	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:19.565249920 CET	50086	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:19.565300941 CET	50086	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:19.684551954 CET	8787	50086	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:19.740997076 CET	50087	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:19.860269070 CET	8787	50087	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:19.860431910 CET	50087	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:19.860754013 CET	50087	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:19.979974985 CET	8787	50087	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:21.803447008 CET	8787	50087	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:21.803519964 CET	50087	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:21.803639889 CET	50087	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:21.923132896 CET	8787	50087	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:21.975260019 CET	50088	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:22.094717026 CET	8787	50088	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:22.094805956 CET	50088	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:22.095103979 CET	50088	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:22.214390993 CET	8787	50088	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:24.038022041 CET	8787	50088	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:24.040432930 CET	50088	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:24.040509939 CET	50088	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:24.159822941 CET	8787	50088	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:24.209836960 CET	50089	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:24.329152107 CET	8787	50089	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:24.329276085 CET	50089	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:24.329740047 CET	50089	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:24.449974060 CET	8787	50089	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:26.268671036 CET	8787	50089	192.210.150.26	192.168.2.4
Dec 8, 2024 09:35:26.268734932 CET	50089	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:26.268771887 CET	50089	8787	192.168.2.4	192.210.150.26
Dec 8, 2024 09:35:26.388132095 CET	8787	50089	192.210.150.26	192.168.2.4

Target ID:	0
Start time:	03:31:18
Start date:	08/12/2024
Path:	C:\Users\user\Desktop\7056ZCiFdE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7056ZCiFdE.exe"
Imagebase:	0x880000
File size:	885'760 bytes
MD5 hash:	6F0604F8A16B94B61D714DFEC11D0358
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	03:31:21
Start date:	08/12/2024
Path:	C:\Users\user\AppData\Local\Milburr\Allene.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\7056ZCiFdE.exe"
Imagebase:	0x5d0000
File size:	885'760 bytes
MD5 hash:	6F0604F8A16B94B61D714DFEC11D0358
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000001.00000002.4155512160.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000001.00000002.4155512160.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000001.00000002.4155512160.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000001.00000002.4155512160.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000001.00000002.4155512160.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000001.00000002.4155512160.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000001.00000002.4156569703.00000000012B3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000001.00000002.4156176304.0000000001058000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000001.00000002.4157121061.0000000003DDE000.00000004.00000010.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000001.00000002.4157009146.0000000003920000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000001.00000002.4157009146.0000000003920000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000001.00000002.4157009146.0000000003920000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000001.00000002.4157009146.0000000003920000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000001.00000002.4157009146.0000000003920000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000001.00000002.4157009146.0000000003920000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000001.00000002.4156339648.00000000010FD000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs Detection: 67%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	03:31:35
Start date:	08/12/2024
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Allene.vbs"
Imagebase:	0x7ff7df310000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	03:31:36
Start date:	08/12/2024
Path:	C:\Users\user\AppData\Local\Milburr\Allene.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Milburr\Allene.exe"
Imagebase:	0x5d0000
File size:	885'760 bytes
MD5 hash:	6F0604F8A16B94B61D714DFEC11D0358
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000002.1920045593.0000000001948000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000004.00000002.1919987718.00000000018B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000002.1919987718.00000000018B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000004.00000002.1919987718.00000000018B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000004.00000002.1919987718.00000000018B0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000004.00000002.1919987718.00000000018B0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000004.00000002.1919987718.00000000018B0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000004.00000002.1919363155.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Remcos, Description: Yara detected Remcos RAT, Source: 00000004.00000002.1919363155.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_UACBypassusingCMSTP, Description: Yara detected UAC Bypass using CMSTP, Source: 00000004.00000002.1919363155.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Remcos_b296e965, Description: unknown, Source: 00000004.00000002.1919363155.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: REMCOS_RAT_variants, Description: unknown, Source: 00000004.00000002.1919363155.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM, Description: Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003), Source: 00000004.00000002.1919363155.0000000000400000.00000040.00001000.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	8.6%
Total number of Nodes:	2000
Total number of Limit Nodes:	55

Executed Functions

Function 00883B3A Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00883B68
IsDebuggerPresent.KERNEL32 ref: 00883B7A
GetFullPathNameW.KERNEL32(00007FFF,?,?,009452F8,009452E0,?,?), ref: 00883BEB

Part of subcall function 00887BCC: _memmove.LIBCMT ref: 00887C06

Part of subcall function 0089092D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00883C14,009452F8,?,?,?), ref: 0089096E

SetCurrentDirectoryW.KERNEL32(?), ref: 00883C6F
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00937770,00000010), ref: 008BD281
SetCurrentDirectoryW.KERNEL32(?,009452F8,?,?,?), ref: 008BD2B9
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00934260,009452F8,?,?,?), ref: 008BD33F
ShellExecuteW.SHELL32(00000000,?,?), ref: 008BD346

Part of subcall function 00883A46: GetSysColorBrush.USER32(0000000F), ref: 00883A50
Part of subcall function 00883A46: LoadCursorW.USER32(00000000,00007F00), ref: 00883A5F
Part of subcall function 00883A46: LoadIconW.USER32(00000063), ref: 00883A76
Part of subcall function 00883A46: LoadIconW.USER32(000000A4), ref: 00883A88
Part of subcall function 00883A46: LoadIconW.USER32(000000A2), ref: 00883A9A
Part of subcall function 00883A46: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00883AC0
Part of subcall function 00883A46: RegisterClassExW.USER32(?), ref: 00883B16

Part of subcall function 008839D5: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00883A03
Part of subcall function 008839D5: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00883A24
Part of subcall function 008839D5: ShowWindow.USER32(00000000,?,?), ref: 00883A38
Part of subcall function 008839D5: ShowWindow.USER32(00000000,?,?), ref: 00883A41

Part of subcall function 0088434A: _memset.LIBCMT ref: 00884370
Part of subcall function 0088434A: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00884415

Strings

This is a third-party compiled AutoIt script., xrefs: 008BD279
runas, xrefs: 008BD33A

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: 651f24e10fd483c6297cd3133587a4b4b17f44ad84583904f8da259dbb14910e
Instruction ID: 07679c57ec5430635ecad6606c2bd04e030f170048d1e818c1017d3dec4965ec
Opcode Fuzzy Hash: 651f24e10fd483c6297cd3133587a4b4b17f44ad84583904f8da259dbb14910e
Instruction Fuzzy Hash: 2351E575908248AFCB21FBF8DC15DED7B75FB46714F104066F421E2263EAA09605EB22

Function 00883633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
timewindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtdllDefWindowProc_W.NTDLL(?,?,?,?), ref: 008836D2
KillTimer.USER32(?,00000001), ref: 008836FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0088371F
RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 0088372A
CreatePopupMenu.USER32 ref: 0088373E
PostQuitMessage.USER32(00000000), ref: 0088374D

Strings

TaskbarCreated, xrefs: 00883725

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Timer$ClipboardCreateFormatKillMenuMessageNtdllPopupPostProc_QuitRegisterWindow
String ID: TaskbarCreated
API String ID: 157504867-2362178303
Opcode ID: b1df4f778509dc0fe6f562e82ddfe4224e4257195c327eee53a22cd43856aff6
Instruction ID: f9fbe0330233192aaf98c6c84fcecf6dad1c230ed534df1c88066882acab63ff
Opcode Fuzzy Hash: b1df4f778509dc0fe6f562e82ddfe4224e4257195c327eee53a22cd43856aff6
Instruction Fuzzy Hash: 7941F8B2118609BBDF25BFACDC09F7D3794F711700F140535F502D62A2EA619E41B762

Function 008849A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 008849CD

Part of subcall function 00887BCC: _memmove.LIBCMT ref: 00887C06

GetCurrentProcess.KERNEL32(?,0090FAEC,00000000,00000000,?), ref: 00884A9A
IsWow64Process.KERNEL32(00000000), ref: 00884AA1
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00884AE7
FreeLibrary.KERNEL32(00000000), ref: 00884AF2
GetSystemInfo.KERNEL32(00000000), ref: 00884B23
GetSystemInfo.KERNEL32(00000000), ref: 00884B2F

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: dfcd54cb090c9ff1043668a7625ef7009df7c54075aa4e1b17fd70d685164ccf
Instruction ID: 2e6ab7c09a63cca5b59af6e3e3c3a1300f27789f968c9f9b4e23203e67a7a342
Opcode Fuzzy Hash: dfcd54cb090c9ff1043668a7625ef7009df7c54075aa4e1b17fd70d685164ccf
Instruction Fuzzy Hash: A691C23298D7C5DEC735EB7884501AABFF5FF2A304B44496ED0D6D7B01D220A908D759

Function 00884E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00884E99
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00884D8E,?,?,00000000,00000000), ref: 00884EB0
LoadResource.KERNEL32(?,00000000,?,?,00884D8E,?,?,00000000,00000000,?,?,?,?,?,?,00884E2F), ref: 008BD937
SizeofResource.KERNEL32(?,00000000,?,?,00884D8E,?,?,00000000,00000000,?,?,?,?,?,?,00884E2F), ref: 008BD94C
LockResource.KERNEL32(00884D8E,?,?,00884D8E,?,?,00000000,00000000,?,?,?,?,?,?,00884E2F,00000000), ref: 008BD95F

Strings

SCRIPT, xrefs: 00884EA6

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 2c309e30286741f2da280b40da954c0db7e02d62160dfa97c6acb6be6dde4c3a
Instruction ID: 84802aae051a2c0c92cca75176950666ec67435e41e385978aaf1b5a62c7941a
Opcode Fuzzy Hash: 2c309e30286741f2da280b40da954c0db7e02d62160dfa97c6acb6be6dde4c3a
Instruction Fuzzy Hash: 0B119E72250701BFD7209B65EC48F677BBAFBC5B21F104268F416C6650EB61E9009660

Function 009D9A50 Relevance: 7.7, APIs: 5, Instructions: 206
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 009D9B8A
GetProcAddress.KERNEL32(?,009D2FF9), ref: 009D9BA8
ExitProcess.KERNEL32(?,009D2FF9), ref: 009D9BB9
VirtualProtect.KERNELBASE(00880000,00001000,00000004,?,00000000), ref: 009D9C07
VirtualProtect.KERNELBASE(00880000,00001000), ref: 009D9C1C

Memory Dump Source

Source File: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ProtectVirtual$AddressExitLibraryLoadProcProcess
String ID:
API String ID: 1996367037-0
Opcode ID: 40b62bfaee3175b61773ca67ec831891edf92d249dbb3b1564182c3257822b3e
Instruction ID: 709eed7c50a6d323005f0947c3efd7959be86bcaa1930c0259eb7fed215c5dae
Opcode Fuzzy Hash: 40b62bfaee3175b61773ca67ec831891edf92d249dbb3b1564182c3257822b3e
Instruction Fuzzy Hash: 28511773AD43524BD720AEB8DCC0661B798EB52324B294B3BD5E2C73C5E7A85C05C760

Function 0088FCE0 Relevance: 5.5, APIs: 3, Instructions: 1040COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: 141d23d19d773fc81ee48aac4657f72dcf3044bcf8f113863f5ad12157918264
Instruction ID: c225d4ace963e5c797eb386d0f9c39a3be5b5172f161c42287e62f52a7ac5370
Opcode Fuzzy Hash: 141d23d19d773fc81ee48aac4657f72dcf3044bcf8f113863f5ad12157918264
Instruction Fuzzy Hash: 879238706083459FDB20EF18C490B2AB7E1FB85314F18896DE99ADB262D771EC45CF92

Function 008E445A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,008BE398), ref: 008E446A
FindFirstFileW.KERNELBASE(?,?), ref: 008E447B
FindClose.KERNEL32(00000000), ref: 008E448B

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 7f0693936b45c5a014bf4f305c02a90846bcc8e31da802d1481b0bc1fc4bc8e7
Instruction ID: 035c40c107375fe43d08f181b4be8b1ba8579a373854449777d0a4c152d8f48b
Opcode Fuzzy Hash: 7f0693936b45c5a014bf4f305c02a90846bcc8e31da802d1481b0bc1fc4bc8e7
Instruction Fuzzy Hash: 01E0D8335255456B8220AB38EC0D4E9779CEE06339F100715F939D14D0E7745A00A599

Function 0088E6A0 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 008C3E62

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: 0b74333053d4f21dcbe16ad5b5ec286fb4d758629ac80f2761528386c7a4d12c
Instruction ID: 1066ff02b769e9fb4025a811366d2b23cd19c3ab32db1e21f44ecbe52c943a6f
Opcode Fuzzy Hash: 0b74333053d4f21dcbe16ad5b5ec286fb4d758629ac80f2761528386c7a4d12c
Instruction Fuzzy Hash: DBA2AF75A00219CFCB24EF98C480AAEB7B2FF59314F248069E915EB352D775ED42CB91

Function 008909D0 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00890A5B
timeGetTime.WINMM ref: 00890D16
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00890E53
Sleep.KERNEL32(0000000A), ref: 00890E61
LockWindowUpdate.USER32(00000000,?,?), ref: 00890EFA
DestroyWindow.USER32 ref: 00890F06
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00890F20
Sleep.KERNEL32(0000000A,?,?), ref: 008C4E83
TranslateMessage.USER32(?), ref: 008C5C60
DispatchMessageW.USER32(?), ref: 008C5C6E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 008C5C82

Strings

@COM_EVENTOBJ, xrefs: 008C54F0
@GUI_CTRLHANDLE, xrefs: 008C4FE4
@GUI_CTRLID, xrefs: 008C4F3A
@TRAY_ID, xrefs: 008C578F
@GUI_WINHANDLE, xrefs: 008C4F8F

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4212290369-3242690629
Opcode ID: ddc8948992b838f99e43923c35f16f6bcdc03d92df4404a624145de1a7cde086
Instruction ID: 4b1c6c69562fb229c8851470338058dfbc276c788e638da1306389a7a1a9ef67
Opcode Fuzzy Hash: ddc8948992b838f99e43923c35f16f6bcdc03d92df4404a624145de1a7cde086
Instruction Fuzzy Hash: C4B28D70608745DFDB24EB28C894F6AB7F5FB85304F18491DE49AD72A1CB71E884DB82

Function 008E9155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 008E8F5F: __time64.LIBCMT ref: 008E8F69

Part of subcall function 00884EE5: _fseek.LIBCMT ref: 00884EFD

__wsplitpath.LIBCMT ref: 008E9234

Part of subcall function 008A40FB: __wsplitpath_helper.LIBCMT ref: 008A413B

_wcscpy.LIBCMT ref: 008E9247
_wcscat.LIBCMT ref: 008E925A
__wsplitpath.LIBCMT ref: 008E927F
_wcscat.LIBCMT ref: 008E9295
_wcscat.LIBCMT ref: 008E92A8

Part of subcall function 008E8FA5: _memmove.LIBCMT ref: 008E8FDE
Part of subcall function 008E8FA5: _memmove.LIBCMT ref: 008E8FED

_wcscmp.LIBCMT ref: 008E91EF

Part of subcall function 008E9734: _wcscmp.LIBCMT ref: 008E9824
Part of subcall function 008E9734: _wcscmp.LIBCMT ref: 008E9837

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 008E9452
_wcsncpy.LIBCMT ref: 008E94C5
DeleteFileW.KERNEL32(?,?), ref: 008E94FB
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 008E9511
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 008E9522
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 008E9534

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 473c582a587f4378b6a4051813275c847a8091921f922e444a20c78211a3f992
Instruction ID: 4b8316a563407b49f1c8061d37685450f904ba7947af9c011fda9682811ec557
Opcode Fuzzy Hash: 473c582a587f4378b6a4051813275c847a8091921f922e444a20c78211a3f992
Instruction Fuzzy Hash: E3C13CB1D00219AADF21DF99CC85ADEB7BDFF96310F0040AAF609E7151EB709A448F65

Function 0088708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00884706: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,009452F8,?,008837AE,?), ref: 00884724

Part of subcall function 008A050B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00887165), ref: 008A052D

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 008871A8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 008BE8C8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 008BE909
RegCloseKey.ADVAPI32(?), ref: 008BE947
_wcscat.LIBCMT ref: 008BE9A0

Strings

Software\AutoIt v3\AutoIt, xrefs: 0088719E
Include, xrefs: 008BE8BF, 008BE900
\, xrefs: 008BE9C3
\Include\, xrefs: 00887165

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: c9a9442e2bb3a594ef463b4471a63f190732a4deb6a7d3158f8ff71df8823be7
Instruction ID: 6e41bc42fa35b6657c288c071e5e801b1dff11cb0c5b84452cfbd35b2236e0cc
Opcode Fuzzy Hash: c9a9442e2bb3a594ef463b4471a63f190732a4deb6a7d3158f8ff71df8823be7
Instruction Fuzzy Hash: B3715BB5518301AED310EF29E851DABBBF8FF86310B50052EF465C72A1EBB19948DB53

Function 00883A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00883A50
LoadCursorW.USER32(00000000,00007F00), ref: 00883A5F
LoadIconW.USER32(00000063), ref: 00883A76
LoadIconW.USER32(000000A4), ref: 00883A88
LoadIconW.USER32(000000A2), ref: 00883A9A
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00883AC0
RegisterClassExW.USER32(?), ref: 00883B16

Part of subcall function 00883041: GetSysColorBrush.USER32(0000000F), ref: 00883074
Part of subcall function 00883041: RegisterClassExW.USER32(00000030), ref: 0088309E
Part of subcall function 00883041: RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 008830AF
Part of subcall function 00883041: LoadIconW.USER32(000000A9), ref: 008830F2

Strings

0, xrefs: 00883AF4
#, xrefs: 00883AFB
AutoIt v3, xrefs: 00883B05

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Load$Icon$Register$BrushClassColor$ClipboardCursorFormatImage
String ID: #$0$AutoIt v3
API String ID: 2880975755-4155596026
Opcode ID: bd32b0f7ffd34e47e0fe70232161876fc4c605d3f6fe255c660e239430aee8fd
Instruction ID: cacfe3b3a33fda38b92169fcd8611ebf5b2e979550f472445f5b989857e01d82
Opcode Fuzzy Hash: bd32b0f7ffd34e47e0fe70232161876fc4c605d3f6fe255c660e239430aee8fd
Instruction Fuzzy Hash: 23213779928708AFEB21DFA4EC19F9D7BB4FB09711F01012AE510A62A2D3B55640AF85

Function 00883766 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/AutoIt3ExecuteScript, xrefs: 008838BC
CMDLINERAW, xrefs: 008837FB
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 008837AE
/AutoIt3OutputDebug, xrefs: 00883892
/ErrorStdOut, xrefs: 0088387D
/AutoIt3ExecuteLine, xrefs: 008838A7
CMDLINE, xrefs: 00883822

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-3513169116
Opcode ID: caaf74eace35837b2c358d520a5f98fee59626306a2e66ace735cee4de00d34c
Instruction ID: 8ab1a83b04505b7ee6058d2fc9376944f0dea6db7caef457dc7088a8fc9938b3
Opcode Fuzzy Hash: caaf74eace35837b2c358d520a5f98fee59626306a2e66ace735cee4de00d34c
Instruction Fuzzy Hash: 12A16D7291021DABCB14FBA8DC51EEEB778FF15714F44042AE416E7192EF749A08CB62

Function 0088301C Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 71
registrywindowclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00883074
RegisterClassExW.USER32(00000030), ref: 0088309E
RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 008830AF
LoadIconW.USER32(000000A9), ref: 008830F2

Strings

AutoIt v3 GUI, xrefs: 00883090
+, xrefs: 0088305D
0, xrefs: 00883056
TaskbarCreated, xrefs: 008830A4

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Register$BrushClassClipboardColorFormatIconLoad
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 975902462-1005189915
Opcode ID: 29dd30c7b3333d89dd7d3312f965dcc232bf51f7ce5f15406ac9c9f0cebc2653
Instruction ID: 0e52b13cd2c5a8864817e735c99d075fc18bda0fbf72e49ba82796ac23810c7b
Opcode Fuzzy Hash: 29dd30c7b3333d89dd7d3312f965dcc232bf51f7ce5f15406ac9c9f0cebc2653
Instruction Fuzzy Hash: D03145B5925209EFDB60CFE4E889AC9BBF4FB09310F10412AF590E62A1D7B50685DF91

Function 00883041 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 54
registrywindowclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00883074
RegisterClassExW.USER32(00000030), ref: 0088309E
RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 008830AF
LoadIconW.USER32(000000A9), ref: 008830F2

Strings

AutoIt v3 GUI, xrefs: 00883090
+, xrefs: 0088305D
0, xrefs: 00883056
TaskbarCreated, xrefs: 008830A4

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Register$BrushClassClipboardColorFormatIconLoad
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 975902462-1005189915
Opcode ID: a9255330b131cd10c03d8ff0895ed28d9b11dd68e63d1ff694f4bf89059ca3b2
Instruction ID: 00975f1f979b2c31638a8f709d576ab8273f50f2a53b3d05fd37069e8b82a029
Opcode Fuzzy Hash: a9255330b131cd10c03d8ff0895ed28d9b11dd68e63d1ff694f4bf89059ca3b2
Instruction Fuzzy Hash: 2721F7B5925208AFDB10DFE4EC48B9DBBF4FB09700F01412AF510A62A1DBB14644AF91

Function 015F9220 Relevance: 10.7, APIs: 7, Instructions: 151
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 015F9265

Memory Dump Source

Source File: 00000000.00000002.1732693093.00000000015F8000.00000040.00000020.00020000.00000000.sdmp, Offset: 015F8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15f8000_7056ZCiFdE.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: eb584f4a57c68eb24893e8662cdde2a6850f072ba7aa360e4ef334368506de38
Instruction ID: e8f31f88df10e87e490cc73a2eed4b1a74590f06fda4d2631aa2d1e9003e6e0d
Opcode Fuzzy Hash: eb584f4a57c68eb24893e8662cdde2a6850f072ba7aa360e4ef334368506de38
Instruction Fuzzy Hash: 0F51E675A50208FBEF20DFA4CC59FDE77B8BF88704F108958F60AEA1C0DA7496458B60

Function 008839D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00883A03
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00883A24
ShowWindow.USER32(00000000,?,?), ref: 00883A38
ShowWindow.USER32(00000000,?,?), ref: 00883A41

Strings

edit, xrefs: 00883A1E
AutoIt v3, xrefs: 008839FB, 00883A00, 00883A01

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: d94a07d8a0ca690f4292cd194d1246aafc6b8e235466bdf824457231dfc4b232
Instruction ID: fc30085b1451f23279213fd343615261cb12c3aa5020906dfd2e799457c52f9b
Opcode Fuzzy Hash: d94a07d8a0ca690f4292cd194d1246aafc6b8e235466bdf824457231dfc4b232
Instruction Fuzzy Hash: 1BF03A74665690BFEA3167A76C18E2B3E7DE7C7F50B02012AB910A21B1C2A10C00EAB0

Function 0088407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 008BD3D7

Part of subcall function 00887BCC: _memmove.LIBCMT ref: 00887C06

_memset.LIBCMT ref: 008840FC
_wcscpy.LIBCMT ref: 00884150
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00884160

Strings

Line: , xrefs: 008BD400

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: da01ca5e688bafeb1cc74240157a442a024100bde181953a306c1ca1eafea671
Instruction ID: b36edd8ab939b980b9a28d1c4b60b0d92b2a29d4950c81c7078437adf8d3ca8b
Opcode Fuzzy Hash: da01ca5e688bafeb1cc74240157a442a024100bde181953a306c1ca1eafea671
Instruction Fuzzy Hash: 4931AF72018705ABD321FBA4DC45FDB77E8FB45314F20451AF595D21A2EB709648CB93

Function 008A541D Relevance: 7.7, APIs: 5, Instructions: 163
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 008A547B
_memcpy_s.LIBCMT ref: 008A54ED
__read_nolock.LIBCMT ref: 008A554B
__filbuf.LIBCMT ref: 008A556E
_memset.LIBCMT ref: 008A55B2

Part of subcall function 008A8B28: __getptd_noexit.LIBCMT ref: 008A8B28

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction ID: d17f0ece17541749cbd48c8492f7fad816560924eb2de1cc81cbe95baf942190
Opcode Fuzzy Hash: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction Fuzzy Hash: 1251D370E01B09DBEB248E69D8806AE77A2FF46334F248729F825D6AD1D770DDD08B45

Function 0088686A Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00884DDD: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,009452F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00884E0F

_free.LIBCMT ref: 008BE263
_free.LIBCMT ref: 008BE2AA

Part of subcall function 00886A8C: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00886BAD

Strings

Bad directive syntax error, xrefs: 008BE292
>>>AUTOIT SCRIPT<<<, xrefs: 008BE039

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: b1b65f82109ea1c4abffa2fa5841c43c876d8f6653106518190809511abc1c62
Instruction ID: 3c74f3714d87e985ea68eaff0d881ca8f78ff520f4740bd0f7c64c94916341c0
Opcode Fuzzy Hash: b1b65f82109ea1c4abffa2fa5841c43c876d8f6653106518190809511abc1c62
Instruction Fuzzy Hash: F1916C71900219AFCF14EFA8CC919EEB7B8FF19314B10452AF816EB3A1DB70A915CB51

Function 015FACB0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 154fileCOMMON

Download Yara Rule

APIs

Part of subcall function 015FABA0: Sleep.KERNELBASE(000001F4), ref: 015FABB1

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 015FADE6

Strings

0RI4G67BEUE5NC0OMWU, xrefs: 015FAE66, 015FAE69

Memory Dump Source

Source File: 00000000.00000002.1732693093.00000000015F8000.00000040.00000020.00020000.00000000.sdmp, Offset: 015F8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15f8000_7056ZCiFdE.jbxd

Similarity

API ID: CreateFileSleep
String ID: 0RI4G67BEUE5NC0OMWU
API String ID: 2694422964-189564730
Opcode ID: 404d9d9eb2f3fb70be51a2f1de6209437cc48add8bc64239be5e36ce6234b11d
Instruction ID: 87db207608467a2597c3cd42a77bb83ff7f3e83b016973120ed58799aac13b0a
Opcode Fuzzy Hash: 404d9d9eb2f3fb70be51a2f1de6209437cc48add8bc64239be5e36ce6234b11d
Instruction Fuzzy Hash: 7A518031D04249DBEF11DBB4C854BEEBBB9AF58300F004599E248BB2C1D7B90B45CBA6

Function 008835B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,008835A1,SwapMouseButtons,00000004,?), ref: 008835D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,008835A1,SwapMouseButtons,00000004,?,?,?,?,00882754), ref: 008835F5
RegCloseKey.KERNELBASE(00000000,?,?,008835A1,SwapMouseButtons,00000004,?,?,?,?,00882754), ref: 00883617

Strings

Control Panel\Mouse, xrefs: 008835D2

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 33f7347bde5489f20c00ca09925831944039847d0ece8a0980e93e4b4a669240
Instruction ID: fe0bb9443d7d22fa169642dea5373805f737febc28797ecf9303159ab993e237
Opcode Fuzzy Hash: 33f7347bde5489f20c00ca09925831944039847d0ece8a0980e93e4b4a669240
Instruction Fuzzy Hash: 12114871514208BFDB21DFA8DC409AEB7BCFF15B40F008469E805E7210E2719F40A760

Function 008E955B Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00884EE5: _fseek.LIBCMT ref: 00884EFD

Part of subcall function 008E9734: _wcscmp.LIBCMT ref: 008E9824
Part of subcall function 008E9734: _wcscmp.LIBCMT ref: 008E9837

_free.LIBCMT ref: 008E96A2
_free.LIBCMT ref: 008E96A9
_free.LIBCMT ref: 008E9714

Part of subcall function 008A2D55: RtlFreeHeap.NTDLL(00000000,00000000,?,008A9A24), ref: 008A2D69
Part of subcall function 008A2D55: GetLastError.KERNEL32(00000000,?,008A9A24), ref: 008A2D7B

_free.LIBCMT ref: 008E971C

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 83a1bf45cb5b46f0fbbb2b282febcfcf75e63ad05b5baa694a85d9b23f0f737c
Instruction ID: 4325d7b12732718ba17752a8c7502476e4de4ce0aa15ee42fc7320b32d68b765
Opcode Fuzzy Hash: 83a1bf45cb5b46f0fbbb2b282febcfcf75e63ad05b5baa694a85d9b23f0f737c
Instruction Fuzzy Hash: E2515CB1D04259ABDF249F69CC81A9EBBB9FF49300F10049EF649E3252DB715A80CF59

Function 008A470A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 008A47A0
__flush.LIBCMT ref: 008A47C0
__write.LIBCMT ref: 008A47F3
__flsbuf.LIBCMT ref: 008A4821

Part of subcall function 008A8B28: __getptd_noexit.LIBCMT ref: 008A8B28

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction ID: c06f6d0bbcb8cb81d9b9c5401ff45e0feee9acb21e078ef95811447167fd78c0
Opcode Fuzzy Hash: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction Fuzzy Hash: 9D41D574A007899BFF188E69D8809AE77A5FFC3364B24913DE815C7E40E7B4DD418B51

Function 008844A0 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008844CF

Part of subcall function 0088407C: _memset.LIBCMT ref: 008840FC
Part of subcall function 0088407C: _wcscpy.LIBCMT ref: 00884150
Part of subcall function 0088407C: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00884160

KillTimer.USER32(?,00000001,?,?), ref: 00884524
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00884533
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 008BD4B9

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 1c827b7b58fbce9a258edce772c45ee051f565e4550a985e1606b1f4efa7e446
Instruction ID: 696304fb113badd45818d9eebf4fab6f295ab22be2a837dc1f186a689f435242
Opcode Fuzzy Hash: 1c827b7b58fbce9a258edce772c45ee051f565e4550a985e1606b1f4efa7e446
Instruction Fuzzy Hash: F8210A75508794AFE7329B248855BEBBBECFF01308F04009DE69ED6242D3742A84DB46

Function 00887285 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008BEA39
7523D0D0.COMDLG32(?), ref: 008BEA83

Part of subcall function 00884750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00884743,?,?,008837AE,?), ref: 00884770

Part of subcall function 008A0791: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 008A07B0

Strings

X, xrefs: 008BEA51

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: NamePath$7523FullLong_memset
String ID: X
API String ID: 3285060876-3081909835
Opcode ID: 78f864be753d9af6e036065db72282af5f0b97d215cd7edeeb4888f6f323712f
Instruction ID: 2e51949517c8ef0b4777623152bb82aae4eec6c56c4143743f33bca81b45395a
Opcode Fuzzy Hash: 78f864be753d9af6e036065db72282af5f0b97d215cd7edeeb4888f6f323712f
Instruction Fuzzy Hash: 8521A131A142589BDB51AF98C845AEF7BFDFF49314F10401AE408EB241DBB499898FA2

Function 008E8D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 008E8DAC
__fread_nolock.LIBCMT ref: 008E8DC1

Strings

EA06, xrefs: 008E8DF3

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 8f6d9ce481f727261462a97cb37d35e395c92f2398d634edc594258fc9f9a289
Instruction ID: f536f45674bca0d80a777168c9c79451e297ce2bd3f5befcaff20ae01a8c38cc
Opcode Fuzzy Hash: 8f6d9ce481f727261462a97cb37d35e395c92f2398d634edc594258fc9f9a289
Instruction Fuzzy Hash: 76012D71D04258BEEB18CBA8CC16EFE7BF8DB12301F00419FF556D2181E875E6048B60

Function 008A0DB6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 008A571C: __FF_MSGBANNER.LIBCMT ref: 008A5733
Part of subcall function 008A571C: __NMSG_WRITE.LIBCMT ref: 008A573A
Part of subcall function 008A571C: RtlAllocateHeap.NTDLL(01550000,00000000,00000001), ref: 008A575F

std::exception::exception.LIBCMT ref: 008A0DEC
__CxxThrowException@8.LIBCMT ref: 008A0E01

Part of subcall function 008A859B: RaiseException.KERNEL32(?,?,00000000,00939E78,?,00000001,?,?,?,008A0E06,00000000,00939E78,00889E8C,00000001), ref: 008A85F0

Strings

bad allocation, xrefs: 008A0DE1

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID: bad allocation
API String ID: 3902256705-2104205924
Opcode ID: 8bbba947bb1bc7168712327cceac36e2f878262598945d7b2e37bf1b9529eafc
Instruction ID: 020418589a85a726176028a80eda76abc13d8b14ef94b732df1d6027bca3ddd9
Opcode Fuzzy Hash: 8bbba947bb1bc7168712327cceac36e2f878262598945d7b2e37bf1b9529eafc
Instruction Fuzzy Hash: EAF0D63590431DA6EF20BB98EC015DE77A8FF06310F000415F904E6A81DF709A9099A2

Function 015F9900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 015F9945
ExitProcess.KERNEL32(00000000), ref: 015F9964

Strings

D, xrefs: 015F9911

Memory Dump Source

Source File: 00000000.00000002.1732693093.00000000015F8000.00000040.00000020.00020000.00000000.sdmp, Offset: 015F8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15f8000_7056ZCiFdE.jbxd

Similarity

API ID: Process$CreateExit
String ID: D
API String ID: 126409537-2746444292
Opcode ID: 03e416529f94357cb7ee45147abf4bf6199a2e9bce9b56f1b6d0fc2bb1e3bcca
Instruction ID: 7cb19ddaaa5c93dd8bc9d4367ad973c89a035aa0bb9d07555e991c873546cb4d
Opcode Fuzzy Hash: 03e416529f94357cb7ee45147abf4bf6199a2e9bce9b56f1b6d0fc2bb1e3bcca
Instruction Fuzzy Hash: AEF0ECB554024DABDB60DFE4CD49FEE777CBF44705F048508BB0A9A184DB7496088B61

Function 008E98E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 008E98F8
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 008E990F

Strings

aut, xrefs: 008E9909

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: ca7908eb36e60ac775beae31ffa854057beb3a8740970075f605dd3d33efc3ae
Instruction ID: b207bd1cd459db0b05e895820d6928f979690bcc1e825308983de17b2f6d31a9
Opcode Fuzzy Hash: ca7908eb36e60ac775beae31ffa854057beb3a8740970075f605dd3d33efc3ae
Instruction Fuzzy Hash: 51D05E7954430DAFDB60DBA4DC0EF9A773CEB04704F0002B1BAA4D10A1EAB0A6989B91

Function 008FCADD Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 55ad9965db937efe6c5940ea0aa70cc9af0cb20057a388f137b7ca89b1520733
Instruction ID: cfb3629f6525ad7239ce16fcbe5009847ed82bd69f96ba0e436807e53ebb8c1a
Opcode Fuzzy Hash: 55ad9965db937efe6c5940ea0aa70cc9af0cb20057a388f137b7ca89b1520733
Instruction Fuzzy Hash: CAF127716083099FC714DF28C580A6ABBE5FF89314F14892EF999DB251DB70EA45CF82

Function 0088F76F Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 008A0162: MapVirtualKeyW.USER32(0000005B,00000000), ref: 008A0193
Part of subcall function 008A0162: MapVirtualKeyW.USER32(00000010,00000000), ref: 008A019B
Part of subcall function 008A0162: MapVirtualKeyW.USER32(000000A0,00000000), ref: 008A01A6
Part of subcall function 008A0162: MapVirtualKeyW.USER32(000000A1,00000000), ref: 008A01B1
Part of subcall function 008A0162: MapVirtualKeyW.USER32(00000011,00000000), ref: 008A01B9
Part of subcall function 008A0162: MapVirtualKeyW.USER32(00000012,00000000), ref: 008A01C1

Part of subcall function 008960F9: RegisterClipboardFormatW.USER32(WM_GETCONTROLNAME), ref: 00896154

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0088F9CD
OleInitialize.OLE32(00000000), ref: 0088FA4A
CloseHandle.KERNEL32(00000000), ref: 008C45C8

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Virtual$Handle$ClipboardCloseFormatInitializeRegister
String ID:
API String ID: 3094916012-0
Opcode ID: ebd58c000e4520606c5aa073475ab415e4129c2e18aa1d2a9672ed144e424bdc
Instruction ID: 4dcd07a7359faed8c3f98b294f32cf2f0ccebfc407e62cbb45f50d82e3f1d092
Opcode Fuzzy Hash: ebd58c000e4520606c5aa073475ab415e4129c2e18aa1d2a9672ed144e424bdc
Instruction Fuzzy Hash: 0C81CEB8929B40CFC394EFB9A850E187BE5FB5A316756813AE119CB273E7704484EF11

Function 0088434A Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00884370
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00884415
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00884432

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 10b7acb4a44160868958cc8f18c040efce40245672cd0c1d230b444ae4babc4d
Instruction ID: 675c34df21e52efdc832f4bbf556cc1eaa39ab2f4037734c12520f3042352a5e
Opcode Fuzzy Hash: 10b7acb4a44160868958cc8f18c040efce40245672cd0c1d230b444ae4babc4d
Instruction Fuzzy Hash: E63193715097029FD721EF64D884A9BBBF8FB59308F00092EE59AC2352E7B1A944CB52

Function 008A571C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 008A5733

Part of subcall function 008AA16B: __NMSG_WRITE.LIBCMT ref: 008AA192
Part of subcall function 008AA16B: __NMSG_WRITE.LIBCMT ref: 008AA19C

__NMSG_WRITE.LIBCMT ref: 008A573A

Part of subcall function 008AA1C8: GetModuleFileNameW.KERNEL32(00000000,009433BA,00000104,00000000,00000001,00000000), ref: 008AA25A
Part of subcall function 008AA1C8: ___crtMessageBoxW.LIBCMT ref: 008AA308

Part of subcall function 008A309F: ___crtCorExitProcess.LIBCMT ref: 008A30A5
Part of subcall function 008A309F: ExitProcess.KERNEL32 ref: 008A30AE

Part of subcall function 008A8B28: __getptd_noexit.LIBCMT ref: 008A8B28

RtlAllocateHeap.NTDLL(01550000,00000000,00000001), ref: 008A575F

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 558e93bb2c8f939942106138bce7202282ef59983c5c09b90679cac65e3c8d4e
Instruction ID: b43351bbbcd105a1f58b455429e85496e04d2abaa031c1637effdceff59b7dc6
Opcode Fuzzy Hash: 558e93bb2c8f939942106138bce7202282ef59983c5c09b90679cac65e3c8d4e
Instruction Fuzzy Hash: 8501B535244F01EAF615273CEC82A2E7398FB43765F600525F515FAD81DFB09D819672

Function 008E98A2 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,008E9548,?,?,?,?,?,00000004), ref: 008E98BB
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,008E9548,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 008E98D1
CloseHandle.KERNEL32(00000000,?,008E9548,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 008E98D8

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 0572c55ffa36f43ea7ea8558e0601c1f44674fb341f0c289a76043b56cc5c0f9
Instruction ID: de0ff2be360e561849c964aec510c5faef9969bcfbe01a8572e691d68e1ba027
Opcode Fuzzy Hash: 0572c55ffa36f43ea7ea8558e0601c1f44674fb341f0c289a76043b56cc5c0f9
Instruction Fuzzy Hash: CAE08632144228BBD7311B54EC09FCA7B19EB06B70F104220FB54A94E087B12611A7D8

Function 008E8D0D Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 008E8D1B

Part of subcall function 008A2D55: RtlFreeHeap.NTDLL(00000000,00000000,?,008A9A24), ref: 008A2D69
Part of subcall function 008A2D55: GetLastError.KERNEL32(00000000,?,008A9A24), ref: 008A2D7B

_free.LIBCMT ref: 008E8D2C
_free.LIBCMT ref: 008E8D3E

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
Instruction ID: 01499fef40f49d7adec1508163be2a8999069dc41c9b7cfe767f45c7b7b60560
Opcode Fuzzy Hash: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
Instruction Fuzzy Hash: A4E012A170264586EB35A57DAD40A9713DCEF5A3527141D1DB40DD7587CE64F8428124

Function 0088A9C3 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 008BFC01

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 6642e21484f13cd4b5b71a561a90a598980cbe2fb6a558d70a1e44a78aaa31c3
Instruction ID: 6910b13d406f699039b7e32ec556b8527f2972ba60defbe37db1abc186e012b4
Opcode Fuzzy Hash: 6642e21484f13cd4b5b71a561a90a598980cbe2fb6a558d70a1e44a78aaa31c3
Instruction Fuzzy Hash: 40225D74508205DFDB28EF18C450A6ABBE1FF85314F14896EE98ADB362D735EC45CB82

Function 00884C70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00884CBA

Strings

EA06, xrefs: 008BD8CC

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: 59ee41d0af0eaba8175910152844aebfc184eb9504d05555a9c636d0f454818f
Instruction ID: b2d7201cb93285fd9395ea982c46d223737644abc3b8f4817fb5b04ba103b7b2
Opcode Fuzzy Hash: 59ee41d0af0eaba8175910152844aebfc184eb9504d05555a9c636d0f454818f
Instruction Fuzzy Hash: 47415D23A0425E67DF21BB68C8517BE7FA6FB45304F686475FC82DB282D6345D4483A2

Function 00887A51 Relevance: 3.1, APIs: 2, Instructions: 97COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00887AAB
_memmove.LIBCMT ref: 00887B16

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 9dd4efb868ffb8a5767105da0b16a8b73f80e319b4c4c742e2df27cd6dceb9ed
Instruction ID: 01dc4a0225441cfcdc77099f911db158ad188bd0a591e24b909d54e5b506775d
Opcode Fuzzy Hash: 9dd4efb868ffb8a5767105da0b16a8b73f80e319b4c4c742e2df27cd6dceb9ed
Instruction Fuzzy Hash: 8031CAB2604516AFC704EF68C8D1D69F3B5FF493207258629E519CB791EB30ED60CB90

Function 008847D0 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

745EC8D0.UXTHEME ref: 00884834

Part of subcall function 008A336C: __lock.LIBCMT ref: 008A3372
Part of subcall function 008A336C: RtlDecodePointer.NTDLL(00000001), ref: 008A337E
Part of subcall function 008A336C: RtlEncodePointer.NTDLL(?), ref: 008A3389

Part of subcall function 008848FD: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00884915
Part of subcall function 008848FD: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 0088492A

Part of subcall function 00883B3A: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00883B68
Part of subcall function 00883B3A: IsDebuggerPresent.KERNEL32 ref: 00883B7A
Part of subcall function 00883B3A: GetFullPathNameW.KERNEL32(00007FFF,?,?,009452F8,009452E0,?,?), ref: 00883BEB
Part of subcall function 00883B3A: SetCurrentDirectoryW.KERNEL32(?), ref: 00883C6F

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00884874

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$DebuggerDecodeEncodeFullNamePathPresent__lock
String ID:
API String ID: 2688871447-0
Opcode ID: 6f2430e49bd2ced7a2c30042d9c2ed331f2523eb410446dc7d326e6430ffd12d
Instruction ID: 09eb070b9f8dd28051087d68a215ef562e4ddffaf157532e408c189a3d234f61
Opcode Fuzzy Hash: 6f2430e49bd2ced7a2c30042d9c2ed331f2523eb410446dc7d326e6430ffd12d
Instruction Fuzzy Hash: A1118E719283029FCB00EF68E80591ABFE8FF86750F10452BF051C3272DBB09644DB92

Function 008A55FD Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 008A562C
__lock_file.LIBCMT ref: 008A564D

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: a80c093686bc2db12f19d67e0a47e02d810a9092e6836085a66eecb33b81e77c
Instruction ID: ed180e355e86904c5a51db08803e17c1dfb53dd83d40128cec3ebabddcd02fa7
Opcode Fuzzy Hash: a80c093686bc2db12f19d67e0a47e02d810a9092e6836085a66eecb33b81e77c
Instruction Fuzzy Hash: 0201D471800A08EBEF12AF6CCD0249E7B71FFA3321F444115F8149B591EB318AA1DFA2

Function 008A53A6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 008A8B28: __getptd_noexit.LIBCMT ref: 008A8B28

__lock_file.LIBCMT ref: 008A53EB

Part of subcall function 008A6C11: __lock.LIBCMT ref: 008A6C34

__fclose_nolock.LIBCMT ref: 008A53F6

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: f7129c6b4d9e22aeb64323f388bfe36cbd861f46b7e88ba4ce87d0566fc8fc88
Instruction ID: e934067ad5eae2ff363fd58cd1190628272006d0ab84c1fffc69ea622f120d1b
Opcode Fuzzy Hash: f7129c6b4d9e22aeb64323f388bfe36cbd861f46b7e88ba4ce87d0566fc8fc88
Instruction Fuzzy Hash: 99F09671801A04DAFF106B6998057AE7AE0FF83374F248508E464EBAC1DBBC49815B63

Function 015F9970 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

APIs

Part of subcall function 015F91E0: GetFileAttributesW.KERNELBASE(?), ref: 015F91EB

CreateDirectoryW.KERNELBASE(?,00000000), ref: 015F9A9F

Memory Dump Source

Source File: 00000000.00000002.1732693093.00000000015F8000.00000040.00000020.00020000.00000000.sdmp, Offset: 015F8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15f8000_7056ZCiFdE.jbxd

Similarity

API ID: AttributesCreateDirectoryFile
String ID:
API String ID: 3401506121-0
Opcode ID: a3629c909564942c7c8b75870f835829e090811fdfb2092ae3fc6556c3fc90d6
Instruction ID: 5320b177317d73317a35caa172307b3f974c134491247eabb84f9dffa1c2d1af
Opcode Fuzzy Hash: a3629c909564942c7c8b75870f835829e090811fdfb2092ae3fc6556c3fc90d6
Instruction Fuzzy Hash: EC516531A1050E96EF14EF64C944BEF7379FF98300F4045A9B609EB180EB79AB49CB65

Function 008A0C08 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 008A0CB7

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 917dd54d1a6275c139c61eb7335d39d8bf878020d41e408aa861bbe2d8991666
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: B431D570A001099BE718DF58C484969F7A6FB5A320B6487A5E80ACFB51D731EED1DFC0

Function 008BFCAC Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 008BFCB7

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 9d61d9d0c138318badf97d2c89d98184d5ec50aed61f100ae4535fef6969e352
Instruction ID: 85ef43183849a6ce282b3d58c53f93d9c84848b6103f1fc2bef2cc01e8355677
Opcode Fuzzy Hash: 9d61d9d0c138318badf97d2c89d98184d5ec50aed61f100ae4535fef6969e352
Instruction Fuzzy Hash: 8841D4745043419FEB24DF18C454B1ABBE1FF49318F0988ACE9998B762C736E845CF52

Function 00887B53 Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00887BB3

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 1a92a8d2d274328c4bdae9058aedb4b7ce38b925b86feb4cf6e4d7e8b767809e
Instruction ID: 1cb682e5a969953c30681da2064e94378dfe3d807b82c575017ea5d8841df713
Opcode Fuzzy Hash: 1a92a8d2d274328c4bdae9058aedb4b7ce38b925b86feb4cf6e4d7e8b767809e
Instruction Fuzzy Hash: 4521F772A24A09EBDB249F15E8517EA7FB4FF14360F218529E485C52A0EB70D1D0DB45

Function 00884DDD Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00884BB5: FreeLibrary.KERNEL32(00000000,?), ref: 00884BEF

Part of subcall function 008A525B: __wfsopen.LIBCMT ref: 008A5266

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,009452F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00884E0F

Part of subcall function 00884B6A: FreeLibrary.KERNEL32(00000000), ref: 00884BA4

Part of subcall function 00884C70: _memmove.LIBCMT ref: 00884CBA

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: a7ff77bcbfaed77811547a865bb4c308c56aa463a34db894f0b3e21355a2b778
Instruction ID: 8c2e27a7c33050b24e2e54b11e7a963210a229f8985ebf37cf8d0be224712049
Opcode Fuzzy Hash: a7ff77bcbfaed77811547a865bb4c308c56aa463a34db894f0b3e21355a2b778
Instruction Fuzzy Hash: 3711E733640306ABCF20FFB8C812FAE77A9FF44720F108829F541E7181EA719A009B52

Function 008BFD85 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 008BFD91

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 8239f18fc50af0b1accaf65d671bc33402258e281a271469b1aebe96ff4b15e4
Instruction ID: 0d14451919be46a4290438b674279b5a42db6262cfa93b15c59bcfddf2c23ebf
Opcode Fuzzy Hash: 8239f18fc50af0b1accaf65d671bc33402258e281a271469b1aebe96ff4b15e4
Instruction Fuzzy Hash: 0A21F374508341DFDB24EF64C444A2ABBE1FF89314F058968F98A97762D731E815CF92

Function 008A072A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 008A07B0

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 29103d501496fe8fa86c701e03e5f947c9735dafba124bfda064f08d2be8de5a
Instruction ID: 031303c402fd9e76263444b0d9b0b45832b0d0da06afc3fab23f9e3589fbd738
Opcode Fuzzy Hash: 29103d501496fe8fa86c701e03e5f947c9735dafba124bfda064f08d2be8de5a
Instruction Fuzzy Hash: 34016D775040489FC711EB64EC41EE4BBACEFCA360B0401FAEC89CB961E6209A599B91

Function 008A4863 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 008A48A6

Part of subcall function 008A8B28: __getptd_noexit.LIBCMT ref: 008A8B28

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: dc6d2ab047b0099602d6d159a1825de166305619240a7184a035586e4030379d
Instruction ID: df85e9a7815ca45f302fdf2a11554c28c3d59f66cc96ce66cf7eb28872ec63fd
Opcode Fuzzy Hash: dc6d2ab047b0099602d6d159a1825de166305619240a7184a035586e4030379d
Instruction Fuzzy Hash: 1DF0A431900649EBFF11AF689C0579E3AA0FF42325F155424B414D7992DBFC8951DB62

Function 00884E4A Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,009452F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00884E7E

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: a837dd9e64a277a05643c377525c5cda11b6b3182e718a4f0258b8ebf12390b9
Instruction ID: 2e3e383939a57f8bcf57c3c0d8789e165c4a76113e6c96331111b5205da68a70
Opcode Fuzzy Hash: a837dd9e64a277a05643c377525c5cda11b6b3182e718a4f0258b8ebf12390b9
Instruction Fuzzy Hash: 7BF03072505712CFCB34AF64D494812B7E1FF55339320993EE1D6C2610C732A840DF40

Function 008A0791 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 008A07B0

Part of subcall function 00887BCC: _memmove.LIBCMT ref: 00887C06

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 7869ef6f29254bf57877fe9214d4d222949e1f708509dfc713f7adefca324349
Instruction ID: 34766cd5d2ba7fa6c61e921843d973f2ca4b8555fcb4667ee72a19a5a6c7aa20
Opcode Fuzzy Hash: 7869ef6f29254bf57877fe9214d4d222949e1f708509dfc713f7adefca324349
Instruction Fuzzy Hash: A3E086369041285BC720A65C9C05FEA77ADEB887A0F0441B5FC08D7205D9609D808691

Function 008E8E9F Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 008E8EC1

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction ID: 7ecc33a1b10509faf0ca27ec67541a2252f87de3361c460be49f4395444d65f4
Opcode Fuzzy Hash: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction Fuzzy Hash: DAE092B0504B409FD7388A24D801BA373E1FB06304F00081DF6AAC3241EB6278418B59

Function 015F91E0 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?), ref: 015F91EB

Memory Dump Source

Source File: 00000000.00000002.1732693093.00000000015F8000.00000040.00000020.00020000.00000000.sdmp, Offset: 015F8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15f8000_7056ZCiFdE.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 195c23eedc4a89e51baf60bc3cc3d10d01908f8b29aed20e491e172ce03d4d2a
Instruction ID: 183562a44d809326b6104d1bbade0ee1806df1d0e688b174f5e09b38e88f6e8e
Opcode Fuzzy Hash: 195c23eedc4a89e51baf60bc3cc3d10d01908f8b29aed20e491e172ce03d4d2a
Instruction Fuzzy Hash: EDE08C71A0560CEBDB60CAAC8808BAD77A8EB09324F004A6CFA2ACB290D5308A409614

Function 015F91B0 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?), ref: 015F91BB

Memory Dump Source

Source File: 00000000.00000002.1732693093.00000000015F8000.00000040.00000020.00020000.00000000.sdmp, Offset: 015F8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15f8000_7056ZCiFdE.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 63700976fb5b8646ca9f82f7877e0f33cef2a649cb81b4b88ad66ba6039b9afc
Instruction ID: c7dba4a029a80f19b1b55c33b857e7013c0d40fc08d835de87f79e7bd395ae99
Opcode Fuzzy Hash: 63700976fb5b8646ca9f82f7877e0f33cef2a649cb81b4b88ad66ba6039b9afc
Instruction Fuzzy Hash: 34D0A73090560CEBCB20DFB89C08EDE73A8E704324F00476DFE15C7280D6319940D790

Function 008A525B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 008A5266

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: fbad2a94a82745f1a51a3a83aa2d07d8cd6c3153a1e5c4eae0f2d4825a4baa3c
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: A2B0927644020C77DE012A86EC02B893B1AAB42B64F408020FB0C18562A673A6A49A8A

Function 015FABA0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 015FABB1

Memory Dump Source

Source File: 00000000.00000002.1732693093.00000000015F8000.00000040.00000020.00020000.00000000.sdmp, Offset: 015F8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15f8000_7056ZCiFdE.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 843c2b59f00dce13e5e96acc73dd94f38a5c80d8fcab2dd521b1e33dd8bb8c24
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 41E0E67494010EDFDB00EFB4D54DA9E7FB4FF04301F100565FD05D2281D6309D508A62

Non-executed Functions

Function 0090CABC Relevance: 68.9, APIs: 37, Strings: 2, Instructions: 632windowkeyboardnativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00882612: GetWindowLongW.USER32(?,000000EB), ref: 00882623

NtdllDialogWndProc_W.NTDLL(?,0000004E,?,?,?,?,?,?), ref: 0090CB37
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0090CB95
GetWindowLongW.USER32(?,000000F0), ref: 0090CBD6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0090CC00
SendMessageW.USER32 ref: 0090CC29
_wcsncpy.LIBCMT ref: 0090CC95
GetKeyState.USER32(00000011), ref: 0090CCB6
GetKeyState.USER32(00000009), ref: 0090CCC3
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0090CCD9
GetKeyState.USER32(00000010), ref: 0090CCE3
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0090CD0C
SendMessageW.USER32 ref: 0090CD33
SendMessageW.USER32(?,00001030,?,0090B348), ref: 0090CE37
SetCapture.USER32(?), ref: 0090CE69
ClientToScreen.USER32(?,?), ref: 0090CECE
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0090CEF5
ReleaseCapture.USER32 ref: 0090CF00
GetCursorPos.USER32(?), ref: 0090CF3A
ScreenToClient.USER32(?,?), ref: 0090CF47
SendMessageW.USER32(?,00001012,00000000,?), ref: 0090CFA3
SendMessageW.USER32 ref: 0090CFD1
SendMessageW.USER32(?,00001111,00000000,?), ref: 0090D00E
SendMessageW.USER32 ref: 0090D03D
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0090D05E
SendMessageW.USER32(?,0000110B,00000009,?), ref: 0090D06D
GetCursorPos.USER32(?), ref: 0090D08D
ScreenToClient.USER32(?,?), ref: 0090D09A
GetParent.USER32(?), ref: 0090D0BA
SendMessageW.USER32(?,00001012,00000000,?), ref: 0090D123
SendMessageW.USER32 ref: 0090D154
ClientToScreen.USER32(?,?), ref: 0090D1B2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0090D1E2
SendMessageW.USER32(?,00001111,00000000,?), ref: 0090D20C
SendMessageW.USER32 ref: 0090D22F
ClientToScreen.USER32(?,?), ref: 0090D281
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0090D2B5

Part of subcall function 008825DB: GetWindowLongW.USER32(?,000000EB), ref: 008825EC

GetWindowLongW.USER32(?,000000F0), ref: 0090D351

Strings

F, xrefs: 0090D235
@GUI_DRAGID, xrefs: 0090CE9C

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: MessageSend$ClientScreen$LongWindow$State$CaptureCursorMenuPopupTrack$DialogInvalidateNtdllParentProc_RectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 302779176-4164748364
Opcode ID: 072ab25f4501b08fa6ed7e21ff227a4f311e217776adf9f78644b7754ab68b38
Instruction ID: 711fb37b491eb9deba0adac05fb5ad82b5189ea6da3158ad33e01729473ed232
Opcode Fuzzy Hash: 072ab25f4501b08fa6ed7e21ff227a4f311e217776adf9f78644b7754ab68b38
Instruction Fuzzy Hash: BE429AB4208241AFDB24DF68D844EAABBE9FF49314F140A29F695C72F1C731D941EB52

Function 00896F9E Relevance: 48.8, APIs: 19, Strings: 6, Instructions: 5018COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 008971C3
_memset.LIBCMT ref: 00897539
_memmove.LIBCMT ref: 008976AC

Strings

Q\E, xrefs: 00897FCB
\b(?=\w), xrefs: 008D3769
\b(?<=\w), xrefs: 008D3773
DEFINE, xrefs: 008D2103
[:>:]], xrefs: 00897492
[:<:]], xrefs: 00897479

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: _memmove$_memset
String ID: DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-1798697756
Opcode ID: c8a4adbef2d52a288be933f57dd42e6fb4169d71a1c7654a51455ca3bd0af18b
Instruction ID: 8498361f28613d2b2ccb2dcd6252b56d847941138a58b183c210960adb8dd02c
Opcode Fuzzy Hash: c8a4adbef2d52a288be933f57dd42e6fb4169d71a1c7654a51455ca3bd0af18b
Instruction Fuzzy Hash: 2B939071A04219DBDF24DF98D881BADB7B1FF58714F24826AE945EB381E7709E81CB40

Function 008848D7 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 008848DF
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 008BD665
IsIconic.USER32(?), ref: 008BD66E
ShowWindow.USER32(?,00000009), ref: 008BD67B
SetForegroundWindow.USER32(?), ref: 008BD685
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 008BD69B
GetCurrentThreadId.KERNEL32 ref: 008BD6A2
GetWindowThreadProcessId.USER32(?,00000000), ref: 008BD6AE
AttachThreadInput.USER32(?,00000000,00000001), ref: 008BD6BF
AttachThreadInput.USER32(?,00000000,00000001), ref: 008BD6C7
AttachThreadInput.USER32(00000000,?,00000001), ref: 008BD6CF
SetForegroundWindow.USER32(?), ref: 008BD6D2
MapVirtualKeyW.USER32(00000012,00000000), ref: 008BD6E7
keybd_event.USER32(00000012,00000000), ref: 008BD6F2
MapVirtualKeyW.USER32(00000012,00000000), ref: 008BD6FC
keybd_event.USER32(00000012,00000000), ref: 008BD701
MapVirtualKeyW.USER32(00000012,00000000), ref: 008BD70A
keybd_event.USER32(00000012,00000000), ref: 008BD70F
MapVirtualKeyW.USER32(00000012,00000000), ref: 008BD719
keybd_event.USER32(00000012,00000000), ref: 008BD71E
SetForegroundWindow.USER32(?), ref: 008BD721
AttachThreadInput.USER32(?,?,00000000), ref: 008BD748

Strings

Shell_TrayWnd, xrefs: 008BD660

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: f73d75e8af6dd8a56aa2ecbcb39d559b2fbd5f9bf6ec82a42858494d59763c2c
Instruction ID: 97aa48cf499516cbabbfc81694f3b28d4a46b1727ce33724761c73b43dfdeff4
Opcode Fuzzy Hash: f73d75e8af6dd8a56aa2ecbcb39d559b2fbd5f9bf6ec82a42858494d59763c2c
Instruction Fuzzy Hash: 44316071A9431CBEEB306B619C49FBF7F6CEB44B50F104025FA04EA1D1DAB15A01BBA1

Function 008D8310 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 008D87E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 008D882B
Part of subcall function 008D87E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 008D8858
Part of subcall function 008D87E1: GetLastError.KERNEL32 ref: 008D8865

_memset.LIBCMT ref: 008D8353
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 008D83A5
CloseHandle.KERNEL32(?), ref: 008D83B6
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 008D83CD
GetProcessWindowStation.USER32 ref: 008D83E6
SetProcessWindowStation.USER32(00000000), ref: 008D83F0
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 008D840A

Part of subcall function 008D81CB: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,008D8309), ref: 008D81E0
Part of subcall function 008D81CB: CloseHandle.KERNEL32(?,?,008D8309), ref: 008D81F2

Strings

default, xrefs: 008D8405
, xrefs: 008D8362
winsta0, xrefs: 008D83C8

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 8030362ecd9bf28c57fd1cfec1fc76a6084a732c216c349f7cbef2489fdd23fe
Instruction ID: f2ed6043f29f22e0ddfbf62b42400734dec5896baba67b4e82ebe56a7b4bef7f
Opcode Fuzzy Hash: 8030362ecd9bf28c57fd1cfec1fc76a6084a732c216c349f7cbef2489fdd23fe
Instruction Fuzzy Hash: 81814BB1910209EFDF219FA8DC45AEEBBB9FF04304F14426AF914E6261DB319E15DB21

Function 008EC75C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 008EC78D
FindClose.KERNEL32(00000000), ref: 008EC7E1
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 008EC806
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 008EC81D
FileTimeToSystemTime.KERNEL32(?,?), ref: 008EC844
__swprintf.LIBCMT ref: 008EC890
__swprintf.LIBCMT ref: 008EC8D3

Part of subcall function 00887DE1: _memmove.LIBCMT ref: 00887E22

__swprintf.LIBCMT ref: 008EC927

Part of subcall function 008A3698: __woutput_l.LIBCMT ref: 008A36F1

__swprintf.LIBCMT ref: 008EC975

Part of subcall function 008A3698: __flsbuf.LIBCMT ref: 008A3713
Part of subcall function 008A3698: __flsbuf.LIBCMT ref: 008A372B

__swprintf.LIBCMT ref: 008EC9C4
__swprintf.LIBCMT ref: 008ECA13
__swprintf.LIBCMT ref: 008ECA62

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 008EC88A
%02d, xrefs: 008EC91B, 008EC925, 008EC973, 008EC9C2, 008ECA11, 008ECA60
%4d, xrefs: 008EC8CD

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 7f376d6f45239211f09b671e10727129d46b4ca49ba0a181e0679a2194779066
Instruction ID: fcd790db4838277b340ec6684ad28c41df5a5b510f843b55f77ffe0f7f5e69cd
Opcode Fuzzy Hash: 7f376d6f45239211f09b671e10727129d46b4ca49ba0a181e0679a2194779066
Instruction Fuzzy Hash: 63A109B2408345ABD750FBA8C886DAFB7ECFF95704F440929F595C6191EA30DA09CB63

Function 008EEF95 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 008EEFB6
_wcscmp.LIBCMT ref: 008EEFCB
_wcscmp.LIBCMT ref: 008EEFE2
GetFileAttributesW.KERNEL32(?), ref: 008EEFF4
SetFileAttributesW.KERNEL32(?,?), ref: 008EF00E
FindNextFileW.KERNEL32(00000000,?), ref: 008EF026
FindClose.KERNEL32(00000000), ref: 008EF031
FindFirstFileW.KERNEL32(*.*,?), ref: 008EF04D
_wcscmp.LIBCMT ref: 008EF074
_wcscmp.LIBCMT ref: 008EF08B
SetCurrentDirectoryW.KERNEL32(?), ref: 008EF09D
SetCurrentDirectoryW.KERNEL32(00938920), ref: 008EF0BB
FindNextFileW.KERNEL32(00000000,00000010), ref: 008EF0C5
FindClose.KERNEL32(00000000), ref: 008EF0D2
FindClose.KERNEL32(00000000), ref: 008EF0E4

Strings

*.*, xrefs: 008EF048

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 1e11911a47d7c787e43b57f39fc63fc907969ebbc71842ada6ed35a94fc47456
Instruction ID: 0e6c6654b9ff3722485bf14010fc182287cc570abc76d71479e97000d058d4da
Opcode Fuzzy Hash: 1e11911a47d7c787e43b57f39fc63fc907969ebbc71842ada6ed35a94fc47456
Instruction Fuzzy Hash: 8731C1325056486FDB24ABA9DC58AEE77ACFF4A360F1001B5F914D2092DB70DB44DF61

Function 00900857 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00900953
RegCreateKeyExW.ADVAPI32(?,?,00000000,0090F910,00000000,?,00000000,?,?), ref: 009009C1
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00900A09
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00900A92
RegCloseKey.ADVAPI32(?), ref: 00900DB2
RegCloseKey.ADVAPI32(00000000), ref: 00900DBF

Strings

REG_SZ, xrefs: 00900AD0
REG_BINARY, xrefs: 00900D4D
REG_MULTI_SZ, xrefs: 00900B7A
REG_EXPAND_SZ, xrefs: 00900A2F
REG_DWORD, xrefs: 00900C83
REG_QWORD, xrefs: 00900D00

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 85940f605a141d4d17c0ff02f75f33435971def5bf3fdab82f43b8813172bd10
Instruction ID: 6b6fa6dd0ef667787f2380458bf1e89bf39521fb1580986be1a8ab52c12e5680
Opcode Fuzzy Hash: 85940f605a141d4d17c0ff02f75f33435971def5bf3fdab82f43b8813172bd10
Instruction Fuzzy Hash: 5A023A756006129FDB14EF18C851E2AB7E5FF89314F048568F89ADB7A2DB30ED41CB82

Function 0090C5FE Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfilenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00882612: GetWindowLongW.USER32(?,000000EB), ref: 00882623

DragQueryPoint.SHELL32(?,?), ref: 0090C627

Part of subcall function 0090AB37: ClientToScreen.USER32(?,?), ref: 0090AB60
Part of subcall function 0090AB37: GetWindowRect.USER32(?,?), ref: 0090ABD6
Part of subcall function 0090AB37: PtInRect.USER32(?,?,0090C014), ref: 0090ABE6

SendMessageW.USER32(?,000000B0,?,?), ref: 0090C690
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0090C69B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0090C6BE
_wcscat.LIBCMT ref: 0090C6EE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0090C705
SendMessageW.USER32(?,000000B0,?,?), ref: 0090C71E
SendMessageW.USER32(?,000000B1,?,?), ref: 0090C735
SendMessageW.USER32(?,000000B1,?,?), ref: 0090C757
DragFinish.SHELL32(?), ref: 0090C75E
NtdllDialogWndProc_W.NTDLL(?,00000233,?,00000000,?,?,?), ref: 0090C851

Strings

@GUI_DRAGFILE, xrefs: 0090C800
@GUI_DROPID, xrefs: 0090C77E
@GUI_DRAGID, xrefs: 0090C7C9

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientDialogFinishLongNtdllPointProc_Screen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 2166380349-3440237614
Opcode ID: 2c6224737f7a6502922d6b14a2107d838c97cd19a5e3290fd473298abcd1aaae
Instruction ID: a3ca32a1fe249b0faa4623b436ff612c4e45bc00d1c490c1b540d8c6cdde179a
Opcode Fuzzy Hash: 2c6224737f7a6502922d6b14a2107d838c97cd19a5e3290fd473298abcd1aaae
Instruction Fuzzy Hash: 64616A72108301AFC711EF64DC85EAFBBE8FF89714F400A2EF595921A1DB719A49CB52

Function 008EF0F2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 008EF113
_wcscmp.LIBCMT ref: 008EF128
_wcscmp.LIBCMT ref: 008EF13F

Part of subcall function 008E4385: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 008E43A0

FindNextFileW.KERNEL32(00000000,?), ref: 008EF16E
FindClose.KERNEL32(00000000), ref: 008EF179
FindFirstFileW.KERNEL32(*.*,?), ref: 008EF195
_wcscmp.LIBCMT ref: 008EF1BC
_wcscmp.LIBCMT ref: 008EF1D3
SetCurrentDirectoryW.KERNEL32(?), ref: 008EF1E5
SetCurrentDirectoryW.KERNEL32(00938920), ref: 008EF203
FindNextFileW.KERNEL32(00000000,00000010), ref: 008EF20D
FindClose.KERNEL32(00000000), ref: 008EF21A
FindClose.KERNEL32(00000000), ref: 008EF22C

Strings

*.*, xrefs: 008EF190

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 8685a6ad38df29fd3d1b99963147a33505728d5bf80de1f156eae89f6f279a2e
Instruction ID: 1716d58f2c217f3b6cfb3407314d938c9e79bbb9e8a30c0c329c64b5fd2b8f36
Opcode Fuzzy Hash: 8685a6ad38df29fd3d1b99963147a33505728d5bf80de1f156eae89f6f279a2e
Instruction Fuzzy Hash: 9B31E43650025DAEDB20AB69EC58AEE77ACFF86364F100171FA14E2091DB30DB45CB54

Function 008EA1EF Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 008EA20F
__swprintf.LIBCMT ref: 008EA231
CreateDirectoryW.KERNEL32(?,00000000), ref: 008EA26E
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 008EA293
_memset.LIBCMT ref: 008EA2B2
_wcsncpy.LIBCMT ref: 008EA2EE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 008EA323
CloseHandle.KERNEL32(00000000), ref: 008EA32E
RemoveDirectoryW.KERNEL32(?), ref: 008EA337
CloseHandle.KERNEL32(00000000), ref: 008EA341

Strings

\??\%s, xrefs: 008EA22B
:, xrefs: 008EA252
\, xrefs: 008EA247

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: dbc3d31dfe4ffe43646c865069569373beb70e7402c139bcc1d9ee2c600bf1dd
Instruction ID: 1689be7c5bc2122f60a1e9ff4c5822792bf4989f3969d74745fb6687119a02f7
Opcode Fuzzy Hash: dbc3d31dfe4ffe43646c865069569373beb70e7402c139bcc1d9ee2c600bf1dd
Instruction Fuzzy Hash: B0319F71504249ABDB20DFA5DC49FEB37BCFF89B41F1040B6F609D2560E670A7448B25

Function 0090C1AC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windownativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00882612: GetWindowLongW.USER32(?,000000EB), ref: 00882623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0090C1FC
GetFocus.USER32 ref: 0090C20C
GetDlgCtrlID.USER32(00000000), ref: 0090C217
_memset.LIBCMT ref: 0090C342
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0090C36D
GetMenuItemCount.USER32(?), ref: 0090C38D
GetMenuItemID.USER32(?,00000000), ref: 0090C3A0
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0090C3D4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0090C41C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0090C454
NtdllDialogWndProc_W.NTDLL(?,00000111,?,?,?,?,?,?,?), ref: 0090C489

Strings

0, xrefs: 0090C33A

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlDialogFocusLongMessageNtdllPostProc_RadioWindow_memset
String ID: 0
API String ID: 3616455698-4108050209
Opcode ID: 204fad49d93d3167c6f46f87b693b7f450169c0e4fee28b1129876a05e328901
Instruction ID: 1b46974b52430e2995105b23c6b48701f31785fccdfe13df8fc2bad9f897325d
Opcode Fuzzy Hash: 204fad49d93d3167c6f46f87b693b7f450169c0e4fee28b1129876a05e328901
Instruction Fuzzy Hash: 38817DB16183019FD720DF58C894A7BBBE9FB88714F004A2EF995D72A1D730D905DB92

Function 008D7CAF Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 008D8202: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 008D821E
Part of subcall function 008D8202: GetLastError.KERNEL32(?,008D7CE2,?,?,?), ref: 008D8228
Part of subcall function 008D8202: GetProcessHeap.KERNEL32(00000008,?,?,008D7CE2,?,?,?), ref: 008D8237
Part of subcall function 008D8202: RtlAllocateHeap.NTDLL(00000000,?,008D7CE2), ref: 008D823E
Part of subcall function 008D8202: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 008D8255

Part of subcall function 008D829F: GetProcessHeap.KERNEL32(00000008,008D7CF8,00000000,00000000,?,008D7CF8,?), ref: 008D82AB
Part of subcall function 008D829F: RtlAllocateHeap.NTDLL(00000000,?,008D7CF8), ref: 008D82B2
Part of subcall function 008D829F: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,008D7CF8,?), ref: 008D82C3

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 008D7D13
_memset.LIBCMT ref: 008D7D28
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 008D7D47
GetLengthSid.ADVAPI32(?), ref: 008D7D58
GetAce.ADVAPI32(?,00000000,?), ref: 008D7D95
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 008D7DB1
GetLengthSid.ADVAPI32(?), ref: 008D7DCE
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 008D7DDD
RtlAllocateHeap.NTDLL(00000000), ref: 008D7DE4
GetLengthSid.ADVAPI32(?,00000008,?), ref: 008D7E05
CopySid.ADVAPI32(00000000), ref: 008D7E0C
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 008D7E3D
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 008D7E63
SetUserObjectSecurity.USER32(?,00000004,?), ref: 008D7E77

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: HeapSecurity$AllocateDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 2347767575-0
Opcode ID: 7ee7ee7007342e6918dd8b0baa9828fec64f1846ac8adb0747e40917ed420a63
Instruction ID: d21695e271db3f003a5832fad5b16cb9da465d5f8655881c5621ea4eac4499c1
Opcode Fuzzy Hash: 7ee7ee7007342e6918dd8b0baa9828fec64f1846ac8adb0747e40917ed420a63
Instruction Fuzzy Hash: D6615B71904209EFDF11DFA4DC85AEEBB7AFF44710F04826AE815E6391EB319A05DB60

Function 008966E1 Relevance: 18.4, Strings: 14, Instructions: 889COMMON

Download Yara Rule

Strings

CR), xrefs: 008D1287
NO_AUTO_POSSESS), xrefs: 008D112E
UTF16), xrefs: 008D10CF
BSR_ANYCRLF), xrefs: 008D131E
LIMIT_MATCH=, xrefs: 008D1170
NO_START_OPT), xrefs: 008D114F
CRLF), xrefs: 008D12C1
ANYCRLF), xrefs: 008D12FB
UCP), xrefs: 008D110D
LIMIT_RECURSION=, xrefs: 008D11FC
ANY), xrefs: 008D12DE
LF), xrefs: 008D12A4
UTF), xrefs: 008D10FA
BSR_UNICODE), xrefs: 008D1338

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-4052911093
Opcode ID: 420cd0d0cccdbe689b6026c5eedf04e93a4358199f95ec2e5d10ed8a95cea798
Instruction ID: 432a7dfe1441e6a131fbf26d86bd5a1d812e5cce1cf4008f920c2e2b7c273903
Opcode Fuzzy Hash: 420cd0d0cccdbe689b6026c5eedf04e93a4358199f95ec2e5d10ed8a95cea798
Instruction Fuzzy Hash: CF725D71E00219DBDF24DF58D884BAEB7B5FF44314F14816AE849EB390EB749A81CB90

Function 008E001C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 008E0097
SetKeyboardState.USER32(?), ref: 008E0102
GetAsyncKeyState.USER32(000000A0), ref: 008E0122
GetKeyState.USER32(000000A0), ref: 008E0139
GetAsyncKeyState.USER32(000000A1), ref: 008E0168
GetKeyState.USER32(000000A1), ref: 008E0179
GetAsyncKeyState.USER32(00000011), ref: 008E01A5
GetKeyState.USER32(00000011), ref: 008E01B3
GetAsyncKeyState.USER32(00000012), ref: 008E01DC
GetKeyState.USER32(00000012), ref: 008E01EA
GetAsyncKeyState.USER32(0000005B), ref: 008E0213
GetKeyState.USER32(0000005B), ref: 008E0221

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: aae48c2ffd372018d69b25287b6dd6c260b6de24707f097b3aa3adbd9e7a054e
Instruction ID: fb3fb48a64a0685f0ebfca1026bf04c12baa1195b7d8401f92e3f10d004bc75b
Opcode Fuzzy Hash: aae48c2ffd372018d69b25287b6dd6c260b6de24707f097b3aa3adbd9e7a054e
Instruction Fuzzy Hash: 2D51BA209047C819FB35D7A588547EABFB4EF13380F08499995C59A5C3DAE49BCCCF62

Function 009003DA Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00900E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,008FFDAD,?,?), ref: 00900E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 009004AC

Part of subcall function 00889837: __itow.LIBCMT ref: 00889862
Part of subcall function 00889837: __swprintf.LIBCMT ref: 008898AC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0090054B
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 009005E3
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00900822
RegCloseKey.ADVAPI32(00000000), ref: 0090082F

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: a91307821bcdac997c93f1130e298420fc64a5c9a5e272d58255e8cf098181bf
Instruction ID: 50e91338ae8fcc9bd8b1ebbaafe6acb1904802dcee673db4b7337c65f68f9564
Opcode Fuzzy Hash: a91307821bcdac997c93f1130e298420fc64a5c9a5e272d58255e8cf098181bf
Instruction Fuzzy Hash: F3E15071204205AFCB14DF28C895E6ABBF9FF89314F04896DF84AD72A1DA31ED05CB52

Function 008F4164 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 008F418B
EmptyClipboard.USER32 ref: 008F4191
GlobalAlloc.KERNEL32(00000002,?), ref: 008F41A6
CloseClipboard.USER32 ref: 008F4245

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 9b5db1ecaed148fb7c5de2a48045e78476713637ce081874401381dac28244eb
Instruction ID: 1169f1e2f85aa974027dcc2858ed250b4fd0a8fdcaa757b9785891ec3ed0e180
Opcode Fuzzy Hash: 9b5db1ecaed148fb7c5de2a48045e78476713637ce081874401381dac28244eb
Instruction Fuzzy Hash: 2621B1352042199FDB20AF68EC19B7E7BA8FF05310F048026FA46DB271DB31AD40DB85

Function 008E37EF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00884750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00884743,?,?,008837AE,?), ref: 00884770

Part of subcall function 008E4A31: GetFileAttributesW.KERNEL32(?,008E370B), ref: 008E4A32

FindFirstFileW.KERNEL32(?,?), ref: 008E38A3
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 008E394B
MoveFileW.KERNEL32(?,?), ref: 008E395E
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 008E397B
FindNextFileW.KERNEL32(00000000,00000010), ref: 008E399D
FindClose.KERNEL32(00000000,?,?,?,?), ref: 008E39B9

Strings

\*.*, xrefs: 008E384E, 008E3857, 008E386C

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 3efee5bb57aeb8dffe88c2df5a2c2fdc27d8e1054ca0b26e957afdd47175f1d7
Instruction ID: 5fe99f1f61a9a94ffa989d8d1b63790fedb5b4a23507ef5ad0dee7915abdbcda
Opcode Fuzzy Hash: 3efee5bb57aeb8dffe88c2df5a2c2fdc27d8e1054ca0b26e957afdd47175f1d7
Instruction Fuzzy Hash: 2351723180518DAACF11FBA9D9969EDBB79FF16310F600069E406F7192EB316F09CB52

Function 008EF3F3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00887DE1: _memmove.LIBCMT ref: 00887E22

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 008EF440
Sleep.KERNEL32(0000000A), ref: 008EF470
_wcscmp.LIBCMT ref: 008EF484
_wcscmp.LIBCMT ref: 008EF49F
FindNextFileW.KERNEL32(?,?), ref: 008EF53D
FindClose.KERNEL32(00000000), ref: 008EF553

Strings

*.*, xrefs: 008EF425

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: a3082b9764f19a91a3cafc885bbfa3201879187e99c3f95c43d3f8aca2b3583f
Instruction ID: a0914c533e4640ac1dc9a7ec3b849200e22c79f487c9775292fe296405e7b561
Opcode Fuzzy Hash: a3082b9764f19a91a3cafc885bbfa3201879187e99c3f95c43d3f8aca2b3583f
Instruction Fuzzy Hash: B1419D7190424A9FCF14EF69DC45AEEBBB4FF16314F104466E915E3292EB309A44CF91

Function 0090D43E Relevance: 12.3, APIs: 8, Instructions: 257windownativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00882612: GetWindowLongW.USER32(?,000000EB), ref: 00882623

GetSystemMetrics.USER32(0000000F), ref: 0090D47C
GetSystemMetrics.USER32(0000000F), ref: 0090D49C
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0090D6D7
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0090D6F5
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0090D716
ShowWindow.USER32(00000003,00000000), ref: 0090D735
InvalidateRect.USER32(?,00000000,00000001), ref: 0090D75A
NtdllDialogWndProc_W.NTDLL(?,00000005,?,?), ref: 0090D77D

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$DialogInvalidateLongMoveNtdllProc_RectShow
String ID:
API String ID: 830902736-0
Opcode ID: 1b0d25844cc347189a4ad8ad9d88b17f1c77a42c5cb329f2ec16d9fbc9bc2742
Instruction ID: e41675a3fd75d4cdc4710c11cfb7571959463273173470103ae4978ca4174cbb
Opcode Fuzzy Hash: 1b0d25844cc347189a4ad8ad9d88b17f1c77a42c5cb329f2ec16d9fbc9bc2742
Instruction Fuzzy Hash: E6B1AA75601229EFDF14CFA8C9C5BAD7BB5FF04701F088069EC489B299D735AA90CB90

Function 00895760 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 008958A5
_memmove.LIBCMT ref: 008958F5
_memmove.LIBCMT ref: 0089595B

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: b4a1b00e8e901252fe8af2bd95611bf85953f55ff1bc064c72a2c9d1ef394118
Instruction ID: d7b724969d8bbfd6762fc23ecbeafd4243875b423607abd594ce08b64fd7b2da
Opcode Fuzzy Hash: b4a1b00e8e901252fe8af2bd95611bf85953f55ff1bc064c72a2c9d1ef394118
Instruction Fuzzy Hash: 2E128D70A00609DFDF14EFA9D981AAEB7F5FF48314F144629E406E7250EB36A914CF51

Function 008E3B12 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00884750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00884743,?,?,008837AE,?), ref: 00884770

Part of subcall function 008E4A31: GetFileAttributesW.KERNEL32(?,008E370B), ref: 008E4A32

FindFirstFileW.KERNEL32(?,?), ref: 008E3B89
DeleteFileW.KERNEL32(?,?,?,?), ref: 008E3BD9
FindNextFileW.KERNEL32(00000000,00000010), ref: 008E3BEA
FindClose.KERNEL32(00000000), ref: 008E3C01
FindClose.KERNEL32(00000000), ref: 008E3C0A

Strings

\*.*, xrefs: 008E3B5B

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: bff4761c10eb1c31594099f0d714266e8ddeac1f387ae7a77f8af37a9533f503
Instruction ID: edc760ca878efbc862081addc61c044238c4027b59b9aed70d88c7a15204b53b
Opcode Fuzzy Hash: bff4761c10eb1c31594099f0d714266e8ddeac1f387ae7a77f8af37a9533f503
Instruction Fuzzy Hash: E0313C710183859FC201FB68D8958AFBBA8FE96314F44492DF4A6D3191EB21DA09DB63

Function 008E51BD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 008D87E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 008D882B
Part of subcall function 008D87E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 008D8858
Part of subcall function 008D87E1: GetLastError.KERNEL32 ref: 008D8865

ExitWindowsEx.USER32(?,00000000), ref: 008E51F9

Strings

SeShutdownPrivilege, xrefs: 008E51C9
@, xrefs: 008E51EC
, xrefs: 008E51E7

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 355835cb9f2854d7aa9956a811b2cef32cc88925a78f1e81e39658a0674f7617
Instruction ID: 934a89aed192ed264bf778021276ce994a85e8974c75c0cf82db6cae8f2e07bb
Opcode Fuzzy Hash: 355835cb9f2854d7aa9956a811b2cef32cc88925a78f1e81e39658a0674f7617
Instruction Fuzzy Hash: AB0176357A56466FFB38226AAC9AFBB7398FB0734CF200421FA13E20C2DA501C008590

Function 008F6283 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 008F62DC
WSAGetLastError.WS2_32(00000000), ref: 008F62EB
bind.WS2_32(00000000,?,00000010), ref: 008F6307
listen.WS2_32(00000000,00000005), ref: 008F6316
WSAGetLastError.WS2_32(00000000), ref: 008F6330
closesocket.WS2_32(00000000), ref: 008F6344

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 130e97485f5cc50369a5e2983da1883202046adea52336317c9ea8483c0f0a4c
Instruction ID: 5aabf38ba54b0ee743b3a99078ea75d6cb46f966ac3e4dddd186a4801dc72c26
Opcode Fuzzy Hash: 130e97485f5cc50369a5e2983da1883202046adea52336317c9ea8483c0f0a4c
Instruction Fuzzy Hash: 2621CE316002099FCB10EF68C845A7EB7B9FF48324F248269EA56E7391D770AD15DB52

Function 00895520 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 008A0DB6: std::exception::exception.LIBCMT ref: 008A0DEC
Part of subcall function 008A0DB6: __CxxThrowException@8.LIBCMT ref: 008A0E01

_memmove.LIBCMT ref: 008D0258
_memmove.LIBCMT ref: 008D036D
_memmove.LIBCMT ref: 008D0414

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: dd366a7f8701ef1ac6526e17a4bdff6a8baefc56e09ecbccb67c664935008b9d
Instruction ID: c8d101c399b366571abc873b25a0f6e3f44a13dcc3f32a745ab73416fd90418d
Opcode Fuzzy Hash: dd366a7f8701ef1ac6526e17a4bdff6a8baefc56e09ecbccb67c664935008b9d
Instruction Fuzzy Hash: 6C02B070A00209DBDF05EF68D981AAEBBB5FF44304F54816AE80ADB355EB35DA50CF91

Function 00881287 Relevance: 7.9, APIs: 5, Instructions: 379nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00882612: GetWindowLongW.USER32(?,000000EB), ref: 00882623

NtdllDialogWndProc_W.NTDLL(?,?,?,?,?), ref: 008819FA
GetSysColor.USER32(0000000F), ref: 00881A4E
SetBkColor.GDI32(?,00000000), ref: 00881A61

Part of subcall function 00881290: NtdllDialogWndProc_W.NTDLL(?,00000020,?), ref: 008812D8

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ColorDialogNtdllProc_$LongWindow
String ID:
API String ID: 591255283-0
Opcode ID: 9a399016a2de8df8715ddbac0a1a8fd112875603077beea641ba6d335bb9cd5e
Instruction ID: 4e85de6f5cad35886860a4093d26479d6b31060d914595b65d1cca002197e60f
Opcode Fuzzy Hash: 9a399016a2de8df8715ddbac0a1a8fd112875603077beea641ba6d335bb9cd5e
Instruction Fuzzy Hash: 2FA118B1116568FEDE2CBB28CC4CEBB395DFF42759B14021AF502D62D2DE549D029372

Function 008EBCBC Relevance: 7.6, APIs: 5, Instructions: 143fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 008EBCE6
_wcscmp.LIBCMT ref: 008EBD16
_wcscmp.LIBCMT ref: 008EBD2B
FindNextFileW.KERNEL32(00000000,?), ref: 008EBD3C
FindClose.KERNEL32(00000000,00000001,00000000), ref: 008EBD6C

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 262074c2a64a85dc3b236872332b6bc04fcad956084e634bef2f74d6bb9f40a6
Instruction ID: e65107c4dfa091f396df04d46af9671c5388dbb2b93b26a2ff85b4093ca3c164
Opcode Fuzzy Hash: 262074c2a64a85dc3b236872332b6bc04fcad956084e634bef2f74d6bb9f40a6
Instruction Fuzzy Hash: B0517C356046429FD714DF69D890EAAB3E8FF4A324F14462DE956C73A1DB30ED04CB92

Function 008F6747 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 008F7D8B: inet_addr.WS2_32(00000000), ref: 008F7DB6

socket.WS2_32(00000002,00000002,00000011), ref: 008F679E
WSAGetLastError.WS2_32(00000000), ref: 008F67C7
bind.WS2_32(00000000,?,00000010), ref: 008F6800
WSAGetLastError.WS2_32(00000000), ref: 008F680D
closesocket.WS2_32(00000000), ref: 008F6821

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 5f69e8bd94acf70717cb917250a638d57a8a577d518cdfccbf12c18ba691acab
Instruction ID: de4380ebf01ddcfb4ef4ede5c35dcdd88937a33cd486c5bfdab164a336835cae
Opcode Fuzzy Hash: 5f69e8bd94acf70717cb917250a638d57a8a577d518cdfccbf12c18ba691acab
Instruction Fuzzy Hash: AE41C575640214AFDB50BF288C86F7E77A8FB09714F44856CFA5AEB3C2DA709D009792

Function 00905376 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 009053C5
IsWindowEnabled.USER32 ref: 009053D3
GetForegroundWindow.USER32(?,?,00000001), ref: 009053E0
IsIconic.USER32 ref: 009053EE
IsZoomed.USER32 ref: 009053FC

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 883f8c76d15a10d7e303d448095a31ce265c42e3133c8b32d0d9bf58265e2526
Instruction ID: 2d533eae94bd59bf72f72c47cd6772b20ee3d4555c5206338d27abaebb5c3463
Opcode Fuzzy Hash: 883f8c76d15a10d7e303d448095a31ce265c42e3133c8b32d0d9bf58265e2526
Instruction Fuzzy Hash: 1B11B231300915AFEB316F269C58A6BBB9DFF847A1B464439F846D3291CBB09D018AA5

Function 008D80A9 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 008D80C0
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 008D80CA
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 008D80D9
RtlAllocateHeap.NTDLL(00000000,?,00000002), ref: 008D80E0
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 008D80F6

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: HeapInformationToken$AllocateErrorLastProcess
String ID:
API String ID: 47921759-0
Opcode ID: 638cc2f822a088edf63282e6d9aa93387a5acd89981c49a38edb07dcab908b25
Instruction ID: 0f362c944ebbf53d4691500aadc92de2e8b4210b38b620fb05e9690ce489ee18
Opcode Fuzzy Hash: 638cc2f822a088edf63282e6d9aa93387a5acd89981c49a38edb07dcab908b25
Instruction Fuzzy Hash: 66F06231258304EFEB304FA5EC9DE673BBCFF49B55B000126F945C6250CB619D45EA60

Function 008EC397 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 008EC432
CoCreateInstance.COMBASE(00912D6C,00000000,00000001,00912BDC,?), ref: 008EC44A

Part of subcall function 00887DE1: _memmove.LIBCMT ref: 00887E22

CoUninitialize.COMBASE ref: 008EC6B7

Strings

.lnk, xrefs: 008EC3C6, 008EC3EE, 008EC3F8

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: da8fdfb31c23ec96ed74efb5f7df8b62c1472fec3e0ad0574e74989cbaf300dc
Instruction ID: 0a0011339245e6b1af583bfd28cfc57398f5803d6651b8a014c14d5705513cce
Opcode Fuzzy Hash: da8fdfb31c23ec96ed74efb5f7df8b62c1472fec3e0ad0574e74989cbaf300dc
Instruction Fuzzy Hash: 36A14C71104205AFD700EF58C881EABB7E8FF95358F04492CF596D71A2DB71EA49CB62

Function 00893030 Relevance: 6.6, APIs: 4, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: df8712b47c7d0f2ae2e0357c4b8b930ebf02376c73ad8866e6391acd05616ba2
Instruction ID: ea28380fb00796da80b5f25d1b24dde1061cdb019b9013db87a6ae89dc218868
Opcode Fuzzy Hash: df8712b47c7d0f2ae2e0357c4b8b930ebf02376c73ad8866e6391acd05616ba2
Instruction Fuzzy Hash: E92247716083019FDB24EF18C881B6AB7E4FB85714F18492DF99AD7291EB71E904CB93

Function 008FEE0D Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 008FEE3D
Process32FirstW.KERNEL32(00000000,?), ref: 008FEE4B

Part of subcall function 00887DE1: _memmove.LIBCMT ref: 00887E22

Process32NextW.KERNEL32(00000000,?), ref: 008FEF0B
CloseHandle.KERNEL32(00000000,?,?,?), ref: 008FEF1A

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 0df636e446b7689932464add3768ff5157b1aca2f14b364ca62f658e03eab0ea
Instruction ID: 8ddacf1af440c6e2e8ab331496cefb582d32d8a1b0b5d3156b8628f67b1baa1f
Opcode Fuzzy Hash: 0df636e446b7689932464add3768ff5157b1aca2f14b364ca62f658e03eab0ea
Instruction Fuzzy Hash: D4515B71508715AFD320EF28DC85E6BBBE8FF94710F50482DF595D62A1EB70A908CB92

Function 0090C498 Relevance: 6.1, APIs: 4, Instructions: 83nativewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00882612: GetWindowLongW.USER32(?,000000EB), ref: 00882623

GetCursorPos.USER32(?), ref: 0090C4D2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,008BB9AB,?,?,?,?,?), ref: 0090C4E7
GetCursorPos.USER32(?), ref: 0090C534
NtdllDialogWndProc_W.NTDLL(?,0000007B,?,?,?,?,?,?,?,?,?,?,008BB9AB,?,?,?), ref: 0090C56E

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Cursor$DialogLongMenuNtdllPopupProc_TrackWindow
String ID:
API String ID: 1423138444-0
Opcode ID: c74dd2b9948b70b11783794eadd6e66d78066a3f7f161f83d639198e3a9f2639
Instruction ID: 45d7bcf77c9b73a44cd6d4680d3dd73da8b754bc65ae31b4f3848d17a6c69212
Opcode Fuzzy Hash: c74dd2b9948b70b11783794eadd6e66d78066a3f7f161f83d639198e3a9f2639
Instruction Fuzzy Hash: 79317379614058AFCB25CF98CC68EBA7BB9FB09310F444265F905CB2A1C731AD51EBA4

Function 00881290 Relevance: 6.1, APIs: 4, Instructions: 59nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00882612: GetWindowLongW.USER32(?,000000EB), ref: 00882623

NtdllDialogWndProc_W.NTDLL(?,00000020,?), ref: 008812D8
GetClientRect.USER32(?,?), ref: 008BB5FB
GetCursorPos.USER32(?), ref: 008BB605
ScreenToClient.USER32(?,?), ref: 008BB610

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Client$CursorDialogLongNtdllProc_RectScreenWindow
String ID:
API String ID: 1010295502-0
Opcode ID: f8ec66eb99888a466ecc126e3b0692c9eebe762d6d3d2e35dd2c7cc6e1650f35
Instruction ID: f2823bc9d03ad61c51a0477cfdb5e60f8611ca2257989150a9fc7ba08d33ec90
Opcode Fuzzy Hash: f8ec66eb99888a466ecc126e3b0692c9eebe762d6d3d2e35dd2c7cc6e1650f35
Instruction Fuzzy Hash: 7911E335A14119AFCF10EFA8D8899AE77B8FB05311F500466F901E7251DB30BA529BA6

Function 008DE616 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 008DE628

Strings

(, xrefs: 008DE66E
|, xrefs: 008DE658

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 1a451526a6ed1f666b65ac05a965ea52d620542cf27db89fc070436c33abac5a
Instruction ID: 73302ca820e0a8bb414e234dbb0da7261703471f84c55f381ece2c0b25667ae3
Opcode Fuzzy Hash: 1a451526a6ed1f666b65ac05a965ea52d620542cf27db89fc070436c33abac5a
Instruction Fuzzy Hash: E1323575A007059FDB28DF19D4819AAB7F0FF58320B15C56EE89ADB3A1E770E941CB40

Function 008F22EE Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,008F180A,00000000), ref: 008F23E1
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 008F2418

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 8944eb57b5ba910de0515375a6d47541768b33fc0be810aa70e8642676296efe
Instruction ID: 25bec455350024ec351f5a7a8530550d35e2dd3003ecd833a75bb4cdf2d25c41
Opcode Fuzzy Hash: 8944eb57b5ba910de0515375a6d47541768b33fc0be810aa70e8642676296efe
Instruction Fuzzy Hash: 4241C5B190420DBFEB20DEB5DC85EBBB7BCFB40328F10406AF701E6650DAB59E419A55

Function 008EB3FB Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 008EB40B
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 008EB465
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 008EB4B2

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: d18eb41b66da20345cdd28028ee8e3b26d4678df490c2a5f8df088f0f3f4d9eb
Instruction ID: c8fce4a3ab97bf3825eaff1446eb64a80bc06176ddac1e00cec5b2a056626943
Opcode Fuzzy Hash: d18eb41b66da20345cdd28028ee8e3b26d4678df490c2a5f8df088f0f3f4d9eb
Instruction Fuzzy Hash: 35217135A10108EFCB00EFA9D884AEEBBB8FF49314F1480A9E945EB351DB319955DB51

Function 008D87E1 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 008A0DB6: std::exception::exception.LIBCMT ref: 008A0DEC
Part of subcall function 008A0DB6: __CxxThrowException@8.LIBCMT ref: 008A0E01

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 008D882B
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 008D8858
GetLastError.KERNEL32 ref: 008D8865

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 7c0d0bee7c26a604fbf3aaf863fcad5b4ab024a368845a35c64fb5dff2a03a54
Instruction ID: 3ffe46aafecf219ed5c28160484ee25aff6db7c6d23d8837c56b7698d25a27b3
Opcode Fuzzy Hash: 7c0d0bee7c26a604fbf3aaf863fcad5b4ab024a368845a35c64fb5dff2a03a54
Instruction Fuzzy Hash: 65116DB2814204AFE728EFA8DC85D6BB7BDFB45710B20862EE45597741EA30BC409B60

Function 008D874B Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 008D8774
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 008D878B
FreeSid.ADVAPI32(?), ref: 008D879B

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: d982a7c5f710d9e629aa4990ea8f950002fbadc95e4ced80489891e6ea7625ae
Instruction ID: 0f15454a1f9baefe0dc69e1052b3aa1acff4d23206efafcb67ac788050c62052
Opcode Fuzzy Hash: d982a7c5f710d9e629aa4990ea8f950002fbadc95e4ced80489891e6ea7625ae
Instruction Fuzzy Hash: 5EF04975A1130CBFDF00DFF4DC99AAEBBBCEF08701F1044A9A901E2681E6716B049B50

Function 008816DE Relevance: 3.1, APIs: 2, Instructions: 83nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00882612: GetWindowLongW.USER32(?,000000EB), ref: 00882623

Part of subcall function 008825DB: GetWindowLongW.USER32(?,000000EB), ref: 008825EC

GetParent.USER32(?), ref: 008BB7BA
NtdllDialogWndProc_W.NTDLL(?,00000133,?,?,?,?,?,?,?,?,008819B3,?,?,?,00000006,?), ref: 008BB834

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: LongWindow$DialogNtdllParentProc_
String ID:
API String ID: 314495775-0
Opcode ID: fb1d5d658cf151d02a80cd7213ee81fd99b38b735bfc7d30e049452cb02196e3
Instruction ID: 75a5694c843e690032695a0bf0c31eb7f47f79a9a4d76c86e5aa682abc4d94af
Opcode Fuzzy Hash: fb1d5d658cf151d02a80cd7213ee81fd99b38b735bfc7d30e049452cb02196e3
Instruction Fuzzy Hash: D5219134205508AFCF20AB68C888DA93B9AFB4A324F544264F525DB3B6CB719D12DB50

Function 008EC6D1 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 008EC6FB
FindClose.KERNEL32(00000000), ref: 008EC72B

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: b5befe4ba557ff3568d7852351e1503827492077def336a42268e0022c2dacfa
Instruction ID: abea66c6458aa92d35e097baca26d2f393eaf301b899e573cf5584f0d5cd23d5
Opcode Fuzzy Hash: b5befe4ba557ff3568d7852351e1503827492077def336a42268e0022c2dacfa
Instruction Fuzzy Hash: A2118E726002059FDB10EF29D845A2AF7E9FF85324F04852EF9AAC7291DB30A905CB81

Function 0090C57D Relevance: 3.0, APIs: 2, Instructions: 46nativewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00882612: GetWindowLongW.USER32(?,000000EB), ref: 00882623

NtdllDialogWndProc_W.NTDLL(?,0000002B,?,?,?,?,?,?,?,008BB93A,?,?,?), ref: 0090C5F1

Part of subcall function 008825DB: GetWindowLongW.USER32(?,000000EB), ref: 008825EC

SendMessageW.USER32(?,00000401,00000000,00000000), ref: 0090C5D7

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: LongWindow$DialogMessageNtdllProc_Send
String ID:
API String ID: 1273190321-0
Opcode ID: 0d4468889ece4b2ea343981ffe65f414f83afc6d263020e9378c7d768d38d948
Instruction ID: 24f0d5a74c49a175fbdd26be34c8097c61d3d4283342d609a3cf1be8ce8e5256
Opcode Fuzzy Hash: 0d4468889ece4b2ea343981ffe65f414f83afc6d263020e9378c7d768d38d948
Instruction Fuzzy Hash: 8701D875204314EFCB259F58CC54F6A3BA6FF89364F140624F9415B3E1CB31A802EB91

Function 0090C93E Relevance: 3.0, APIs: 2, Instructions: 33nativeCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0090C961
NtdllDialogWndProc_W.NTDLL(?,00000200,?,?,?,?,?,?,?,008BBA16,?,?,?,?,?), ref: 0090C98A

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ClientDialogNtdllProc_Screen
String ID:
API String ID: 3420055661-0
Opcode ID: 29298b2be521c1cd762c6bc2f3f4dfd674e49e287e1e2d66abe87722b1d82d3a
Instruction ID: f32f54171bdb11c986bfb7b894effcc2ebe0dd856d075246bdf8dcc8c5e74df0
Opcode Fuzzy Hash: 29298b2be521c1cd762c6bc2f3f4dfd674e49e287e1e2d66abe87722b1d82d3a
Instruction Fuzzy Hash: A3F03A7241021CFFEF148F85DC09DBE7BB9FB48311F00416AF901A2161D7716A60EBA4

Function 008EA06A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,008F9468,?,0090FB84,?), ref: 008EA097
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,008F9468,?,0090FB84,?), ref: 008EA0A9

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 15818bdf094589c4a102a8316b2031ca2c5dbc50fec88d7b96cdd54278513138
Instruction ID: edefc76eea292231ceab70cab111b9aee16c8a8e42daec6c24b9da00ae2f8510
Opcode Fuzzy Hash: 15818bdf094589c4a102a8316b2031ca2c5dbc50fec88d7b96cdd54278513138
Instruction Fuzzy Hash: 4EF0823511522DABDB21AFA8CC48FEA776CFF09761F004165F919D6181D630AA40CBA2

Function 0090CA7C Relevance: 3.0, APIs: 2, Instructions: 23nativeCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0090CA84
NtdllDialogWndProc_W.NTDLL(?,00000084,00000000,?,?,008BB995,?,?,?,?), ref: 0090CAB2

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 53746f7db9c26f8c902d828b401b33ea0158bbb737a68edc093437a829ed3385
Instruction ID: eac2d766ad75f72e25fe695c92a4bce3c6e31a0f91a5469c800487c409f9158b
Opcode Fuzzy Hash: 53746f7db9c26f8c902d828b401b33ea0158bbb737a68edc093437a829ed3385
Instruction Fuzzy Hash: E4E02670204208BFEB24CF19CC1AFBA3B58EB00750F408215F856D90E1C7709850E760

Function 008D81CB Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,008D8309), ref: 008D81E0
CloseHandle.KERNEL32(?,?,008D8309), ref: 008D81F2

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: a93696e754b10c204bc7f49e6839119319274e1d8bc70ac5d81a40ec23ef3211
Instruction ID: ad279494a6b2f5c191bca292e39dd2d274b52e145bbe6b4705099e1dcafbb8e6
Opcode Fuzzy Hash: a93696e754b10c204bc7f49e6839119319274e1d8bc70ac5d81a40ec23ef3211
Instruction Fuzzy Hash: 9CE0BF71014610AFEB252B64EC05D7777A9FB043507148929B455C4870DB615DA1EB10

Function 008AA155 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,00914178,008A8D57,t of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.,?,?,00000001), ref: 008AA15A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 008AA163

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 51a495a159cab6803cbc68138de310a13b24e57c01020751a212f572f9660495
Instruction ID: 9d347e03e5b74be8134238d89a5eea68c94aab785514f3cc65498f40629212e8
Opcode Fuzzy Hash: 51a495a159cab6803cbc68138de310a13b24e57c01020751a212f572f9660495
Instruction Fuzzy Hash: 10B0923106C208AFCA102B91EC19B883FA8EB45BF2F404020F60D84860CB625650AA91

Function 008AF1D9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ccb0add191aad47d08a6b88cb90e413dbe13d99f8674a70cf6e0f6813c02f1
Instruction ID: 8f3b23ff751fbacf903e686293dc0226f37bfaa1dc8caabf731c47e4240f7708
Opcode Fuzzy Hash: e0ccb0add191aad47d08a6b88cb90e413dbe13d99f8674a70cf6e0f6813c02f1
Instruction Fuzzy Hash: 33320321E6DF014DE7239674D822336A659EFB73C4F15D737E82AB5DA6EB28C4839100

Function 008B242E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c00e6746de87d5a6cb879f57804fe6d0d2ddef27b7eac2bb51802597a946444
Instruction ID: 9c460e63e6c13706d1e3be28c58541e9e1442563002f94fdc7fa1ffc5ab2a25e
Opcode Fuzzy Hash: 1c00e6746de87d5a6cb879f57804fe6d0d2ddef27b7eac2bb51802597a946444
Instruction Fuzzy Hash: 73B1E020E3AF514DD32396398831336BA5CAFBB2D5F51D71BFC2A74D62EB2189839141

Function 008E8889 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 008E889B

Part of subcall function 008A520A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,008E8F6E,00000000,?,?,?,?,008E911F,00000000,?), ref: 008A5213
Part of subcall function 008A520A: __aulldiv.LIBCMT ref: 008A5233

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: f6b95af3ad7d76740f13e7a42c6f374815347677d36e3553246b66777733231a
Instruction ID: 0d9afd5857af99b48cf15561a0532a637660d5bd66b251d266a464f75e16b24b
Opcode Fuzzy Hash: f6b95af3ad7d76740f13e7a42c6f374815347677d36e3553246b66777733231a
Instruction Fuzzy Hash: F321D576635510CBC329CF29D441A52B3E1EFA6310B288E6CE4F5CB2C0CA34A945DB54

Function 0090D78C Relevance: 1.6, APIs: 1, Instructions: 66nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00882612: GetWindowLongW.USER32(?,000000EB), ref: 00882623

NtdllDialogWndProc_W.NTDLL(?,00000112,?,00000000), ref: 0090D838

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 939e2727fc5d4b301309b9f40083a91db60fb79bb5876baff5ec46a4c788738f
Instruction ID: f56cead7ac4506370f3d4eae11e3ca12f5b8070aa71b1fef893a0dcd5b7b193a
Opcode Fuzzy Hash: 939e2727fc5d4b301309b9f40083a91db60fb79bb5876baff5ec46a4c788738f
Instruction Fuzzy Hash: 93112C75205215BFFB359EACCC06F7A3B5CDB42B20F208724F9119A5E3CB649D10A3A5

Function 0090D3B8 Relevance: 1.5, APIs: 1, Instructions: 47nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 008825DB: GetWindowLongW.USER32(?,000000EB), ref: 008825EC

NtdllDialogWndProc_W.NTDLL(?,00000115,?,?,?,?,?,?,008BB952,?,?,?,?,00000000,?), ref: 0090D432

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 1e06d6eea52b015c1f67bb660b9d9725e491164f7c252f5f664c258b7a8b36cb
Instruction ID: 01c895bcdd2e711aa583a6cabf9f0fd3dac68d0a76c902304d62e3b67ab47492
Opcode Fuzzy Hash: 1e06d6eea52b015c1f67bb660b9d9725e491164f7c252f5f664c258b7a8b36cb
Instruction Fuzzy Hash: 3601D431601114AFDB24DFA9C849FBA3BAAEF46325F444125F9565B2E2C331BC12D7A0

Function 0088189B Relevance: 1.5, APIs: 1, Instructions: 29nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00882612: GetWindowLongW.USER32(?,000000EB), ref: 00882623

NtdllDialogWndProc_W.NTDLL(?,00000006,00000000,?,?,?,00881B04,?,?,?,?,?), ref: 008818E2

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: f856c8e2ec9a65e2b3865cdafd3c4907b71c25b6d6389a9ad23855bcfd89564e
Instruction ID: 8a374d2dc7e71a3d44dc2b3ec125aeb1b18d05c56bfe3ddb9254b13590bdf319
Opcode Fuzzy Hash: f856c8e2ec9a65e2b3865cdafd3c4907b71c25b6d6389a9ad23855bcfd89564e
Instruction Fuzzy Hash: 60F0BE34210219DFCF18EF48C855D3637E6FB00310F504139F8528B2A2DB31D950EB50

Function 0090C8BE Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL(?,00000232,?,?), ref: 0090C8FE

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: 763bb0d8dc6146b9a5e8e63257b5560206b27633913a6cf47f517f8de6e461be
Instruction ID: de18dab9d62a24f35c2723e1891a41e90dd337a46032b8b17aa33c336146c7dc
Opcode Fuzzy Hash: 763bb0d8dc6146b9a5e8e63257b5560206b27633913a6cf47f517f8de6e461be
Instruction Fuzzy Hash: 01F06D35214255FFDB21DF58DC05FD63B95EB09720F048018FA11672E2CB706920E7A0

Function 008E4C27 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 008E4C4A

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: a5ef24d10b3b4bc5e803ae3ed3d417009531fffef7c4392a7482d27603d327a4
Instruction ID: fc784cacbbb61241a23d8ff9e15a5dd68d2d58e5c0e7c38cbbe5eed198bbb479
Opcode Fuzzy Hash: a5ef24d10b3b4bc5e803ae3ed3d417009531fffef7c4392a7482d27603d327a4
Instruction Fuzzy Hash: 8CD05E9116928D38EC2C07229E1FF7E0148F343796FF0B1897109CB0C1ECA05C406031

Function 008D87B1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,008D8389), ref: 008D87D1

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: daaca7d97e3745f0f9de32bf002d14655b14787bfbd318777ed96f4fd60f1e52
Instruction ID: 5d24131771877721f1f99df45e9c99aaab165559e3e4a7ba93d32db8b102197b
Opcode Fuzzy Hash: daaca7d97e3745f0f9de32bf002d14655b14787bfbd318777ed96f4fd60f1e52
Instruction Fuzzy Hash: 70D05E3226450EAFEF018EA4DC01EAF3B69EB04B01F408111FE15C50A1C775D935AB60

Function 0090C909 Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL(?,00000053,?,?,?,008BB9BC,?,?,?,?,?,?), ref: 0090C934

Part of subcall function 0090B635: _memset.LIBCMT ref: 0090B644
Part of subcall function 0090B635: _memset.LIBCMT ref: 0090B653
Part of subcall function 0090B635: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00946F20,00946F64), ref: 0090B682
Part of subcall function 0090B635: CloseHandle.KERNEL32 ref: 0090B694

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: _memset$CloseCreateDialogHandleNtdllProc_Process
String ID:
API String ID: 2364484715-0
Opcode ID: 85f01fccf9e95a69b97cc8cfbdacc25acbec1bbab7d7fc70021d52d0077fe919
Instruction ID: 097a9497a812de97fd055551cd9f2c911ca5c070ce6f98c5ca3fcb1179ed2fd4
Opcode Fuzzy Hash: 85f01fccf9e95a69b97cc8cfbdacc25acbec1bbab7d7fc70021d52d0077fe919
Instruction Fuzzy Hash: 0FE01276110208EFCB01AF44DC10E9537A5FB18310F018010FA16572B2CB31A920EF50

Function 0088167D Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00882612: GetWindowLongW.USER32(?,000000EB), ref: 00882623

NtdllDialogWndProc_W.NTDLL(?,00000007,?,00000000,00000000,?,?,?,00881AEE,?,?,?), ref: 008816AB

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 21ccd5151ee8959999f3a97ec74b7e0ba5697942027249d179babf3b4df99139
Instruction ID: cc2f113b08c1db009107d60fba5f5510b02403973ed65f3c1db082317a80ab5b
Opcode Fuzzy Hash: 21ccd5151ee8959999f3a97ec74b7e0ba5697942027249d179babf3b4df99139
Instruction Fuzzy Hash: 02E0EC35104208FBCF15EF94DC21E643B26FB59314F508428FA459A2A2CA32A522EB51

Function 0090C88F Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL ref: 0090C8B4

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: 2ec0c47902d08f768d988245e64da702522bb33bfe6861917f9d17a12f045ec8
Instruction ID: 073ec9b5fa9254fc339bc1a93299d432739339a99a69123c80854dea30c04c5e
Opcode Fuzzy Hash: 2ec0c47902d08f768d988245e64da702522bb33bfe6861917f9d17a12f045ec8
Instruction Fuzzy Hash: A9E0E239214209EFCB01DF88D844D963BA5AB1D300F014054FA0547362CB71A820EBA1

Function 0090C860 Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL ref: 0090C885

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: 54ffeb8a79fc7cc273867c703cd287372976f7c0a41d8dc161fe6722e933a59e
Instruction ID: 043eb77161a32faf8212d4ad9bfd447fda73d71f8c767bf55497ff925e835308
Opcode Fuzzy Hash: 54ffeb8a79fc7cc273867c703cd287372976f7c0a41d8dc161fe6722e933a59e
Instruction Fuzzy Hash: E2E04279254249EFDB01DF88DC95E963BA5AB1D700F014054FA1557362CB71A920EB61

Function 008816B5 Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00882612: GetWindowLongW.USER32(?,000000EB), ref: 00882623

Part of subcall function 0088201B: DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 008820D3
Part of subcall function 0088201B: KillTimer.USER32(-00000001,?,?,?,?,008816CB,00000000,?,?,00881AE2,?,?), ref: 0088216E

NtdllDialogWndProc_W.NTDLL(?,00000002,00000000,00000000,00000000,?,?,00881AE2,?,?), ref: 008816D4

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Window$DestroyDialogKillLongNtdllProc_Timer
String ID:
API String ID: 2797419724-0
Opcode ID: a72f8ca5ac72fb0fc1b29b8f86e4998f01ea8547eab37bb3bb12554576d5d0a4
Instruction ID: 30d069f29bc3aeeb6c5bb1f4e4081f8abfb2e0cb0b41267d8d23b910038e87cb
Opcode Fuzzy Hash: a72f8ca5ac72fb0fc1b29b8f86e4998f01ea8547eab37bb3bb12554576d5d0a4
Instruction Fuzzy Hash: 9AD01271140308BBDA20BB94DC17F593A1DEB14750F408021BA04E91D3DA716910A659

Function 008AA124 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 008AA12A

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b4ddfd8451a4e09fa23330b7cba626b8a6cf3298f099bcb41dbfaf8663e7b122
Instruction ID: 3839de2d887679ae65c6d4375d6ab527ffb68ddb97dc360c686ca4555ebd2467
Opcode Fuzzy Hash: b4ddfd8451a4e09fa23330b7cba626b8a6cf3298f099bcb41dbfaf8663e7b122
Instruction Fuzzy Hash: 09A0123001810CABCA001B41EC044447F9CD6002E07004020F40C40421873255105580

Function 00898808 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 909bff7c8dc5e2fa141612666afc866cdc3b5c5f60cfc940238df10d34a7295d
Instruction ID: a3108b1c07577f671b4745d628c2dad9c24caf0d98b47701bcbf35d78c5adf65
Opcode Fuzzy Hash: 909bff7c8dc5e2fa141612666afc866cdc3b5c5f60cfc940238df10d34a7295d
Instruction Fuzzy Hash: 2722143060451BCBDF28AA24C49477CBBE1FB46358F3C826BD956CB692DB70DD91CA42

Function 008A21C5 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: c041df5a4fb47c91b9d4f1417c5d54559afcb85ef7ee097883059321a8bae461
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 26C182322050A30AEF6D463D843413EFAA1BFA37B171A075DD8B2DB9D4EE24C965D720

Function 008A25FA Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: ab019f320124dfb35ac268a07ae69c3c1733e274f4e1c60809b3109414c310a1
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: E6C173322051A30AEF3D463E843453EBAA1BFA37B171A076DD4B2DB9D4EE14C925D720

Function 008A1978 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: db5ccb8c4af99a4d9752350da73db13cead079a295a5b9b74fc989aa20c866a3
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 7CC170322051A309EF6D4639847813EBAA1EFA37B171A176DD4B2DB9C4EE20D925D720

Function 015FBF30 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732693093.00000000015F8000.00000040.00000020.00020000.00000000.sdmp, Offset: 015F8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15f8000_7056ZCiFdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction ID: e9ae8ca92932e80a157f1ac6f0dc5b7449f83dbb25f5cde1adf86a696c26c6d5
Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction Fuzzy Hash: C841C2B1D1051CEBCF48CFADC991AAEBBF2AF88201F548299D516AB345D730AB41DB40

Function 015FBDC0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732693093.00000000015F8000.00000040.00000020.00020000.00000000.sdmp, Offset: 015F8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15f8000_7056ZCiFdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction ID: c5f8c2ba70d5d93516fa70f3652afc6414421d8cd906455ca6e9a796a92ec12b
Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction Fuzzy Hash: 3D01A478A00109EFCB48DF98C5909AEF7F5FF48310F208599DA09AB341D730AE41DB80

Function 015FBE20 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732693093.00000000015F8000.00000040.00000020.00020000.00000000.sdmp, Offset: 015F8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15f8000_7056ZCiFdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction ID: 2bae1186ad3a20cfa3aa806440486723b1cfd87d35e429e98b5b3f4ba9dab905
Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction Fuzzy Hash: B6019278A10109EFCB44DF98C5909AEF7F5FB48310F208599DA19AB301D730AE41DB80

Function 015FA75E Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732693093.00000000015F8000.00000040.00000020.00020000.00000000.sdmp, Offset: 015F8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15f8000_7056ZCiFdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39883051ad0acd5fc3a9b65a285c220fc8651299cfdca9718842298b505bee9e
Instruction ID: 12cbbee2ad97ca28ebd479973cedbf0f86dc4bb29c9604106d163cb5d8cfbbc3
Opcode Fuzzy Hash: 39883051ad0acd5fc3a9b65a285c220fc8651299cfdca9718842298b505bee9e
Instruction Fuzzy Hash: F6C08C300453C89ADB028759E08C7407BEDAB0AA18F1400E4D8080BA02C3A96A048A45

Function 015FA770 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732693093.00000000015F8000.00000040.00000020.00020000.00000000.sdmp, Offset: 015F8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_15f8000_7056ZCiFdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48

Function 008F7806 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 008F785B
DeleteObject.GDI32(00000000), ref: 008F786D
DestroyWindow.USER32 ref: 008F787B
GetDesktopWindow.USER32 ref: 008F7895
GetWindowRect.USER32(00000000), ref: 008F789C
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 008F79DD
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 008F79ED
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 008F7A35
GetClientRect.USER32(00000000,?), ref: 008F7A41
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 008F7A7B
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 008F7A9D
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 008F7AB0
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 008F7ABB
GlobalLock.KERNEL32(00000000), ref: 008F7AC4
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 008F7AD3
GlobalUnlock.KERNEL32(00000000), ref: 008F7ADC
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 008F7AE3
GlobalFree.KERNEL32(00000000), ref: 008F7AEE
CreateStreamOnHGlobal.COMBASE(00000000,00000001,88C00000), ref: 008F7B00
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00912CAC,00000000), ref: 008F7B16
GlobalFree.KERNEL32(00000000), ref: 008F7B26
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 008F7B4C
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 008F7B6B
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 008F7B8D
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 008F7D7A

Strings

, xrefs: 008F7D00
DISPLAY, xrefs: 008F7BDD
static, xrefs: 008F7A75, 008F7BCC
AutoIt v3, xrefs: 008F7A2D

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 0867d95d4cfcec0a5f2f4a7c686cfe1f2f215aa699649b05ecdc0f9a37167a34
Instruction ID: 4a3d3f5545318d6784f68864aa0cc5eb0a735a633c32fa5047d05664fe4fd8dc
Opcode Fuzzy Hash: 0867d95d4cfcec0a5f2f4a7c686cfe1f2f215aa699649b05ecdc0f9a37167a34
Instruction Fuzzy Hash: 3F028B71A14119EFEB14DFA8CC99EAE7BB9FB48310F148168F915EB2A1C7709D01DB60

Function 0090356B Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,0090F910), ref: 00903627
IsWindowVisible.USER32(?), ref: 0090364B

Strings

GETSELECTED, xrefs: 009038A3
GETLINECOUNT, xrefs: 009038C6
GETCURRENTCOL, xrefs: 00903928
TABRIGHT, xrefs: 0090369D
SENDCOMMANDID, xrefs: 009039DA
FINDSTRING, xrefs: 00903776
ISVISIBLE, xrefs: 00903637
HIDEDROPDOWN, xrefs: 00903700
SELECTSTRING, xrefs: 00903806
ISCHECKED, xrefs: 00903839
CHECK, xrefs: 0090386D
EDITPASTE, xrefs: 0090395F
ADDSTRING, xrefs: 00903716
DELSTRING, xrefs: 00903749
TABLEFT, xrefs: 00903687
UNCHECK, xrefs: 00903883
SHOWDROPDOWN, xrefs: 009036E0
GETCURRENTSELECTION, xrefs: 009037E3
ISENABLED, xrefs: 0090366B
SETCURRENTSELECTION, xrefs: 009037B6
CURRENTTAB, xrefs: 009036BD
GETCURRENTLINE, xrefs: 009038ED
GETLINE, xrefs: 0090399B

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 0065f633b84378dd0871d770a71a92396cae57e3d61dc8a1cc35340b2d00438a
Instruction ID: e0cc7fe3bb9580859ee742f3d5c487ef60b50de9f959b69a7afd1e09ae5f0472
Opcode Fuzzy Hash: 0065f633b84378dd0871d770a71a92396cae57e3d61dc8a1cc35340b2d00438a
Instruction Fuzzy Hash: 55D17E302043119FCB14EF14C456A6E77E9FF95354F188868F8869B7E2DB61EE4ACB42

Function 0090A5DA Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0090A630
GetSysColorBrush.USER32(0000000F), ref: 0090A661
GetSysColor.USER32(0000000F), ref: 0090A66D
SetBkColor.GDI32(?,000000FF), ref: 0090A687
SelectObject.GDI32(?,00000000), ref: 0090A696
InflateRect.USER32(?,000000FF,000000FF), ref: 0090A6C1
GetSysColor.USER32(00000010), ref: 0090A6C9
CreateSolidBrush.GDI32(00000000), ref: 0090A6D0
FrameRect.USER32(?,?,00000000), ref: 0090A6DF
DeleteObject.GDI32(00000000), ref: 0090A6E6
InflateRect.USER32(?,000000FE,000000FE), ref: 0090A731
FillRect.USER32(?,?,00000000), ref: 0090A763
GetWindowLongW.USER32(?,000000F0), ref: 0090A78E

Part of subcall function 0090A8CA: GetSysColor.USER32(00000012), ref: 0090A903
Part of subcall function 0090A8CA: SetTextColor.GDI32(?,?), ref: 0090A907
Part of subcall function 0090A8CA: GetSysColorBrush.USER32(0000000F), ref: 0090A91D
Part of subcall function 0090A8CA: GetSysColor.USER32(0000000F), ref: 0090A928
Part of subcall function 0090A8CA: GetSysColor.USER32(00000011), ref: 0090A945
Part of subcall function 0090A8CA: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0090A953
Part of subcall function 0090A8CA: SelectObject.GDI32(?,00000000), ref: 0090A964
Part of subcall function 0090A8CA: SetBkColor.GDI32(?,00000000), ref: 0090A96D
Part of subcall function 0090A8CA: SelectObject.GDI32(?,?), ref: 0090A97A
Part of subcall function 0090A8CA: InflateRect.USER32(?,000000FF,000000FF), ref: 0090A999
Part of subcall function 0090A8CA: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0090A9B0
Part of subcall function 0090A8CA: GetWindowLongW.USER32(00000000,000000F0), ref: 0090A9C5
Part of subcall function 0090A8CA: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0090A9ED

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: 7730c5f39dbc60203a3d874fd288429c32ae1c09f9d6c64e41b9c4c1075034e7
Instruction ID: 19f97fb699172462cb13221db2514c6449c50e514e853f5d75be8bfef04a57ac
Opcode Fuzzy Hash: 7730c5f39dbc60203a3d874fd288429c32ae1c09f9d6c64e41b9c4c1075034e7
Instruction Fuzzy Hash: 4D918D72418301EFDB609F64DC08A6B7BB9FF89321F104B29F962961E0D771DA44DB92

Function 008F74AB Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 008F74DE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 008F759D
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 008F75DB
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 008F75ED
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 008F7633
GetClientRect.USER32(00000000,?), ref: 008F763F
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 008F7683
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 008F7692
GetStockObject.GDI32(00000011), ref: 008F76A2
SelectObject.GDI32(00000000,00000000), ref: 008F76A6
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 008F76B6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 008F76BF
DeleteDC.GDI32(00000000), ref: 008F76C8
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 008F76F4
SendMessageW.USER32(00000030,00000000,00000001), ref: 008F770B
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 008F7746
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 008F775A
SendMessageW.USER32(00000404,00000001,00000000), ref: 008F776B
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 008F779B
GetStockObject.GDI32(00000011), ref: 008F77A6
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 008F77B1
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 008F77BB

Strings

DISPLAY, xrefs: 008F7688
msctls_progress32, xrefs: 008F773C
static, xrefs: 008F767D, 008F7795
AutoIt v3, xrefs: 008F762B

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 49c33c317a68347afc472e046a8c30ad7e39bef73b404951903ef3201142ad30
Instruction ID: 614c9d8ff2dcc2503910ca9b3cddfaf809d1fefed3cde460ea8e054804044808
Opcode Fuzzy Hash: 49c33c317a68347afc472e046a8c30ad7e39bef73b404951903ef3201142ad30
Instruction Fuzzy Hash: B2A17F71A54619BFEB14DBA8DC4AFAE7BB9FB09710F004115FA14E72E1D6B0AD00DB60

Function 008EAD10 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 008EAD1E
GetDriveTypeW.KERNEL32(?,0090FAC0,?,\\.\,0090F910), ref: 008EADFB
SetErrorMode.KERNEL32(00000000,0090FAC0,?,\\.\,0090F910), ref: 008EAF59

Strings

RAMDisk, xrefs: 008EAE25
FileBackedVirtual, xrefs: 008EAF28
MMC, xrefs: 008EAF1A
Fibre, xrefs: 008EAEE9
SSD, xrefs: 008EAE86
1394, xrefs: 008EAEDB
SCSI, xrefs: 008EAEC6
PhysicalDrive, xrefs: 008EADA7
Fixed, xrefs: 008EAE43
Unknown, xrefs: 008EAE1B, 008EAEBF
RAID, xrefs: 008EAEF7
iSCSI, xrefs: 008EAEFE
ATAPI, xrefs: 008EAECD
SSA, xrefs: 008EAEE2
CDROM, xrefs: 008EAE2F
Removable, xrefs: 008EAE4D
Network, xrefs: 008EAE39
\\.\, xrefs: 008EAD70
SATA, xrefs: 008EAF0C
Virtual, xrefs: 008EAF21
SAS, xrefs: 008EAF05
ATA, xrefs: 008EAED4
USB, xrefs: 008EAEF0

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: c52ef22180c14e842ae79ac9f9c626fe8924b15b631fdc88f5ea5f84fca4b3bf
Instruction ID: e8eb6160bfc1f4d72e011551ea7d27d6bdd07a8f26693125b65dfec5e045a7bc
Opcode Fuzzy Hash: c52ef22180c14e842ae79ac9f9c626fe8924b15b631fdc88f5ea5f84fca4b3bf
Instruction Fuzzy Hash: 485187B064424A9BCB18EB16D952C7E73B1FF8AB08B204156F407E7291DE71BD41DB53

Function 008868DC Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00886931
__wcsnicmp.LIBCMT ref: 00886949
__wcsnicmp.LIBCMT ref: 00886961
__wcsnicmp.LIBCMT ref: 00886979
__wcsnicmp.LIBCMT ref: 00886991
__wcsnicmp.LIBCMT ref: 008869A9
__wcsnicmp.LIBCMT ref: 008869C1
__wcsnicmp.LIBCMT ref: 008869D5
__wcsnicmp.LIBCMT ref: 00886A16
__wcsnicmp.LIBCMT ref: 00886A2A
__wcsnicmp.LIBCMT ref: 00886A3E
__wcsnicmp.LIBCMT ref: 00886A52

Strings

#comments-end, xrefs: 00886A38
#cs, xrefs: 008869CF, 00886A24
Bad directive syntax error, xrefs: 008BE31A
#notrayicon, xrefs: 00886943
#comments-start, xrefs: 008869BB, 00886A10
#include, xrefs: 008869A3
#pragma compile, xrefs: 0088692B
#ce, xrefs: 00886A4C
Cannot parse #include, xrefs: 008BE3F0
#include-once, xrefs: 0088698B
#requireadmin, xrefs: 0088695B
#OnAutoItStartRegister, xrefs: 00886973
Unterminated group of comments, xrefs: 008BE403

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 387633a2b62fb872e13f7217007449b56139cb68a86679e39cc6532fa684dd87
Instruction ID: 448f9e762dfe6a9a3a33628bc30e0677e11b57c19c0f7bdbb84a7162015acdee
Opcode Fuzzy Hash: 387633a2b62fb872e13f7217007449b56139cb68a86679e39cc6532fa684dd87
Instruction Fuzzy Hash: F38105B06002196BDB21BB68EC43FEB37A8FF15704F040025F905EA6D2FB60DA61D762

Function 00882C18 Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00882CA2
DeleteObject.GDI32(00000000), ref: 00882CE8
DeleteObject.GDI32(00000000), ref: 00882CF3
DestroyCursor.USER32(00000000), ref: 00882CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00882D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 008BC43B
6F550200.COMCTL32(?,000000FF,?), ref: 008BC474
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 008BC89D

Part of subcall function 00881B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00882036,?,00000000,?,?,?,?,008816CB,00000000,?), ref: 00881B9A

SendMessageW.USER32(?,00001053), ref: 008BC8DA
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 008BC8F1

Strings

0, xrefs: 008BC731

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: DestroyMessageSendWindow$DeleteObject$CursorF550200InvalidateMoveRect
String ID: 0
API String ID: 2586706302-4108050209
Opcode ID: ce0c64806533b1edf882df529653331f9d3b00b15a92b4937460867127e14bcd
Instruction ID: 80a4c2c3eef13fd9367f9ce48684c8463131a532868afafc7757b3e71b3ce7d0
Opcode Fuzzy Hash: ce0c64806533b1edf882df529653331f9d3b00b15a92b4937460867127e14bcd
Instruction Fuzzy Hash: B3129D30604201EFDB21DF28C994BB9BBE5FF05304F5445A9F896CB662CB31E942DBA1

Function 0090A8CA Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0090A903
SetTextColor.GDI32(?,?), ref: 0090A907
GetSysColorBrush.USER32(0000000F), ref: 0090A91D
GetSysColor.USER32(0000000F), ref: 0090A928
CreateSolidBrush.GDI32(?), ref: 0090A92D
GetSysColor.USER32(00000011), ref: 0090A945
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0090A953
SelectObject.GDI32(?,00000000), ref: 0090A964
SetBkColor.GDI32(?,00000000), ref: 0090A96D
SelectObject.GDI32(?,?), ref: 0090A97A
InflateRect.USER32(?,000000FF,000000FF), ref: 0090A999
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0090A9B0
GetWindowLongW.USER32(00000000,000000F0), ref: 0090A9C5
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0090A9ED
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0090AA14
InflateRect.USER32(?,000000FD,000000FD), ref: 0090AA32
DrawFocusRect.USER32(?,?), ref: 0090AA3D
GetSysColor.USER32(00000011), ref: 0090AA4B
SetTextColor.GDI32(?,00000000), ref: 0090AA53
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0090AA67
SelectObject.GDI32(?,0090A5FA), ref: 0090AA7E
DeleteObject.GDI32(?), ref: 0090AA89
SelectObject.GDI32(?,?), ref: 0090AA8F
DeleteObject.GDI32(?), ref: 0090AA94
SetTextColor.GDI32(?,?), ref: 0090AA9A
SetBkColor.GDI32(?,?), ref: 0090AAA4

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: d4891b11005452285da268d2003bb177264fca95fe414fbe680378ce3d2328f4
Instruction ID: c6e85e54003e13b8d98f4b95df6bb603714eda8bec4563db68190d6f676869ba
Opcode Fuzzy Hash: d4891b11005452285da268d2003bb177264fca95fe414fbe680378ce3d2328f4
Instruction Fuzzy Hash: F8513B71914208EFDF209FA4DC48EAE7BB9EF09320F114625F911AB2A1D7759A40EF90

Function 009089D5 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00908AC1
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00908AD2
CharNextW.USER32(0000014E), ref: 00908B01
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00908B42
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00908B58
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00908B69
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00908B86
SetWindowTextW.USER32(?,0000014E), ref: 00908BD8
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00908BEE
SendMessageW.USER32(?,00001002,00000000,?), ref: 00908C1F
_memset.LIBCMT ref: 00908C44
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00908C8D
_memset.LIBCMT ref: 00908CEC
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00908D16
SendMessageW.USER32(?,00001074,?,00000001), ref: 00908D6E
SendMessageW.USER32(?,0000133D,?,?), ref: 00908E1B
InvalidateRect.USER32(?,00000000,00000001), ref: 00908E3D
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00908E87
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00908EB4
DrawMenuBar.USER32(?), ref: 00908EC3
SetWindowTextW.USER32(?,0000014E), ref: 00908EEB

Strings

0, xrefs: 00908E55

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: f1c92f709f0c1c128793396472cf44dd48a29f48380cf122413565097117fb08
Instruction ID: 253cc38bf1e2563293b17b88dc7196e5e9889e90f2999908ec0ffb1ac93c93b9
Opcode Fuzzy Hash: f1c92f709f0c1c128793396472cf44dd48a29f48380cf122413565097117fb08
Instruction Fuzzy Hash: 69E18D71A04219AFDF209F64CC84EEF7BB9EF09710F008156F995AA2D1DB748A81DF60

Function 0090488F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 009049CA
GetDesktopWindow.USER32 ref: 009049DF
GetWindowRect.USER32(00000000), ref: 009049E6
GetWindowLongW.USER32(?,000000F0), ref: 00904A48
DestroyWindow.USER32(?), ref: 00904A74
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00904A9D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00904ABB
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00904AE1
SendMessageW.USER32(?,00000421,?,?), ref: 00904AF6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00904B09
IsWindowVisible.USER32(?), ref: 00904B29
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00904B44
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00904B58
GetWindowRect.USER32(?,?), ref: 00904B70
MonitorFromPoint.USER32(?,?,00000002), ref: 00904B96
GetMonitorInfoW.USER32(00000000,?), ref: 00904BB0
CopyRect.USER32(?,?), ref: 00904BC7
SendMessageW.USER32(?,00000412,00000000), ref: 00904C32

Strings

0, xrefs: 00904975
tooltips_class32, xrefs: 00904A96
(, xrefs: 00904BA3

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 134ee38f7a549c33acbac206714524b63084921e23b80197021aab303458f999
Instruction ID: 3a9ce9c2896134cda94d8aedf43a4f3fd1b234f335471a076b4cc8a07490c939
Opcode Fuzzy Hash: 134ee38f7a549c33acbac206714524b63084921e23b80197021aab303458f999
Instruction Fuzzy Hash: 2BB19DB1608341AFDB04DF64C844B6ABBE8FF88714F008A1CF6999B2A1D771ED05CB56

Function 008827D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 008828BC
GetSystemMetrics.USER32(00000007), ref: 008828C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 008828EF
GetSystemMetrics.USER32(00000008), ref: 008828F7
GetSystemMetrics.USER32(00000004), ref: 0088291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00882939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00882949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0088297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00882990
GetClientRect.USER32(00000000,000000FF), ref: 008829AE
GetStockObject.GDI32(00000011), ref: 008829CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 008829D5

Part of subcall function 00882344: GetCursorPos.USER32(?), ref: 00882357
Part of subcall function 00882344: ScreenToClient.USER32(009457B0,?), ref: 00882374
Part of subcall function 00882344: GetAsyncKeyState.USER32(00000001), ref: 00882399
Part of subcall function 00882344: GetAsyncKeyState.USER32(00000002), ref: 008823A7

SetTimer.USER32(00000000,00000000,00000028,00881256), ref: 008829FC

Strings

AutoIt v3 GUI, xrefs: 00882974

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: d5ac5cc4b3e02061d4f09be7c49cb367f6e9a852b6ad8a66f1a34510ed180013
Instruction ID: 7426e4c51f01db3961219d706ea1734e0a65bb5031d0cbc49150d47a206e8561
Opcode Fuzzy Hash: d5ac5cc4b3e02061d4f09be7c49cb367f6e9a852b6ad8a66f1a34510ed180013
Instruction Fuzzy Hash: 1DB19E71A1020AEFDB24EFA8DC55FAE7BB4FB08314F104129FA15E72A0DB74A941DB50

Function 008DA439 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 008DA47A
__swprintf.LIBCMT ref: 008DA51B
_wcscmp.LIBCMT ref: 008DA52E
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 008DA583
_wcscmp.LIBCMT ref: 008DA5BF
GetClassNameW.USER32(?,?,00000400), ref: 008DA5F6
GetDlgCtrlID.USER32(?), ref: 008DA648
GetWindowRect.USER32(?,?), ref: 008DA67E
GetParent.USER32(?), ref: 008DA69C
ScreenToClient.USER32(00000000), ref: 008DA6A3
GetClassNameW.USER32(?,?,00000100), ref: 008DA71D
_wcscmp.LIBCMT ref: 008DA731
GetWindowTextW.USER32(?,?,00000400), ref: 008DA757
_wcscmp.LIBCMT ref: 008DA76B

Part of subcall function 008A362C: _iswctype.LIBCMT ref: 008A3634

Strings

%s%u, xrefs: 008DA515

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 1ee29e932c5a8df0ae21fded329ff7d510d307983b188377a4ed6aaf5d99ba07
Instruction ID: d2d3f330db191583d9bbb630c708bc69d45f8f3e49d32ed93fe67c1af36856e3
Opcode Fuzzy Hash: 1ee29e932c5a8df0ae21fded329ff7d510d307983b188377a4ed6aaf5d99ba07
Instruction Fuzzy Hash: C1A1D771204706EFD718DF64C884FAAB7E8FF54314F24462AF999D2250DB30EA55CB92

Function 008DAED4 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 008DAF18
_wcscmp.LIBCMT ref: 008DAF29
GetWindowTextW.USER32(00000001,?,00000400), ref: 008DAF51
CharUpperBuffW.USER32(?,00000000), ref: 008DAF6E
_wcscmp.LIBCMT ref: 008DAF8C
_wcsstr.LIBCMT ref: 008DAF9D
GetClassNameW.USER32(00000018,?,00000400), ref: 008DAFD5
_wcscmp.LIBCMT ref: 008DAFE5
GetWindowTextW.USER32(00000002,?,00000400), ref: 008DB00C
GetClassNameW.USER32(00000018,?,00000400), ref: 008DB055
_wcscmp.LIBCMT ref: 008DB065
GetClassNameW.USER32(00000010,?,00000400), ref: 008DB08D
GetWindowRect.USER32(00000004,?), ref: 008DB0F6

Strings

@, xrefs: 008DAEF9
ThumbnailClass, xrefs: 008DAFE0, 008DB060

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: ed219274d058c2101c6f60507acd1c75f3acdfd2e55aaa0626420c5ab4b96990
Instruction ID: 7eff77c6b8a1e5d7aa26d448c356ed7ffdc5a7e752c0b9976367d97aaaeee118
Opcode Fuzzy Hash: ed219274d058c2101c6f60507acd1c75f3acdfd2e55aaa0626420c5ab4b96990
Instruction Fuzzy Hash: D6819E71108209DFDB15DF14C881BAABBE8FF44714F14866AFD85CA296DB30DE49CB62

Function 008DABD4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 008DAC33

Strings

[HANDLE:, xrefs: 008DAC3F
REGEXP=, xrefs: 008DAC48
HANDLE=, xrefs: 008DAC2C
[REGEXPTITLE:, xrefs: 008DAC5B
LAST, xrefs: 008DABF8
ACTIVE, xrefs: 008DAC0E
CLASSNAME=, xrefs: 008DAC70
[ALL, xrefs: 008DACD9
ALL, xrefs: 008DACC7
[ACTIVE, xrefs: 008DAC20
[CLASS:, xrefs: 008DAC83
[LAST, xrefs: 008DACE0

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 9d9328660f2548bb570bd0a868e80d006741c735847fbad62b782d19c997eef7
Instruction ID: 904f8a728d73d73c607da2f945c296b8c170bfd2b7a9b01d1a732f92a0dd5589
Opcode Fuzzy Hash: 9d9328660f2548bb570bd0a868e80d006741c735847fbad62b782d19c997eef7
Instruction Fuzzy Hash: 31319271548209A7DA24FA98DE03EAEB7A4FB10724F700526F441F15D1EB51AF04DA53

Function 008F4FFD Relevance: 25.6, APIs: 17, Instructions: 110COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 008F5013
LoadCursorW.USER32(00000000,00007F00), ref: 008F501E
LoadCursorW.USER32(00000000,00007F03), ref: 008F5029
LoadCursorW.USER32(00000000,00007F8B), ref: 008F5034
LoadCursorW.USER32(00000000,00007F01), ref: 008F503F
LoadCursorW.USER32(00000000,00007F81), ref: 008F504A
LoadCursorW.USER32(00000000,00007F88), ref: 008F5055
LoadCursorW.USER32(00000000,00007F80), ref: 008F5060
LoadCursorW.USER32(00000000,00007F86), ref: 008F506B
LoadCursorW.USER32(00000000,00007F83), ref: 008F5076
LoadCursorW.USER32(00000000,00007F85), ref: 008F5081
LoadCursorW.USER32(00000000,00007F82), ref: 008F508C
LoadCursorW.USER32(00000000,00007F84), ref: 008F5097
LoadCursorW.USER32(00000000,00007F04), ref: 008F50A2
LoadCursorW.USER32(00000000,00007F02), ref: 008F50AD
LoadCursorW.USER32(00000000,00007F89), ref: 008F50B8
GetCursorInfo.USER32(?), ref: 008F50C8

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: c06f23f4bb1283ad98d6300956c72d2c8bc9250ab19f009ae8d31c26e4e81b9d
Instruction ID: 69db20e77a00e4baaea8fae246bb8f752ee91303f7051353fbc124f1068886de
Opcode Fuzzy Hash: c06f23f4bb1283ad98d6300956c72d2c8bc9250ab19f009ae8d31c26e4e81b9d
Instruction Fuzzy Hash: D831F2B1D4871E6ADF109FB68C8996EBFE8FF04754F50453AE60DE7280DA78A5008F91

Function 0090A1B9 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0090A259
DestroyWindow.USER32(?,?), ref: 0090A2D3

Part of subcall function 00887BCC: _memmove.LIBCMT ref: 00887C06

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0090A34D
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0090A36F
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0090A382
DestroyWindow.USER32(00000000), ref: 0090A3A4
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00880000,00000000), ref: 0090A3DB
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0090A3F4
GetDesktopWindow.USER32 ref: 0090A40D
GetWindowRect.USER32(00000000), ref: 0090A414
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0090A42C
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0090A444

Part of subcall function 008825DB: GetWindowLongW.USER32(?,000000EB), ref: 008825EC

Strings

0, xrefs: 0090A26F
tooltips_class32, xrefs: 0090A346, 0090A3D4

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: e4ff21166e15ad14e11c0dc7a2a62c767ee4c650eae9c39608ce1c41f27b12da
Instruction ID: ed553b17ff516f2310aca8e462fc591c2b35133363f133818cb6eac0d96b6786
Opcode Fuzzy Hash: e4ff21166e15ad14e11c0dc7a2a62c767ee4c650eae9c39608ce1c41f27b12da
Instruction Fuzzy Hash: 8D716675154304AFD721CF28C849F6A7BEAFB89704F04492DF9858B2B1DB71E902DB92

Function 00904392 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00904424
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0090446F

Strings

GETSELECTED, xrefs: 0090457F
UNCHECK, xrefs: 0090464B
GETTEXT, xrefs: 009045C2
COLLAPSE, xrefs: 009044B5
EXPAND, xrefs: 00904521
EXISTS, xrefs: 009044D8
GETTOTALCOUNT, xrefs: 00904456
ISCHECKED, xrefs: 009045F2
CHECK, xrefs: 0090448F
GETITEMCOUNT, xrefs: 00904551
SELECT, xrefs: 00904620

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 54a005404d756aa8510a261d4e6d0903d9bb76abb6382207ac4761ff5dbdf100
Instruction ID: da16d2b2d47c295dde32e9b7c8e33aa715981e1edd864cfcd822ed6a8aa6f629
Opcode Fuzzy Hash: 54a005404d756aa8510a261d4e6d0903d9bb76abb6382207ac4761ff5dbdf100
Instruction Fuzzy Hash: A8918C702043119FCB14EF18C851A6EB7E5FF95354F088868F8969B7A2DB35ED49CB82

Function 0090B7FE Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0090B8B4
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00906B11,?), ref: 0090B910
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0090B949
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 0090B98C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0090B9C3
FreeLibrary.KERNEL32(?), ref: 0090B9CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0090B9DF
DestroyCursor.USER32(?), ref: 0090B9EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0090BA0B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0090BA17

Part of subcall function 008A2EFD: __wcsicmp_l.LIBCMT ref: 008A2F86

Strings

.icl, xrefs: 0090B82A
.exe, xrefs: 0090B84A
.dll, xrefs: 0090B86D

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Load$Image$LibraryMessageSend$CursorDestroyExtractFreeIcon__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 3907162815-1154884017
Opcode ID: 26e8963aa014cea074f54fc8b61b4acf42838fb41036e216b29748bf4c14b7cc
Instruction ID: de2b61adf5d8cd86d6df9671f02228f5f574c7963f9d6ebeea392a3afec247b9
Opcode Fuzzy Hash: 26e8963aa014cea074f54fc8b61b4acf42838fb41036e216b29748bf4c14b7cc
Instruction Fuzzy Hash: 7261BE71500219BEEB24DF68CC41FBE77ACFB08724F104515F925D61D1DBB4AA90DBA0

Function 008EDC1A Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 008EDCDC
SystemTimeToFileTime.KERNEL32(?,?), ref: 008EDCEC
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 008EDCF8
__wsplitpath.LIBCMT ref: 008EDD56
_wcscat.LIBCMT ref: 008EDD6E
_wcscat.LIBCMT ref: 008EDD80
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 008EDD95
SetCurrentDirectoryW.KERNEL32(?), ref: 008EDDA9
SetCurrentDirectoryW.KERNEL32(?), ref: 008EDDDB
SetCurrentDirectoryW.KERNEL32(?), ref: 008EDDFC
_wcscpy.LIBCMT ref: 008EDE08
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 008EDE47

Strings

*.*, xrefs: 008EDE02

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: 275677a83da3a23bfba990bc932fdc36fc786e0866e5a01de68e6ccf0b59b607
Instruction ID: ae966e7937258b83f8a71affba0437d20981f63dea7ef4442616068ed74b6bd5
Opcode Fuzzy Hash: 275677a83da3a23bfba990bc932fdc36fc786e0866e5a01de68e6ccf0b59b607
Instruction Fuzzy Hash: E9615B765043469FCB10EF69C8449AEB3E8FF8A314F04492DF999C7251DB31EA49CB92

Function 008EA352 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00889837: __itow.LIBCMT ref: 00889862
Part of subcall function 00889837: __swprintf.LIBCMT ref: 008898AC

CharLowerBuffW.USER32(?,?), ref: 008EA3CB
GetDriveTypeW.KERNEL32 ref: 008EA418
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 008EA460
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 008EA497
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 008EA4C5

Part of subcall function 00887BCC: _memmove.LIBCMT ref: 00887C06

Strings

type cdaudio alias cd wait, xrefs: 008EA443
open, xrefs: 008EA3F2
open , xrefs: 008EA427
close, xrefs: 008EA3D1
close cd wait, xrefs: 008EA4B0
wait, xrefs: 008EA482
closed, xrefs: 008EA3DF, 008EA3E8
set cd door , xrefs: 008EA466

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: f750f1f80b4792af8ddac14c7f6c7d0ccd64407f5686e44fb08d346dc59b9aec
Instruction ID: 296da313601b60c31e1dd293bf2026c79826bbd7f39af9a8daff849be111b8f9
Opcode Fuzzy Hash: f750f1f80b4792af8ddac14c7f6c7d0ccd64407f5686e44fb08d346dc59b9aec
Instruction Fuzzy Hash: 995149751083059FC704EF15C89196AB7F4FF89718F14886DF89A972A1DB31EE09CB42

Function 008DF8AA Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000000,?,008BE029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000), ref: 008DF8DF
LoadStringW.USER32(00000000,?,008BE029,00000001), ref: 008DF8E8

Part of subcall function 00887DE1: _memmove.LIBCMT ref: 00887E22

GetModuleHandleW.KERNEL32(00000000,00945310,?,00000FFF,?,?,008BE029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000,00000001), ref: 008DF90A
LoadStringW.USER32(00000000,?,008BE029,00000001), ref: 008DF90D
__swprintf.LIBCMT ref: 008DF95D
__swprintf.LIBCMT ref: 008DF96E
_wprintf.LIBCMT ref: 008DFA17
MessageBoxW.USER32(00000000,?,?,00011010), ref: 008DFA2E

Strings

Error: , xrefs: 008DF9E5
%s (%d) : ==> %s: %s %s, xrefs: 008DFA12
Line %d (File "%s"):, xrefs: 008DF957
^ ERROR, xrefs: 008DF9C3
Line %d:, xrefs: 008DF968

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: c3b46ca31946a396908ab2909617fbb8baa448f8678133566b766c41439c94bf
Instruction ID: d978eee5da0b13fe4a3ed8fd024fbf464406b44eac73bde577913aca09d73278
Opcode Fuzzy Hash: c3b46ca31946a396908ab2909617fbb8baa448f8678133566b766c41439c94bf
Instruction Fuzzy Hash: 65415072804219AACB04FBE8DD56DEEB779FF14314F600065F606F2192EA316F09DB62

Function 008BA8CB Relevance: 22.7, APIs: 15, Instructions: 211COMMONLIBRARYCODE

Download Yara Rule

APIs

_copy_environ.LIBCMT ref: 008BA92B
___wtomb_environ.LIBCMT ref: 008BA94D

Part of subcall function 008A8B28: __getptd_noexit.LIBCMT ref: 008A8B28

__malloc_crt.LIBCMT ref: 008BA975
__malloc_crt.LIBCMT ref: 008BA992
_free.LIBCMT ref: 008BA9C9
__recalloc_crt.LIBCMT ref: 008BAA02
__recalloc_crt.LIBCMT ref: 008BAA47
_strlen.LIBCMT ref: 008BAA73
__calloc_crt.LIBCMT ref: 008BAA7D
_strlen.LIBCMT ref: 008BAA8C
SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000), ref: 008BAABA
_free.LIBCMT ref: 008BAAD4
_free.LIBCMT ref: 008BAAE1
_free.LIBCMT ref: 008BAAF3
__invoke_watson.LIBCMT ref: 008BAB0D

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
String ID:
API String ID: 884005220-0
Opcode ID: 047f4608bb287b2877f3e7c4fa37ceee47f5cb1862eafb70a9a9f8bb368469b1
Instruction ID: 3455ed94f9a783bbb853183d33ea0a79171ef9138d0e5816051b99f80d87370a
Opcode Fuzzy Hash: 047f4608bb287b2877f3e7c4fa37ceee47f5cb1862eafb70a9a9f8bb368469b1
Instruction Fuzzy Hash: BF610472508215EFEB289F7CD801BAA7BA8FF02320F214125E811E7391EB35D941DB63

Function 0090BA33 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 0090BA56
GetFileSize.KERNEL32(00000000,00000000), ref: 0090BA6D
GlobalAlloc.KERNEL32(00000002,00000000), ref: 0090BA78
CloseHandle.KERNEL32(00000000), ref: 0090BA85
GlobalLock.KERNEL32(00000000), ref: 0090BA8E
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0090BA9D
GlobalUnlock.KERNEL32(00000000), ref: 0090BAA6
CloseHandle.KERNEL32(00000000), ref: 0090BAAD
CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0090BABE
OleLoadPicture.OLEAUT32(?,00000000,00000000,00912CAC,?), ref: 0090BAD7
GlobalFree.KERNEL32(00000000), ref: 0090BAE7
GetObjectW.GDI32(?,00000018,000000FF), ref: 0090BB0B
CopyImage.USER32(?,00000000,?,?,00002000), ref: 0090BB36
DeleteObject.GDI32(00000000), ref: 0090BB5E
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0090BB74

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 0bc8bca8dcbcd5cb97913e64aefb7c2cd4cc9122bdf2105efcb270f0533e4b65
Instruction ID: d4407989d0e86340685c8f9ba5f7802713750e1fbb41cedd8950d611179eed0a
Opcode Fuzzy Hash: 0bc8bca8dcbcd5cb97913e64aefb7c2cd4cc9122bdf2105efcb270f0533e4b65
Instruction Fuzzy Hash: A4412775604208EFDB219F69DC98EAABBB8EB89B11F104068F905D72A0D7309E41DB60

Function 008ED899 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 008EDA10
_wcscat.LIBCMT ref: 008EDA28
_wcscat.LIBCMT ref: 008EDA3A
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 008EDA4F
SetCurrentDirectoryW.KERNEL32(?), ref: 008EDA63
GetFileAttributesW.KERNEL32(?), ref: 008EDA7B
SetFileAttributesW.KERNEL32(?,00000000), ref: 008EDA95
SetCurrentDirectoryW.KERNEL32(?), ref: 008EDAA7

Strings

*.*, xrefs: 008EDAE6

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: e0cad7bf939b37232188e7e4dbe886dbd5f914efd592a860c83f89b58d0f90b5
Instruction ID: 88c42351a68394bbd75c63a999521c194a8586f432aa3555d8806dcf805737db
Opcode Fuzzy Hash: e0cad7bf939b37232188e7e4dbe886dbd5f914efd592a860c83f89b58d0f90b5
Instruction Fuzzy Hash: 8D8177715043859FCB64EF59C84496ABBE4FF8A714F18882EF889CB251E630DD49CB52

Function 008F731A Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 008F738F
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 008F739B
CreateCompatibleDC.GDI32(?), ref: 008F73A7
SelectObject.GDI32(00000000,?), ref: 008F73B4
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 008F7408
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 008F7444
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 008F7468
SelectObject.GDI32(00000006,?), ref: 008F7470
DeleteObject.GDI32(?), ref: 008F7479
DeleteDC.GDI32(00000006), ref: 008F7480
ReleaseDC.USER32(00000000,?), ref: 008F748B

Strings

(, xrefs: 008F7410

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 7db0d38ac193c25416a510608ff22cf8e0aa09f5eb22a5bfbc0d8837ce651217
Instruction ID: 51b12b633837465dfbae9bc648ab030ca5e68a306e9b5c6a544e230d94fcd20a
Opcode Fuzzy Hash: 7db0d38ac193c25416a510608ff22cf8e0aa09f5eb22a5bfbc0d8837ce651217
Instruction Fuzzy Hash: 4E513775904209EFDB24CFA8CC85EAEBBB9FF48310F14852DFA5AD7611C771A9409B50

Function 00886A8C Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 008A0957: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00886B0C,?,00008000), ref: 008A0973

Part of subcall function 00884750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00884743,?,?,008837AE,?), ref: 00884770

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00886BAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00886CFA

Part of subcall function 0088586D: _wcscpy.LIBCMT ref: 008858A5

Part of subcall function 008A363D: _iswctype.LIBCMT ref: 008A3645

Strings

Bad directive syntax error, xrefs: 008BE79D
#include depth exceeded. Make sure there are no recursive includes, xrefs: 008BE421
Error opening the file, xrefs: 008BE43D, 008BE4B8
Unterminated string, xrefs: 008BE7E4
AU3!, xrefs: 00886B61
EA06, xrefs: 008BE452
>>>AUTOIT SCRIPT<<<, xrefs: 008BE496

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: f0c01df9efce1411325a0eec5df52778a256b60e30fbf68eeefc854e2b8c4502
Instruction ID: 7448d5150a6c63ba04c9fc6f49abd2db67a13cb0b5531409cefea661cda5b68a
Opcode Fuzzy Hash: f0c01df9efce1411325a0eec5df52778a256b60e30fbf68eeefc854e2b8c4502
Instruction Fuzzy Hash: 760246711083419FC724EF28C8819AEBBE5FF99314F14492DF49AD72A2EA30D949CB53

Function 008E2D36 Relevance: 19.7, APIs: 13, Instructions: 214windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008E2D50
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 008E2DDD
GetMenuItemCount.USER32(00945890), ref: 008E2E66
DeleteMenu.USER32(00945890,00000005,00000000,000000F5,?,?), ref: 008E2EF6
DeleteMenu.USER32(00945890,00000004,00000000), ref: 008E2EFE
DeleteMenu.USER32(00945890,00000006,00000000), ref: 008E2F06
DeleteMenu.USER32(00945890,00000003,00000000), ref: 008E2F0E
GetMenuItemCount.USER32(00945890), ref: 008E2F16
SetMenuItemInfoW.USER32(00945890,00000004,00000000,00000030), ref: 008E2F4C
GetCursorPos.USER32(?), ref: 008E2F56
SetForegroundWindow.USER32(00000000), ref: 008E2F5F
TrackPopupMenuEx.USER32(00945890,00000000,?,00000000,00000000,00000000), ref: 008E2F72
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 008E2F7E

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: ab67d67d4ba4679fd1756a1aa4dc61c2c1f86c78dda18a4511e77823f922edc4
Instruction ID: b303a2fbcb1d92a0f0677ebe89320c024a5811d96148ea30ccf9c5db486b1577
Opcode Fuzzy Hash: ab67d67d4ba4679fd1756a1aa4dc61c2c1f86c78dda18a4511e77823f922edc4
Instruction Fuzzy Hash: B871D37160429ABEEB318F5ADC45FAABF6CFB06324F100216F625E61E1CBB15C10D791

Function 008D77DC Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00887BCC: _memmove.LIBCMT ref: 00887C06

_memset.LIBCMT ref: 008D786B
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 008D78A0
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 008D78BC
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 008D78D8
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 008D7902
CLSIDFromString.COMBASE(?,?), ref: 008D792A
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 008D7935
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 008D793A

Strings

SOFTWARE\Classes\, xrefs: 008D780C
\CLSID, xrefs: 008D7822
\IPC$, xrefs: 008D7882

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: 95624f722d5a880562c3f16cab7ac2cfcc61c5a240cd800f23ded1604b866509
Instruction ID: 9d6836795aced9da806d493c38cf241987dff56541e480bc330b6ccded5b43b0
Opcode Fuzzy Hash: 95624f722d5a880562c3f16cab7ac2cfcc61c5a240cd800f23ded1604b866509
Instruction Fuzzy Hash: 23410872C1422DABCF21EBA8DC95DEDBB78FF14314F44452AE905E3261EA309E05DB91

Function 00900E1A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,008FFDAD,?,?), ref: 00900E31

Strings

HKEY_CLASSES_ROOT, xrefs: 00900EC4
HKCU, xrefs: 00900F21
HKCC, xrefs: 00900EFF
HKEY_CURRENT_CONFIG, xrefs: 00900EEE
HKEY_LOCAL_MACHINE, xrefs: 00900E9A
HKCR, xrefs: 00900ED9
HKEY_CURRENT_USER, xrefs: 00900F10
HKU, xrefs: 00900F43
HKLM, xrefs: 00900EAF
HKEY_USERS, xrefs: 00900F32

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 26398485953f2b2b9679c1f71bb8643f62c03b24c1c5dd9a472d74ada13d65a6
Instruction ID: ae6369d6440c087b64310bd589dae73d87f8cfe4a82a28d5663e40c2d520e258
Opcode Fuzzy Hash: 26398485953f2b2b9679c1f71bb8643f62c03b24c1c5dd9a472d74ada13d65a6
Instruction Fuzzy Hash: 3D419C3210032A8FDF20EF14D856BEE37A4FF52300F140424FD559B692EB74A91ADB61

Function 008DF7A1 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,008BE2A0,00000010,?,Bad directive syntax error,0090F910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 008DF7C2
LoadStringW.USER32(00000000,?,008BE2A0,00000010), ref: 008DF7C9

Part of subcall function 00887DE1: _memmove.LIBCMT ref: 00887E22

_wprintf.LIBCMT ref: 008DF7FC
__swprintf.LIBCMT ref: 008DF81E
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 008DF88D

Strings

Line %d (File "%s"):, xrefs: 008DF833
., xrefs: 008DF873
Error: , xrefs: 008DF85B
%s (%d) : ==> %s.: %s %s, xrefs: 008DF7F7
Line %d:, xrefs: 008DF818

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1506413516-4153970271
Opcode ID: 3c8fce7426fc4c2c4f54584fe5322b9e677830d48c749bda241eb34ab47cb2a5
Instruction ID: 9cfba07962b95eaf6477a6edb5be8129d35ce1ebf686d2b67bb90eb73e895b6d
Opcode Fuzzy Hash: 3c8fce7426fc4c2c4f54584fe5322b9e677830d48c749bda241eb34ab47cb2a5
Instruction Fuzzy Hash: C5216F3290421EEFCF11EF94CC5AEEE7B39FF14304F040466F515A61A2DA719618EB52

Function 008E52C7 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00887BCC: _memmove.LIBCMT ref: 00887C06

Part of subcall function 00887924: _memmove.LIBCMT ref: 008879AD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 008E5330
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 008E5346
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 008E5357
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 008E5369
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 008E537A

Strings

alias PlayMe, xrefs: 008E5309
status PlayMe mode, xrefs: 008E532B
open , xrefs: 008E52DF
close PlayMe, xrefs: 008E5341, 008E536E
play PlayMe wait, xrefs: 008E5364
play PlayMe, xrefs: 008E5375

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: a746d7e554d8e6959d35c5a5c7f3adb24958de1af6fc69ccda624b32dea141dd
Instruction ID: f862b61870a10f52a44db00aefecc867b21ee86342ef58783be76c9e916c80c4
Opcode Fuzzy Hash: a746d7e554d8e6959d35c5a5c7f3adb24958de1af6fc69ccda624b32dea141dd
Instruction Fuzzy Hash: A4118261A5026979D720B666CC4ADFFBB7CFBD2B4CF100429B812E21D1EEA05D04CAA1

Function 008E46B7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000101,?), ref: 008E46D2
gethostname.WS2_32(?,00000100), ref: 008E46EC
gethostbyname.WS2_32(?), ref: 008E46F9
_wcscpy.LIBCMT ref: 008E4721
_memmove.LIBCMT ref: 008E4734
inet_ntoa.WS2_32(?), ref: 008E473F
_strcat.LIBCMT ref: 008E474D
_wcscpy.LIBCMT ref: 008E4764
WSACleanup.WS2_32 ref: 008E4772
_wcscpy.LIBCMT ref: 008E4780

Strings

0.0.0.0, xrefs: 008E471B

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: dcf3114569d4e94d6f2e164908ca7dd1b1d850cf354f6e9e6a4de07b80ee1688
Instruction ID: a4383375c0bfee802da4fd16cd86ae109c182864a4aee16f8bfd3dde3d8f593a
Opcode Fuzzy Hash: dcf3114569d4e94d6f2e164908ca7dd1b1d850cf354f6e9e6a4de07b80ee1688
Instruction Fuzzy Hash: 7611273150411CAFDB20AB399C4AEDA77BCFF43315F0041B6F84AD6491EF718A819A92

Function 008E4F75 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 008E4F7A

Part of subcall function 008A049F: timeGetTime.WINMM(?,75C0B400,00890E7B), ref: 008A04A3

Sleep.KERNEL32(0000000A), ref: 008E4FA6
EnumThreadWindows.USER32(?,Function_00064F28,00000000), ref: 008E4FCA
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 008E4FEC
SetActiveWindow.USER32 ref: 008E500B
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 008E5019
SendMessageW.USER32(00000010,00000000,00000000), ref: 008E5038
Sleep.KERNEL32(000000FA), ref: 008E5043
IsWindow.USER32 ref: 008E504F
EndDialog.USER32(00000000), ref: 008E5060

Strings

BUTTON, xrefs: 008E4FDE

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 8be531eee528d0c4b709ec810eef9d0acc4d0b0301ef891de59d1b1aa2caeb99
Instruction ID: 85c45bc21eac727ca51499beb1387088ede8d38e562bdd19f31dda5b9f7fefaa
Opcode Fuzzy Hash: 8be531eee528d0c4b709ec810eef9d0acc4d0b0301ef891de59d1b1aa2caeb99
Instruction Fuzzy Hash: 33219FB862CB44AFE7209F61EC98E663B69FB47749F041024F115C25B1CBA18E50FA62

Function 008ED58D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00889837: __itow.LIBCMT ref: 00889862
Part of subcall function 00889837: __swprintf.LIBCMT ref: 008898AC

CoInitialize.OLE32(00000000), ref: 008ED5EA
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 008ED67D
SHGetDesktopFolder.SHELL32(?), ref: 008ED691
CoCreateInstance.COMBASE(00912D7C,00000000,00000001,00938C1C,?), ref: 008ED6DD
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 008ED74C
CoTaskMemFree.COMBASE(?), ref: 008ED7A4
_memset.LIBCMT ref: 008ED7E1
SHBrowseForFolderW.SHELL32(?), ref: 008ED81D
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 008ED840
CoTaskMemFree.COMBASE(00000000), ref: 008ED847
CoTaskMemFree.COMBASE(00000000), ref: 008ED87E
CoUninitialize.COMBASE ref: 008ED880

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 492521f06657f017226859b246a88748813b02829ff4546f667ec388a2eec563
Instruction ID: 4bf6fd2d3f7b920b5831339ec0155302da003739d0e939ec3406573ccc22f499
Opcode Fuzzy Hash: 492521f06657f017226859b246a88748813b02829ff4546f667ec388a2eec563
Instruction Fuzzy Hash: 06B12D75A00219AFDB14DFA9C884DAEBBB9FF49314F048469F809DB261DB30ED45CB51

Function 008DC267 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 008DC283
GetWindowRect.USER32(00000000,?), ref: 008DC295
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 008DC2F3
GetDlgItem.USER32(?,00000002), ref: 008DC2FE
GetWindowRect.USER32(00000000,?), ref: 008DC310
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 008DC364
GetDlgItem.USER32(?,000003E9), ref: 008DC372
GetWindowRect.USER32(00000000,?), ref: 008DC383
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 008DC3C6
GetDlgItem.USER32(?,000003EA), ref: 008DC3D4
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 008DC3F1
InvalidateRect.USER32(?,00000000,00000001), ref: 008DC3FE

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 1a1fe1a0d3725c498a07189863cbf42e26cedfdc02dc440debdec74f1eda72e1
Instruction ID: a75a6eb7e8f3dc62cb28702568a3cbf1315846267be3e317152e4838159b5411
Opcode Fuzzy Hash: 1a1fe1a0d3725c498a07189863cbf42e26cedfdc02dc440debdec74f1eda72e1
Instruction Fuzzy Hash: FF511171B10205AFDB18CFA9DD99A6EBBBAFB88711F148129F515D7390D7719D00CB10

Function 008821A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 008825DB: GetWindowLongW.USER32(?,000000EB), ref: 008825EC

GetSysColor.USER32(0000000F), ref: 008821D3

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: c3a97d0c74d25adbf9b32b3d0aa35863134563974d34c020795b16b1d51a2563
Instruction ID: 1d7b2d95b9b7ea8e14f1e1b6b75b056132589bf71112be61e1d6ab69ed8ff79d
Opcode Fuzzy Hash: c3a97d0c74d25adbf9b32b3d0aa35863134563974d34c020795b16b1d51a2563
Instruction Fuzzy Hash: 05419F31008144EFDB21AF28DC98BB97B66FB06331F144265FE65CA2E2C7718D42EB61

Function 008EA8A7 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,0090F910), ref: 008EA90B
GetDriveTypeW.KERNEL32(00000061,009389A0,00000061), ref: 008EA9D5
_wcscpy.LIBCMT ref: 008EA9FF

Strings

fixed, xrefs: 008EA953
all, xrefs: 008EA911
removable, xrefs: 008EA93D
ramdisk, xrefs: 008EA97F
cdrom, xrefs: 008EA927
unknown, xrefs: 008EA996
network, xrefs: 008EA969

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 64094e400880f9f17a0885554c755d9d4cdc80ae4784b1bee65085a2bed263ed
Instruction ID: aebfb1f0e651c882fdc49741dbb6ba8ce9fb65afce4016880d673bb07762f0a9
Opcode Fuzzy Hash: 64094e400880f9f17a0885554c755d9d4cdc80ae4784b1bee65085a2bed263ed
Instruction Fuzzy Hash: 15517C311183519FC314EF19C892AAFBBA5FF86704F154829F4A6D72A2DB31A909CB53

Function 00889837 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00889862
__swprintf.LIBCMT ref: 008898AC
__i64tow.LIBCMT ref: 008BF5E6

Strings

True, xrefs: 008BF5A7
0x%p, xrefs: 008BF5C8
%.15g, xrefs: 008898A6
False, xrefs: 008BF5AE

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: c9958344da4f9e530ba4403aca38a20c425f3f4267ab50325c396aa68878f785
Instruction ID: e7874aafe9297661df683d2a0e84c9d1981163acf67b25b0a8f5c1e2100e0d28
Opcode Fuzzy Hash: c9958344da4f9e530ba4403aca38a20c425f3f4267ab50325c396aa68878f785
Instruction Fuzzy Hash: FB41D771500609AFEB34EF78DC46EB677E8FF46304F24447EE589D7292EA31A9418B11

Function 00907152 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0090716A
CreateMenu.USER32 ref: 00907185
SetMenu.USER32(?,00000000), ref: 00907194
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00907221
IsMenu.USER32(?), ref: 00907237
CreatePopupMenu.USER32 ref: 00907241
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 0090726E
DrawMenuBar.USER32 ref: 00907276

Strings

F, xrefs: 00907262
0, xrefs: 00907160

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: f4f0e2a64ea53c1db32448b5f0c139f06698e7d6e6edfa004ac9fc5ab05afc1e
Instruction ID: b38650001109e2a85aa62be1917b54977854e0eaf38468b42516d86b14389d3f
Opcode Fuzzy Hash: f4f0e2a64ea53c1db32448b5f0c139f06698e7d6e6edfa004ac9fc5ab05afc1e
Instruction Fuzzy Hash: B1416C75A15209EFDB20DFA8D844EAABBF9FF49320F140029F955973A1D731A910DF90

Function 009074BB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0090755E
CreateCompatibleDC.GDI32(00000000), ref: 00907565
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00907578
SelectObject.GDI32(00000000,00000000), ref: 00907580
GetPixel.GDI32(00000000,00000000,00000000), ref: 0090758B
DeleteDC.GDI32(00000000), ref: 00907594
GetWindowLongW.USER32(?,000000EC), ref: 0090759E
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 009075B2
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 009075BE

Strings

static, xrefs: 009074F6

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: 01a08c989179b61491e7325101d143529f81669610710c19fc6d310be5db34ef
Instruction ID: 9f4c3fc1dd0c89a95a781ce69817b404ea9e965a0259081a0a7dedd820c4447f
Opcode Fuzzy Hash: 01a08c989179b61491e7325101d143529f81669610710c19fc6d310be5db34ef
Instruction Fuzzy Hash: F6316A72518219AFDF219FA4DC09FEA7B6DFF09720F114224FA15A60E0C735E911EBA4

Function 008A6E03 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008A6E3E

Part of subcall function 008A8B28: __getptd_noexit.LIBCMT ref: 008A8B28

__gmtime64_s.LIBCMT ref: 008A6ED7
__gmtime64_s.LIBCMT ref: 008A6F0D
__gmtime64_s.LIBCMT ref: 008A6F2A
__allrem.LIBCMT ref: 008A6F80
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008A6F9C
__allrem.LIBCMT ref: 008A6FB3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008A6FD1
__allrem.LIBCMT ref: 008A6FE8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 008A7006
__invoke_watson.LIBCMT ref: 008A7077

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction ID: 6c1ecb5556fc9f7088ae5bee78f15442f18378e8ea2e24b94b07cc76c78310b7
Opcode Fuzzy Hash: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction Fuzzy Hash: 4771E776A00B16ABF714AE7CDC42B9AB7A4FF06724F244229F514D7A81F770D9208BD1

Function 008E2527 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008E2542
GetMenuItemInfoW.USER32(00945890,000000FF,00000000,00000030), ref: 008E25A3
SetMenuItemInfoW.USER32(00945890,00000004,00000000,00000030), ref: 008E25D9
Sleep.KERNEL32(000001F4), ref: 008E25EB
GetMenuItemCount.USER32(?), ref: 008E262F
GetMenuItemID.USER32(?,00000000), ref: 008E264B
GetMenuItemID.USER32(?,-00000001), ref: 008E2675
GetMenuItemID.USER32(?,?), ref: 008E26BA
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 008E2700
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 008E2714
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 008E2735

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 6d9fc1aeaf0f124ea4041fc10b6a0340576838983cf811158ef1af87159ce6d7
Instruction ID: 4217a2b5277b1e1a3eac63677fd659337dfea2ee6fe15a1e44c25a7774c21583
Opcode Fuzzy Hash: 6d9fc1aeaf0f124ea4041fc10b6a0340576838983cf811158ef1af87159ce6d7
Instruction Fuzzy Hash: 45619F70914289AFDB21CFA5CC94DBE7BBCFB02304F140169E842E7261D771AE05DB21

Function 00906F23 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00906FA5
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00906FA8
GetWindowLongW.USER32(?,000000F0), ref: 00906FCC
_memset.LIBCMT ref: 00906FDD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00906FEF
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00907067

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 0d45ef372960736dbbe6970f7c5db4f8a919d60d863f0fabaa2decd192309bf9
Instruction ID: 842a4fe2d0c5ef0bf8ca471fd4dd480350d9c9abf8dae882e8361a4aa3511717
Opcode Fuzzy Hash: 0d45ef372960736dbbe6970f7c5db4f8a919d60d863f0fabaa2decd192309bf9
Instruction Fuzzy Hash: 35614975904208AFDB11DFA8CC81EEEB7B8EF09710F104159FA14EB2E2C775A951DBA0

Function 008D6B98 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 008D6BBF
SafeArrayAllocData.OLEAUT32(?), ref: 008D6C18
VariantInit.OLEAUT32(?), ref: 008D6C2A
SafeArrayAccessData.OLEAUT32(?,?), ref: 008D6C4A
VariantCopy.OLEAUT32(?,?), ref: 008D6C9D
SafeArrayUnaccessData.OLEAUT32(?), ref: 008D6CB1
VariantClear.OLEAUT32(?), ref: 008D6CC6
SafeArrayDestroyData.OLEAUT32(?), ref: 008D6CD3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 008D6CDC
VariantClear.OLEAUT32(?), ref: 008D6CEE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 008D6CF9

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 5de218236320982e62f01a088dc3aac0d37fd531c46f4a16d544ecb05350f612
Instruction ID: ae3beae9800358915fd01478fcf6fe68c6b5235cbf945517786ff963c36e2565
Opcode Fuzzy Hash: 5de218236320982e62f01a088dc3aac0d37fd531c46f4a16d544ecb05350f612
Instruction Fuzzy Hash: 33418231A1021D9FCF10DF68D8989AEBBB9FF08314F00816AE955E7361DB30AA45DF90

Function 008F83BB Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00889837: __itow.LIBCMT ref: 00889862
Part of subcall function 00889837: __swprintf.LIBCMT ref: 008898AC

CoInitialize.OLE32 ref: 008F8403
CoUninitialize.COMBASE ref: 008F840E
CoCreateInstance.COMBASE(?,00000000,00000017,00912BEC,?), ref: 008F846E
IIDFromString.COMBASE(?,?), ref: 008F84E1
VariantInit.OLEAUT32(?), ref: 008F857B
VariantClear.OLEAUT32(?), ref: 008F85DC

Strings

Failed to create object, xrefs: 008F8479, 008F852F
Invalid parameter, xrefs: 008F84FA
NULL Pointer assignment, xrefs: 008F84B3

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 51d2075c1ee1a105833cc73da4876bb6ed4dd723b03c126589ce64c795822b5b
Instruction ID: be29f696820a07b2ba42db8be2096d186c6ad8a3ea67362501f45975f07dc5f4
Opcode Fuzzy Hash: 51d2075c1ee1a105833cc73da4876bb6ed4dd723b03c126589ce64c795822b5b
Instruction Fuzzy Hash: 19618B7060871ADFC710DF24C848A6AB7E8FF49758F044519FA86DB291CB70EE44CB92

Function 008F5732 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000101,?), ref: 008F5793
inet_addr.WS2_32(?), ref: 008F57D8
gethostbyname.WS2_32(?), ref: 008F57E4
IcmpCreateFile.IPHLPAPI ref: 008F57F2
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 008F5862
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 008F5878
IcmpCloseHandle.IPHLPAPI(00000000), ref: 008F58ED
WSACleanup.WS2_32 ref: 008F58F3

Strings

Ping, xrefs: 008F5816

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 662d3a9e0b33a31c38dd7fbb4b2c45eb5d76e2e6eb05f7ef686450b655246109
Instruction ID: 6c3b2942bb506647fd56f0e722d62f419c7a268c6c5d1bb935ca58d668046056
Opcode Fuzzy Hash: 662d3a9e0b33a31c38dd7fbb4b2c45eb5d76e2e6eb05f7ef686450b655246109
Instruction Fuzzy Hash: 51518C31614604EFD720AF28DC45B3ABBE4FB48760F044529FA96DB2A1DB30E900DB42

Function 008EB4C3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 008EB4D0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 008EB546
GetLastError.KERNEL32 ref: 008EB550
SetErrorMode.KERNEL32(00000000,READY), ref: 008EB5BD

Strings

UNKNOWN, xrefs: 008EB575
READY, xrefs: 008EB596
INVALID, xrefs: 008EB58F
READONLY, xrefs: 008EB588
NOTREADY, xrefs: 008EB57C

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 1170203b5c0d86b8f76036566ec399a707194ec4b7561be067e1d8f55c8a7fbd
Instruction ID: 97fe9c6d1cf438ce9fad91af74cd70073c2f020e260e4308b7d0fa5c520e7dc8
Opcode Fuzzy Hash: 1170203b5c0d86b8f76036566ec399a707194ec4b7561be067e1d8f55c8a7fbd
Instruction Fuzzy Hash: 73318E35A00249EFCB10EB69D885ABFBBB4FF4A314F144126F515E7291DB709A42CB91

Function 008D8F8F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00887DE1: _memmove.LIBCMT ref: 00887E22

Part of subcall function 008DAA99: GetClassNameW.USER32(?,?,000000FF), ref: 008DAABC

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 008D9014
GetDlgCtrlID.USER32 ref: 008D901F
GetParent.USER32 ref: 008D903B
SendMessageW.USER32(00000000,?,00000111,?), ref: 008D903E
GetDlgCtrlID.USER32(?), ref: 008D9047
GetParent.USER32(?), ref: 008D9063
SendMessageW.USER32(00000000,?,?,00000111), ref: 008D9066

Strings

ComboBox, xrefs: 008D8F9C
ListBox, xrefs: 008D8FD1

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: 1250f929fbc6cb04b719eb7d0b8048b3d201d2694184ea48e7f31b7fc871942a
Instruction ID: cda98fcb31732f5d05b53fdc8643dbd619d4666fe641fc92118e0726f9256694
Opcode Fuzzy Hash: 1250f929fbc6cb04b719eb7d0b8048b3d201d2694184ea48e7f31b7fc871942a
Instruction Fuzzy Hash: D621FF75A00108BFDF14ABA4CC95EFEBB74FF49310F10021AF961972A1DB368919EB21

Function 008D907A Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00887DE1: _memmove.LIBCMT ref: 00887E22

Part of subcall function 008DAA99: GetClassNameW.USER32(?,?,000000FF), ref: 008DAABC

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 008D90FD
GetDlgCtrlID.USER32 ref: 008D9108
GetParent.USER32 ref: 008D9124
SendMessageW.USER32(00000000,?,00000111,?), ref: 008D9127
GetDlgCtrlID.USER32(?), ref: 008D9130
GetParent.USER32(?), ref: 008D914C
SendMessageW.USER32(00000000,?,?,00000111), ref: 008D914F

Strings

ComboBox, xrefs: 008D9087
ListBox, xrefs: 008D90BC

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: a672b103fe712274477d12a503cb82024532898e7bdb269d64d2914a77ee8b0e
Instruction ID: 73e6018414c56c261f96d39b87af38fee6d9383d46f587d33314806817093306
Opcode Fuzzy Hash: a672b103fe712274477d12a503cb82024532898e7bdb269d64d2914a77ee8b0e
Instruction Fuzzy Hash: BE21B075A00108BBDF10ABA4CC85AFEBB74FB48300F100216F951972A1DA758919EB21

Function 008D9163 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 008D916F
GetClassNameW.USER32(00000000,?,00000100), ref: 008D9184
_wcscmp.LIBCMT ref: 008D9196
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 008D9211

Strings

largeicons, xrefs: 008D91A5
list, xrefs: 008D91F3
details, xrefs: 008D91BF
smallicons, xrefs: 008D91D9
SHELLDLL_DefView, xrefs: 008D9190

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: a6989115e358bffdd968ddce3f420c244f6a5cec52c735e49d09b250f72b6e74
Instruction ID: 57e202f85c07e651ae0928027d805be1dad96e949a762dfd3c840953c86877c3
Opcode Fuzzy Hash: a6989115e358bffdd968ddce3f420c244f6a5cec52c735e49d09b250f72b6e74
Instruction Fuzzy Hash: E6113A7624C30BB9FA302628DC06EA7779CFB12324F200267F910E19D2FEA1A8616951

Function 008F88AB Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 008F88D7
CoInitialize.OLE32(00000000), ref: 008F8904
CoUninitialize.COMBASE ref: 008F890E
GetRunningObjectTable.OLE32(00000000,?), ref: 008F8A0E
SetErrorMode.KERNEL32(00000001,00000029), ref: 008F8B3B
CoGetInstanceFromFile.COMBASE(00000000,?,00000000,00000015,00000002,?,00000001,00912C0C), ref: 008F8B6F
CoGetObject.OLE32(?,00000000,00912C0C,?), ref: 008F8B92
SetErrorMode.KERNEL32(00000000), ref: 008F8BA5
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 008F8C25
VariantClear.OLEAUT32(?), ref: 008F8C35

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: dd38d30a2642019df452f16dd04d18a03b27a6e958107ebd5fa810f682a2142a
Instruction ID: 3b2b74716df53bf5d0014b493ef7d9a85a208201f41c84cb602873773bab852b
Opcode Fuzzy Hash: dd38d30a2642019df452f16dd04d18a03b27a6e958107ebd5fa810f682a2142a
Instruction Fuzzy Hash: E3C102B16083099FC700EF68C88496AB7E9FF89748F00495DFA8ADB251DB71ED05CB52

Function 008E7990 Relevance: 15.3, APIs: 10, Instructions: 292COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 008E7A6C

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: d1b2572c4abb92430ac203420eadfc302e8ac6996ebe14c9efacdab29df82a87
Instruction ID: 4cae241cfe73e8f0844cf10bcd5266ea575e484b71fd2854f3aed7c62509106e
Opcode Fuzzy Hash: d1b2572c4abb92430ac203420eadfc302e8ac6996ebe14c9efacdab29df82a87
Instruction Fuzzy Hash: 60B1F67190825A9FDB10DFA9C884BBEB7F8FF4A324F240429EA11E7251D734E941CB91

Function 008E11CE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 008E11F0
GetForegroundWindow.USER32(00000000,?,?,?,?,?,008E0268,?,00000001), ref: 008E1204
GetWindowThreadProcessId.USER32(00000000), ref: 008E120B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,008E0268,?,00000001), ref: 008E121A
GetWindowThreadProcessId.USER32(?,00000000), ref: 008E122C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,008E0268,?,00000001), ref: 008E1245
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,008E0268,?,00000001), ref: 008E1257
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,008E0268,?,00000001), ref: 008E129C
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,008E0268,?,00000001), ref: 008E12B1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,008E0268,?,00000001), ref: 008E12BC

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 7afae62cd9d76ef4d30d1dcccc73278eeb515f85edf78579c170b02c4f964a90
Instruction ID: 9aa906932198c64c3d17d6c68bc195d01b1ef1c1256a0c016d3e0c90ddab7571
Opcode Fuzzy Hash: 7afae62cd9d76ef4d30d1dcccc73278eeb515f85edf78579c170b02c4f964a90
Instruction Fuzzy Hash: 8D31ACB9628208AFDF20DF55EC88FA937A9FB57715F104165FA00C71A0D7709E44AB61

Function 0088FA5D Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 0088FAA6
OleUninitialize.OLE32(?,00000000), ref: 0088FB45
UnregisterHotKey.USER32(?), ref: 0088FC9C
DestroyWindow.USER32(?), ref: 008C45D6
FreeLibrary.KERNEL32(?), ref: 008C463B
VirtualFree.KERNEL32(?,00000000,00008000), ref: 008C4668

Strings

close all, xrefs: 0088FAA1

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: c3a1885d6d3e9fec1bae348e5f3059e4a749d80aa75f3b7ee7766a9856f9156c
Instruction ID: 5b921a0f63454d273fa223c1ee8133de51d4fe5e6b4597179a2b9027c88d837e
Opcode Fuzzy Hash: c3a1885d6d3e9fec1bae348e5f3059e4a749d80aa75f3b7ee7766a9856f9156c
Instruction Fuzzy Hash: C0A147303012268FDB29EB18C9A4F69B764FF15714F1442ADE90AEB262DB30ED56CF51

Function 008DA068 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,008DA439), ref: 008DA377

Strings

TEXT, xrefs: 008DA2AE
REGEXPCLASS, xrefs: 008DA13C
NAME, xrefs: 008DA1A9
INSTANCE, xrefs: 008DA285
CLASS, xrefs: 008DA0F6
CLASSNN, xrefs: 008DA119

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 46ef15ae8e55e79ebb7d1901454e701ed695b0355635706c3eb13f0133d8c5e2
Instruction ID: 915b6bf8bb6ad2f5f227f69110a2eebca4f63cd09ed449706b423f0c2d9c0ef9
Opcode Fuzzy Hash: 46ef15ae8e55e79ebb7d1901454e701ed695b0355635706c3eb13f0133d8c5e2
Instruction Fuzzy Hash: 2991B630900605AADB1CEFA4C441BEDFBB5FF05314F64821AE45AE7341DF31AA99DB92

Function 00882E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00882EAE

Part of subcall function 00881DB3: GetClientRect.USER32(?,?), ref: 00881DDC
Part of subcall function 00881DB3: GetWindowRect.USER32(?,?), ref: 00881E1D
Part of subcall function 00881DB3: ScreenToClient.USER32(?,?), ref: 00881E45

GetDC.USER32 ref: 008BCD32
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 008BCD45
SelectObject.GDI32(00000000,00000000), ref: 008BCD53
SelectObject.GDI32(00000000,00000000), ref: 008BCD68
ReleaseDC.USER32(?,00000000), ref: 008BCD70
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 008BCDFB

Strings

U, xrefs: 008BCCD0

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: c00bc7382754fef83fbca39360f538ed3a2fdf3ab67feca2938d16615b6ad9f5
Instruction ID: 96a823d29119b7a776833d5914277834699c9cbeae3a6a773cc5729beb874c72
Opcode Fuzzy Hash: c00bc7382754fef83fbca39360f538ed3a2fdf3ab67feca2938d16615b6ad9f5
Instruction Fuzzy Hash: 4671DC35500209EFCF219F64C894AEA7FB5FF49324F18427AED55DA2A6C7318C81EB60

Function 008F1A15 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 008F1A50
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 008F1A7C
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 008F1ABE
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 008F1AD3
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 008F1AE0
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 008F1B10
InternetCloseHandle.WININET(00000000), ref: 008F1B57

Part of subcall function 008F2483: GetLastError.KERNEL32(?,?,008F1817,00000000,00000000,00000001), ref: 008F2498
Part of subcall function 008F2483: SetEvent.KERNEL32(?,?,008F1817,00000000,00000000,00000001), ref: 008F24AD

Strings

, xrefs: 008F1B01

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: aa05f79c57a8a318e9b30ed35f81abfd610e06d37428cdb2135e22eb13e16ae0
Instruction ID: 26bdf3cea8d82e169e7bf87b5bf0f45666414ad3058faed7f18efa6716fc6522
Opcode Fuzzy Hash: aa05f79c57a8a318e9b30ed35f81abfd610e06d37428cdb2135e22eb13e16ae0
Instruction Fuzzy Hash: 40417BB1505218FEEB118F60CC99FBA7BACFB08354F00412AFA05DA141E7B09E449BA1

Function 008F8C46 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,0090F910), ref: 008F8D28
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0090F910), ref: 008F8D5C
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 008F8ED6
SysFreeString.OLEAUT32(?), ref: 008F8F00

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 23acb6788037940a7c94625a0adcd33b2eceb4e94a7339ea98bdb4438b502ee1
Instruction ID: d6fed224b27382a2b37d4263499c2d496f2121651a16977f2f76ec0332c532f3
Opcode Fuzzy Hash: 23acb6788037940a7c94625a0adcd33b2eceb4e94a7339ea98bdb4438b502ee1
Instruction Fuzzy Hash: 09F10571A00209EFCB14DFA4C884EBEB7B9FF89314F148498EA55EB251DB31AE45CB51

Function 008FF694 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008FF6B5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 008FF848
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 008FF86C
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 008FF8AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 008FF8CE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 008FFA4A
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 008FFA7C
CloseHandle.KERNEL32(?), ref: 008FFAAB
CloseHandle.KERNEL32(?), ref: 008FFB22

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 089e9ec5df5f2aa2fd43b6387663f63cf9b4391d4cbcb8bac695feebe955aba0
Instruction ID: fd4a93490d8c2bea269de3ce9ef8b67e2186dcb64fb4b26a50335bdcb55a113c
Opcode Fuzzy Hash: 089e9ec5df5f2aa2fd43b6387663f63cf9b4391d4cbcb8bac695feebe955aba0
Instruction Fuzzy Hash: A0E1AE312042559FCB14EF38C891A6ABBE1FF85354F18856DFA99CB2A2DB70DC41CB52

Function 0088201B Relevance: 13.7, APIs: 9, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00881B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00882036,?,00000000,?,?,?,?,008816CB,00000000,?), ref: 00881B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 008820D3
KillTimer.USER32(-00000001,?,?,?,?,008816CB,00000000,?,?,00881AE2,?,?), ref: 0088216E
DestroyAcceleratorTable.USER32(00000000), ref: 008BBCA6
DeleteObject.GDI32(00000000), ref: 008BBD1C

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Destroy$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 2402799130-0
Opcode ID: a63f17b4ddf2a3bff9d8a862e5f0abf87a2f31f04aef85746f161df046dd838c
Instruction ID: eef0d4c45add6ead09c89cfaf3f6d61a5d4742c6dfc61b8a4e22cbfcce084888
Opcode Fuzzy Hash: a63f17b4ddf2a3bff9d8a862e5f0abf87a2f31f04aef85746f161df046dd838c
Instruction Fuzzy Hash: 2F61DE39124A04DFCB35AF54D958B29B7F1FF41316F208428E042CBA71CBB4A881EF91

Function 008E4CC1 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 008E466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,008E3697,?), ref: 008E468B

Part of subcall function 008E466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,008E3697,?), ref: 008E46A4

Part of subcall function 008E4A31: GetFileAttributesW.KERNEL32(?,008E370B), ref: 008E4A32

lstrcmpiW.KERNEL32(?,?), ref: 008E4D40
_wcscmp.LIBCMT ref: 008E4D5A
MoveFileW.KERNEL32(?,?), ref: 008E4D75

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: c2c056eba52bc640aab4a856f03efde710ed99847c0a48e6af33d35bfe58fc1c
Instruction ID: 14a3dba870b75ffba9c1178d3be92c3dc05517866aad7aa30d5e0ad4e4dfb193
Opcode Fuzzy Hash: c2c056eba52bc640aab4a856f03efde710ed99847c0a48e6af33d35bfe58fc1c
Instruction Fuzzy Hash: 075151B21083859BD624EB64DC819DB73ECFF86350F00192EF589D3152EE70A688C766

Function 00908645 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 009086FF

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: a5ee7e9d0871725ca43543f7726cfd1d0bfb6ceb742e3c8010e0fee28a2fdba0
Instruction ID: a3829940fd1bd415353eedacfeec32090bf9940c0bdc4cbfb41ca922ede8e156
Opcode Fuzzy Hash: a5ee7e9d0871725ca43543f7726cfd1d0bfb6ceb742e3c8010e0fee28a2fdba0
Instruction Fuzzy Hash: 3451B430714244BFDF209B28CC89FAE7BA9FB05724F604615F990E61E1CF76AA90DB51

Function 00882B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 008BC2F7
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 008BC319
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 008BC331
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 008BC34F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 008BC370
DestroyCursor.USER32(00000000), ref: 008BC37F
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 008BC39C
DestroyCursor.USER32(?), ref: 008BC3AB

Part of subcall function 0090A4AF: DeleteObject.GDI32(00000000), ref: 0090A4E8

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: CursorDestroyExtractIconImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2975913752-0
Opcode ID: deb925aecf84d1e43bb53d170d604b932ad27edec487ccd07443488313c33162
Instruction ID: e148aa32451e961c71b342c278d888248fdb0365edb6ddb9c0b26d7d2ef01912
Opcode Fuzzy Hash: deb925aecf84d1e43bb53d170d604b932ad27edec487ccd07443488313c33162
Instruction Fuzzy Hash: EF514674A10209EFDB20EF64CC45FAA7BE5FB58320F104528F902E72A0DB70AD90EB50

Function 008D966E Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 008DA82C: GetWindowThreadProcessId.USER32(?,00000000), ref: 008DA84C
Part of subcall function 008DA82C: GetCurrentThreadId.KERNEL32 ref: 008DA853
Part of subcall function 008DA82C: AttachThreadInput.USER32(00000000,?,008D9683,?,00000001), ref: 008DA85A

MapVirtualKeyW.USER32(00000025,00000000), ref: 008D968E
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 008D96AB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 008D96AE
MapVirtualKeyW.USER32(00000025,00000000), ref: 008D96B7
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 008D96D5
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 008D96D8
MapVirtualKeyW.USER32(00000025,00000000), ref: 008D96E1
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 008D96F8
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 008D96FB

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 6a64a619d4d7457ad3cdf316d5e5093193593cccfa54e656a467a73936dcd649
Instruction ID: 82b787bee3e20566f2b26fe2045aec86a267887f822155270077ecac2660eab2
Opcode Fuzzy Hash: 6a64a619d4d7457ad3cdf316d5e5093193593cccfa54e656a467a73936dcd649
Instruction Fuzzy Hash: 3E1121B1964208BEF7202F24DC89F6A3F2DEB0C751F200026F644AB1A0C9F35D40EAE4

Function 008D8921 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,008D853C,00000B00,?,?), ref: 008D892A
RtlAllocateHeap.NTDLL(00000000,?,008D853C), ref: 008D8931
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,008D853C,00000B00,?,?), ref: 008D8946
GetCurrentProcess.KERNEL32(?,00000000,?,008D853C,00000B00,?,?), ref: 008D894E
DuplicateHandle.KERNEL32(00000000,?,008D853C,00000B00,?,?), ref: 008D8951
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,008D853C,00000B00,?,?), ref: 008D8961
GetCurrentProcess.KERNEL32(008D853C,00000000,?,008D853C,00000B00,?,?), ref: 008D8969
DuplicateHandle.KERNEL32(00000000,?,008D853C,00000B00,?,?), ref: 008D896C
CreateThread.KERNEL32(00000000,00000000,008D8992,00000000,00000000,00000000), ref: 008D8986

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocateCreateThread
String ID:
API String ID: 1422014791-0
Opcode ID: 0c08a619e1327b1ef6e532f2897bc947290fb689c68756131701d5095f561d0b
Instruction ID: c873623f190b0d98c1924b6f2df4a15cb3ed383dd707f9c507735c1ab5fbb568
Opcode Fuzzy Hash: 0c08a619e1327b1ef6e532f2897bc947290fb689c68756131701d5095f561d0b
Instruction Fuzzy Hash: 2601BF75254304FFE760EBA5DC5DF673B6CEB89B11F404421FA05DB691CA749900DB20

Function 008F9B23 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 008F9B7B
NULL Pointer assignment, xrefs: 008F9BA4, 008F9EC8

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 8bfcd990383acfeaca10e5c3853b6029d4b250520ff2a4da73bfffb02e3c7927
Instruction ID: cf26c009ca133013ae227f0f7349c27364ce9f02406d5fcf542df790a650bb49
Opcode Fuzzy Hash: 8bfcd990383acfeaca10e5c3853b6029d4b250520ff2a4da73bfffb02e3c7927
Instruction Fuzzy Hash: C8C18E71A0021E9BDF10DFA8D884BBEB7F5FB48314F158569EA45EB280E770AD45CB90

Function 008F9113 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008F9167
VariantInit.OLEAUT32(?), ref: 008F9238
VariantInit.OLEAUT32(?), ref: 008F9339
VariantClear.OLEAUT32(?), ref: 008F9343
VariantClear.OLEAUT32(?), ref: 008F93A0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 008F931C
Null Object assignment in FOR..IN loop, xrefs: 008F91C8, 008F92F6, 008F93AE

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: cc94f0d1e4406806e20258f9e36eb42ea07119a9af4f3503eddba116f1917dcd
Instruction ID: 9734928b59954253afbfd7191d19730329180a8f6289c3cce1f276200ad3a1a4
Opcode Fuzzy Hash: cc94f0d1e4406806e20258f9e36eb42ea07119a9af4f3503eddba116f1917dcd
Instruction Fuzzy Hash: 92919C31A00219ABDF24DFA5C848FAEBBB8FF85714F108159FA55EB280D7709941CFA0

Function 008F975D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 008D710A: CLSIDFromProgID.COMBASE ref: 008D7127
Part of subcall function 008D710A: ProgIDFromCLSID.COMBASE(?,00000000), ref: 008D7142
Part of subcall function 008D710A: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,008D7044,80070057,?,?), ref: 008D7150
Part of subcall function 008D710A: CoTaskMemFree.COMBASE(00000000), ref: 008D7160

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 008F9806
_memset.LIBCMT ref: 008F9813
_memset.LIBCMT ref: 008F9956
CoCreateInstanceEx.COMBASE(?,00000000,00000015,?,00000001,00000000), ref: 008F9982
CoTaskMemFree.COMBASE(?), ref: 008F998D

Strings

NULL Pointer assignment, xrefs: 008F99DB

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: e04d5f7b375ccfed5c4e756f52082665a2b1db6e9bd2faae855527b849c32fce
Instruction ID: 1ff2657351866c6cf25d3b0f368b3d758454809d0dfc0a10cca5e2975ee98cca
Opcode Fuzzy Hash: e04d5f7b375ccfed5c4e756f52082665a2b1db6e9bd2faae855527b849c32fce
Instruction Fuzzy Hash: C291077190022DEBDB10EFA5DC45AEEBBB9FF08310F20415AE519E7251EB719A44CFA1

Function 00906D80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00906E24
SendMessageW.USER32(?,00001036,00000000,?), ref: 00906E38
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00906E52
_wcscat.LIBCMT ref: 00906EAD
SendMessageW.USER32(?,00001057,00000000,?), ref: 00906EC4
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00906EF2

Strings

SysListView32, xrefs: 00906DF6

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 9222dddb911122623f21fecd6e9e91351e29ca2a6ba62d70e426089afcc74aee
Instruction ID: e6b6f11ce3321ac49e8d44ca20621ab425acf6dbe77e6a707b4163e3cf9f5150
Opcode Fuzzy Hash: 9222dddb911122623f21fecd6e9e91351e29ca2a6ba62d70e426089afcc74aee
Instruction Fuzzy Hash: 48419E71A00349AFEB219FA8CC85BEA77ECEF08354F10052AF584E72D1D7729D958B60

Function 008FE933 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 008E3C55: CreateToolhelp32Snapshot.KERNEL32 ref: 008E3C7A
Part of subcall function 008E3C55: Process32FirstW.KERNEL32(00000000,?), ref: 008E3C88
Part of subcall function 008E3C55: CloseHandle.KERNEL32(00000000), ref: 008E3D52

OpenProcess.KERNEL32(00000001,00000000,?), ref: 008FE9A4
GetLastError.KERNEL32 ref: 008FE9B7
OpenProcess.KERNEL32(00000001,00000000,?), ref: 008FE9E6
TerminateProcess.KERNEL32(00000000,00000000), ref: 008FEA63
GetLastError.KERNEL32(00000000), ref: 008FEA6E
CloseHandle.KERNEL32(00000000), ref: 008FEAA3

Strings

SeDebugPrivilege, xrefs: 008FE9C2

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 0a6944da31f5c339c5044cba490598265e045641d17b03e33ca5cc085d3aa820
Instruction ID: 2be5d21f8b34986b737efaa28283e19b6aab188e587e2202754e0c2fbf9bd293
Opcode Fuzzy Hash: 0a6944da31f5c339c5044cba490598265e045641d17b03e33ca5cc085d3aa820
Instruction Fuzzy Hash: 634179712042059FDB24EF28CCA5F79B7A5FF54314F188419FA42DB2D2DB74A944CB92

Function 008E2F94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 008E3033

Strings

question, xrefs: 008E2FEC
stop, xrefs: 008E3004
warning, xrefs: 008E301C
info, xrefs: 008E2FD4
blank, xrefs: 008E2FB5

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: c99ff7bfb5dace223d491681c501ad412b39b990442ee96564f35cfc08ae5953
Instruction ID: 23879b0515ea595385b64f32ddca98c549ac6fecdce46f3d9a5358ec71a1ab7c
Opcode Fuzzy Hash: c99ff7bfb5dace223d491681c501ad412b39b990442ee96564f35cfc08ae5953
Instruction Fuzzy Hash: DC1108313487C6BEE7259A1ADC46C6B779CFF17324F10006AF900E7582DAA09F4059A1

Function 008E42F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 008E4312
LoadStringW.USER32(00000000), ref: 008E4319
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 008E432F
LoadStringW.USER32(00000000), ref: 008E4336
_wprintf.LIBCMT ref: 008E435C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 008E437A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 008E4357

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 5292ea87dfe831a577b8997a12b94da87eaa39e0981ccf430ebb9ca3c2a06b35
Instruction ID: abc2cfd65754d82e2e6177d93dc2940a2748f8b9c8e53cd60dce4851babacced
Opcode Fuzzy Hash: 5292ea87dfe831a577b8997a12b94da87eaa39e0981ccf430ebb9ca3c2a06b35
Instruction Fuzzy Hash: E90128F290420CBFE761ABA49D89EEB766CEB08300F0005A1BB49E2451EA759F855B71

Function 00882A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,008BC1C7,00000004,00000000,00000000,00000000), ref: 00882ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,008BC1C7,00000004,00000000,00000000,00000000,000000FF), ref: 00882B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,008BC1C7,00000004,00000000,00000000,00000000), ref: 008BC21A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,008BC1C7,00000004,00000000,00000000,00000000), ref: 008BC286

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: bddd8c3f27665800d1939267297e195abfaec61d0c771e5d350f702eadb9e20a
Instruction ID: 3708ad55503a3355ed7474b0447cd264dc8e2e572a7d1ad18316094ec2558d6f
Opcode Fuzzy Hash: bddd8c3f27665800d1939267297e195abfaec61d0c771e5d350f702eadb9e20a
Instruction Fuzzy Hash: D8411634218694EFC73DAB28CC98BAF7B96FF85314F148829E057C6A61C631A841D711

Function 008E70C6 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 008E70DD

Part of subcall function 008A0DB6: std::exception::exception.LIBCMT ref: 008A0DEC
Part of subcall function 008A0DB6: __CxxThrowException@8.LIBCMT ref: 008A0E01

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 008E7114
RtlEnterCriticalSection.NTDLL(?), ref: 008E7130
_memmove.LIBCMT ref: 008E717E
_memmove.LIBCMT ref: 008E719B
RtlLeaveCriticalSection.NTDLL(?), ref: 008E71AA
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 008E71BF
InterlockedExchange.KERNEL32(?,000001F6), ref: 008E71DE

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: fce9ebed4c6aa178dd892d196a6d4b9adbf5a9b672b839fabb8f20272f5570ad
Instruction ID: f061fe66ba1888f39f46589423558dfb9a001f2d6187aa3ed6573f742df7d7ba
Opcode Fuzzy Hash: fce9ebed4c6aa178dd892d196a6d4b9adbf5a9b672b839fabb8f20272f5570ad
Instruction Fuzzy Hash: 96315E32904205EFDF10EFA9DC85AAAB7B8FF46710F1441A5E904EB256DB709A10DB61

Function 009061D3 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 009061EB
GetDC.USER32(00000000), ref: 009061F3
GetDeviceCaps.GDI32(00000000,0000005A), ref: 009061FE
ReleaseDC.USER32(00000000,00000000), ref: 0090620A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00906246
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00906257
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,0090902A,?,?,000000FF,00000000,?,000000FF,?), ref: 00906291
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 009062B1

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 40aaa623055ffbafb55da7038544bb66a572fc2851f088660390f7eb043c8ff9
Instruction ID: baee54af6f3a81cc944aec14bd5c0fc8a26289daface0f04077a39844e3822a8
Opcode Fuzzy Hash: 40aaa623055ffbafb55da7038544bb66a572fc2851f088660390f7eb043c8ff9
Instruction Fuzzy Hash: 0F317A72214214BFEF208F14CC8AFAA3BADEF4A765F044065FE08DA291C7759951CBA0

Function 008DBBAF Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 008DBBC4
_memcmp.LIBCMT ref: 008DBBE6
_memcmp.LIBCMT ref: 008DBBFE
_memcmp.LIBCMT ref: 008DBC11
_memcmp.LIBCMT ref: 008DBC2B
_memcmp.LIBCMT ref: 008DBC3E
_memcmp.LIBCMT ref: 008DBC56
_memcmp.LIBCMT ref: 008DBC71

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 503316875de1510b59ca7aeddad7f3bf1171db50915a06a9239db53110a22f53
Instruction ID: 1e10bf157240f10f3b0986fdc7ea64614528d58ad572cc1de3449335ca244d13
Opcode Fuzzy Hash: 503316875de1510b59ca7aeddad7f3bf1171db50915a06a9239db53110a22f53
Instruction Fuzzy Hash: EF21BD61702209AAAA0476299D42FFB735DFF5535CF054122FD05D6B43EB24DE2083A6

Function 00881424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a3306f1c2689daed92d67a9ee12de313c5d125dca2f665366a92fecdb0e2ea4
Instruction ID: b7bb1d6028a0746a4fda0701b8f079ab50524a39d32294f9fa5b5529fb5d93f3
Opcode Fuzzy Hash: 8a3306f1c2689daed92d67a9ee12de313c5d125dca2f665366a92fecdb0e2ea4
Instruction Fuzzy Hash: D5717C30904109EFCF14DF98CC48ABEBB79FF85314F148159F915EA251CB34AA52CBA8

Function 0090B351 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01562660), ref: 0090B3EB
IsWindowEnabled.USER32(01562660), ref: 0090B3F7
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 0090B4DB
SendMessageW.USER32(01562660,000000B0,?,?), ref: 0090B512
IsDlgButtonChecked.USER32(?,?), ref: 0090B54F
GetWindowLongW.USER32(01562660,000000EC), ref: 0090B571
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0090B589

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: c5d70b793106cf5f7c38877b588843844acaa3eb13030a45fca3b830ac6077f5
Instruction ID: ec9e909ef6d55a922f363f2cbaa06a4247a331dff847f6fc240669daa5642719
Opcode Fuzzy Hash: c5d70b793106cf5f7c38877b588843844acaa3eb13030a45fca3b830ac6077f5
Instruction Fuzzy Hash: C6718D34605204EFDB209F54C8A4FBABBBAEF49300F144569FA55972E2C732AA41DB50

Function 008FF41E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008FF448
_memset.LIBCMT ref: 008FF511
ShellExecuteExW.SHELL32(?), ref: 008FF556

Part of subcall function 00889837: __itow.LIBCMT ref: 00889862
Part of subcall function 00889837: __swprintf.LIBCMT ref: 008898AC

Part of subcall function 0089FC86: _wcscpy.LIBCMT ref: 0089FCA9

GetProcessId.KERNEL32(00000000), ref: 008FF5CD
CloseHandle.KERNEL32(00000000), ref: 008FF5FC

Strings

@, xrefs: 008FF525

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 749913d6a983e6528ebcadb20c3f780781a6f0fe84200f496ddfe30a2c567cce
Instruction ID: 816ead354416cbdafaad82a72fa32d4dedb17ad5a98c03cfbb8cb2fc47a8d69b
Opcode Fuzzy Hash: 749913d6a983e6528ebcadb20c3f780781a6f0fe84200f496ddfe30a2c567cce
Instruction Fuzzy Hash: 3061AE75A006199FCF14EF68C4819AEBBF5FF49314F148069E95AEB752CB30AD41CB81

Function 008E0F4D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 008E0F8C
GetKeyboardState.USER32(?), ref: 008E0FA1
SetKeyboardState.USER32(?), ref: 008E1002
PostMessageW.USER32(?,00000101,00000010,?), ref: 008E1030
PostMessageW.USER32(?,00000101,00000011,?), ref: 008E104F
PostMessageW.USER32(?,00000101,00000012,?), ref: 008E1095
PostMessageW.USER32(?,00000101,0000005B,?), ref: 008E10B8

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: f8179aff22a19a73c4d77206caba15ab5ae20d02e906c8b02b2bfdfae85912cf
Instruction ID: a6266d93ab8678861d7c548ad40ae68681831c163210e16f7988730c2ac91a29
Opcode Fuzzy Hash: f8179aff22a19a73c4d77206caba15ab5ae20d02e906c8b02b2bfdfae85912cf
Instruction Fuzzy Hash: 1251C170618AD53DFF3642358C19BB6BEA9BB07304F084989E1D5C58C3C6E5D8D8DB51

Function 008E0D66 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 008E0DA5
GetKeyboardState.USER32(?), ref: 008E0DBA
SetKeyboardState.USER32(?), ref: 008E0E1B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 008E0E47
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 008E0E64
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 008E0EA8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 008E0EC9

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 7c15f587591ba55324bf351d6740790dd74c909807f94138e8d50ea909227f6f
Instruction ID: 87037d3479e6f8e272551f2bd5c3c9a9e73e50da9a9c314b346689b72a63b2cb
Opcode Fuzzy Hash: 7c15f587591ba55324bf351d6740790dd74c909807f94138e8d50ea909227f6f
Instruction Fuzzy Hash: 7D51D5A05087D63DFB3282658C55B7A7EA9FB07300F084D99E1D4D68C2C7D5ACD8EB51

Function 008E55FD Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 008E560A
_wcsncpy.LIBCMT ref: 008E563F
_wcsncpy.LIBCMT ref: 008E5671
_wcsncpy.LIBCMT ref: 008E56A4
_wcsncpy.LIBCMT ref: 008E56E6
_wcsncpy.LIBCMT ref: 008E5720
_wcsncpy.LIBCMT ref: 008E574F

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 602206b19cf8dc603487fa7dc6eaeb6e7d4908eec8f3c84f44b53526518710fb
Instruction ID: 64b0d5c537ba2825a043b269c038f8b4989fa7d522ce64efa4ad6a3e1ff92015
Opcode Fuzzy Hash: 602206b19cf8dc603487fa7dc6eaeb6e7d4908eec8f3c84f44b53526518710fb
Instruction Fuzzy Hash: EE41B365C10618B6DB11EBBC8C46ACFB3B8FF06310F508856F558E3621EA34E256C7A7

Function 008E3671 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 008E466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,008E3697,?), ref: 008E468B

Part of subcall function 008E466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,008E3697,?), ref: 008E46A4

lstrcmpiW.KERNEL32(?,?), ref: 008E36B7
_wcscmp.LIBCMT ref: 008E36D3
MoveFileW.KERNEL32(?,?), ref: 008E36EB
_wcscat.LIBCMT ref: 008E3733
SHFileOperationW.SHELL32(?), ref: 008E379F

Strings

\*.*, xrefs: 008E372D

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: a1bfe0627a42d8ba9c3dd8f2bf42c8428b77711e8198e9266c64540123935b97
Instruction ID: 2a1c213a72a0b06423e43020fe907704c1da7335884ab7f90e37191f991818ec
Opcode Fuzzy Hash: a1bfe0627a42d8ba9c3dd8f2bf42c8428b77711e8198e9266c64540123935b97
Instruction Fuzzy Hash: 6541817150C384AED751EF69C4459DF77E8FF8A390F00182EB49AC3261EA34D689C752

Function 00907291 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 009072AA
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00907351
IsMenu.USER32(?), ref: 00907369
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 009073B1
DrawMenuBar.USER32 ref: 009073C4

Strings

0, xrefs: 0090729E

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 0a1de555eb658759ce3b1eeb5c0a51f30a42af7dd60a40fc132db336b477ecf4
Instruction ID: 75edf1561300b166e472fcec8df677d32eb7485a0931b6bf78cf1f3639c6a081
Opcode Fuzzy Hash: 0a1de555eb658759ce3b1eeb5c0a51f30a42af7dd60a40fc132db336b477ecf4
Instruction Fuzzy Hash: 5A412975A04208EFEB20DF94E884EAABBF9FB05320F148529FD5597290D730AD50EF50

Function 00900FA5 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00900FD4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00900FFE
FreeLibrary.KERNEL32(00000000), ref: 009010B5

Part of subcall function 00900FA5: RegCloseKey.ADVAPI32(?), ref: 0090101B
Part of subcall function 00900FA5: FreeLibrary.KERNEL32(?), ref: 0090106D
Part of subcall function 00900FA5: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00901090

RegDeleteKeyW.ADVAPI32(?,?), ref: 00901058

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 5d6bca475eccd23b6856839f67e96b0f372a703550fe3d878007691722010a6f
Instruction ID: ce846032c8108e4ba62bc800cf8fc43f3c2fe51d9fcb34734553dd7e4241ec1f
Opcode Fuzzy Hash: 5d6bca475eccd23b6856839f67e96b0f372a703550fe3d878007691722010a6f
Instruction Fuzzy Hash: 69310D71915109BFEB259F90DC99EFFB7BCEF09300F000169E541E2191EB749F859AA0

Function 009062CD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 009062EC
GetWindowLongW.USER32(01562660,000000F0), ref: 0090631F
GetWindowLongW.USER32(01562660,000000F0), ref: 00906354
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00906386
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 009063B0
GetWindowLongW.USER32(00000000,000000F0), ref: 009063C1
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 009063DB

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 3e166dd75f8f61b29bdc1cc3d37d15cdf73040d7b4ba048ea040c73ec1a95b56
Instruction ID: 7008d97bb4ccb34a9c8163803faf2e27103e17ed0344feabb19f7854ad8989af
Opcode Fuzzy Hash: 3e166dd75f8f61b29bdc1cc3d37d15cdf73040d7b4ba048ea040c73ec1a95b56
Instruction Fuzzy Hash: 61311F35608255AFDB20CF58DC88F593BE9FB4A714F1901A8F5009F2F2CB72A950EB90

Function 008DDAEB Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 008DDB2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 008DDB54
SysAllocString.OLEAUT32(00000000), ref: 008DDB57
SysAllocString.OLEAUT32(?), ref: 008DDB75
SysFreeString.OLEAUT32(?), ref: 008DDB7E
StringFromGUID2.COMBASE(?,?,00000028), ref: 008DDBA3
SysAllocString.OLEAUT32(?), ref: 008DDBB1

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 8b94ef12ecf37357db227a930092d329048e4a53bea0a4b98012fe24988801fb
Instruction ID: 74dfcb49ea165da60093475433204b43d9851cf354b439c5d572f7246bc060b7
Opcode Fuzzy Hash: 8b94ef12ecf37357db227a930092d329048e4a53bea0a4b98012fe24988801fb
Instruction Fuzzy Hash: 56216B36604319AFDB10AFA8DC88CBB73ACFB09364B018626FD14DB2A0D6709D419B60

Function 008F6173 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 008F7D8B: inet_addr.WS2_32(00000000), ref: 008F7DB6

socket.WS2_32(00000002,00000001,00000006), ref: 008F61C6
WSAGetLastError.WS2_32(00000000), ref: 008F61D5
ioctlsocket.WS2_32(00000000,8004667E,00000000), ref: 008F620E
connect.WSOCK32(00000000,?,00000010), ref: 008F6217
WSAGetLastError.WS2_32 ref: 008F6221
closesocket.WS2_32(00000000), ref: 008F624A
ioctlsocket.WS2_32(00000000,8004667E,00000000), ref: 008F6263

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 65686214e21971ff80e5e72c3bc1935c81de1600ef98df4385123c0879ce57b6
Instruction ID: 3fbfccd453376590c80935f43e0cfd1c3cb66ce6fdb8a2cd881620f889a4be5a
Opcode Fuzzy Hash: 65686214e21971ff80e5e72c3bc1935c81de1600ef98df4385123c0879ce57b6
Instruction Fuzzy Hash: B4318131600118AFEF10AF64CC85BBE77A9FF45764F048129FE06E7291DB70AD549BA2

Function 008DF65E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 008DF671
__wcsnicmp.LIBCMT ref: 008DF692
__wcsnicmp.LIBCMT ref: 008DF6AC

Strings

#notrayicon, xrefs: 008DF669
#requireadmin, xrefs: 008DF68C
#OnAutoItStartRegister, xrefs: 008DF6A6

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 1bd7dc0e5cb0cd8f8c1b7e983120026e4ccbd0dad1feb9d0181561d86046359f
Instruction ID: 386ad67f19a955ae6ccd192a4e807924caf2fabb26d7c76f8c0ac987e37554de
Opcode Fuzzy Hash: 1bd7dc0e5cb0cd8f8c1b7e983120026e4ccbd0dad1feb9d0181561d86046359f
Instruction Fuzzy Hash: 4621457220415166E321BA38AC02EE77398FF66358B14413BFA43C6692EB509D91E396

Function 008DDBC4 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 008DDC09
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 008DDC2F
SysAllocString.OLEAUT32(00000000), ref: 008DDC32
SysAllocString.OLEAUT32 ref: 008DDC53
SysFreeString.OLEAUT32 ref: 008DDC5C
StringFromGUID2.COMBASE(?,?,00000028), ref: 008DDC76
SysAllocString.OLEAUT32(?), ref: 008DDC84

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 08e5980bd631f6052886c174eb98b7cb7adfae3915c1bfbdcad2e9c7ab3a3246
Instruction ID: ac8eac4b06a1f84408fb7a666c477787104afd1c11ab68c0f4b6b13decba2ec7
Opcode Fuzzy Hash: 08e5980bd631f6052886c174eb98b7cb7adfae3915c1bfbdcad2e9c7ab3a3246
Instruction Fuzzy Hash: 6E213275618204AFDB20DBA8DC88DAB77ACFB09360B108226F915CB761D674DD41DB64

Function 009075CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00881D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00881D73
Part of subcall function 00881D35: GetStockObject.GDI32(00000011), ref: 00881D87
Part of subcall function 00881D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00881D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00907632
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0090763F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0090764A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00907659
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00907665

Strings

Msctls_Progress32, xrefs: 00907603

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 842c65c3e4004d9a3bb53f9a9460f1527f9be4687e597551c25505323dadc341
Instruction ID: ba59136d0cefd84ab6c41c9646758ca0a4c35b77813c2585949f6877f6981df0
Opcode Fuzzy Hash: 842c65c3e4004d9a3bb53f9a9460f1527f9be4687e597551c25505323dadc341
Instruction Fuzzy Hash: D811B9B15101197FEF115FA4CC85EE7BF5DEF08798F014114B605A2090C672AC21DBA4

Function 008A9AE6 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 008A9AE6

Part of subcall function 008A3187: RtlEncodePointer.NTDLL(00000000), ref: 008A318A
Part of subcall function 008A3187: __initp_misc_winsig.LIBCMT ref: 008A31A5
Part of subcall function 008A3187: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 008A9EA0
Part of subcall function 008A3187: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 008A9EB4
Part of subcall function 008A3187: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 008A9EC7
Part of subcall function 008A3187: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 008A9EDA
Part of subcall function 008A3187: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 008A9EED
Part of subcall function 008A3187: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 008A9F00
Part of subcall function 008A3187: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 008A9F13
Part of subcall function 008A3187: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 008A9F26
Part of subcall function 008A3187: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 008A9F39
Part of subcall function 008A3187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 008A9F4C
Part of subcall function 008A3187: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 008A9F5F
Part of subcall function 008A3187: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 008A9F72
Part of subcall function 008A3187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 008A9F85
Part of subcall function 008A3187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 008A9F98
Part of subcall function 008A3187: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 008A9FAB
Part of subcall function 008A3187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 008A9FBE

__mtinitlocks.LIBCMT ref: 008A9AEB
__mtterm.LIBCMT ref: 008A9AF4

Part of subcall function 008A9B5C: RtlDeleteCriticalSection.NTDLL(00000000), ref: 008A9C56
Part of subcall function 008A9B5C: _free.LIBCMT ref: 008A9C5D
Part of subcall function 008A9B5C: RtlDeleteCriticalSection.NTDLL(0093EC00), ref: 008A9C7F

__calloc_crt.LIBCMT ref: 008A9B19
__initptd.LIBCMT ref: 008A9B3B
GetCurrentThreadId.KERNEL32 ref: 008A9B42

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: a964ca21974354fccbe87f35e8b3e63966ab7e6125012ee3c41359d039d0337b
Instruction ID: 475be646f5d72fb8d82451898073d630523e9edf6465d395b6e75abb7f2ac83f
Opcode Fuzzy Hash: a964ca21974354fccbe87f35e8b3e63966ab7e6125012ee3c41359d039d0337b
Instruction Fuzzy Hash: 8DF06D3251D7215AF734B67CBC0364A3690FB03730B214A2AF4E5C59D2EF60944245A2

Function 008A406B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,008A3F85), ref: 008A4085
GetProcAddress.KERNEL32(00000000), ref: 008A408C
RtlEncodePointer.NTDLL(00000000), ref: 008A4097
RtlDecodePointer.NTDLL(008A3F85), ref: 008A40B2

Strings

combase.dll, xrefs: 008A4080
RoUninitialize, xrefs: 008A4074

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 50566ac1e8fea92afe89b8911c71debe9c8f9b71daec846c3d6d79a1557cb8a0
Instruction ID: 6918b99f76c18453375650ee0036b34a655bbbe5249d1d03b8c2b99ec4f99453
Opcode Fuzzy Hash: 50566ac1e8fea92afe89b8911c71debe9c8f9b71daec846c3d6d79a1557cb8a0
Instruction Fuzzy Hash: C6E092786AD700EFEB60AF71ED1AB453AA4B74A786F109024F111E58A0CBB64644FB14

Function 008F6B76 Relevance: 9.2, APIs: 6, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b189b47de8413556861a5eddaff62eefa4b25f099830299e6cb0665a61b72b0
Instruction ID: a5e12ef34d1a6bc84f5f9cc9122ae17e8b11d55c1b35052827240694d0121091
Opcode Fuzzy Hash: 6b189b47de8413556861a5eddaff62eefa4b25f099830299e6cb0665a61b72b0
Instruction Fuzzy Hash: DA619D71208205ABD710FB28DC82E7BB7A8FF84714F544A19F696DB292EB719D04C752

Function 008E64B8 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 008E660B
_memmove.LIBCMT ref: 008E6546

Part of subcall function 00889837: __itow.LIBCMT ref: 00889862
Part of subcall function 00889837: __swprintf.LIBCMT ref: 008898AC

_memmove.LIBCMT ref: 008E65B9
_memmove.LIBCMT ref: 008E66A0
_memmove.LIBCMT ref: 008E66B9
_memmove.LIBCMT ref: 008E66D5

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 252363474222daa7ffc5f90582436cd049655afb3bfa590e9cf2d97247ad03e5
Instruction ID: ded6fef1deb4911a089b49dea4f2acdd985ad2e4e7e4174a87ba0acc2586f65b
Opcode Fuzzy Hash: 252363474222daa7ffc5f90582436cd049655afb3bfa590e9cf2d97247ad03e5
Instruction Fuzzy Hash: FA619D3050029A9BDF01FF69CC81AFE37A5FF16308F044529F8599B1A2EA35D815DB52

Function 009001E4 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00887DE1: _memmove.LIBCMT ref: 00887E22

Part of subcall function 00900E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,008FFDAD,?,?), ref: 00900E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 009002BD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 009002FD
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00900320
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00900349
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0090038C
RegCloseKey.ADVAPI32(00000000), ref: 00900399

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: b61436a3b07055a0e0fc7fce59d03abcacf465d7113ddd971e496d357bea9a83
Instruction ID: 2ae3911ded128bec99c6bc4e8a63590596659c81ceb32a84642085fcb9cff64b
Opcode Fuzzy Hash: b61436a3b07055a0e0fc7fce59d03abcacf465d7113ddd971e496d357bea9a83
Instruction Fuzzy Hash: 4A515731208204AFCB15EF68D885E6EBBF9FF89314F04492DF595872A2DB31E905DB52

Function 00905799 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 009057FB
GetMenuItemCount.USER32(00000000), ref: 00905832
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 0090585A
GetMenuItemID.USER32(?,?), ref: 009058C9
GetSubMenu.USER32(?,?), ref: 009058D7
PostMessageW.USER32(?,00000111,?,00000000), ref: 00905928

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 5e2d90d40dc05cae6fb66d3313c874cd69cc9996502425a330f3356c8e4fd7d9
Instruction ID: 72ce652a765c2514af48dad0abc447a95e2541d2e08c5b2b504380fcc2bb18b0
Opcode Fuzzy Hash: 5e2d90d40dc05cae6fb66d3313c874cd69cc9996502425a330f3356c8e4fd7d9
Instruction Fuzzy Hash: 23515A35A00615EFCF11AF68C845AAEB7B4FF48320F158069EC56AB391CB34AE419F91

Function 008DEEEC Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 008DEF06
VariantClear.OLEAUT32(00000013), ref: 008DEF78
VariantClear.OLEAUT32(00000000), ref: 008DEFD3
_memmove.LIBCMT ref: 008DEFFD
VariantClear.OLEAUT32(?), ref: 008DF04A
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 008DF078

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 299746681ca80abfecefcb9f87ff61cb98c68d995f8a56db0b1d18360ab1aac6
Instruction ID: aa75fdfd4c1da1353955da21b055e46bc734742e781186b0f76eed7e096842b5
Opcode Fuzzy Hash: 299746681ca80abfecefcb9f87ff61cb98c68d995f8a56db0b1d18360ab1aac6
Instruction Fuzzy Hash: 3D515CB5A00209DFDB14DF58C884AAAB7B8FF4C314B15856AEE59DB301E735E911CBA0

Function 008E220A Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008E2258
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 008E22A3
IsMenu.USER32(00000000), ref: 008E22C3
CreatePopupMenu.USER32 ref: 008E22F7
GetMenuItemCount.USER32(000000FF), ref: 008E2355
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 008E2386

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 190ea18e37b38799b7a1a78de091952d225a98776b543ce2c742fe90b2b6a46c
Instruction ID: 52844118774bccf09b70be315584af40d148cd4d225a239af52b4c1e269945db
Opcode Fuzzy Hash: 190ea18e37b38799b7a1a78de091952d225a98776b543ce2c742fe90b2b6a46c
Instruction Fuzzy Hash: E6518B70600289DFDF21CF6AC888BAEBBE9FF46318F144169E815D72A1D3749A44CF51

Function 00881765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00882612: GetWindowLongW.USER32(?,000000EB), ref: 00882623

BeginPaint.USER32(?,?,?,?,?,?), ref: 0088179A
GetWindowRect.USER32(?,?), ref: 008817FE
ScreenToClient.USER32(?,?), ref: 0088181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0088182C
EndPaint.USER32(?,?), ref: 00881876

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: a86e56e085b41ce08ae0431d7fd9329629d279a0392f6e615176fb6f8586425e
Instruction ID: 93078968fa0a063f5dd3d315fcffd42d4ade4be8fc81137e4638b01581214a73
Opcode Fuzzy Hash: a86e56e085b41ce08ae0431d7fd9329629d279a0392f6e615176fb6f8586425e
Instruction Fuzzy Hash: C841A3301047049FDB10EF64CC89FA67BECFB4A724F040639F564C62A2CB719946EB62

Function 0090B69E Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(009457B0,00000000,01562660,?,?,009457B0,?,0090B5A8,?,?), ref: 0090B712
EnableWindow.USER32(00000000,00000000), ref: 0090B736
ShowWindow.USER32(009457B0,00000000,01562660,?,?,009457B0,?,0090B5A8,?,?), ref: 0090B796
ShowWindow.USER32(00000000,00000004,?,0090B5A8,?,?), ref: 0090B7A8
EnableWindow.USER32(00000000,00000001), ref: 0090B7CC
SendMessageW.USER32(?,0000130C,?,00000000), ref: 0090B7EF

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 90ab693c7abe81b2fd9a64eec182ed1a4fd0259cd70e1d50dc61269124c4c525
Instruction ID: 3d8ec3f4ca37a5a9e57d5b0ca547cca502df04f80b88506f10faed95295d0222
Opcode Fuzzy Hash: 90ab693c7abe81b2fd9a64eec182ed1a4fd0259cd70e1d50dc61269124c4c525
Instruction Fuzzy Hash: B4419D34604244AFDB22CF28C499B947BF4FF85710F1841B9E9489FAE3C732A956DB51

Function 008F709E Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,008F4E41,?,?,00000000,00000001), ref: 008F70AC

Part of subcall function 008F39A0: GetWindowRect.USER32(?,?), ref: 008F39B3

GetDesktopWindow.USER32 ref: 008F70D6
GetWindowRect.USER32(00000000), ref: 008F70DD
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 008F710F

Part of subcall function 008E5244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 008E52BC

GetCursorPos.USER32(?), ref: 008F713B
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 008F7199

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: a73f3256cc721085d06bb31b79055e889797276b2ea0c802da9587f90bf6506f
Instruction ID: 491e78adb4c97929eddab1b0eeba121d186060641763e6f64bcdbeb71b23d59f
Opcode Fuzzy Hash: a73f3256cc721085d06bb31b79055e889797276b2ea0c802da9587f90bf6506f
Instruction Fuzzy Hash: A631B272509309AFD720DF24CC49BABB7EAFF89314F000919F585D7191DA71EA49CB92

Function 008EEB23 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00889837: __itow.LIBCMT ref: 00889862
Part of subcall function 00889837: __swprintf.LIBCMT ref: 008898AC

Part of subcall function 0089FC86: _wcscpy.LIBCMT ref: 0089FCA9

_wcstok.LIBCMT ref: 008EEC94
_wcscpy.LIBCMT ref: 008EED23
_memset.LIBCMT ref: 008EED56

Strings

X, xrefs: 008EED93

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 755d39478f7adc7791bd7f466c5001b002395c6942c7787ccf8cd17edf1f0e4f
Instruction ID: cfa481e2cdb10322f27b16d7832a1f301f81ef19e7aa9ca680037f827257471e
Opcode Fuzzy Hash: 755d39478f7adc7791bd7f466c5001b002395c6942c7787ccf8cd17edf1f0e4f
Instruction Fuzzy Hash: 22C13A715083519FC764EF28D881A6AB7E4FF86314F14492DF899DB2A2DB30ED45CB82

Function 008D8879 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 008D80A9: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 008D80C0
Part of subcall function 008D80A9: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 008D80CA
Part of subcall function 008D80A9: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 008D80D9
Part of subcall function 008D80A9: RtlAllocateHeap.NTDLL(00000000,?,00000002), ref: 008D80E0
Part of subcall function 008D80A9: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 008D80F6

GetLengthSid.ADVAPI32(?,00000000,008D842F), ref: 008D88CA
GetProcessHeap.KERNEL32(00000008,00000000), ref: 008D88D6
RtlAllocateHeap.NTDLL(00000000), ref: 008D88DD
CopySid.ADVAPI32(00000000,00000000,?), ref: 008D88F6
GetProcessHeap.KERNEL32(00000000,00000000,008D842F), ref: 008D890A
HeapFree.KERNEL32(00000000), ref: 008D8911

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Heap$Process$AllocateInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 169236558-0
Opcode ID: fdffe59a1eee648b9f2181c93a41710ae955ca251d5e2c8a52d4ef6f5dc0bb09
Instruction ID: d7ae52b5c30837527a5f2184b57a3007c31622eddc3a150ee8fa90d165cfef0d
Opcode Fuzzy Hash: fdffe59a1eee648b9f2181c93a41710ae955ca251d5e2c8a52d4ef6f5dc0bb09
Instruction Fuzzy Hash: A6116D71515209FFDB209FA4DC29FBE7B79FB45316F10422AE885D7210CB32AA44EB61

Function 008DB790 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 008DB7B5
GetDeviceCaps.GDI32(00000000,00000058), ref: 008DB7C6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 008DB7CD
ReleaseDC.USER32(00000000,00000000), ref: 008DB7D5
MulDiv.KERNEL32(000009EC,?,00000000), ref: 008DB7EC
MulDiv.KERNEL32(000009EC,?,?), ref: 008DB7FE

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: c324fc5764e436c2037ad7b2df17e99a0f2afebad5a2064145810729c4e7e83c
Instruction ID: 4c73ed5bfcab413fbe21cd90f2693e44d73078ba6e2efd3eee3e2b4f4a6955e0
Opcode Fuzzy Hash: c324fc5764e436c2037ad7b2df17e99a0f2afebad5a2064145810729c4e7e83c
Instruction Fuzzy Hash: CB018475E04609BFEF109BA69C45A5EBFB8EB48311F004076FA08E7391D6319D00CF91

Function 008A0162 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 008A0193
MapVirtualKeyW.USER32(00000010,00000000), ref: 008A019B
MapVirtualKeyW.USER32(000000A0,00000000), ref: 008A01A6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 008A01B1
MapVirtualKeyW.USER32(00000011,00000000), ref: 008A01B9
MapVirtualKeyW.USER32(00000012,00000000), ref: 008A01C1

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: c069bdf56114c9912dedbcc37c4a7db2837ae170db7ce178728141ec7771ee23
Instruction ID: f28b384e10350ffd9a44f37633fc6fa819085a694c9beae79b76f30df141b19a
Opcode Fuzzy Hash: c069bdf56114c9912dedbcc37c4a7db2837ae170db7ce178728141ec7771ee23
Instruction Fuzzy Hash: 35016CB09017597DE3008F5A8C85B52FFA8FF19354F00411BA15C47941C7F5A864CBE5

Function 008E53E9 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 008E53F9
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 008E540F
GetWindowThreadProcessId.USER32(?,?), ref: 008E541E
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 008E542D
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 008E5437
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 008E543E

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 3a2e6ce6df0b9d2f1ab10d25040f45f4c379fdaa2d47b99f6854cc81d8a9779f
Instruction ID: 134a6b183530748da6600fb1d595e23335ca92e2288fe4500d6ba48c49abc3e0
Opcode Fuzzy Hash: 3a2e6ce6df0b9d2f1ab10d25040f45f4c379fdaa2d47b99f6854cc81d8a9779f
Instruction Fuzzy Hash: D0F06D32258558BFE3305BA2DC0DEAB7A7CEBC6B11F000169FA04D10909AA11B0196B5

Function 008E7230 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 008E7243
RtlEnterCriticalSection.NTDLL(?), ref: 008E7254
TerminateThread.KERNEL32(00000000,000001F6,?,00890EE4,?,?), ref: 008E7261
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00890EE4,?,?), ref: 008E726E

Part of subcall function 008E6C35: CloseHandle.KERNEL32(00000000,?,008E727B,?,00890EE4,?,?), ref: 008E6C3F

InterlockedExchange.KERNEL32(?,000001F6), ref: 008E7281
RtlLeaveCriticalSection.NTDLL(?), ref: 008E7288

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 606fdc38c681bc19b398265b412fe13b7e3fa5d527d2ff9cff47067c528416d5
Instruction ID: 1878dd3dfb8fa31bedb5152aa1069dcda0644f73be0529ad9a1213d732772ff2
Opcode Fuzzy Hash: 606fdc38c681bc19b398265b412fe13b7e3fa5d527d2ff9cff47067c528416d5
Instruction Fuzzy Hash: A4F0E236058702EFE7212B28EC4C9DB7739FF05702B100131F203D04A0CB761A40EB50

Function 008F85ED Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 008F8613
CharUpperBuffW.USER32(?,?), ref: 008F8722
VariantClear.OLEAUT32(?), ref: 008F889A

Part of subcall function 008E7562: VariantInit.OLEAUT32(00000000), ref: 008E75A2
Part of subcall function 008E7562: VariantCopy.OLEAUT32(00000000,?), ref: 008E75AB
Part of subcall function 008E7562: VariantClear.OLEAUT32(00000000), ref: 008E75B7

Strings

AUTOIT.ERROR, xrefs: 008F8728
Incorrect Parameter format, xrefs: 008F864B, 008F880D

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: c412135c02e5d0beb8157fbee11e08824611faf7f0ae4e005991a45a579609d5
Instruction ID: 1caf6be98833376d2bb24af04c8f62f6ad2604dda563a03c579ef4c04044f9b3
Opcode Fuzzy Hash: c412135c02e5d0beb8157fbee11e08824611faf7f0ae4e005991a45a579609d5
Instruction Fuzzy Hash: 7C914671608305DFC710EF28C48496ABBE4FF89754F14896EF99ACB261DB30E905CB92

Function 008E2A96 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0089FC86: _wcscpy.LIBCMT ref: 0089FCA9

_memset.LIBCMT ref: 008E2B87
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 008E2BB6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 008E2C69
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 008E2C97

Strings

0, xrefs: 008E2B73

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 9d145af89bdc911f9bc2aec2cbda44e18d07dc782a019945ef83d7efb0e09d8a
Instruction ID: 9a57dc1256f7728f8e2cf795288517881bc57a15f6e1dc13153dd592a1f40c84
Opcode Fuzzy Hash: 9d145af89bdc911f9bc2aec2cbda44e18d07dc782a019945ef83d7efb0e09d8a
Instruction Fuzzy Hash: 0551CE711083809BD7249F2AC845A6FB7ECFF9A324F240A2DF895D2291DB70CD44DB52

Function 008DD56C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(?,00000000,00000005,?,?), ref: 008DD5D4
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 008DD60A
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 008DD61B
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 008DD69D

Strings

DllGetClassObject, xrefs: 008DD610

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: d7b33942d952c1f12bf4f3e0684774c61f59183b9f6ff62073182c0e01f1fe6c
Instruction ID: e9bd4a6cac72aab85e15d29678d65ec2b5fb17649916fa7f80c8f20f41141beb
Opcode Fuzzy Hash: d7b33942d952c1f12bf4f3e0684774c61f59183b9f6ff62073182c0e01f1fe6c
Instruction Fuzzy Hash: 1341AEB1600304EFDB15CF64D884A9ABBA9FF54314F1182AAAC09DF305D7B0DA40CBE0

Function 008E2753 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008E27C0
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 008E27DC
DeleteMenu.USER32(?,00000007,00000000), ref: 008E2822
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00945890,00000000), ref: 008E286B

Strings

0, xrefs: 008E27B5

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: e1f279325e3fab6c0e99ab04e54c6167e2e927b1aca332a313f4a9d717eba635
Instruction ID: f4dcb111e96b7e38f92310534c896e02a6284074418a2ae063fe8184e0f15e49
Opcode Fuzzy Hash: e1f279325e3fab6c0e99ab04e54c6167e2e927b1aca332a313f4a9d717eba635
Instruction Fuzzy Hash: D5417C702043919FD724DF2ACC44B2ABBE8FF86314F144A6DF9A5D7292D730A905CB52

Function 008FD7A5 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 008FD7C5

Part of subcall function 0088784B: _memmove.LIBCMT ref: 00887899

Strings

none, xrefs: 008FD8A0
winapi, xrefs: 008FD836
cdecl, xrefs: 008FD81C
stdcall, xrefs: 008FD847

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 85dbb473f93e422e89dd0d882e9fc8fda456033023aaa41b9d9ca952e0067ee7
Instruction ID: af95bece6cb498b10d0e329f93e9645ba77235cbf9f771b497f9bbb3b693bda7
Opcode Fuzzy Hash: 85dbb473f93e422e89dd0d882e9fc8fda456033023aaa41b9d9ca952e0067ee7
Instruction Fuzzy Hash: 45319A7191421DABDF10EF68C8519BEB3B5FF05320B108A29E926E76D1EB71AD05CB80

Function 008D8E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00887DE1: _memmove.LIBCMT ref: 00887E22

Part of subcall function 008DAA99: GetClassNameW.USER32(?,?,000000FF), ref: 008DAABC

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 008D8F14
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 008D8F27
SendMessageW.USER32(?,00000189,?,00000000), ref: 008D8F57

Part of subcall function 00887BCC: _memmove.LIBCMT ref: 00887C06

Strings

ComboBox, xrefs: 008D8E9E
ListBox, xrefs: 008D8ED3

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: b25ca70f43d846431cc3d96a4b11d63be831fb056bf718316bec28ab572090d0
Instruction ID: 3546aed4f6ee155ae97952e4504cf09dca4ced78bf1834ce99fda76015abc86f
Opcode Fuzzy Hash: b25ca70f43d846431cc3d96a4b11d63be831fb056bf718316bec28ab572090d0
Instruction Fuzzy Hash: 4C21D272A04108BEDB24ABA49C85DFEB779EF45324B14461AF421E72E1DE3549099A11

Function 008F182D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 008F184C
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 008F1872
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 008F18A2
InternetCloseHandle.WININET(00000000), ref: 008F18E9

Part of subcall function 008F2483: GetLastError.KERNEL32(?,?,008F1817,00000000,00000000,00000001), ref: 008F2498
Part of subcall function 008F2483: SetEvent.KERNEL32(?,?,008F1817,00000000,00000000,00000001), ref: 008F24AD

Strings

, xrefs: 008F1893

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 7c4f2e7f7a95294f8d39c38586a54d4d6cf922ed1d530f75bd6122e574a6f3ef
Instruction ID: 10379b308eb493d2889ca76ebfe1ed71137b017da6b0542aaa5bacd7a1170f80
Opcode Fuzzy Hash: 7c4f2e7f7a95294f8d39c38586a54d4d6cf922ed1d530f75bd6122e574a6f3ef
Instruction Fuzzy Hash: 0D21B0B151420CBFEB119B74CD89EBB77EDFB48784F10413AF605D6640EA608E0567A2

Function 009063E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00881D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00881D73
Part of subcall function 00881D35: GetStockObject.GDI32(00000011), ref: 00881D87
Part of subcall function 00881D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00881D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00906461
LoadLibraryW.KERNEL32(?), ref: 00906468
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 0090647D
DestroyWindow.USER32(?), ref: 00906485

Strings

SysAnimate32, xrefs: 0090643C

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 20810bbfe68003d201a2fb020cefed74bf3eefdb92fea5f49f3da07b039cb6cd
Instruction ID: 13b54b09b57d1d34e02a331f80129bbf7abe9e79fc8561a886182292c4abbdfb
Opcode Fuzzy Hash: 20810bbfe68003d201a2fb020cefed74bf3eefdb92fea5f49f3da07b039cb6cd
Instruction Fuzzy Hash: B2218872210209AFEF108FA4DC90EBA77ADEF59368F104629FA10920E0D7719C62A760

Function 008E6D9C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 008E6DBC
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 008E6DEF
GetStdHandle.KERNEL32(0000000C), ref: 008E6E01
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 008E6E3B

Strings

nul, xrefs: 008E6E36

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: af747ddc6b7467789f59490795de7e86db51ef69a1d395f6787b12fa28deb495
Instruction ID: 6eaaa3d4352091ae24e18216593074f8e3300a46c8881e0d62cf4b3ed90bbe26
Opcode Fuzzy Hash: af747ddc6b7467789f59490795de7e86db51ef69a1d395f6787b12fa28deb495
Instruction Fuzzy Hash: DB21977470034AAFDB209F2ADC05A5977F4FF667A0F204619FCA1D72D0E77199609B50

Function 008E6E6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 008E6E89
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 008E6EBB
GetStdHandle.KERNEL32(000000F6), ref: 008E6ECC
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 008E6F06

Strings

nul, xrefs: 008E6F01

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 095a4cf837867faf3eebe9ef60b0117b35ed6138ceb3bc15c86d148ebce69a52
Instruction ID: 2c4e2059002c1b2a2e4040f6721c37794b8ac355745e0a9216c8f19f7cf9ad5a
Opcode Fuzzy Hash: 095a4cf837867faf3eebe9ef60b0117b35ed6138ceb3bc15c86d148ebce69a52
Instruction Fuzzy Hash: 1921B275500346DBDB209F6ACC04AAA77A8FF66764F300A59F8B0D32D0E77099608B21

Function 008EAC40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 008EAC54
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 008EACA8
__swprintf.LIBCMT ref: 008EACC1
SetErrorMode.KERNEL32(00000000,00000001,00000000,0090F910), ref: 008EACFF

Strings

%lu, xrefs: 008EACBB

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: d4ba6a14be470e900384f710a3f498b8caf81287805122be8c1eef9c575d196b
Instruction ID: 52ce9aecfdaa807b3781158ffebfc8f4f59fbba54980406c3ee0850fbf2c0244
Opcode Fuzzy Hash: d4ba6a14be470e900384f710a3f498b8caf81287805122be8c1eef9c575d196b
Instruction Fuzzy Hash: 8221A130A00109AFCB10EF69C945DAE7BB8FF89714B004069F809EB251DA31EE41DB22

Function 008E1AE8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 008E1B19

Strings

KEYS, xrefs: 008E1B30
REMOVE, xrefs: 008E1B1F
EXISTS, xrefs: 008E1B41
APPEND, xrefs: 008E1B52

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: f3c3edf70853b6115b081956fd33cb3821661d400257d931cbe7f6d163a1db03
Instruction ID: c8347beba03a2e8a5f75d806ea8efb8c19651231d15c454f5c709e14d32427c5
Opcode Fuzzy Hash: f3c3edf70853b6115b081956fd33cb3821661d400257d931cbe7f6d163a1db03
Instruction Fuzzy Hash: 7B113C319102588FCF00EF58D8558AEB7B4FF66304F1444A5E825A7691EB326906CF51

Function 008FEB55 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 008FEC07
GetProcessIoCounters.KERNEL32(00000000,?), ref: 008FEC37
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 008FED6A
CloseHandle.KERNEL32(?), ref: 008FEDEB

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 48ceddb24dfc770d38fa8b112c1968b49ae7df7f5a550ecaadb8029a452f444b
Instruction ID: 11d405a25e9b6118a3cf0b465c622f0f43a12fc61b205b10f5f6d3b1ee6aedd4
Opcode Fuzzy Hash: 48ceddb24dfc770d38fa8b112c1968b49ae7df7f5a550ecaadb8029a452f444b
Instruction Fuzzy Hash: 438150716043019FD760EF28C886F2AB7E5FF48724F14882DF99ADB292D670AD40CB52

Function 00900037 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00887DE1: _memmove.LIBCMT ref: 00887E22

Part of subcall function 00900E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,008FFDAD,?,?), ref: 00900E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 009000FD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0090013C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00900183
RegCloseKey.ADVAPI32(?,?), ref: 009001AF
RegCloseKey.ADVAPI32(00000000), ref: 009001BC

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: fa14d70995dbe088a0bccf35f6b1fa13d2112ea83f31483f0375bf68bd7de0e0
Instruction ID: baf81103bf9a5118eeb73164cb9fca36d44beec7e294f0d17978f1dae1bc174a
Opcode Fuzzy Hash: fa14d70995dbe088a0bccf35f6b1fa13d2112ea83f31483f0375bf68bd7de0e0
Instruction Fuzzy Hash: BC513771208204AFD714EF68D891F6AB7F9FF84314F44492DF596872A2DB31E944CB52

Function 008FD8C8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00889837: __itow.LIBCMT ref: 00889862
Part of subcall function 00889837: __swprintf.LIBCMT ref: 008898AC

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 008FD927
GetProcAddress.KERNEL32(00000000,?), ref: 008FD9AA
GetProcAddress.KERNEL32(00000000,00000000), ref: 008FD9C6
GetProcAddress.KERNEL32(00000000,?), ref: 008FDA07
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 008FDA21

Part of subcall function 00885A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,008E7896,?,?,00000000), ref: 00885A2C
Part of subcall function 00885A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,008E7896,?,?,00000000,?,?), ref: 00885A50

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 006e783e5455dd1304669354466e41bcdfca8e48b5a43959de9c81fa1c96eab3
Instruction ID: 36b90fa258945a643a8fde642d40ebb0a4104fd0c28f34d3a9ea9164659db84b
Opcode Fuzzy Hash: 006e783e5455dd1304669354466e41bcdfca8e48b5a43959de9c81fa1c96eab3
Instruction Fuzzy Hash: 8051F735A04219DFCB00EFA8C8949ADBBF5FF09324B148165EA59EB312D731AD45CF91

Function 008EE571 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 008EE61F
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 008EE648
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 008EE687

Part of subcall function 00889837: __itow.LIBCMT ref: 00889862
Part of subcall function 00889837: __swprintf.LIBCMT ref: 008898AC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 008EE6AC
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 008EE6B4

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: f05a23f473d9d01a8e60dda7c85e9be6c3b522e4b8684eebe4bf0c714fa7ffa5
Instruction ID: 05216122b1f4f246047a3d154f714b27cfd66397b226fe23956dd0b1273735f8
Opcode Fuzzy Hash: f05a23f473d9d01a8e60dda7c85e9be6c3b522e4b8684eebe4bf0c714fa7ffa5
Instruction Fuzzy Hash: E0510835A00106DFCB01EF69C9819AEBBF5FF09314B1480A9E859EB361CB31ED11DB51

Function 0090A056 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56e025e1b404682f9bcd244ec60f6a54c6c46b83691e2e6a4f43bb43716c3b59
Instruction ID: bdf3f06fe8b257d97f263f3af1b5fd49d3cd3251f52e94056547b10fd2a5f543
Opcode Fuzzy Hash: 56e025e1b404682f9bcd244ec60f6a54c6c46b83691e2e6a4f43bb43716c3b59
Instruction Fuzzy Hash: 0B41B43590C308AFD760DF68CC58FA9BBBCEB09320F150565F815A72E1C770AE41EA91

Function 00882344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00882357
ScreenToClient.USER32(009457B0,?), ref: 00882374
GetAsyncKeyState.USER32(00000001), ref: 00882399
GetAsyncKeyState.USER32(00000002), ref: 008823A7

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 996888de8d44a930a72a73cd8e02b77f4fe7e6ee8d014bf6eca68bb6d7fb00b3
Instruction ID: 440281961820a9876a15ee4c577c06db6952022d305d3f06451668204c31d90a
Opcode Fuzzy Hash: 996888de8d44a930a72a73cd8e02b77f4fe7e6ee8d014bf6eca68bb6d7fb00b3
Instruction Fuzzy Hash: 72416E75608109FFCF25AF68C854AE9BB75FB05364F20435AF829D23A0CB349990DB91

Function 008D63AA Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 008D63E7
TranslateAcceleratorW.USER32(?,?,?), ref: 008D6433
TranslateMessage.USER32(?), ref: 008D645C
DispatchMessageW.USER32(?), ref: 008D6466
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 008D6475

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: 2f45089d4a7a7f78835897b248ce86c1e7fa860e4befa32fb2ff7aacb33584c9
Instruction ID: 2d2883c9ae9d0765a7b38458d6d8fb171d24625e84f715c9f5de0e1039384031
Opcode Fuzzy Hash: 2f45089d4a7a7f78835897b248ce86c1e7fa860e4befa32fb2ff7aacb33584c9
Instruction Fuzzy Hash: 5131F23091460EAFDB249FB48C44FB67BA9FB01314F150367E421C22A2F7659469EB60

Function 008D8A1F Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 008D8A30
PostMessageW.USER32(?,00000201,00000001), ref: 008D8ADA
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 008D8AE2
PostMessageW.USER32(?,00000202,00000000), ref: 008D8AF0
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 008D8AF8

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 5c38bdacc0e1e9082b7e952baa8a7b9966000972e2406617a3a0f7594defd8a3
Instruction ID: 7d96b4056d9e68155e54a126185f1ae940d68819d7e87ab6c50e51b9bb5b9823
Opcode Fuzzy Hash: 5c38bdacc0e1e9082b7e952baa8a7b9966000972e2406617a3a0f7594defd8a3
Instruction Fuzzy Hash: AF31C071504229EFDF14CFA8D94CA9E3BB5FB04315F10822AF925EA2D0C7B09A54DB91

Function 008DB1EC Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 008DB204
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 008DB221
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 008DB259
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 008DB27F
_wcsstr.LIBCMT ref: 008DB289

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: ac315be9ac16bbe863e646f78230df74658a8f6fbae76e1a18271d17151369a6
Instruction ID: e539965006ec7f65cb9955db8fe129cf2a65022bc3bd2b761a78b1947c46a07f
Opcode Fuzzy Hash: ac315be9ac16bbe863e646f78230df74658a8f6fbae76e1a18271d17151369a6
Instruction Fuzzy Hash: A1212933204204BBEB255B79DC49E7F7B9CEF4A760F01423AF804DA261EF61DC41A661

Function 0090B14B Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00882612: GetWindowLongW.USER32(?,000000EB), ref: 00882623

GetWindowLongW.USER32(?,000000F0), ref: 0090B192
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0090B1B7
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0090B1CF
GetSystemMetrics.USER32(00000004), ref: 0090B1F8
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,008F0E90,00000000), ref: 0090B216

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 77589d2913124f25c8e298fac82d7909584b41e903a34610f0cf9eb89f26568a
Instruction ID: 21aecef96c106263de201b1770f1e3a5e80c427d6904e4a57b53b5243def98b0
Opcode Fuzzy Hash: 77589d2913124f25c8e298fac82d7909584b41e903a34610f0cf9eb89f26568a
Instruction Fuzzy Hash: B521B571928251AFCB209F78DC14A6A37A8FB15721F114B38FD32D76E1E7309950DB90

Function 008D9307 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 008D9320

Part of subcall function 00887BCC: _memmove.LIBCMT ref: 00887C06

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 008D9352
__itow.LIBCMT ref: 008D936A
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 008D9392
__itow.LIBCMT ref: 008D93A3

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: 65568ff8a6c0da0dc12169b0d56a043f03641c86aca78b01bd117d0f3b57de2c
Instruction ID: 96c46a8ceadb89d80edcaab9b282f59c91a26ff45b8d047c611095867e88376d
Opcode Fuzzy Hash: 65568ff8a6c0da0dc12169b0d56a043f03641c86aca78b01bd117d0f3b57de2c
Instruction Fuzzy Hash: 2A210731700208AFDB24AA648C85EAE7BADFB89714F145126F984D73C0D6B0CD419792

Function 008F5A4D Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 008F5A6E
GetForegroundWindow.USER32 ref: 008F5A85
GetDC.USER32(00000000), ref: 008F5AC1
GetPixel.GDI32(00000000,?,00000003), ref: 008F5ACD
ReleaseDC.USER32(00000000,00000003), ref: 008F5B08

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 583dc8fe2691bceff55df2476ff33575c626d46e4eb21797522649e54b5c6061
Instruction ID: d4e119dfe50d8ff6ceef5fd15a74a0f03f949b000d4673af4179c55e29081207
Opcode Fuzzy Hash: 583dc8fe2691bceff55df2476ff33575c626d46e4eb21797522649e54b5c6061
Instruction Fuzzy Hash: 6321A135A00118EFDB10EF69DC84AAABBE5FF48310F148079F949D7762CA70AD00DB91

Function 008812F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0088134D
SelectObject.GDI32(?,00000000), ref: 0088135C
BeginPath.GDI32(?), ref: 00881373
SelectObject.GDI32(?,00000000), ref: 0088139C

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: b2954ab6096b51ad52a8658df2ec50c56310668ea3d1cbb2a5cf06a42716c033
Instruction ID: a3034a55fc2da37dc145e8261d8b4cef93b4f5cd711aa3b0ddb7fee2b541900b
Opcode Fuzzy Hash: b2954ab6096b51ad52a8658df2ec50c56310668ea3d1cbb2a5cf06a42716c033
Instruction Fuzzy Hash: 0A219034828608EFDF20AFA5DD08B697BA8FB11321F154216F814D67B1DF749992EF90

Function 008DBC9E Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 008DBCB3
_memcmp.LIBCMT ref: 008DBCD1
_memcmp.LIBCMT ref: 008DBCE4
_memcmp.LIBCMT ref: 008DBCFC
_memcmp.LIBCMT ref: 008DBD14

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 2fce90d801bc42aa4f2da5a553562d26cc7f3f2a6680b5e13eed9894955a9a1b
Instruction ID: 735bb0030cb1faf47d2bd66766f8a30322d71241b23f3da95c47e8ccbc18159d
Opcode Fuzzy Hash: 2fce90d801bc42aa4f2da5a553562d26cc7f3f2a6680b5e13eed9894955a9a1b
Instruction Fuzzy Hash: EF018071741209BAE6047B299D42FFBA35DFF5538CF054122FE05D6342EB60DE2083A9

Function 008E4A93 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 008E4ABA
__beginthreadex.LIBCMT ref: 008E4AD8
MessageBoxW.USER32(?,?,?,?), ref: 008E4AED
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 008E4B03
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 008E4B0A

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: b4ef41d84227913f5b03cd499953d60109475f2129a43f31b3e124aa7eb7fb98
Instruction ID: 5dd10100c8cf044e832c5c624a73c4390029cdb7a2e6b20831cf2ea567c338e0
Opcode Fuzzy Hash: b4ef41d84227913f5b03cd499953d60109475f2129a43f31b3e124aa7eb7fb98
Instruction Fuzzy Hash: F311087691C658BFC7109FE99C08E9B7FACFB46320F154266F828D3351D6B1C90497A0

Function 008D8202 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 008D821E
GetLastError.KERNEL32(?,008D7CE2,?,?,?), ref: 008D8228
GetProcessHeap.KERNEL32(00000008,?,?,008D7CE2,?,?,?), ref: 008D8237
RtlAllocateHeap.NTDLL(00000000,?,008D7CE2), ref: 008D823E
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 008D8255

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocateErrorLastProcess
String ID:
API String ID: 883493501-0
Opcode ID: fb8e16d4c09777ff33cf5f9312ee9cc6f948f4c3f258567e10895834fe1cc98b
Instruction ID: 64c57eedcb97ace822787a863888b2ee3e5415c0c3a8cdec5629750b32b8bf85
Opcode Fuzzy Hash: fb8e16d4c09777ff33cf5f9312ee9cc6f948f4c3f258567e10895834fe1cc98b
Instruction Fuzzy Hash: 24016D71218608FFDB208FA5DC59D6B7BBDFF8A755B50056AF809C2220DA329D40DA60

Function 008D710A Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.COMBASE ref: 008D7127
ProgIDFromCLSID.COMBASE(?,00000000), ref: 008D7142
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,008D7044,80070057,?,?), ref: 008D7150
CoTaskMemFree.COMBASE(00000000), ref: 008D7160
CLSIDFromString.COMBASE(?,?), ref: 008D716C

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: ab9f3e509ccc78677c61bd15f7c35e551cd0815239b7e8f95fef4c5584051df4
Instruction ID: 4f74ab90ff1f205fd6cf8d5d368ac255c0a2930ee48367851e53c4f7c30dcd64
Opcode Fuzzy Hash: ab9f3e509ccc78677c61bd15f7c35e551cd0815239b7e8f95fef4c5584051df4
Instruction Fuzzy Hash: 7B017C72615219AFDF218F64DC44AAA7BADFB447A1F144265FD05D2320E731DE40ABA0

Function 008E5244 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 008E5260
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 008E526E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 008E5276
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 008E5280
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 008E52BC

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: aafdb54d08c660129331b1d6c4c64d39636f1e369eb515ddd26712348dbf82f8
Instruction ID: 3d0264591a90a7cdd6b0506417fe72d831f6fb79291145f4376fc534a3cd52fd
Opcode Fuzzy Hash: aafdb54d08c660129331b1d6c4c64d39636f1e369eb515ddd26712348dbf82f8
Instruction Fuzzy Hash: 30012931D19A1DDBCF10EFE5E8599EDBB78FB0E715F400156EA41F2240CB3096549BA1

Function 008D810A Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 008D8121
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 008D812B
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 008D813A
RtlAllocateHeap.NTDLL(00000000,?,TokenIntegrityLevel), ref: 008D8141
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 008D8157

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: HeapInformationToken$AllocateErrorLastProcess
String ID:
API String ID: 47921759-0
Opcode ID: 6e017a27038e6f7eeae9f455af5fb568fbf766a4864499aeceb75b3541f13297
Instruction ID: d8d2ea7141167aafa8ad1458464aee4bb405756d824bc8bd18e753dc2e458cc2
Opcode Fuzzy Hash: 6e017a27038e6f7eeae9f455af5fb568fbf766a4864499aeceb75b3541f13297
Instruction Fuzzy Hash: F6F06271214314EFEB220FA5EC99F673BBCFF49B54F000126F945C6250CB619E45EA60

Function 008DC1E3 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 008DC1F7
GetWindowTextW.USER32(00000000,?,00000100), ref: 008DC20E
MessageBeep.USER32(00000000), ref: 008DC226
KillTimer.USER32(?,0000040A), ref: 008DC242
EndDialog.USER32(?,00000001), ref: 008DC25C

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 8f99dcd0552c4f96abfe4704e86512c09313034a0e293c3349bea786d190a707
Instruction ID: a765f1ac59a361cd4bdf2603e757f6493f6584cbd80ac4bd5b308b708fcddffc
Opcode Fuzzy Hash: 8f99dcd0552c4f96abfe4704e86512c09313034a0e293c3349bea786d190a707
Instruction Fuzzy Hash: 6001A7304587099BEB315B54DD5EB967778FB00B06F04076AE542D15E0D7E16944DB50

Function 008813B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 008813BF
StrokeAndFillPath.GDI32(?,?,008BB888,00000000,?), ref: 008813DB
SelectObject.GDI32(?,00000000), ref: 008813EE
DeleteObject.GDI32 ref: 00881401
StrokePath.GDI32(?), ref: 0088141C

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 1e675b3241b044e03eafeb3d119a9815d547ef63858ae7053bb501a3c6d3c042
Instruction ID: 61ffb1ea42a4d7cb5f47f0d753f791a49df9f1273d8e7e0932c3680d76ac38c6
Opcode Fuzzy Hash: 1e675b3241b044e03eafeb3d119a9815d547ef63858ae7053bb501a3c6d3c042
Instruction Fuzzy Hash: 91F0CD34028608DFDB215F56EC5CB583BA9F702326F098224E42989AF2CB354596EF54

Function 008D8992 Relevance: 7.5, APIs: 5, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 008D899D
CloseHandle.KERNEL32(?), ref: 008D89B2
CloseHandle.KERNEL32(?), ref: 008D89BA
GetProcessHeap.KERNEL32(00000000,?), ref: 008D89C3
HeapFree.KERNEL32(00000000), ref: 008D89CA

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessSingleWait
String ID:
API String ID: 3751786701-0
Opcode ID: 5fd11a196b21a6896ba2a884260528a47f40ee199e95884236d9d0c8ddf35f8d
Instruction ID: 8f9bbf84d9c719a86ad8372bf59e268435a320e341ca4ea3f4a1b51728f88cc4
Opcode Fuzzy Hash: 5fd11a196b21a6896ba2a884260528a47f40ee199e95884236d9d0c8ddf35f8d
Instruction Fuzzy Hash: 3AE0C236018601FFDA115FE1EC1C90ABB79FB89B62B108230F219C1870CB329560EB90

Function 00892CFB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 008A0DB6: std::exception::exception.LIBCMT ref: 008A0DEC
Part of subcall function 008A0DB6: __CxxThrowException@8.LIBCMT ref: 008A0E01

Part of subcall function 00887DE1: _memmove.LIBCMT ref: 00887E22

Part of subcall function 00887A51: _memmove.LIBCMT ref: 00887AAB

__swprintf.LIBCMT ref: 00892ECD

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00892D66

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: b7cde44654f9658757ecbd4cdd14be87b3f9773bfe1d9af08c1a4564780127f4
Instruction ID: aac83b38451b3d2b410e622df3ddf9dca7e910568e922718b3ea5d7032ce5881
Opcode Fuzzy Hash: b7cde44654f9658757ecbd4cdd14be87b3f9773bfe1d9af08c1a4564780127f4
Instruction Fuzzy Hash: F9913671108215ABDB14FF28C885D6EB7B4FF85720F14492DF496DB2A2EA30ED44CB52

Function 008EB93B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00884750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00884743,?,?,008837AE,?), ref: 00884770

CoInitialize.OLE32(00000000), ref: 008EB9BB
CoCreateInstance.COMBASE(00912D6C,00000000,00000001,00912BDC,?), ref: 008EB9D4
CoUninitialize.COMBASE ref: 008EB9F1

Part of subcall function 00889837: __itow.LIBCMT ref: 00889862
Part of subcall function 00889837: __swprintf.LIBCMT ref: 008898AC

Strings

.lnk, xrefs: 008EB99D, 008EB9AB

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: b7f97ca1072cbdd7c4b341925ac19f667c68b411a0f84cb9c4007587b96cbf0d
Instruction ID: 8d306c58eb34defc2df35f5b6693fa29aada6b168763742fc0e8365e26591bda
Opcode Fuzzy Hash: b7f97ca1072cbdd7c4b341925ac19f667c68b411a0f84cb9c4007587b96cbf0d
Instruction Fuzzy Hash: 4FA135756043469FCB00EF19C884D6ABBE5FF8A324F148958F8999B361CB31ED45CB92

Function 008A501D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 008A50AD

Part of subcall function 008B00F0: __87except.LIBCMT ref: 008B012B

Strings

pow, xrefs: 008A5085, 008A50A2

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 6e975829ba9d35fa723074f7246c00574f6007b87c0ae85627d20fe554992c06
Instruction ID: 06a7d900585f3c661f525cc7157129d20fa7157dc4e536027cd40bbdd9b8ce64
Opcode Fuzzy Hash: 6e975829ba9d35fa723074f7246c00574f6007b87c0ae85627d20fe554992c06
Instruction Fuzzy Hash: B0515D21A1CE0696E715B718C8053FF7B94FB42700F208959E4D5C6799EE348DC8EE82

Function 00896192 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00896248
_memmove.LIBCMT ref: 008962E4
_memset.LIBCMT ref: 00896308

Strings

ERCP, xrefs: 008961B3

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: b487f9fbac8e9e6fb302b5110b924287e043f84e1785fe12f6934d9117e2226f
Instruction ID: e576b7615c36705ad39ece79ff6961d5b4e676d986c277731278bf6e6f1a9f6a
Opcode Fuzzy Hash: b487f9fbac8e9e6fb302b5110b924287e043f84e1785fe12f6934d9117e2226f
Instruction Fuzzy Hash: D151B071900309DFDB24DFA9C941BAAB7E5FF04314F24466EE44ACB291E770AA50DF40

Function 008D97F5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 008E14BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,008D9296,?,?,00000034,00000800,?,00000034), ref: 008E14E6

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 008D983F

Part of subcall function 008E1487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,008D92C5,?,?,00000800,?,00001073,00000000,?,?), ref: 008E14B1

Part of subcall function 008E13DE: GetWindowThreadProcessId.USER32(?,?), ref: 008E1409
Part of subcall function 008E13DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,008D925A,00000034,?,?,00001004,00000000,00000000), ref: 008E1419
Part of subcall function 008E13DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,008D925A,00000034,?,?,00001004,00000000,00000000), ref: 008E142F

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 008D98AC
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 008D98F9

Strings

@, xrefs: 008D9911

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: f7c4e248de33641389f52bd98d7bf3d7c3385b8a6ff3fa45b25053e1a7dac305
Instruction ID: cbf4242283cb427104b2d9a39419efba453abc2b8d7c9e8bfffe45fd7762f544
Opcode Fuzzy Hash: f7c4e248de33641389f52bd98d7bf3d7c3385b8a6ff3fa45b25053e1a7dac305
Instruction Fuzzy Hash: 16412D76900218BEDF10DFA4CC95EDEBBB8FB09700F004199F945B7291DA716E45DBA1

Function 00907946 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0090F910,00000000,?,?,?,?), ref: 009079DF
GetWindowLongW.USER32 ref: 009079FC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00907A0C

Strings

SysTreeView32, xrefs: 009079B1

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: f49437fba8285d23066340000646d4ebdce8ebd0b7f7c3cd3efed30ef576215a
Instruction ID: c50644d91091c1507ca04ea1ab8da8acc208a4384b1d22a3f5860b76793c7775
Opcode Fuzzy Hash: f49437fba8285d23066340000646d4ebdce8ebd0b7f7c3cd3efed30ef576215a
Instruction Fuzzy Hash: FF31AB31604606AFDB219EB8CC45BEBB7A9FB49334F208725F875E22E0D731E9519B50

Function 009073D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00907461
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00907475
SendMessageW.USER32(?,00001002,00000000,?), ref: 00907499

Strings

SysMonthCal32, xrefs: 0090742C

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: c91caaba404389f0d816759702626dea0d3704ee33f46d858beb6d64d456bbd1
Instruction ID: 9f042db68d60557cbb334769c8d8371873f5d2abbca2464649ede71f5c7141c9
Opcode Fuzzy Hash: c91caaba404389f0d816759702626dea0d3704ee33f46d858beb6d64d456bbd1
Instruction Fuzzy Hash: DB218032514219AFDF118F94CC46FEA7B6AEB48724F110214FE15AB1E0DAB5A8519BA0

Function 00907B93 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00907C4A
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00907C58
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00907C5F

Strings

msctls_updown32, xrefs: 00907BC4

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: f32b131edfca808b2ab4b0d85e60aa566cf4f94003cd4ddd2c1825891918e1e1
Instruction ID: 93e9fe650d9cd82112754978dfddffaa29c40100e0ac12a53a72e779536d0471
Opcode Fuzzy Hash: f32b131edfca808b2ab4b0d85e60aa566cf4f94003cd4ddd2c1825891918e1e1
Instruction Fuzzy Hash: 20218EB5604219AFEB10DF68DCC1DA677ECEF5A364B140059FA01DB3A1CB31EC519B60

Function 00906CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00906D3B
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00906D4B
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00906D70

Strings

Listbox, xrefs: 00906D08

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: f85a7d14ffc2c73d62fb614e6ab7c8163bc08966adba5f28def67c8b3daa7ca6
Instruction ID: 081e4c61d4cc867958d622ddd458b2832ff46bd6eaab73fd73b3a3cff35f6939
Opcode Fuzzy Hash: f85a7d14ffc2c73d62fb614e6ab7c8163bc08966adba5f28def67c8b3daa7ca6
Instruction Fuzzy Hash: 52218032610118BFEF118F54DC45FAB3BBEEB89764F018124FA459B1E0CB71AC619BA0

Function 0090770E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00907772
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00907787
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00907794

Strings

msctls_trackbar32, xrefs: 00907749

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 2ba2aa6706988005a16a72f598e9bb857df4aab2fcf96d8e1c9e17bc0219ef9e
Instruction ID: 7809f49086fd5a2fd623390755924792f53112b0069256e08592b419174d6493
Opcode Fuzzy Hash: 2ba2aa6706988005a16a72f598e9bb857df4aab2fcf96d8e1c9e17bc0219ef9e
Instruction Fuzzy Hash: 99110432604209BEEF205FA4CC05FA777ACEF88B64F010128FA41920D0C672E811DB10

Function 00884B37 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00884AD0), ref: 00884B45
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00884B57

Strings

kernel32.dll, xrefs: 00884B40
GetNativeSystemInfo, xrefs: 00884B51

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: e89b669481be792049e97881254111a695673f217c9dcef954420107387a528e
Instruction ID: d7a178d9d750f48432833be6aa3a196830e4f1d6180814c45318ae64ddc8ec23
Opcode Fuzzy Hash: e89b669481be792049e97881254111a695673f217c9dcef954420107387a528e
Instruction Fuzzy Hash: 2AD01235A14713CFD730AF72D838B0676D4FF45355B1188399485D6990E670E580CB54

Function 00884C03 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00884BD0,?,00884DEF,?,009452F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00884C11
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00884C23

Strings

kernel32.dll, xrefs: 00884C0C
Wow64DisableWow64FsRedirection, xrefs: 00884C1D

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 35754cf855ed74607ab95e5492fa73f26f1c8ce08ea35fc0f057b3282c5a2355
Instruction ID: 1629bfa7fa59b06c7150d11fb8ceb4bfd5842306a067d96003cb28150710458f
Opcode Fuzzy Hash: 35754cf855ed74607ab95e5492fa73f26f1c8ce08ea35fc0f057b3282c5a2355
Instruction Fuzzy Hash: C2D01231515723CFD730AF71D918606B6DAFF09355B118C39D485D6550E6B0D580CB50

Function 00884C36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00884B83,?), ref: 00884C44
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00884C56

Strings

kernel32.dll, xrefs: 00884C3F
Wow64RevertWow64FsRedirection, xrefs: 00884C50

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 61bb3d8a46b04f4e90148d01f151059716071070773a6cc48776acda238eedce
Instruction ID: 44414b84f1f117ba099a03b75f44ce5f9fb031c62cb23e1bd0598fa8f92277be
Opcode Fuzzy Hash: 61bb3d8a46b04f4e90148d01f151059716071070773a6cc48776acda238eedce
Instruction Fuzzy Hash: 1CD01772528713CFD730AF31D91860A76E9FF19355B12883AA496D69A0E670D980CB50

Function 00900DE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00901039), ref: 00900DF5
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00900E07

Strings

RegDeleteKeyExW, xrefs: 00900E01
advapi32.dll, xrefs: 00900DF0

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 1757015d9e2c2e10f26d6d1de5d1c285314288e0ec43571b218fc59706a66cec
Instruction ID: fa0bd1d556e342e58000aae9a15beab43499d4cb68f4898c08f75b0475197e0a
Opcode Fuzzy Hash: 1757015d9e2c2e10f26d6d1de5d1c285314288e0ec43571b218fc59706a66cec
Instruction Fuzzy Hash: 76D01770528722CFD7219F75C80878676E9AF84356F118C3EA886E2590E6B0D8D0CA50

Function 008F90E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,008F8CF4,?,0090F910), ref: 008F90EE
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 008F9100

Strings

kernel32.dll, xrefs: 008F90E9
GetModuleHandleExW, xrefs: 008F90FA

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 910101a80ed4f20c07a7e8bfba9ae1ccb56cfb3b5107b0a85cc7a4f6d25dbea1
Instruction ID: e136986e3c66535bb99f45602a2e54060708bc8b11b1fa999102db4ae4e45157
Opcode Fuzzy Hash: 910101a80ed4f20c07a7e8bfba9ae1ccb56cfb3b5107b0a85cc7a4f6d25dbea1
Instruction Fuzzy Hash: ACD01734528713CFDB309F31D82861676E8FF05355B12887AE6C6D69A0EA74C8C0CA90

Function 008C1714 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 008C1718
__swprintf.LIBCMT ref: 008C1749

Strings

%.3d, xrefs: 008C1723
WIN_XPe, xrefs: 008C1788

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 0f18b073e0334a8ab2eae23c85880fcbe52abf108abe193b5828aee5ae808216
Instruction ID: 79c4c728c221e4fbea9db52071ba87706dbe67b48e10e778b63d91f1be4d2e0d
Opcode Fuzzy Hash: 0f18b073e0334a8ab2eae23c85880fcbe52abf108abe193b5828aee5ae808216
Instruction Fuzzy Hash: 7CD0177180910DEACF11DB9098CCEB9737CFB1A309F14046AB402E2446E231CB94EB61

Function 008D717D Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 62b97e2174a0d0e7c404b9b94987d6ca69b5ecfdc7e534658c7da1b6568dd7e3
Instruction ID: 3e08fe44071d9a96aa13be39e780bf51b784434105c32e1f31afa055175006ee
Opcode Fuzzy Hash: 62b97e2174a0d0e7c404b9b94987d6ca69b5ecfdc7e534658c7da1b6568dd7e3
Instruction Fuzzy Hash: 74C16074A0421AEFCB14CF94C884EAEBBB5FF48714B558699E805EB351E730ED81DB90

Function 008FE02A Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 008FE0BE
CharLowerBuffW.USER32(?,?), ref: 008FE101

Part of subcall function 008FD7A5: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 008FD7C5

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 008FE301
_memmove.LIBCMT ref: 008FE314

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 6ecceffbef17775d357cbda0cb09eef6f001bfd5a97de7e050aabd23d26ad4f4
Instruction ID: 57f48a2a5be94fb6696d270dfe919a7da40d5d25f8df65f8f57871d0248f1788
Opcode Fuzzy Hash: 6ecceffbef17775d357cbda0cb09eef6f001bfd5a97de7e050aabd23d26ad4f4
Instruction Fuzzy Hash: 26C126716083059FC714DF28C480A6ABBE4FF89718F14896EF999DB361D731E946CB82

Function 008F8093 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 008F80C3
CoUninitialize.COMBASE ref: 008F80CE

Part of subcall function 008DD56C: CoCreateInstance.COMBASE(?,00000000,00000005,?,?), ref: 008DD5D4

VariantInit.OLEAUT32(?), ref: 008F80D9
VariantClear.OLEAUT32(?), ref: 008F83AA

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 626cea1fe5b16444864b44f025a0591400a32dffac6e76844c28865f51de1aee
Instruction ID: c3ffd626d1f98126262a4f839ac6b11d0b08c4d72e5968f3f1e259851b84e0ad
Opcode Fuzzy Hash: 626cea1fe5b16444864b44f025a0591400a32dffac6e76844c28865f51de1aee
Instruction Fuzzy Hash: 4CA126356047069FDB10EF68C881A2AB7E4FF89714F184558FA9ADB3A1CB30ED45CB42

Function 008D7530 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.COMBASE(?,00000000), ref: 008D76EA
CoTaskMemFree.COMBASE(00000000), ref: 008D7702
CLSIDFromProgID.COMBASE(?,?), ref: 008D7727
_memcmp.LIBCMT ref: 008D7748

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: b92887b99b9ad98c0af6b889f2f210f9052dd236295f4157418f2f1eb288c72b
Instruction ID: a6f7eabff3d0d88fb428f8c15971daf02beac53f61183ebf61be51e1fae6920d
Opcode Fuzzy Hash: b92887b99b9ad98c0af6b889f2f210f9052dd236295f4157418f2f1eb288c72b
Instruction Fuzzy Hash: 8B811C75A00109EFCB04DFA8C984DEEB7B9FF89315F204559E516EB250EB71AE06CB60

Function 008D687D Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 008D688E
SysAllocString.OLEAUT32(00000000), ref: 008D6937
VariantCopy.OLEAUT32 ref: 008D6966
VariantClear.OLEAUT32(?), ref: 008D698D

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: fe67372f2587ce521dd47f25c8ba85c6c268f85265ac4ced992d138549970706
Instruction ID: aebd328a53c1e40b9aed6f24a675c4cb9219489a0a6ca919fab18f29761e9e57
Opcode Fuzzy Hash: fe67372f2587ce521dd47f25c8ba85c6c268f85265ac4ced992d138549970706
Instruction Fuzzy Hash: A351B3746043099EDB24AF69D891A3AB7E5FF45314F20C91FE5C6DB791FA30D8A08702

Function 009097F4 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(0156DEF0,?), ref: 00909863
ScreenToClient.USER32(00000002,00000002), ref: 00909896
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00909903

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 42841a40947d670f8bbe55e5123951894a3916408d482035948060ed30f804bb
Instruction ID: ec30eafd1bb4a1cc9cb56a02976952ef950408a5b9fab0758c6f44d742afcce9
Opcode Fuzzy Hash: 42841a40947d670f8bbe55e5123951894a3916408d482035948060ed30f804bb
Instruction Fuzzy Hash: F6513035A00209EFCF14DF58C884AAE7BB9FF56360F148159F8659B3A1D731AD81DB90

Function 008D9A80 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 008D9AD2
__itow.LIBCMT ref: 008D9B03

Part of subcall function 008D9D53: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 008D9DBE

SendMessageW.USER32(?,0000110A,00000001,?), ref: 008D9B6C
__itow.LIBCMT ref: 008D9BC3

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: a51e60aefeef062108bea10338ba57e5a255bf50279c20b81a8ccea64e7dbc7e
Instruction ID: 1a5434c48873e29901f6f7db3d83f124e89c6e73e580ffb5257505c46f8130fe
Opcode Fuzzy Hash: a51e60aefeef062108bea10338ba57e5a255bf50279c20b81a8ccea64e7dbc7e
Instruction Fuzzy Hash: 34416F74A00218ABDF21EF58D845BAEBFB9FF45724F00015AF945E7391DB709A44CB52

Function 008EB7F4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 008EB89E
GetLastError.KERNEL32(?,00000000), ref: 008EB8C4
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 008EB8E9
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 008EB915

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: d77d71371a89bb7e3794112361a626bcd62948ccd05e7df69cb50f16a96ca936
Instruction ID: b1d09e383efe521b410b67747a7c04aaa4f6a3b7f71bc7321482a0806c881c79
Opcode Fuzzy Hash: d77d71371a89bb7e3794112361a626bcd62948ccd05e7df69cb50f16a96ca936
Instruction Fuzzy Hash: B541FB35600552DFCB11EF19C455A6ABBE1FF4A314F198098ED8A9B762CB30FD01DB92

Function 00908851 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 009088DE

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 288aa17570063a60aa183013bd55b0568f03751b34771ee2cf3756346dbe3edb
Instruction ID: 9badf8312be947274fef0e59558225ceb4f7ae90070143cbc6d6800b23f7fcf4
Opcode Fuzzy Hash: 288aa17570063a60aa183013bd55b0568f03751b34771ee2cf3756346dbe3edb
Instruction Fuzzy Hash: 5331D434714108EFEB24AA58CC45FBE77A9EB06350F544512F9B1E62E1CE71D980AB52

Function 0090AB37 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0090AB60
GetWindowRect.USER32(?,?), ref: 0090ABD6
PtInRect.USER32(?,?,0090C014), ref: 0090ABE6
MessageBeep.USER32(00000000), ref: 0090AC57

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: ab615141ee127971dbde1e146fb1b8990aee66124641f58b0f3f2adb95517ca3
Instruction ID: 9dc915eec0ce2d10944761762c1f6bf9a0b48d8e7d91c8646e2fc9521c965ac3
Opcode Fuzzy Hash: ab615141ee127971dbde1e146fb1b8990aee66124641f58b0f3f2adb95517ca3
Instruction Fuzzy Hash: 6041AE34604229DFDB21DF58C884BA97BF9FF49300F1A80A9E854DB2A1D730E941DBD2

Function 008E0AD6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 008E0B27
SetKeyboardState.USER32(00000080,?,00000001), ref: 008E0B43
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 008E0BA9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 008E0BFB

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: d75716ae868f29365904cb7e0b5631603db80f166f8d36bce4f7fd1ae18063d0
Instruction ID: bfaa2d2aa31c06de4dee82e35fcf065b1564c97621f1c0f06ca0756c26505547
Opcode Fuzzy Hash: d75716ae868f29365904cb7e0b5631603db80f166f8d36bce4f7fd1ae18063d0
Instruction Fuzzy Hash: D7314A309442886EEB308B668C05BF9BBA9FB86328F144B5AF581D11D1C3F489C09F51

Function 008E0C11 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 008E0C66
SetKeyboardState.USER32(00000080,?,00008000), ref: 008E0C82
PostMessageW.USER32(00000000,00000101,00000000), ref: 008E0CE1
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 008E0D33

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: e5336545d739ad8e1248e93a984661a5b2aa7bfa5d02c9cc53f0a26c4cd29e50
Instruction ID: 7a6aad60efaa692f1afca4b19a31a4a5ce6606a0cef6c9d2e9851396bcd72bed
Opcode Fuzzy Hash: e5336545d739ad8e1248e93a984661a5b2aa7bfa5d02c9cc53f0a26c4cd29e50
Instruction Fuzzy Hash: DB314830A0429C6EFF308B6A8C147FEBB66FB47310F244B1AE481D21D1C3B999C59B52

Function 008B61C5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 008B61FB
__isleadbyte_l.LIBCMT ref: 008B6229
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 008B6257
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 008B628D

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: aff2a6561c96c76ed8503d49d8ac30d82916a6c0f479e24fc08038d790bd1ead
Instruction ID: 76b7365d9f3508190afa397536cbcb66a513a3569d52436078d682eaf314d923
Opcode Fuzzy Hash: aff2a6561c96c76ed8503d49d8ac30d82916a6c0f479e24fc08038d790bd1ead
Instruction Fuzzy Hash: EE31AE31A04246AFEF218F69CC44BBA7BA9FF42310F154029E864D72A1E735D961DB90

Function 00904EEE Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00904F02

Part of subcall function 008E3641: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 008E365B
Part of subcall function 008E3641: GetCurrentThreadId.KERNEL32 ref: 008E3662
Part of subcall function 008E3641: AttachThreadInput.USER32(00000000,?,008E5005), ref: 008E3669

GetCaretPos.USER32(?), ref: 00904F13
ClientToScreen.USER32(00000000,?), ref: 00904F4E
GetForegroundWindow.USER32 ref: 00904F54

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: ce588fae6e2ee114f6ece072dc4766e26f1f0bbd922f85649b5422ce740bb896
Instruction ID: 0cf0edd02739db2528c3c50a57132916efbedc6f5c360ca52567991443acffb3
Opcode Fuzzy Hash: ce588fae6e2ee114f6ece072dc4766e26f1f0bbd922f85649b5422ce740bb896
Instruction Fuzzy Hash: 38312D71E00108AFCB10EFB9C8859EFB7F9FF99304F10406AE555E7251DA719E058BA1

Function 008D8656 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 008D810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 008D8121
Part of subcall function 008D810A: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 008D812B
Part of subcall function 008D810A: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 008D813A
Part of subcall function 008D810A: RtlAllocateHeap.NTDLL(00000000,?,TokenIntegrityLevel), ref: 008D8141
Part of subcall function 008D810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 008D8157

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 008D86A3
_memcmp.LIBCMT ref: 008D86C6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 008D86FC
HeapFree.KERNEL32(00000000), ref: 008D8703

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocateErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 2182266621-0
Opcode ID: c929d74388e0a9313bd7d038efb04149284b3fac4d9cc2d5aa13ee8d6f1bcab1
Instruction ID: fada22dd4d06abc14052cfe71289f81dad1ae72761c40bc7d80c66b70fb235d8
Opcode Fuzzy Hash: c929d74388e0a9313bd7d038efb04149284b3fac4d9cc2d5aa13ee8d6f1bcab1
Instruction Fuzzy Hash: 99215771E04208EFDB10DFA8D949BAEB7B8FF54314F15415AE444AB240EB30AE05DB90

Function 008A098C Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 008A09AE

Part of subcall function 00885A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,008E7896,?,?,00000000), ref: 00885A2C
Part of subcall function 00885A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,008E7896,?,?,00000000,?,?), ref: 00885A50

_fprintf.LIBCMT ref: 008A09E5
OutputDebugStringW.KERNEL32(?), ref: 008D5DBB

Part of subcall function 008A4AAA: _flsall.LIBCMT ref: 008A4AC3

__setmode.LIBCMT ref: 008A0A1A

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: b932586476877fb18e36d6c22bba1d8a0b2464c3839a2d38cca2513669c1f67b
Instruction ID: 77ee4553128fea0135998c5cc700f79aa0a81f87ef136e97246af3869530a514
Opcode Fuzzy Hash: b932586476877fb18e36d6c22bba1d8a0b2464c3839a2d38cca2513669c1f67b
Instruction Fuzzy Hash: F91127319042086FEB04B7BCAC479BE7B69FF87320F240126F105D6582EEA0584297A2

Function 008F1767 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 008F17A3

Part of subcall function 008F182D: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 008F184C
Part of subcall function 008F182D: InternetCloseHandle.WININET(00000000), ref: 008F18E9

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 6702278a1054cee3af06f88986660fea9abf71debde11260e9a62640004e4bb2
Instruction ID: fd94f43bad0f274b0350a27f0add65e4f12e376a94c2e7b7a4d7d14365b9aed5
Opcode Fuzzy Hash: 6702278a1054cee3af06f88986660fea9abf71debde11260e9a62640004e4bb2
Instruction Fuzzy Hash: 2B21B031214609FFEF129F748C04BBABBA9FF48751F14402AFA05D6550D7719911A7A1

Function 008E3A2A Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0090FAC0), ref: 008E3A64
GetLastError.KERNEL32 ref: 008E3A73
CreateDirectoryW.KERNEL32(?,00000000), ref: 008E3A82
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0090FAC0), ref: 008E3ADF

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 3f60b92178df2e88d2e8940c72279b89434fe95b056cf19c593d6fb3685a1248
Instruction ID: d6b14c62d13de139fc27d39441b1644bda20088bd25954108afeefc75daa7e34
Opcode Fuzzy Hash: 3f60b92178df2e88d2e8940c72279b89434fe95b056cf19c593d6fb3685a1248
Instruction Fuzzy Hash: 3721D6341086119FC710EF29D88586A77E8FF56368F104A2DF499C72A1D731DE85CB83

Function 008DDCBE Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 008DF0BC: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,008DDCD3,?,?,?,008DEAC6,00000000,000000EF,00000119,?,?), ref: 008DF0CB
Part of subcall function 008DF0BC: lstrcpyW.KERNEL32(00000000,?,?,008DDCD3,?,?,?,008DEAC6,00000000,000000EF,00000119,?,?,00000000), ref: 008DF0F1
Part of subcall function 008DF0BC: lstrcmpiW.KERNEL32(00000000,?,008DDCD3,?,?,?,008DEAC6,00000000,000000EF,00000119,?,?), ref: 008DF122

lstrlenW.KERNEL32(?,00000002,?,?,?,?,008DEAC6,00000000,000000EF,00000119,?,?,00000000), ref: 008DDCEC
lstrcpyW.KERNEL32(00000000,?,?,008DEAC6,00000000,000000EF,00000119,?,?,00000000), ref: 008DDD12
lstrcmpiW.KERNEL32(00000002,cdecl,?,008DEAC6,00000000,000000EF,00000119,?,?,00000000), ref: 008DDD46

Strings

cdecl, xrefs: 008DDD3D

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 86bf7cbaabf6aef4f04606bc38acb4b80bf116413c563318150ec743694ed913
Instruction ID: a0be294155fbc25d861b4332450208d96aee59d1c89e98c2408f1e78473ff409
Opcode Fuzzy Hash: 86bf7cbaabf6aef4f04606bc38acb4b80bf116413c563318150ec743694ed913
Instruction Fuzzy Hash: C011AC3A200305EFDB25AF64C84597A77AAFF46350B40822AF906CB3A1EB719950DB91

Function 008B50E2 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 008B5101

Part of subcall function 008A571C: __FF_MSGBANNER.LIBCMT ref: 008A5733
Part of subcall function 008A571C: __NMSG_WRITE.LIBCMT ref: 008A573A
Part of subcall function 008A571C: RtlAllocateHeap.NTDLL(01550000,00000000,00000001), ref: 008A575F

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 567e951994b1b8bdb96f5052dd9e5a8c23b0a6cd21f32e91f72cbce224200909
Instruction ID: a40908a179727e970d4aedba8bcb4de771709a28e0bb2cc5dab136ccc37c1ccb
Opcode Fuzzy Hash: 567e951994b1b8bdb96f5052dd9e5a8c23b0a6cd21f32e91f72cbce224200909
Instruction Fuzzy Hash: 8C11A372904A15EEDF312F7CBC45B9E3798FF063B1B204529FA04D6B61DE30994197A1

Function 008D85B1 Relevance: 6.1, APIs: 4, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 008D85E2
OpenProcessToken.ADVAPI32(00000000), ref: 008D85E9
CloseHandle.KERNEL32(00000004), ref: 008D8603
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 008D8632

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Process$CloseCreateCurrentHandleLogonOpenTokenWith
String ID:
API String ID: 2621361867-0
Opcode ID: a2e2168002e94358064b0a4cc9e11b0657de7d59250bdcfa84199a449cd7204d
Instruction ID: 260ba0eedc19d614a287d2b15f7820e72fae4a894c95183d577f9d339643c0da
Opcode Fuzzy Hash: a2e2168002e94358064b0a4cc9e11b0657de7d59250bdcfa84199a449cd7204d
Instruction Fuzzy Hash: A5114A72504209EFDF118FA4ED49BEE7BA9FF08754F044165FE04E2160C7729E60AB61

Function 008F6369 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00885A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,008E7896,?,?,00000000), ref: 00885A2C
Part of subcall function 00885A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,008E7896,?,?,00000000,?,?), ref: 00885A50

gethostbyname.WS2_32(?), ref: 008F6399
WSAGetLastError.WS2_32(00000000), ref: 008F63A4
_memmove.LIBCMT ref: 008F63D1
inet_ntoa.WS2_32(?), ref: 008F63DC

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: a46e902e7a8567f2046a457263302a4b200825b9a355045e117f5f9898ec52e3
Instruction ID: 4bb1b758ff8f58bb26781fb843f46a7e663be710948cb0977c4ee29918a296a2
Opcode Fuzzy Hash: a46e902e7a8567f2046a457263302a4b200825b9a355045e117f5f9898ec52e3
Instruction Fuzzy Hash: 45111C36500109AFCB04FBA8DD96CEEB7B8FF08314B144165F506E7261DB31AE14DB62

Function 008D8B41 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 008D8B61
SendMessageW.USER32(?,000000C9,?,00000000), ref: 008D8B73
SendMessageW.USER32(?,000000C9,?,00000000), ref: 008D8B89
SendMessageW.USER32(?,000000C9,?,00000000), ref: 008D8BA4

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 646dd5eaf05a82f6708a3fe4d62c5126d2db155acd658b03c0d68e22b8368c09
Instruction ID: 8c6128a74ee3ecffc00ca7e671360a36d96a6576bdd9d99b5b34225eb640276c
Opcode Fuzzy Hash: 646dd5eaf05a82f6708a3fe4d62c5126d2db155acd658b03c0d68e22b8368c09
Instruction Fuzzy Hash: 77112E79901218FFDB11DFA5CC85F9DBB74FB48710F204196E904B7250DA716E11DB94

Function 008E1142 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,008DFCED,?,008E0D40,?,00008000), ref: 008E115F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,008DFCED,?,008E0D40,?,00008000), ref: 008E1184
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,008DFCED,?,008E0D40,?,00008000), ref: 008E118E
Sleep.KERNEL32(?,?,?,?,?,?,?,008DFCED,?,008E0D40,?,00008000), ref: 008E11C1

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 56149466624f98abca60945f769fa6b6486d94f00c06b038e553c6e1d81e3a6c
Instruction ID: d3db14b3813dafadf56df853d693b8f92e2b46020769b89eebef5aebd0499f2a
Opcode Fuzzy Hash: 56149466624f98abca60945f769fa6b6486d94f00c06b038e553c6e1d81e3a6c
Instruction Fuzzy Hash: 78113C31D0465DEBCF149FA6D848AEEBB78FF0A751F004055EA45F2240CB709690DBD5

Function 008DD831 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 008DD84D
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 008DD864
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 008DD879
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 008DD897

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: b869ca9879c899d0697698712ee6c095f746f60ffbdaf856f914585868b00877
Instruction ID: ff66ffdfaee6c94f24fb36dd2dd271112622576a3138da1e79f5b2fb7d38b2f3
Opcode Fuzzy Hash: b869ca9879c899d0697698712ee6c095f746f60ffbdaf856f914585868b00877
Instruction Fuzzy Hash: B8118E71605309DFE3219F50EC08F92BBBCFB00B00F108A7AA916C6650D7B0E609ABA1

Function 008B6FB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 008B6FDB

Part of subcall function 008B76C2: __fltout2.LIBCMT ref: 008B76EB

__cftog_l.LIBCMT ref: 008B7001
__cftoe_l.LIBCMT ref: 008B7033

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 3bc1bb832ce77332a556f8e630b2262754cb3812461cb3f2a0e918fd4bb85459
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 8701407244864EBBCF166F88CC01CED3F62FB58354F598416FE1898231D636C9B2AB81

Function 0090B2C5 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0090B2E4
ScreenToClient.USER32(?,?), ref: 0090B2FC
ScreenToClient.USER32(?,?), ref: 0090B320
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0090B33B

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: e68399fbccfdae6458dc5534cf85acf1d83348456247ad3a664c47e1ae61d109
Instruction ID: 3343d81a75a20003ed736ee01574f06641a2eeb66585089b3705a6846a62b808
Opcode Fuzzy Hash: e68399fbccfdae6458dc5534cf85acf1d83348456247ad3a664c47e1ae61d109
Instruction Fuzzy Hash: D31132B9D0420DAFDB51CFA9C8849EEBBB9FF08310F108166E914E3620D735AA559F50

Function 0090B635 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0090B644
_memset.LIBCMT ref: 0090B653
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00946F20,00946F64), ref: 0090B682
CloseHandle.KERNEL32 ref: 0090B694

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: 7fbe8baf16e83e17acd45858a8927fa613d9bc6d52cf9254e16b214339817b99
Instruction ID: 29f8722dba481a545d08b9f35920930a716f089a15a576e6c41334dce1a352d8
Opcode Fuzzy Hash: 7fbe8baf16e83e17acd45858a8927fa613d9bc6d52cf9254e16b214339817b99
Instruction Fuzzy Hash: 3DF05EF65543047EF3202B65BC06FBB3A9CEB0B795F004060BA48E5592E7724C0497AA

Function 008E6BDA Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 008E6BE6

Part of subcall function 008E76C4: _memset.LIBCMT ref: 008E76F9

_memmove.LIBCMT ref: 008E6C09
_memset.LIBCMT ref: 008E6C16
RtlLeaveCriticalSection.NTDLL(?), ref: 008E6C26

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: fa862622d0a9c1dd2e3d36fe57362408f49460f96aa116e63426e602941b15ae
Instruction ID: b2e3e52fecb15e7ffa10d9cc488784dcb95f04bc66a17dbd0655267802b4511e
Opcode Fuzzy Hash: fa862622d0a9c1dd2e3d36fe57362408f49460f96aa116e63426e602941b15ae
Instruction Fuzzy Hash: CDF05E3A204100BBCF116F99DC85A8ABB29FF46320F048061FE089E627D732E911DBB5

Function 00882218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00882231
SetTextColor.GDI32(?,000000FF), ref: 0088223B
SetBkMode.GDI32(?,00000001), ref: 00882250
GetStockObject.GDI32(00000005), ref: 00882258
GetWindowDC.USER32(?,00000000), ref: 008BBE83
GetPixel.GDI32(00000000,00000000,00000000), ref: 008BBE90
GetPixel.GDI32(00000000,?,00000000), ref: 008BBEA9
GetPixel.GDI32(00000000,00000000,?), ref: 008BBEC2
GetPixel.GDI32(00000000,?,?), ref: 008BBEE2
ReleaseDC.USER32(?,00000000), ref: 008BBEED

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: dca6913e89b02821c8cf5b689ea0d74e123ae3c7142f0f48cc0f3d90e3f71df6
Instruction ID: 160959e9283bfc24fb8505c22c1f93271634864138f7ebb42a8c35c821fbc242
Opcode Fuzzy Hash: dca6913e89b02821c8cf5b689ea0d74e123ae3c7142f0f48cc0f3d90e3f71df6
Instruction Fuzzy Hash: D6E03932118244AEDF715F64EC0D7E83B10EB05336F008366FA69880F187B14A90EB12

Function 008D8712 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 008D871B
OpenThreadToken.ADVAPI32(00000000,?,?,?,008D82E6), ref: 008D8722
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,008D82E6), ref: 008D872F
OpenProcessToken.ADVAPI32(00000000,?,?,?,008D82E6), ref: 008D8736

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 4d6e4ffa7b728429bccbf41f20e703944abc514dc821944f85da3daf0eda38b0
Instruction ID: 98be24e1c9006a631811b8a0c618c8e775beec4a3b5e9e4c67a5dd5427ce4814
Opcode Fuzzy Hash: 4d6e4ffa7b728429bccbf41f20e703944abc514dc821944f85da3daf0eda38b0
Instruction Fuzzy Hash: D3E08636629211DFD7305FF45D0CB563BBCEF50BD1F148828B245D9040DA348545E750

Function 008DB2F3 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 008DB4BE

Strings

Container, xrefs: 008DB43B
AutoIt3GUI, xrefs: 008DB436

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 89e7b8ca693b53276849e911c8d8e3c82d0dc8404f61e4c8bda9cafbe3b4c887
Instruction ID: 24af786e531910dd574d20fc510d8edf791a95b4ba1f813faaf53e770b41e4d0
Opcode Fuzzy Hash: 89e7b8ca693b53276849e911c8d8e3c82d0dc8404f61e4c8bda9cafbe3b4c887
Instruction Fuzzy Hash: 7D913870600605EFDB24DF68C884A6ABBF5FF49714F21866EE94ACB791DB70E841CB50

Function 008EAFAC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 0089FC86: _wcscpy.LIBCMT ref: 0089FCA9

Part of subcall function 00889837: __itow.LIBCMT ref: 00889862
Part of subcall function 00889837: __swprintf.LIBCMT ref: 008898AC

__wcsnicmp.LIBCMT ref: 008EB02D
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 008EB0F6

Strings

LPT, xrefs: 008EB027

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 35352e561c454a3e9cf46976b3b09cf76253efa4e475b0acb4ebcd31ca5244b2
Instruction ID: 86e809d2f711b530cb3a5428560199754249ba050dba4c114a11084ff1cc2ae3
Opcode Fuzzy Hash: 35352e561c454a3e9cf46976b3b09cf76253efa4e475b0acb4ebcd31ca5244b2
Instruction Fuzzy Hash: 5D617F75A00219AFCB14EF99C891EAFB7B4FF09314F144069F956EB291D730AE44CB91

Function 00892957 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00892968
GlobalMemoryStatusEx.KERNEL32(?), ref: 00892981

Strings

@, xrefs: 00892975

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 3edde85e9f7d12905c60a1b44a0357210abb4f688997793882e194a9ad68cc18
Instruction ID: 7fd7a4dbdff868b0a030c644bcf2d0b2e2c671de1ebfc6bc92658d438c94270b
Opcode Fuzzy Hash: 3edde85e9f7d12905c60a1b44a0357210abb4f688997793882e194a9ad68cc18
Instruction Fuzzy Hash: AA5144724187449BD320EF14D886BAFBBE8FF85344F81885DF2D9810A1EB308569CB67

Function 008E9734 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00884F0B: __fread_nolock.LIBCMT ref: 00884F29

_wcscmp.LIBCMT ref: 008E9824
_wcscmp.LIBCMT ref: 008E9837

Strings

FILE, xrefs: 008E9770

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: e6721c65469260b69b23a991796ebef143034b56842e37e18792b0b102fdee11
Instruction ID: 2b8c3e8570fde601defefd5cbf201a2cf562fb2a7f43848ac22a4a8c77585de4
Opcode Fuzzy Hash: e6721c65469260b69b23a991796ebef143034b56842e37e18792b0b102fdee11
Instruction Fuzzy Hash: 2941A772A0025ABADF20AAA5CC45FEFB7B9FF86714F000479F904E7191DAB199048B61

Function 008F258E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008F259E
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 008F25D4

Strings

|, xrefs: 008F25A5

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 7cdac23ba206c319908b5f545af0e0e243e30583b7cf790d0e74bb4d0dfcbb77
Instruction ID: 7b92d0e55a17e270c614b32a982da7f6c01ce2cddbaa9749f11b57a7158e024f
Opcode Fuzzy Hash: 7cdac23ba206c319908b5f545af0e0e243e30583b7cf790d0e74bb4d0dfcbb77
Instruction Fuzzy Hash: AB310571804119EBCF11EFA8CC85EEEBFB8FF18310F100069F915E6162EA359A56DB61

Function 00907A71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00907B61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00907B76

Strings

', xrefs: 00907ACA

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: b3583ded150fa11cc58d85b627098559009fdddbd887077c4dc0061d54af33dd
Instruction ID: cd6eec688ca5ee169135aa1ea326ce966192faf083ea7ae108792cc762857770
Opcode Fuzzy Hash: b3583ded150fa11cc58d85b627098559009fdddbd887077c4dc0061d54af33dd
Instruction Fuzzy Hash: EC410774E052099FDB14CFA4C881BEABBB9FF09310F10416AE905EB391D770A951DFA0

Function 00906A63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00906B17
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00906B53

Strings

static, xrefs: 00906AB3

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: c678f641b0c6082737adb3e2a5b35f413f5054f19f96541ff48a584a156a02b1
Instruction ID: 71f89cba740051826fd2df05ae00a077d8de5d0fbe5b67ab576da01e2b73cf8c
Opcode Fuzzy Hash: c678f641b0c6082737adb3e2a5b35f413f5054f19f96541ff48a584a156a02b1
Instruction Fuzzy Hash: D9318F71210604AEDB109F68CC91BFB77ADFF48764F108629F9A5D7190DB31AC91D760

Function 008E28A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008E2911
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 008E294C

Strings

0, xrefs: 008E290A

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 34c25b1b7abf37afd461197d9cb6c6485825f570469348b50b5f85ee7524cebd
Instruction ID: 645a248ca8e013a9f1de8ceaefbfc19e924d673097f6a995e7361d5f476c5fd8
Opcode Fuzzy Hash: 34c25b1b7abf37afd461197d9cb6c6485825f570469348b50b5f85ee7524cebd
Instruction Fuzzy Hash: 1D31D1716003899BEB24EF5ACC45FAEBFACFF07350F141069E985E61A2DB709940CB11

Function 008F39E9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 008F3A66

Part of subcall function 00887DE1: _memmove.LIBCMT ref: 00887E22

Strings

, $, xrefs: 008F3AA6
AUTOITCALLVARIABLE%d, xrefs: 008F3A58

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: bb2ddbc90d722b3aa08156e945ec65d41f506de6fd4ce7fd646b3f102520ff50
Instruction ID: b26d05fa72146b720562abf6813cb90104e56789c12f1be022d4ab49cff3e3b2
Opcode Fuzzy Hash: bb2ddbc90d722b3aa08156e945ec65d41f506de6fd4ce7fd646b3f102520ff50
Instruction Fuzzy Hash: AA215E7160062DAECF10EFA9CC82AAEBBB5FF44704F500455F545E7182DA30EA45CB62

Function 009066D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00906761
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0090676C

Strings

Combobox, xrefs: 0090672E

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 514fab7f9da8b14f5e77d7b1a68c1789766de68611824613bcefe7630c214c58
Instruction ID: 6eb3cfaf8150c69e589ec29d2b564b01fe55af1a968320b7e870be34ae4b58af
Opcode Fuzzy Hash: 514fab7f9da8b14f5e77d7b1a68c1789766de68611824613bcefe7630c214c58
Instruction Fuzzy Hash: 69118675210209AFEF119F54CC81EAB37AEEB84368F114125F914972D1D775DC6197A0

Function 00906C07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00881D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00881D73
Part of subcall function 00881D35: GetStockObject.GDI32(00000011), ref: 00881D87
Part of subcall function 00881D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00881D91

GetWindowRect.USER32(00000000,?), ref: 00906C71
GetSysColor.USER32(00000012), ref: 00906C8B

Strings

static, xrefs: 00906C4E

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 08e70db7f01ac068af92ec5c0a9d1a394e905e4f1353915362441677721166cb
Instruction ID: 21be072f36d10028c61b9eb6e90fd6a4c293968aa47532c58a86981e84016c1a
Opcode Fuzzy Hash: 08e70db7f01ac068af92ec5c0a9d1a394e905e4f1353915362441677721166cb
Instruction Fuzzy Hash: 0C21297252421AAFDF14DFA8CC45EFA7BA8FB08314F004629FA95D2290D735E861DB60

Function 00906920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 009069A2
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 009069B1

Strings

edit, xrefs: 00906986

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 62318b6c8f0e148ce9b6340939f433e6c8d428b34b02e92d29bf87d56a00d8a5
Instruction ID: 8974011d7b4bec02be9ca69608183bf64ea38bf0b78a008af14694a3feba26d5
Opcode Fuzzy Hash: 62318b6c8f0e148ce9b6340939f433e6c8d428b34b02e92d29bf87d56a00d8a5
Instruction Fuzzy Hash: C0116A71110208AFEB108E649C54EAB3AADEB053B8F504728F9B5975E0C775DCA1AB60

Function 008E29AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 008E2A22
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 008E2A41

Strings

0, xrefs: 008E2A18

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: dacc4fa6b48a1a333c4f8ec08a7ee8312357dc6882f100892b145a8dabba7b96
Instruction ID: cf031b3b8c1b9377bf094c5730cfaab21e44c857d2c48d4f384f8171389a00b2
Opcode Fuzzy Hash: dacc4fa6b48a1a333c4f8ec08a7ee8312357dc6882f100892b145a8dabba7b96
Instruction Fuzzy Hash: 3E1100329042A8ABCB30EA9DDC44FAA77AEFB47314F054031E815E7291D770AD0AC791

Function 008F21D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 008F222C
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 008F2255

Strings

<local>, xrefs: 008F221D

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 22682d41a6c9fe7de6bbd4d34011e14f8a6a275f2eb2a0a916619c9fd53ac56c
Instruction ID: 3ed810b333940fb5f9228c8a99003c99c22bc7f0d702b18812caf4304f505cc2
Opcode Fuzzy Hash: 22682d41a6c9fe7de6bbd4d34011e14f8a6a275f2eb2a0a916619c9fd53ac56c
Instruction Fuzzy Hash: B511027054122DBEEB258F618C95EBBFBA8FF06355F10822AFA14C6040D3706991D6F1

Function 008D8E05 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00887DE1: _memmove.LIBCMT ref: 00887E22

Part of subcall function 008DAA99: GetClassNameW.USER32(?,?,000000FF), ref: 008DAABC

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 008D8E73

Strings

ComboBox, xrefs: 008D8E12
ListBox, xrefs: 008D8E3D

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: ab224c5add0022c45fd778e95e13c68cb4dd8a45f0223f167fc8a2dd322ff263
Instruction ID: 589857f317c95e10b1cded2139cb739eb65091e9d89afc8d7f6a434547a8d040
Opcode Fuzzy Hash: ab224c5add0022c45fd778e95e13c68cb4dd8a45f0223f167fc8a2dd322ff263
Instruction Fuzzy Hash: 3301B5B5605229EBCB14FBA8CC558FE7769FF45320B540B1AF821A73D1DE315808DB51

Function 008D8CFD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00887DE1: _memmove.LIBCMT ref: 00887E22

Part of subcall function 008DAA99: GetClassNameW.USER32(?,?,000000FF), ref: 008DAABC

SendMessageW.USER32(?,00000180,00000000,?), ref: 008D8D6B

Strings

ComboBox, xrefs: 008D8D0A
ListBox, xrefs: 008D8D35

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 85c5c5255a84b44ddeaa555d84a5a40e21145af0deaaa14762c7ad29569fbde7
Instruction ID: f0cb9a04a915cb12391928561b57b32fc1c6c0fe8b3f4caf51ec04501b1253c6
Opcode Fuzzy Hash: 85c5c5255a84b44ddeaa555d84a5a40e21145af0deaaa14762c7ad29569fbde7
Instruction Fuzzy Hash: 0E01D871641108ABDB14E7E4CD52AFE77A9EF15300F600116B402E32D1DE119E08D772

Function 008D8D82 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00887DE1: _memmove.LIBCMT ref: 00887E22

Part of subcall function 008DAA99: GetClassNameW.USER32(?,?,000000FF), ref: 008DAABC

SendMessageW.USER32(?,00000182,?,00000000), ref: 008D8DEE

Strings

ComboBox, xrefs: 008D8D8F
ListBox, xrefs: 008D8DBA

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: fda9d33d455f6c9deeb76e50fda5aa2e088f000085dec37aea156f4a223d48c2
Instruction ID: a7d302b63ceac5785a043c8e1bcaa32c55d7a9521a76b92145a8d6ebad14b9ea
Opcode Fuzzy Hash: fda9d33d455f6c9deeb76e50fda5aa2e088f000085dec37aea156f4a223d48c2
Instruction Fuzzy Hash: 8701A7B1A45109ABDB25F6A8C952AFE77A9EF11300F600616B805F33D1DE219E08D672

Function 008E4F28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 008E4F46
_wcscmp.LIBCMT ref: 008E4F58

Strings

#32770, xrefs: 008E4F52

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 64d8eeb9a4019d3654d8ecdf299719cfdaa665cfa9911e7f61eb46d11badc976
Instruction ID: 55b0444d6d0416ee7f0c0db3d8d92251828751ecc8ee80a6ec9414daaefc1651
Opcode Fuzzy Hash: 64d8eeb9a4019d3654d8ecdf299719cfdaa665cfa9911e7f61eb46d11badc976
Instruction Fuzzy Hash: 6DE0D1329043282BD7209B599C45FA7F7ACFB46B71F000057FD04D3051D9609B45C7D1

Function 008BB2C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 008BB314: _memset.LIBCMT ref: 008BB321

Part of subcall function 008A0940: InitializeCriticalSectionAndSpinCount.KERNEL32(00944158,00000000,00944144,008BB2F0,?,?,?,0088100A), ref: 008A0945

IsDebuggerPresent.KERNEL32(?,?,?,0088100A), ref: 008BB2F4
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0088100A), ref: 008BB303

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 008BB2FE

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 15034167cb12441c6723987c5c78084404a8d156041d6f027cb263a657e54920
Instruction ID: 66bb72623c58539d8adcf1d57bf904e010d0103e988b7b812f715b9072084ef0
Opcode Fuzzy Hash: 15034167cb12441c6723987c5c78084404a8d156041d6f027cb263a657e54920
Instruction Fuzzy Hash: CDE06D702147118FD7709F68E4047827AE4FF04314F018A2DE456C7751E7F4E408DBA1

Function 008C1935 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 008C1775

Part of subcall function 008FBFF0: LoadLibraryA.KERNEL32(kernel32.dll,?,008C195E,?), ref: 008FBFFE
Part of subcall function 008FBFF0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 008FC010

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 008C196D

Strings

WIN_XPe, xrefs: 008C1788

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: 51b975bbcaa61695ce91e27284ed6b10e3d5cf6de4b192e44a71016e08d005c2
Instruction ID: b0cf727bf48b36ab4b388c5c911610d0de6be640bcf6788b785382f33c202372
Opcode Fuzzy Hash: 51b975bbcaa61695ce91e27284ed6b10e3d5cf6de4b192e44a71016e08d005c2
Instruction Fuzzy Hash: 5FF0F270819009DFDB26DBA0C998BECBAB8FB09304F100099E102A24A5D7308F84DB61

Function 00905998 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 009059AE
PostMessageW.USER32(00000000), ref: 009059B5

Part of subcall function 008E5244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 008E52BC

Strings

Shell_TrayWnd, xrefs: 009059A7

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 91e9e4d45ae91c785df03b9e67d3e1bb276dda3c3549df7a9cc818ddf3df53f7
Instruction ID: 2b51708fa38b91938f60fe4d73d57dc4537d49219d006ca530443cde6d5236d6
Opcode Fuzzy Hash: 91e9e4d45ae91c785df03b9e67d3e1bb276dda3c3549df7a9cc818ddf3df53f7
Instruction Fuzzy Hash: A3D0C931798311BAE678AB709C1BF976655BB45B55F000825B345EA5D0C9E0A900DA54

Function 00905964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0090596E
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00905981

Part of subcall function 008E5244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 008E52BC

Strings

Shell_TrayWnd, xrefs: 00905967

Memory Dump Source

Source File: 00000000.00000002.1732158041.0000000000881000.00000040.00000001.01000000.00000003.sdmp, Offset: 00880000, based on PE: true

Associated: 00000000.00000002.1732140271.0000000000880000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.0000000000934000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000093E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.000000000094D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732158041.00000000009D3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732293645.00000000009D9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1732308789.00000000009DA000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_880000_7056ZCiFdE.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: f69e2f9901871ebb76bd2b8b044d825444fe448eb97e0d54c1666d3e145c0e99
Instruction ID: 04b4bf9b6efd98fb415c842669af5b36aff436c8b8fedd5300814859acc5ead9
Opcode Fuzzy Hash: f69e2f9901871ebb76bd2b8b044d825444fe448eb97e0d54c1666d3e145c0e99
Instruction Fuzzy Hash: 55D0C931798311BAE678AB709C1BFA76A55BB40B55F000825B349AA5D0C9E09900DA54

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 7056ZCiFdE.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Remcos

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Stealing of Sensitive Information

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Privilege Escalation

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\remcos\logs.dat

C:\Users\user\AppData\Local\Milburr\Allene.exe

C:\Users\user\AppData\Local\Temp\Anglophile

C:\Users\user\AppData\Local\Temp\aut30FA.tmp

C:\Users\user\AppData\Local\Temp\autE914.tmp

C:\Users\user\AppData\Local\Temp\autF7AA.tmp

Windows Analysis Report
7056ZCiFdE.exe

Function 00883B3A Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Function 00883633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
timewindowregistryCOMMON

Function 008849A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00884E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 009D9A50 Relevance: 7.7, APIs: 5, Instructions: 206
librarymemoryloaderCOMMON

Function 008E9155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 0088708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00883A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00883766 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Function 0088301C Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 71
registrywindowclipboardCOMMON

Function 00883041 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 54
registrywindowclipboardCOMMON

Function 015F9220 Relevance: 10.7, APIs: 7, Instructions: 151
fileCOMMON

Function 008839D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 0088407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre