Edit tour

Windows Analysis Report
xrAlbTvRsz.exe

Overview

General Information

Sample name:	xrAlbTvRsz.exe renamed because original name is a hash value
Original sample name:	e9d14aa62f8d624d28cffd309e71d96bee4588b461e05b043394073002e25831.exe
Analysis ID:	1587946
MD5:	7e1b9f1a6d93097b8ff8df4ba628e068
SHA1:	f4ee0de57246077d83749f384faa04c9e4a5ef67
SHA256:	e9d14aa62f8d624d28cffd309e71d96bee4588b461e05b043394073002e25831
Tags:	exeFormbookuser-adrian__luca
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Drops script at startup location

Yara detected FormBook

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Drops VBS files to the startup folder

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Sigma detected: WScript or CScript Dropper

Switches to a custom stack to bypass stack traces

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Writes to foreign memory regions

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sigma detected: Uncommon Svchost Parent Process

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

xrAlbTvRsz.exe (PID: 7504 cmdline: "C:\Users\user\Desktop\xrAlbTvRsz.exe" MD5: 7E1B9F1A6D93097B8FF8DF4BA628E068)

Fonda.exe (PID: 7564 cmdline: "C:\Users\user\Desktop\xrAlbTvRsz.exe" MD5: 7E1B9F1A6D93097B8FF8DF4BA628E068)

svchost.exe (PID: 7608 cmdline: "C:\Users\user\Desktop\xrAlbTvRsz.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

wscript.exe (PID: 7692 cmdline: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fonda.vbs" MD5: A47CBE969EA935BDD3AB568BB126BC80)

Fonda.exe (PID: 7748 cmdline: "C:\Users\user\AppData\Local\carryover\Fonda.exe" MD5: 7E1B9F1A6D93097B8FF8DF4BA628E068)

svchost.exe (PID: 7764 cmdline: "C:\Users\user\AppData\Local\carryover\Fonda.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.1718026507.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000003.00000002.1718467858.0000000002F50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.1831918660.00000000035A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000006.00000002.1831666506.0000000000400000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security

Unpacked PEs

Source	Rule	Description	Author
3.2.svchost.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
6.2.svchost.exe.400000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
6.2.svchost.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
3.2.svchost.exe.400000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security

Sigma Signatures

System Summary

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fonda.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fonda.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fonda.vbs" , ProcessId: 7692, ProcessName: wscript.exe

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\xrAlbTvRsz.exe", CommandLine: "C:\Users\user\Desktop\xrAlbTvRsz.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\xrAlbTvRsz.exe", ParentImage: C:\Users\user\AppData\Local\carryover\Fonda.exe, ParentProcessId: 7564, ParentProcessName: Fonda.exe, ProcessCommandLine: "C:\Users\user\Desktop\xrAlbTvRsz.exe", ProcessId: 7608, ProcessName: svchost.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fonda.vbs" , CommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fonda.vbs" , CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 3504, ProcessCommandLine: "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fonda.vbs" , ProcessId: 7692, ProcessName: wscript.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\user\Desktop\xrAlbTvRsz.exe", CommandLine: "C:\Users\user\Desktop\xrAlbTvRsz.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\xrAlbTvRsz.exe", ParentImage: C:\Users\user\AppData\Local\carryover\Fonda.exe, ParentProcessId: 7564, ParentProcessName: Fonda.exe, ProcessCommandLine: "C:\Users\user\Desktop\xrAlbTvRsz.exe", ProcessId: 7608, ProcessName: svchost.exe

Data Obfuscation

Sigma detected: Drops script at startup location

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\carryover\Fonda.exe, ProcessId: 7564, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fonda.vbs

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	ReversingLabs: Detection: 65%
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Virustotal: Detection: 66%			Perma Link

Multi AV Scanner detection for submitted file

Source: xrAlbTvRsz.exe	Virustotal: Detection: 66%			Perma Link
Source: xrAlbTvRsz.exe	ReversingLabs: Detection: 65%

Yara detected FormBook

Source: Yara match	File source: 3.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1718026507.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1718467858.0000000002F50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1831918660.00000000035A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1831666506.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\carryover\Fonda.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: xrAlbTvRsz.exe

Joe Sandbox ML: detected

Source: xrAlbTvRsz.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: wntdll.pdbUGP source: Fonda.exe, 00000002.00000003.1385281986.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, Fonda.exe, 00000002.00000003.1384891521.0000000003F60000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1673223871.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1718507624.0000000003100000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1718507624.000000000329E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1670776421.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, Fonda.exe, 00000005.00000003.1520485258.00000000038F0000.00000004.00001000.00020000.00000000.sdmp, Fonda.exe, 00000005.00000003.1523861209.0000000003750000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1832096563.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1792842915.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1790812532.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1832096563.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Fonda.exe, 00000002.00000003.1385281986.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, Fonda.exe, 00000002.00000003.1384891521.0000000003F60000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000003.00000003.1673223871.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1718507624.0000000003100000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1718507624.000000000329E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1670776421.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, Fonda.exe, 00000005.00000003.1520485258.00000000038F0000.00000004.00001000.00020000.00000000.sdmp, Fonda.exe, 00000005.00000003.1523861209.0000000003750000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1832096563.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1792842915.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1790812532.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1832096563.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C6445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00C6445A
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C6C6D1 FindFirstFileW,FindClose,	0_2_00C6C6D1
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C6C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00C6C75C
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C6EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00C6EF95
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C6F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00C6F0F2
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C6F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00C6F3F3
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C637EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00C637EF
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C63B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00C63B12
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C6BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00C6BCBC
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0051445A GetFileAttributesW,FindFirstFileW,FindClose,	2_2_0051445A
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0051C6D1 FindFirstFileW,FindClose,	2_2_0051C6D1
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0051C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	2_2_0051C75C
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0051EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_0051EF95
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0051F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_0051F0F2
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0051F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_0051F3F3
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_005137EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_005137EF
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_00513B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_00513B12
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0051BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_0051BCBC

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C722EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_00C722EE

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C74164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_00C74164

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C74164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		0_2_00C74164
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_00524164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,		2_2_00524164

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C73F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_00C73F66

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C6001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_00C6001C

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C8CABC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		0_2_00C8CABC
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0053CABC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,		2_2_0053CABC

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 3.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1718026507.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1718467858.0000000002F50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1831918660.00000000035A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1831666506.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00C03B3A
Source: xrAlbTvRsz.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: xrAlbTvRsz.exe, 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_f716183b-8
Source: xrAlbTvRsz.exe, 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_3fe23741-e
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: This is a third-party compiled AutoIt script.	2_2_004B3B3A
Source: Fonda.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: Fonda.exe, 00000002.00000002.1387474922.0000000000564000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_0bfdd2b6-5
Source: Fonda.exe, 00000002.00000002.1387474922.0000000000564000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_26932f17-d
Source: Fonda.exe, 00000005.00000002.1531873397.0000000000564000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_a246a71a-6
Source: Fonda.exe, 00000005.00000002.1531873397.0000000000564000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_b1cc82e4-9

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C03633 NtdllDefWindowProc_W,KillTimer,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,PostQuitMessage,SetFocus,MoveWindow,	0_2_00C03633
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C8C1AC PostMessageW,GetFocus,GetDlgCtrlID,_memset,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W,	0_2_00C8C1AC
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C8C498 GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,	0_2_00C8C498
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C8C5FE DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	0_2_00C8C5FE
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C8C57D SendMessageW,NtdllDialogWndProc_W,	0_2_00C8C57D
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C8C88F NtdllDialogWndProc_W,	0_2_00C8C88F
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C8C8BE NtdllDialogWndProc_W,	0_2_00C8C8BE
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C8C860 NtdllDialogWndProc_W,	0_2_00C8C860
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C8C909 NtdllDialogWndProc_W,	0_2_00C8C909
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C8C93E ClientToScreen,NtdllDialogWndProc_W,	0_2_00C8C93E
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C8CABC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	0_2_00C8CABC
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C8CA7C GetWindowLongW,NtdllDialogWndProc_W,	0_2_00C8CA7C
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C01287 NtdllDialogWndProc_W,GetSysColor,SetBkColor,74BFC8D0,NtdllDialogWndProc_W,	0_2_00C01287
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C01290 NtdllDialogWndProc_W,GetClientRect,GetCursorPos,ScreenToClient,	0_2_00C01290
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C8D3B8 NtdllDialogWndProc_W,	0_2_00C8D3B8
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C8D43E GetSystemMetrics,GetSystemMetrics,MoveWindow,SendMessageW,SendMessageW,ShowWindow,InvalidateRect,NtdllDialogWndProc_W,	0_2_00C8D43E
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C016DE GetParent,NtdllDialogWndProc_W,	0_2_00C016DE
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C016B5 NtdllDialogWndProc_W,	0_2_00C016B5
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C0167D NtdllDialogWndProc_W,	0_2_00C0167D
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C8D78C NtdllDialogWndProc_W,	0_2_00C8D78C
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C0189B NtdllDialogWndProc_W,	0_2_00C0189B
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C8BC5D NtdllDialogWndProc_W,CallWindowProcW,	0_2_00C8BC5D
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C8BF8C ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W,	0_2_00C8BF8C
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C8BF30 NtdllDialogWndProc_W,	0_2_00C8BF30
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004B3633 NtdllDefWindowProc_W,KillTimer,SetTimer,RegisterClipboardFormatW,CreatePopupMenu,PostQuitMessage,SetFocus,MoveWindow,	2_2_004B3633
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0053C1AC PostMessageW,GetFocus,GetDlgCtrlID,_memset,GetMenuItemInfoW,GetMenuItemCount,GetMenuItemID,GetMenuItemInfoW,GetMenuItemInfoW,CheckMenuRadioItem,NtdllDialogWndProc_W,	2_2_0053C1AC
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0053C498 GetCursorPos,TrackPopupMenuEx,GetCursorPos,NtdllDialogWndProc_W,	2_2_0053C498
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0053C57D SendMessageW,NtdllDialogWndProc_W,	2_2_0053C57D
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0053C5FE DragQueryPoint,SendMessageW,DragQueryFileW,DragQueryFileW,_wcscat,SendMessageW,SendMessageW,SendMessageW,SendMessageW,DragFinish,NtdllDialogWndProc_W,	2_2_0053C5FE
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0053C860 NtdllDialogWndProc_W,	2_2_0053C860
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0053C88F NtdllDialogWndProc_W,	2_2_0053C88F
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0053C8BE NtdllDialogWndProc_W,	2_2_0053C8BE
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0053C909 NtdllDialogWndProc_W,	2_2_0053C909
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0053C93E ClientToScreen,NtdllDialogWndProc_W,	2_2_0053C93E
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0053CA7C GetWindowLongW,NtdllDialogWndProc_W,	2_2_0053CA7C
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0053CABC NtdllDialogWndProc_W,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SetCapture,ClientToScreen,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,	2_2_0053CABC
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004B1287 NtdllDialogWndProc_W,GetSysColor,SetBkColor,74BFC8D0,NtdllDialogWndProc_W,	2_2_004B1287
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004B1290 NtdllDialogWndProc_W,GetClientRect,GetCursorPos,ScreenToClient,	2_2_004B1290
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0053D3B8 NtdllDialogWndProc_W,	2_2_0053D3B8
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0053D43E GetSystemMetrics,GetSystemMetrics,MoveWindow,SendMessageW,SendMessageW,ShowWindow,InvalidateRect,NtdllDialogWndProc_W,	2_2_0053D43E
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004B167D NtdllDialogWndProc_W,	2_2_004B167D
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004B16DE GetParent,NtdllDialogWndProc_W,	2_2_004B16DE
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004B16B5 NtdllDialogWndProc_W,	2_2_004B16B5
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0053D78C NtdllDialogWndProc_W,	2_2_0053D78C
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004B189B NtdllDialogWndProc_W,	2_2_004B189B
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0053BC5D NtdllDialogWndProc_W,CallWindowProcW,	2_2_0053BC5D
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0053BF30 NtdllDialogWndProc_W,	2_2_0053BF30
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0053BF8C ReleaseCapture,SetWindowTextW,SendMessageW,NtdllDialogWndProc_W,	2_2_0053BF8C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0042C933 NtClose,	3_2_0042C933
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172B60 NtClose,LdrInitializeThunk,	3_2_03172B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172DF0 NtQuerySystemInformation,LdrInitializeThunk,	3_2_03172DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031735C0 NtCreateMutant,LdrInitializeThunk,	3_2_031735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03174340 NtSetContextThread,	3_2_03174340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03174650 NtSuspendThread,	3_2_03174650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172B80 NtQueryInformationFile,	3_2_03172B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172BA0 NtEnumerateValueKey,	3_2_03172BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172BF0 NtAllocateVirtualMemory,	3_2_03172BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172BE0 NtQueryValueKey,	3_2_03172BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172AB0 NtWaitForSingleObject,	3_2_03172AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172AD0 NtReadFile,	3_2_03172AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172AF0 NtWriteFile,	3_2_03172AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172F30 NtCreateSection,	3_2_03172F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172F60 NtCreateProcessEx,	3_2_03172F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172F90 NtProtectVirtualMemory,	3_2_03172F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172FB0 NtResumeThread,	3_2_03172FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172FA0 NtQuerySection,	3_2_03172FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172FE0 NtCreateFile,	3_2_03172FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172E30 NtWriteVirtualMemory,	3_2_03172E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172E80 NtReadVirtualMemory,	3_2_03172E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172EA0 NtAdjustPrivilegesToken,	3_2_03172EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172EE0 NtQueueApcThread,	3_2_03172EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172D10 NtMapViewOfSection,	3_2_03172D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172D00 NtSetInformationFile,	3_2_03172D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172D30 NtUnmapViewOfSection,	3_2_03172D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172DB0 NtEnumerateKey,	3_2_03172DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172DD0 NtDelayExecution,	3_2_03172DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172C00 NtQueryInformationProcess,	3_2_03172C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172C70 NtFreeVirtualMemory,	3_2_03172C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172C60 NtCreateKey,	3_2_03172C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172CA0 NtQueryInformationToken,	3_2_03172CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172CC0 NtQueryVirtualMemory,	3_2_03172CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172CF0 NtOpenProcess,	3_2_03172CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03173010 NtOpenDirectoryObject,	3_2_03173010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03173090 NtSetValueKey,	3_2_03173090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031739B0 NtGetContextThread,	3_2_031739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03173D10 NtOpenProcessToken,	3_2_03173D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03173D70 NtOpenThread,	3_2_03173D70

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C6A1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_00C6A1EF

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C58310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,74585590,CreateProcessAsUserW,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,

0_2_00C58310

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C651BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		0_2_00C651BD
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_005151BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,		2_2_005151BD

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C0E6A0	0_2_00C0E6A0
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C2D975	0_2_00C2D975
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C221C5	0_2_00C221C5
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C362D2	0_2_00C362D2
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C803DA	0_2_00C803DA
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C3242E	0_2_00C3242E
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C225FA	0_2_00C225FA
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C166E1	0_2_00C166E1
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C5E616	0_2_00C5E616
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C3878F	0_2_00C3878F
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C68889	0_2_00C68889
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C36844	0_2_00C36844
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C80857	0_2_00C80857
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C18808	0_2_00C18808
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C2CB21	0_2_00C2CB21
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C36DB6	0_2_00C36DB6
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C16F9E	0_2_00C16F9E
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C13030	0_2_00C13030
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C2F1D9	0_2_00C2F1D9
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C23187	0_2_00C23187
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C01287	0_2_00C01287
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C21484	0_2_00C21484
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C15520	0_2_00C15520
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C27696	0_2_00C27696
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C15760	0_2_00C15760
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C21978	0_2_00C21978
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C39AB5	0_2_00C39AB5
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C0FCE0	0_2_00C0FCE0
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C87DDB	0_2_00C87DDB
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C21D90	0_2_00C21D90
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C2BDA6	0_2_00C2BDA6
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C13FE0	0_2_00C13FE0
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C0DF00	0_2_00C0DF00
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00BD3630	0_2_00BD3630
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004BE6A0	2_2_004BE6A0
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004DD975	2_2_004DD975
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004BFCE0	2_2_004BFCE0
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004D21C5	2_2_004D21C5
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004E62D2	2_2_004E62D2
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_005303DA	2_2_005303DA
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004E242E	2_2_004E242E
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004D25FA	2_2_004D25FA
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0050E616	2_2_0050E616
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004C66E1	2_2_004C66E1
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004E878F	2_2_004E878F
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_00530857	2_2_00530857
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004E6844	2_2_004E6844
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004C8808	2_2_004C8808
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_00518889	2_2_00518889
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004DCB21	2_2_004DCB21
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004E6DB6	2_2_004E6DB6
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004C6F9E	2_2_004C6F9E
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004C3030	2_2_004C3030
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004DF1D9	2_2_004DF1D9
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004D3187	2_2_004D3187
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004B1287	2_2_004B1287
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004D1484	2_2_004D1484
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004C5520	2_2_004C5520
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004D7696	2_2_004D7696
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004C5760	2_2_004C5760
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004D1978	2_2_004D1978
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004E9AB5	2_2_004E9AB5
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_00537DDB	2_2_00537DDB
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004D1D90	2_2_004D1D90
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004DBDA6	2_2_004DBDA6
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004BDF00	2_2_004BDF00
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004C3FE0	2_2_004C3FE0
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_01503630	2_2_01503630
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00402810	3_2_00402810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_004101D0	3_2_004101D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_004101D3	3_2_004101D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00403270	3_2_00403270
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00416AFE	3_2_00416AFE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00416B03	3_2_00416B03
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0040E3E3	3_2_0040E3E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_004103F3	3_2_004103F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00401B80	3_2_00401B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_004024F0	3_2_004024F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00402D56	3_2_00402D56
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00402D0B	3_2_00402D0B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00402D10	3_2_00402D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0040E533	3_2_0040E533
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0040E535	3_2_0040E535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0042EF53	3_2_0042EF53
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031FA352	3_2_031FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_032003E6	3_2_032003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0314E3F0	3_2_0314E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031E0274	3_2_031E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031C02C0	3_2_031C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031DA118	3_2_031DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03130100	3_2_03130100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031C8158	3_2_031C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_032001AA	3_2_032001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031F41A2	3_2_031F41A2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031F81CC	3_2_031F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031D2000	3_2_031D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03164750	3_2_03164750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03140770	3_2_03140770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313C7C0	3_2_0313C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315C6E0	3_2_0315C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03140535	3_2_03140535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03200591	3_2_03200591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031E4420	3_2_031E4420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031F2446	3_2_031F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031EE4F6	3_2_031EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031FAB40	3_2_031FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031F6BD7	3_2_031F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313EA80	3_2_0313EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03156962	3_2_03156962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0320A9A6	3_2_0320A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031429A0	3_2_031429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0314A840	3_2_0314A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03142840	3_2_03142840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031268B8	3_2_031268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316E8F0	3_2_0316E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03160F30	3_2_03160F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031E2F30	3_2_031E2F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03182F28	3_2_03182F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B4F40	3_2_031B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031BEFA0	3_2_031BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03132FC8	3_2_03132FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0314CFE0	3_2_0314CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031FEE26	3_2_031FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03140E59	3_2_03140E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03152E90	3_2_03152E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031FCE93	3_2_031FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031FEEDB	3_2_031FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031DCD1F	3_2_031DCD1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0314AD00	3_2_0314AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03158DBF	3_2_03158DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313ADE0	3_2_0313ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03140C00	3_2_03140C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031E0CB5	3_2_031E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03130CF2	3_2_03130CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031F132D	3_2_031F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0312D34C	3_2_0312D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0318739A	3_2_0318739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031452A0	3_2_031452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315B2C0	3_2_0315B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031E12ED	3_2_031E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0320B16B	3_2_0320B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0312F172	3_2_0312F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0317516C	3_2_0317516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0314B1B0	3_2_0314B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031EF0CC	3_2_031EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031470C0	3_2_031470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031F70E9	3_2_031F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031FF0E0	3_2_031FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031FF7B0	3_2_031FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031F16CC	3_2_031F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031F7571	3_2_031F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031DD5B0	3_2_031DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031FF43F	3_2_031FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03131460	3_2_03131460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031FFB76	3_2_031FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315FB80	3_2_0315FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B5BF0	3_2_031B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0317DBF9	3_2_0317DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031FFA49	3_2_031FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031F7A46	3_2_031F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B3A6C	3_2_031B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031DDAAC	3_2_031DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03185AA0	3_2_03185AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031E1AA3	3_2_031E1AA3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031EDAC6	3_2_031EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031D5910	3_2_031D5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03149950	3_2_03149950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315B950	3_2_0315B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031AD800	3_2_031AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031438E0	3_2_031438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031FFF09	3_2_031FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03141F92	3_2_03141F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031FFFB1	3_2_031FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03149EB0	3_2_03149EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031F1D5A	3_2_031F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03143D40	3_2_03143D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031F7D73	3_2_031F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315FDC0	3_2_0315FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B9C32	3_2_031B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031FFCF2	3_2_031FFCF2

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03187E54 appears 101 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0312B970 appears 280 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03175130 appears 58 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 031BF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 031AEA12 appears 86 times
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: String function: 00C28900 appears 42 times
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: String function: 00C07DE1 appears 35 times
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: String function: 00C20AE3 appears 70 times
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: String function: 004D0AE3 appears 70 times
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: String function: 004B7DE1 appears 36 times
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: String function: 004D8900 appears 42 times

Source: xrAlbTvRsz.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@10/6@0/0

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C6A06A GetLastError,FormatMessageW,

0_2_00C6A06A

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C581CB AdjustTokenPrivileges,CloseHandle,	0_2_00C581CB
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C587E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	0_2_00C587E1
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_005081CB AdjustTokenPrivileges,CloseHandle,	2_2_005081CB
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_005087E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,	2_2_005087E1

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C6B3FB SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_00C6B3FB

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C7EE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00C7EE0D

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C6C397 CoInitialize,CoCreateInstance,CoUninitialize,

0_2_00C6C397

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C04E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00C04E89

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

File created: C:\Users\user\AppData\Local\carryover

Jump to behavior

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

File created: C:\Users\user\AppData\Local\Temp\autD32E.tmp

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fonda.vbs"

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: xrAlbTvRsz.exe	Virustotal: Detection: 66%
Source: xrAlbTvRsz.exe	ReversingLabs: Detection: 65%

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

File read: C:\Users\user\Desktop\xrAlbTvRsz.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\xrAlbTvRsz.exe "C:\Users\user\Desktop\xrAlbTvRsz.exe"
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Process created: C:\Users\user\AppData\Local\carryover\Fonda.exe "C:\Users\user\Desktop\xrAlbTvRsz.exe"
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\xrAlbTvRsz.exe"
Source: unknown	Process created: C:\Windows\System32\wscript.exe "C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fonda.vbs"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\carryover\Fonda.exe "C:\Users\user\AppData\Local\carryover\Fonda.exe"
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\AppData\Local\carryover\Fonda.exe"
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Process created: C:\Users\user\AppData\Local\carryover\Fonda.exe "C:\Users\user\Desktop\xrAlbTvRsz.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\xrAlbTvRsz.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\carryover\Fonda.exe "C:\Users\user\AppData\Local\carryover\Fonda.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\AppData\Local\carryover\Fonda.exe"	Jump to behavior

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Jump to behavior

Source:	Binary string: wntdll.pdbUGP source: Fonda.exe, 00000002.00000003.1385281986.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, Fonda.exe, 00000002.00000003.1384891521.0000000003F60000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1673223871.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1718507624.0000000003100000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1718507624.000000000329E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1670776421.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, Fonda.exe, 00000005.00000003.1520485258.00000000038F0000.00000004.00001000.00020000.00000000.sdmp, Fonda.exe, 00000005.00000003.1523861209.0000000003750000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1832096563.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1792842915.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1790812532.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1832096563.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: Fonda.exe, 00000002.00000003.1385281986.0000000003DC0000.00000004.00001000.00020000.00000000.sdmp, Fonda.exe, 00000002.00000003.1384891521.0000000003F60000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000003.00000003.1673223871.0000000002F00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1718507624.0000000003100000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1718507624.000000000329E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1670776421.0000000002D00000.00000004.00000020.00020000.00000000.sdmp, Fonda.exe, 00000005.00000003.1520485258.00000000038F0000.00000004.00001000.00020000.00000000.sdmp, Fonda.exe, 00000005.00000003.1523861209.0000000003750000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1832096563.0000000003C00000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1792842915.0000000003A00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1790812532.0000000003800000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1832096563.0000000003D9E000.00000040.00001000.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00D2EA10 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_00D2EA10

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C20739 push es; retn 5600h	0_2_00C20753
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C28945 push ecx; ret	0_2_00C28958
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C92F42 push esp; retf	0_2_00C92F4E
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C92F0D push esp; retf	0_2_00C92F0E
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004BC4C6 push A3004BBAh; retn 004Bh	2_2_004BC50D
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004D8945 push ecx; ret	2_2_004D8958
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004B2F12 push es; retf	2_2_004B2F13
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_004050C2 push esp; iretd	3_2_004050D7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_004148DD push eax; iretd	3_2_004148E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0040D137 push ebx; iretd	3_2_0040D138
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_004021AD push esp; iretd	3_2_004021BD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00411A80 push ecx; iretd	3_2_00411A82
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0041AB6D push edx; ret	3_2_0041AB7C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_004063C5 push ds; retf	3_2_004063C6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0040ABA1 pushfd ; retf	3_2_0040ABA2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00411C41 push ss; ret	3_2_00411C42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0041EC42 push ss; ret	3_2_0041EC4A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0041EC0C push edi; ret	3_2_0041EC0D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_004174E3 push 67AB33D5h; retf	3_2_004174F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00417563 push 29541E82h; ret	3_2_00417568
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00403510 push eax; ret	3_2_00403512
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00418E53 push FFFFFFA3h; iretd	3_2_00418E33
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_00414708 push ebp; ret	3_2_0041473A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031309AD push ecx; mov dword ptr [esp], ecx	3_2_031309B6

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

File created: C:\Users\user\AppData\Local\carryover\Fonda.exe

Jump to dropped file

Boot Survival

Drops VBS files to the startup folder

Source: C:\Users\user\AppData\Local\carryover\Fonda.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fonda.vbs

Jump to dropped file

Source: C:\Users\user\AppData\Local\carryover\Fonda.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fonda.vbs

Jump to behavior

Source: C:\Users\user\AppData\Local\carryover\Fonda.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fonda.vbs

Jump to behavior

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C048D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	0_2_00C048D7
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C85376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	0_2_00C85376
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004B48D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,	2_2_004B48D7
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_00535376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,	2_2_00535376

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C23187 RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00C23187

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	API/Special instruction interceptor: Address: 1503254
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	API/Special instruction interceptor: Address: 793254

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 3_2_0317096E rdtsc

3_2_0317096E

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	API coverage: 4.7 %
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	API coverage: 5.1 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.6 %

Source: C:\Windows\SysWOW64\svchost.exe TID: 7612	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe TID: 7768	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C6445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_00C6445A
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C6C6D1 FindFirstFileW,FindClose,	0_2_00C6C6D1
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C6C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_00C6C75C
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C6EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00C6EF95
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C6F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_00C6F0F2
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C6F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00C6F3F3
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C637EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00C637EF
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C63B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_00C63B12
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C6BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_00C6BCBC
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0051445A GetFileAttributesW,FindFirstFileW,FindClose,	2_2_0051445A
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0051C6D1 FindFirstFileW,FindClose,	2_2_0051C6D1
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0051C75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	2_2_0051C75C
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0051EF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_0051EF95
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0051F0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	2_2_0051F0F2
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0051F3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_0051F3F3
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_005137EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_005137EF
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_00513B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	2_2_00513B12
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_0051BCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	2_2_0051BCBC

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C049A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00C049A0

Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: C:\Users\user\	Jump to behavior

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

API call chain: ExitProcess graph end node

graph_0-105097

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 3_2_0317096E rdtsc

3_2_0317096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 3_2_00417A93 LdrLoadDll,

3_2_00417A93

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C73F09 BlockInput,

0_2_00C73F09

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C03B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00C03B3A

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C35A7C RtlEncodePointer,RtlEncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,GetProcAddress,RtlEncodePointer,IsDebuggerPresent,OutputDebugStringW,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,RtlDecodePointer,

0_2_00C35A7C

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00D2EA10 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_00D2EA10

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00BD34C0 mov eax, dword ptr fs:[00000030h]	0_2_00BD34C0
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00BD3520 mov eax, dword ptr fs:[00000030h]	0_2_00BD3520
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00BD1E70 mov eax, dword ptr fs:[00000030h]	0_2_00BD1E70
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_01503520 mov eax, dword ptr fs:[00000030h]	2_2_01503520
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_015034C0 mov eax, dword ptr fs:[00000030h]	2_2_015034C0
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_01501E70 mov eax, dword ptr fs:[00000030h]	2_2_01501E70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0312C310 mov ecx, dword ptr fs:[00000030h]	3_2_0312C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03150310 mov ecx, dword ptr fs:[00000030h]	3_2_03150310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316A30B mov eax, dword ptr fs:[00000030h]	3_2_0316A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316A30B mov eax, dword ptr fs:[00000030h]	3_2_0316A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316A30B mov eax, dword ptr fs:[00000030h]	3_2_0316A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B035C mov eax, dword ptr fs:[00000030h]	3_2_031B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B035C mov eax, dword ptr fs:[00000030h]	3_2_031B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B035C mov eax, dword ptr fs:[00000030h]	3_2_031B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B035C mov ecx, dword ptr fs:[00000030h]	3_2_031B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B035C mov eax, dword ptr fs:[00000030h]	3_2_031B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B035C mov eax, dword ptr fs:[00000030h]	3_2_031B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031FA352 mov eax, dword ptr fs:[00000030h]	3_2_031FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031D8350 mov ecx, dword ptr fs:[00000030h]	3_2_031D8350
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B2349 mov eax, dword ptr fs:[00000030h]	3_2_031B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B2349 mov eax, dword ptr fs:[00000030h]	3_2_031B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B2349 mov eax, dword ptr fs:[00000030h]	3_2_031B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B2349 mov eax, dword ptr fs:[00000030h]	3_2_031B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B2349 mov eax, dword ptr fs:[00000030h]	3_2_031B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B2349 mov eax, dword ptr fs:[00000030h]	3_2_031B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B2349 mov eax, dword ptr fs:[00000030h]	3_2_031B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B2349 mov eax, dword ptr fs:[00000030h]	3_2_031B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B2349 mov eax, dword ptr fs:[00000030h]	3_2_031B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B2349 mov eax, dword ptr fs:[00000030h]	3_2_031B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B2349 mov eax, dword ptr fs:[00000030h]	3_2_031B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B2349 mov eax, dword ptr fs:[00000030h]	3_2_031B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B2349 mov eax, dword ptr fs:[00000030h]	3_2_031B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B2349 mov eax, dword ptr fs:[00000030h]	3_2_031B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B2349 mov eax, dword ptr fs:[00000030h]	3_2_031B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031D437C mov eax, dword ptr fs:[00000030h]	3_2_031D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03128397 mov eax, dword ptr fs:[00000030h]	3_2_03128397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03128397 mov eax, dword ptr fs:[00000030h]	3_2_03128397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03128397 mov eax, dword ptr fs:[00000030h]	3_2_03128397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0312E388 mov eax, dword ptr fs:[00000030h]	3_2_0312E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0312E388 mov eax, dword ptr fs:[00000030h]	3_2_0312E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0312E388 mov eax, dword ptr fs:[00000030h]	3_2_0312E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315438F mov eax, dword ptr fs:[00000030h]	3_2_0315438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315438F mov eax, dword ptr fs:[00000030h]	3_2_0315438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031DE3DB mov eax, dword ptr fs:[00000030h]	3_2_031DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031DE3DB mov eax, dword ptr fs:[00000030h]	3_2_031DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031DE3DB mov ecx, dword ptr fs:[00000030h]	3_2_031DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031DE3DB mov eax, dword ptr fs:[00000030h]	3_2_031DE3DB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031D43D4 mov eax, dword ptr fs:[00000030h]	3_2_031D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031D43D4 mov eax, dword ptr fs:[00000030h]	3_2_031D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031EC3CD mov eax, dword ptr fs:[00000030h]	3_2_031EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313A3C0 mov eax, dword ptr fs:[00000030h]	3_2_0313A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313A3C0 mov eax, dword ptr fs:[00000030h]	3_2_0313A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313A3C0 mov eax, dword ptr fs:[00000030h]	3_2_0313A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313A3C0 mov eax, dword ptr fs:[00000030h]	3_2_0313A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313A3C0 mov eax, dword ptr fs:[00000030h]	3_2_0313A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313A3C0 mov eax, dword ptr fs:[00000030h]	3_2_0313A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031383C0 mov eax, dword ptr fs:[00000030h]	3_2_031383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031383C0 mov eax, dword ptr fs:[00000030h]	3_2_031383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031383C0 mov eax, dword ptr fs:[00000030h]	3_2_031383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031383C0 mov eax, dword ptr fs:[00000030h]	3_2_031383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B63C0 mov eax, dword ptr fs:[00000030h]	3_2_031B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0314E3F0 mov eax, dword ptr fs:[00000030h]	3_2_0314E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0314E3F0 mov eax, dword ptr fs:[00000030h]	3_2_0314E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0314E3F0 mov eax, dword ptr fs:[00000030h]	3_2_0314E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031663FF mov eax, dword ptr fs:[00000030h]	3_2_031663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031403E9 mov eax, dword ptr fs:[00000030h]	3_2_031403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031403E9 mov eax, dword ptr fs:[00000030h]	3_2_031403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031403E9 mov eax, dword ptr fs:[00000030h]	3_2_031403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031403E9 mov eax, dword ptr fs:[00000030h]	3_2_031403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031403E9 mov eax, dword ptr fs:[00000030h]	3_2_031403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031403E9 mov eax, dword ptr fs:[00000030h]	3_2_031403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031403E9 mov eax, dword ptr fs:[00000030h]	3_2_031403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031403E9 mov eax, dword ptr fs:[00000030h]	3_2_031403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0312823B mov eax, dword ptr fs:[00000030h]	3_2_0312823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0312A250 mov eax, dword ptr fs:[00000030h]	3_2_0312A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03136259 mov eax, dword ptr fs:[00000030h]	3_2_03136259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031EA250 mov eax, dword ptr fs:[00000030h]	3_2_031EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031EA250 mov eax, dword ptr fs:[00000030h]	3_2_031EA250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B8243 mov eax, dword ptr fs:[00000030h]	3_2_031B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B8243 mov ecx, dword ptr fs:[00000030h]	3_2_031B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031E0274 mov eax, dword ptr fs:[00000030h]	3_2_031E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031E0274 mov eax, dword ptr fs:[00000030h]	3_2_031E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031E0274 mov eax, dword ptr fs:[00000030h]	3_2_031E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031E0274 mov eax, dword ptr fs:[00000030h]	3_2_031E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031E0274 mov eax, dword ptr fs:[00000030h]	3_2_031E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031E0274 mov eax, dword ptr fs:[00000030h]	3_2_031E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031E0274 mov eax, dword ptr fs:[00000030h]	3_2_031E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031E0274 mov eax, dword ptr fs:[00000030h]	3_2_031E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031E0274 mov eax, dword ptr fs:[00000030h]	3_2_031E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031E0274 mov eax, dword ptr fs:[00000030h]	3_2_031E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031E0274 mov eax, dword ptr fs:[00000030h]	3_2_031E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031E0274 mov eax, dword ptr fs:[00000030h]	3_2_031E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03134260 mov eax, dword ptr fs:[00000030h]	3_2_03134260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03134260 mov eax, dword ptr fs:[00000030h]	3_2_03134260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03134260 mov eax, dword ptr fs:[00000030h]	3_2_03134260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0312826B mov eax, dword ptr fs:[00000030h]	3_2_0312826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316E284 mov eax, dword ptr fs:[00000030h]	3_2_0316E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316E284 mov eax, dword ptr fs:[00000030h]	3_2_0316E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B0283 mov eax, dword ptr fs:[00000030h]	3_2_031B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B0283 mov eax, dword ptr fs:[00000030h]	3_2_031B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B0283 mov eax, dword ptr fs:[00000030h]	3_2_031B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031402A0 mov eax, dword ptr fs:[00000030h]	3_2_031402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031402A0 mov eax, dword ptr fs:[00000030h]	3_2_031402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031C62A0 mov eax, dword ptr fs:[00000030h]	3_2_031C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031C62A0 mov ecx, dword ptr fs:[00000030h]	3_2_031C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031C62A0 mov eax, dword ptr fs:[00000030h]	3_2_031C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031C62A0 mov eax, dword ptr fs:[00000030h]	3_2_031C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031C62A0 mov eax, dword ptr fs:[00000030h]	3_2_031C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031C62A0 mov eax, dword ptr fs:[00000030h]	3_2_031C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313A2C3 mov eax, dword ptr fs:[00000030h]	3_2_0313A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313A2C3 mov eax, dword ptr fs:[00000030h]	3_2_0313A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313A2C3 mov eax, dword ptr fs:[00000030h]	3_2_0313A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313A2C3 mov eax, dword ptr fs:[00000030h]	3_2_0313A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313A2C3 mov eax, dword ptr fs:[00000030h]	3_2_0313A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031402E1 mov eax, dword ptr fs:[00000030h]	3_2_031402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031402E1 mov eax, dword ptr fs:[00000030h]	3_2_031402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031402E1 mov eax, dword ptr fs:[00000030h]	3_2_031402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031DA118 mov ecx, dword ptr fs:[00000030h]	3_2_031DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031DA118 mov eax, dword ptr fs:[00000030h]	3_2_031DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031DA118 mov eax, dword ptr fs:[00000030h]	3_2_031DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031DA118 mov eax, dword ptr fs:[00000030h]	3_2_031DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031F0115 mov eax, dword ptr fs:[00000030h]	3_2_031F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031DE10E mov eax, dword ptr fs:[00000030h]	3_2_031DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031DE10E mov ecx, dword ptr fs:[00000030h]	3_2_031DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031DE10E mov eax, dword ptr fs:[00000030h]	3_2_031DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031DE10E mov eax, dword ptr fs:[00000030h]	3_2_031DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031DE10E mov ecx, dword ptr fs:[00000030h]	3_2_031DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031DE10E mov eax, dword ptr fs:[00000030h]	3_2_031DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031DE10E mov eax, dword ptr fs:[00000030h]	3_2_031DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031DE10E mov ecx, dword ptr fs:[00000030h]	3_2_031DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031DE10E mov eax, dword ptr fs:[00000030h]	3_2_031DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031DE10E mov ecx, dword ptr fs:[00000030h]	3_2_031DE10E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03160124 mov eax, dword ptr fs:[00000030h]	3_2_03160124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0312C156 mov eax, dword ptr fs:[00000030h]	3_2_0312C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031C8158 mov eax, dword ptr fs:[00000030h]	3_2_031C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03136154 mov eax, dword ptr fs:[00000030h]	3_2_03136154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03136154 mov eax, dword ptr fs:[00000030h]	3_2_03136154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031C4144 mov eax, dword ptr fs:[00000030h]	3_2_031C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031C4144 mov eax, dword ptr fs:[00000030h]	3_2_031C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031C4144 mov ecx, dword ptr fs:[00000030h]	3_2_031C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031C4144 mov eax, dword ptr fs:[00000030h]	3_2_031C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031C4144 mov eax, dword ptr fs:[00000030h]	3_2_031C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B019F mov eax, dword ptr fs:[00000030h]	3_2_031B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B019F mov eax, dword ptr fs:[00000030h]	3_2_031B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B019F mov eax, dword ptr fs:[00000030h]	3_2_031B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B019F mov eax, dword ptr fs:[00000030h]	3_2_031B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0312A197 mov eax, dword ptr fs:[00000030h]	3_2_0312A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0312A197 mov eax, dword ptr fs:[00000030h]	3_2_0312A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0312A197 mov eax, dword ptr fs:[00000030h]	3_2_0312A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03170185 mov eax, dword ptr fs:[00000030h]	3_2_03170185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031EC188 mov eax, dword ptr fs:[00000030h]	3_2_031EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031EC188 mov eax, dword ptr fs:[00000030h]	3_2_031EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031D4180 mov eax, dword ptr fs:[00000030h]	3_2_031D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031D4180 mov eax, dword ptr fs:[00000030h]	3_2_031D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_032061E5 mov eax, dword ptr fs:[00000030h]	3_2_032061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031AE1D0 mov eax, dword ptr fs:[00000030h]	3_2_031AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031AE1D0 mov eax, dword ptr fs:[00000030h]	3_2_031AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031AE1D0 mov ecx, dword ptr fs:[00000030h]	3_2_031AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031AE1D0 mov eax, dword ptr fs:[00000030h]	3_2_031AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031AE1D0 mov eax, dword ptr fs:[00000030h]	3_2_031AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031F61C3 mov eax, dword ptr fs:[00000030h]	3_2_031F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031F61C3 mov eax, dword ptr fs:[00000030h]	3_2_031F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031601F8 mov eax, dword ptr fs:[00000030h]	3_2_031601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0314E016 mov eax, dword ptr fs:[00000030h]	3_2_0314E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0314E016 mov eax, dword ptr fs:[00000030h]	3_2_0314E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0314E016 mov eax, dword ptr fs:[00000030h]	3_2_0314E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0314E016 mov eax, dword ptr fs:[00000030h]	3_2_0314E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B4000 mov ecx, dword ptr fs:[00000030h]	3_2_031B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031D2000 mov eax, dword ptr fs:[00000030h]	3_2_031D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031D2000 mov eax, dword ptr fs:[00000030h]	3_2_031D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031D2000 mov eax, dword ptr fs:[00000030h]	3_2_031D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031D2000 mov eax, dword ptr fs:[00000030h]	3_2_031D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031D2000 mov eax, dword ptr fs:[00000030h]	3_2_031D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031D2000 mov eax, dword ptr fs:[00000030h]	3_2_031D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031D2000 mov eax, dword ptr fs:[00000030h]	3_2_031D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031D2000 mov eax, dword ptr fs:[00000030h]	3_2_031D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031C6030 mov eax, dword ptr fs:[00000030h]	3_2_031C6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0312A020 mov eax, dword ptr fs:[00000030h]	3_2_0312A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0312C020 mov eax, dword ptr fs:[00000030h]	3_2_0312C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03132050 mov eax, dword ptr fs:[00000030h]	3_2_03132050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B6050 mov eax, dword ptr fs:[00000030h]	3_2_031B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315C073 mov eax, dword ptr fs:[00000030h]	3_2_0315C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313208A mov eax, dword ptr fs:[00000030h]	3_2_0313208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031F60B8 mov eax, dword ptr fs:[00000030h]	3_2_031F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031F60B8 mov ecx, dword ptr fs:[00000030h]	3_2_031F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031C80A8 mov eax, dword ptr fs:[00000030h]	3_2_031C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B20DE mov eax, dword ptr fs:[00000030h]	3_2_031B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0312C0F0 mov eax, dword ptr fs:[00000030h]	3_2_0312C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031720F0 mov ecx, dword ptr fs:[00000030h]	3_2_031720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0312A0E3 mov ecx, dword ptr fs:[00000030h]	3_2_0312A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031380E9 mov eax, dword ptr fs:[00000030h]	3_2_031380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B60E0 mov eax, dword ptr fs:[00000030h]	3_2_031B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03130710 mov eax, dword ptr fs:[00000030h]	3_2_03130710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03160710 mov eax, dword ptr fs:[00000030h]	3_2_03160710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316C700 mov eax, dword ptr fs:[00000030h]	3_2_0316C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316273C mov eax, dword ptr fs:[00000030h]	3_2_0316273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316273C mov ecx, dword ptr fs:[00000030h]	3_2_0316273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316273C mov eax, dword ptr fs:[00000030h]	3_2_0316273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031AC730 mov eax, dword ptr fs:[00000030h]	3_2_031AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316C720 mov eax, dword ptr fs:[00000030h]	3_2_0316C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316C720 mov eax, dword ptr fs:[00000030h]	3_2_0316C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03130750 mov eax, dword ptr fs:[00000030h]	3_2_03130750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031BE75D mov eax, dword ptr fs:[00000030h]	3_2_031BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172750 mov eax, dword ptr fs:[00000030h]	3_2_03172750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172750 mov eax, dword ptr fs:[00000030h]	3_2_03172750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B4755 mov eax, dword ptr fs:[00000030h]	3_2_031B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316674D mov esi, dword ptr fs:[00000030h]	3_2_0316674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316674D mov eax, dword ptr fs:[00000030h]	3_2_0316674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316674D mov eax, dword ptr fs:[00000030h]	3_2_0316674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03138770 mov eax, dword ptr fs:[00000030h]	3_2_03138770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03140770 mov eax, dword ptr fs:[00000030h]	3_2_03140770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03140770 mov eax, dword ptr fs:[00000030h]	3_2_03140770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03140770 mov eax, dword ptr fs:[00000030h]	3_2_03140770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03140770 mov eax, dword ptr fs:[00000030h]	3_2_03140770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03140770 mov eax, dword ptr fs:[00000030h]	3_2_03140770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03140770 mov eax, dword ptr fs:[00000030h]	3_2_03140770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03140770 mov eax, dword ptr fs:[00000030h]	3_2_03140770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03140770 mov eax, dword ptr fs:[00000030h]	3_2_03140770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03140770 mov eax, dword ptr fs:[00000030h]	3_2_03140770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03140770 mov eax, dword ptr fs:[00000030h]	3_2_03140770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03140770 mov eax, dword ptr fs:[00000030h]	3_2_03140770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03140770 mov eax, dword ptr fs:[00000030h]	3_2_03140770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031D678E mov eax, dword ptr fs:[00000030h]	3_2_031D678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031307AF mov eax, dword ptr fs:[00000030h]	3_2_031307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031E47A0 mov eax, dword ptr fs:[00000030h]	3_2_031E47A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313C7C0 mov eax, dword ptr fs:[00000030h]	3_2_0313C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B07C3 mov eax, dword ptr fs:[00000030h]	3_2_031B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031347FB mov eax, dword ptr fs:[00000030h]	3_2_031347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031347FB mov eax, dword ptr fs:[00000030h]	3_2_031347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031527ED mov eax, dword ptr fs:[00000030h]	3_2_031527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031527ED mov eax, dword ptr fs:[00000030h]	3_2_031527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031527ED mov eax, dword ptr fs:[00000030h]	3_2_031527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031BE7E1 mov eax, dword ptr fs:[00000030h]	3_2_031BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03172619 mov eax, dword ptr fs:[00000030h]	3_2_03172619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031AE609 mov eax, dword ptr fs:[00000030h]	3_2_031AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0314260B mov eax, dword ptr fs:[00000030h]	3_2_0314260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0314260B mov eax, dword ptr fs:[00000030h]	3_2_0314260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0314260B mov eax, dword ptr fs:[00000030h]	3_2_0314260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0314260B mov eax, dword ptr fs:[00000030h]	3_2_0314260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0314260B mov eax, dword ptr fs:[00000030h]	3_2_0314260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0314260B mov eax, dword ptr fs:[00000030h]	3_2_0314260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0314260B mov eax, dword ptr fs:[00000030h]	3_2_0314260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0314E627 mov eax, dword ptr fs:[00000030h]	3_2_0314E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03166620 mov eax, dword ptr fs:[00000030h]	3_2_03166620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03168620 mov eax, dword ptr fs:[00000030h]	3_2_03168620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313262C mov eax, dword ptr fs:[00000030h]	3_2_0313262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0314C640 mov eax, dword ptr fs:[00000030h]	3_2_0314C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03162674 mov eax, dword ptr fs:[00000030h]	3_2_03162674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031F866E mov eax, dword ptr fs:[00000030h]	3_2_031F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031F866E mov eax, dword ptr fs:[00000030h]	3_2_031F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316A660 mov eax, dword ptr fs:[00000030h]	3_2_0316A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316A660 mov eax, dword ptr fs:[00000030h]	3_2_0316A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03134690 mov eax, dword ptr fs:[00000030h]	3_2_03134690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03134690 mov eax, dword ptr fs:[00000030h]	3_2_03134690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031666B0 mov eax, dword ptr fs:[00000030h]	3_2_031666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316C6A6 mov eax, dword ptr fs:[00000030h]	3_2_0316C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316A6C7 mov ebx, dword ptr fs:[00000030h]	3_2_0316A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316A6C7 mov eax, dword ptr fs:[00000030h]	3_2_0316A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031AE6F2 mov eax, dword ptr fs:[00000030h]	3_2_031AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031AE6F2 mov eax, dword ptr fs:[00000030h]	3_2_031AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031AE6F2 mov eax, dword ptr fs:[00000030h]	3_2_031AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031AE6F2 mov eax, dword ptr fs:[00000030h]	3_2_031AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B06F1 mov eax, dword ptr fs:[00000030h]	3_2_031B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B06F1 mov eax, dword ptr fs:[00000030h]	3_2_031B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031C6500 mov eax, dword ptr fs:[00000030h]	3_2_031C6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03204500 mov eax, dword ptr fs:[00000030h]	3_2_03204500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03204500 mov eax, dword ptr fs:[00000030h]	3_2_03204500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03204500 mov eax, dword ptr fs:[00000030h]	3_2_03204500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03204500 mov eax, dword ptr fs:[00000030h]	3_2_03204500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03204500 mov eax, dword ptr fs:[00000030h]	3_2_03204500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03204500 mov eax, dword ptr fs:[00000030h]	3_2_03204500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03204500 mov eax, dword ptr fs:[00000030h]	3_2_03204500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03140535 mov eax, dword ptr fs:[00000030h]	3_2_03140535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03140535 mov eax, dword ptr fs:[00000030h]	3_2_03140535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03140535 mov eax, dword ptr fs:[00000030h]	3_2_03140535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03140535 mov eax, dword ptr fs:[00000030h]	3_2_03140535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03140535 mov eax, dword ptr fs:[00000030h]	3_2_03140535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03140535 mov eax, dword ptr fs:[00000030h]	3_2_03140535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315E53E mov eax, dword ptr fs:[00000030h]	3_2_0315E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315E53E mov eax, dword ptr fs:[00000030h]	3_2_0315E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315E53E mov eax, dword ptr fs:[00000030h]	3_2_0315E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315E53E mov eax, dword ptr fs:[00000030h]	3_2_0315E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315E53E mov eax, dword ptr fs:[00000030h]	3_2_0315E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03138550 mov eax, dword ptr fs:[00000030h]	3_2_03138550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03138550 mov eax, dword ptr fs:[00000030h]	3_2_03138550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316656A mov eax, dword ptr fs:[00000030h]	3_2_0316656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316656A mov eax, dword ptr fs:[00000030h]	3_2_0316656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316656A mov eax, dword ptr fs:[00000030h]	3_2_0316656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316E59C mov eax, dword ptr fs:[00000030h]	3_2_0316E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03132582 mov eax, dword ptr fs:[00000030h]	3_2_03132582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03132582 mov ecx, dword ptr fs:[00000030h]	3_2_03132582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03164588 mov eax, dword ptr fs:[00000030h]	3_2_03164588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031545B1 mov eax, dword ptr fs:[00000030h]	3_2_031545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031545B1 mov eax, dword ptr fs:[00000030h]	3_2_031545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B05A7 mov eax, dword ptr fs:[00000030h]	3_2_031B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B05A7 mov eax, dword ptr fs:[00000030h]	3_2_031B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B05A7 mov eax, dword ptr fs:[00000030h]	3_2_031B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031365D0 mov eax, dword ptr fs:[00000030h]	3_2_031365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316A5D0 mov eax, dword ptr fs:[00000030h]	3_2_0316A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316A5D0 mov eax, dword ptr fs:[00000030h]	3_2_0316A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316E5CF mov eax, dword ptr fs:[00000030h]	3_2_0316E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316E5CF mov eax, dword ptr fs:[00000030h]	3_2_0316E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315E5E7 mov eax, dword ptr fs:[00000030h]	3_2_0315E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315E5E7 mov eax, dword ptr fs:[00000030h]	3_2_0315E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315E5E7 mov eax, dword ptr fs:[00000030h]	3_2_0315E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315E5E7 mov eax, dword ptr fs:[00000030h]	3_2_0315E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315E5E7 mov eax, dword ptr fs:[00000030h]	3_2_0315E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315E5E7 mov eax, dword ptr fs:[00000030h]	3_2_0315E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315E5E7 mov eax, dword ptr fs:[00000030h]	3_2_0315E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315E5E7 mov eax, dword ptr fs:[00000030h]	3_2_0315E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031325E0 mov eax, dword ptr fs:[00000030h]	3_2_031325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316C5ED mov eax, dword ptr fs:[00000030h]	3_2_0316C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316C5ED mov eax, dword ptr fs:[00000030h]	3_2_0316C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03168402 mov eax, dword ptr fs:[00000030h]	3_2_03168402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03168402 mov eax, dword ptr fs:[00000030h]	3_2_03168402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03168402 mov eax, dword ptr fs:[00000030h]	3_2_03168402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316A430 mov eax, dword ptr fs:[00000030h]	3_2_0316A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0312E420 mov eax, dword ptr fs:[00000030h]	3_2_0312E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0312E420 mov eax, dword ptr fs:[00000030h]	3_2_0312E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0312E420 mov eax, dword ptr fs:[00000030h]	3_2_0312E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0312C427 mov eax, dword ptr fs:[00000030h]	3_2_0312C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B6420 mov eax, dword ptr fs:[00000030h]	3_2_031B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B6420 mov eax, dword ptr fs:[00000030h]	3_2_031B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B6420 mov eax, dword ptr fs:[00000030h]	3_2_031B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B6420 mov eax, dword ptr fs:[00000030h]	3_2_031B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B6420 mov eax, dword ptr fs:[00000030h]	3_2_031B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B6420 mov eax, dword ptr fs:[00000030h]	3_2_031B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B6420 mov eax, dword ptr fs:[00000030h]	3_2_031B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031EA456 mov eax, dword ptr fs:[00000030h]	3_2_031EA456
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0312645D mov eax, dword ptr fs:[00000030h]	3_2_0312645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315245A mov eax, dword ptr fs:[00000030h]	3_2_0315245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316E443 mov eax, dword ptr fs:[00000030h]	3_2_0316E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316E443 mov eax, dword ptr fs:[00000030h]	3_2_0316E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316E443 mov eax, dword ptr fs:[00000030h]	3_2_0316E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316E443 mov eax, dword ptr fs:[00000030h]	3_2_0316E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316E443 mov eax, dword ptr fs:[00000030h]	3_2_0316E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316E443 mov eax, dword ptr fs:[00000030h]	3_2_0316E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316E443 mov eax, dword ptr fs:[00000030h]	3_2_0316E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316E443 mov eax, dword ptr fs:[00000030h]	3_2_0316E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315A470 mov eax, dword ptr fs:[00000030h]	3_2_0315A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315A470 mov eax, dword ptr fs:[00000030h]	3_2_0315A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315A470 mov eax, dword ptr fs:[00000030h]	3_2_0315A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031BC460 mov ecx, dword ptr fs:[00000030h]	3_2_031BC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031EA49A mov eax, dword ptr fs:[00000030h]	3_2_031EA49A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031644B0 mov ecx, dword ptr fs:[00000030h]	3_2_031644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031BA4B0 mov eax, dword ptr fs:[00000030h]	3_2_031BA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031364AB mov eax, dword ptr fs:[00000030h]	3_2_031364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031304E5 mov ecx, dword ptr fs:[00000030h]	3_2_031304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031AEB1D mov eax, dword ptr fs:[00000030h]	3_2_031AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031AEB1D mov eax, dword ptr fs:[00000030h]	3_2_031AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031AEB1D mov eax, dword ptr fs:[00000030h]	3_2_031AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031AEB1D mov eax, dword ptr fs:[00000030h]	3_2_031AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031AEB1D mov eax, dword ptr fs:[00000030h]	3_2_031AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031AEB1D mov eax, dword ptr fs:[00000030h]	3_2_031AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031AEB1D mov eax, dword ptr fs:[00000030h]	3_2_031AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031AEB1D mov eax, dword ptr fs:[00000030h]	3_2_031AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031AEB1D mov eax, dword ptr fs:[00000030h]	3_2_031AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315EB20 mov eax, dword ptr fs:[00000030h]	3_2_0315EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315EB20 mov eax, dword ptr fs:[00000030h]	3_2_0315EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031F8B28 mov eax, dword ptr fs:[00000030h]	3_2_031F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031F8B28 mov eax, dword ptr fs:[00000030h]	3_2_031F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031DEB50 mov eax, dword ptr fs:[00000030h]	3_2_031DEB50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031E4B4B mov eax, dword ptr fs:[00000030h]	3_2_031E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031E4B4B mov eax, dword ptr fs:[00000030h]	3_2_031E4B4B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031C6B40 mov eax, dword ptr fs:[00000030h]	3_2_031C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031C6B40 mov eax, dword ptr fs:[00000030h]	3_2_031C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031FAB40 mov eax, dword ptr fs:[00000030h]	3_2_031FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031D8B42 mov eax, dword ptr fs:[00000030h]	3_2_031D8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0312CB7E mov eax, dword ptr fs:[00000030h]	3_2_0312CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03140BBE mov eax, dword ptr fs:[00000030h]	3_2_03140BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03140BBE mov eax, dword ptr fs:[00000030h]	3_2_03140BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031E4BB0 mov eax, dword ptr fs:[00000030h]	3_2_031E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031E4BB0 mov eax, dword ptr fs:[00000030h]	3_2_031E4BB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031DEBD0 mov eax, dword ptr fs:[00000030h]	3_2_031DEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03150BCB mov eax, dword ptr fs:[00000030h]	3_2_03150BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03150BCB mov eax, dword ptr fs:[00000030h]	3_2_03150BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03150BCB mov eax, dword ptr fs:[00000030h]	3_2_03150BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03130BCD mov eax, dword ptr fs:[00000030h]	3_2_03130BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03130BCD mov eax, dword ptr fs:[00000030h]	3_2_03130BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03130BCD mov eax, dword ptr fs:[00000030h]	3_2_03130BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03138BF0 mov eax, dword ptr fs:[00000030h]	3_2_03138BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03138BF0 mov eax, dword ptr fs:[00000030h]	3_2_03138BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03138BF0 mov eax, dword ptr fs:[00000030h]	3_2_03138BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315EBFC mov eax, dword ptr fs:[00000030h]	3_2_0315EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031BCBF0 mov eax, dword ptr fs:[00000030h]	3_2_031BCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031BCA11 mov eax, dword ptr fs:[00000030h]	3_2_031BCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03154A35 mov eax, dword ptr fs:[00000030h]	3_2_03154A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03154A35 mov eax, dword ptr fs:[00000030h]	3_2_03154A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316CA38 mov eax, dword ptr fs:[00000030h]	3_2_0316CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316CA24 mov eax, dword ptr fs:[00000030h]	3_2_0316CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315EA2E mov eax, dword ptr fs:[00000030h]	3_2_0315EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03136A50 mov eax, dword ptr fs:[00000030h]	3_2_03136A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03136A50 mov eax, dword ptr fs:[00000030h]	3_2_03136A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03136A50 mov eax, dword ptr fs:[00000030h]	3_2_03136A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03136A50 mov eax, dword ptr fs:[00000030h]	3_2_03136A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03136A50 mov eax, dword ptr fs:[00000030h]	3_2_03136A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03136A50 mov eax, dword ptr fs:[00000030h]	3_2_03136A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03136A50 mov eax, dword ptr fs:[00000030h]	3_2_03136A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03140A5B mov eax, dword ptr fs:[00000030h]	3_2_03140A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03140A5B mov eax, dword ptr fs:[00000030h]	3_2_03140A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031ACA72 mov eax, dword ptr fs:[00000030h]	3_2_031ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031ACA72 mov eax, dword ptr fs:[00000030h]	3_2_031ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316CA6F mov eax, dword ptr fs:[00000030h]	3_2_0316CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316CA6F mov eax, dword ptr fs:[00000030h]	3_2_0316CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316CA6F mov eax, dword ptr fs:[00000030h]	3_2_0316CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031DEA60 mov eax, dword ptr fs:[00000030h]	3_2_031DEA60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03168A90 mov edx, dword ptr fs:[00000030h]	3_2_03168A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313EA80 mov eax, dword ptr fs:[00000030h]	3_2_0313EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313EA80 mov eax, dword ptr fs:[00000030h]	3_2_0313EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313EA80 mov eax, dword ptr fs:[00000030h]	3_2_0313EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313EA80 mov eax, dword ptr fs:[00000030h]	3_2_0313EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313EA80 mov eax, dword ptr fs:[00000030h]	3_2_0313EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313EA80 mov eax, dword ptr fs:[00000030h]	3_2_0313EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313EA80 mov eax, dword ptr fs:[00000030h]	3_2_0313EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313EA80 mov eax, dword ptr fs:[00000030h]	3_2_0313EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313EA80 mov eax, dword ptr fs:[00000030h]	3_2_0313EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03204A80 mov eax, dword ptr fs:[00000030h]	3_2_03204A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03138AA0 mov eax, dword ptr fs:[00000030h]	3_2_03138AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03138AA0 mov eax, dword ptr fs:[00000030h]	3_2_03138AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03186AA4 mov eax, dword ptr fs:[00000030h]	3_2_03186AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03130AD0 mov eax, dword ptr fs:[00000030h]	3_2_03130AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03164AD0 mov eax, dword ptr fs:[00000030h]	3_2_03164AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03164AD0 mov eax, dword ptr fs:[00000030h]	3_2_03164AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03186ACC mov eax, dword ptr fs:[00000030h]	3_2_03186ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03186ACC mov eax, dword ptr fs:[00000030h]	3_2_03186ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03186ACC mov eax, dword ptr fs:[00000030h]	3_2_03186ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316AAEE mov eax, dword ptr fs:[00000030h]	3_2_0316AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316AAEE mov eax, dword ptr fs:[00000030h]	3_2_0316AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031BC912 mov eax, dword ptr fs:[00000030h]	3_2_031BC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03128918 mov eax, dword ptr fs:[00000030h]	3_2_03128918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03128918 mov eax, dword ptr fs:[00000030h]	3_2_03128918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031AE908 mov eax, dword ptr fs:[00000030h]	3_2_031AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031AE908 mov eax, dword ptr fs:[00000030h]	3_2_031AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B892A mov eax, dword ptr fs:[00000030h]	3_2_031B892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031C892B mov eax, dword ptr fs:[00000030h]	3_2_031C892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B0946 mov eax, dword ptr fs:[00000030h]	3_2_031B0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031D4978 mov eax, dword ptr fs:[00000030h]	3_2_031D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031D4978 mov eax, dword ptr fs:[00000030h]	3_2_031D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031BC97C mov eax, dword ptr fs:[00000030h]	3_2_031BC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03156962 mov eax, dword ptr fs:[00000030h]	3_2_03156962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03156962 mov eax, dword ptr fs:[00000030h]	3_2_03156962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03156962 mov eax, dword ptr fs:[00000030h]	3_2_03156962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0317096E mov eax, dword ptr fs:[00000030h]	3_2_0317096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0317096E mov edx, dword ptr fs:[00000030h]	3_2_0317096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0317096E mov eax, dword ptr fs:[00000030h]	3_2_0317096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B89B3 mov esi, dword ptr fs:[00000030h]	3_2_031B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B89B3 mov eax, dword ptr fs:[00000030h]	3_2_031B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031B89B3 mov eax, dword ptr fs:[00000030h]	3_2_031B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031429A0 mov eax, dword ptr fs:[00000030h]	3_2_031429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031429A0 mov eax, dword ptr fs:[00000030h]	3_2_031429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031429A0 mov eax, dword ptr fs:[00000030h]	3_2_031429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031429A0 mov eax, dword ptr fs:[00000030h]	3_2_031429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031429A0 mov eax, dword ptr fs:[00000030h]	3_2_031429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031429A0 mov eax, dword ptr fs:[00000030h]	3_2_031429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031429A0 mov eax, dword ptr fs:[00000030h]	3_2_031429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031429A0 mov eax, dword ptr fs:[00000030h]	3_2_031429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031429A0 mov eax, dword ptr fs:[00000030h]	3_2_031429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031429A0 mov eax, dword ptr fs:[00000030h]	3_2_031429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031429A0 mov eax, dword ptr fs:[00000030h]	3_2_031429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031429A0 mov eax, dword ptr fs:[00000030h]	3_2_031429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031429A0 mov eax, dword ptr fs:[00000030h]	3_2_031429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031309AD mov eax, dword ptr fs:[00000030h]	3_2_031309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031309AD mov eax, dword ptr fs:[00000030h]	3_2_031309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313A9D0 mov eax, dword ptr fs:[00000030h]	3_2_0313A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313A9D0 mov eax, dword ptr fs:[00000030h]	3_2_0313A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313A9D0 mov eax, dword ptr fs:[00000030h]	3_2_0313A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313A9D0 mov eax, dword ptr fs:[00000030h]	3_2_0313A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313A9D0 mov eax, dword ptr fs:[00000030h]	3_2_0313A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0313A9D0 mov eax, dword ptr fs:[00000030h]	3_2_0313A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031649D0 mov eax, dword ptr fs:[00000030h]	3_2_031649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031FA9D3 mov eax, dword ptr fs:[00000030h]	3_2_031FA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031C69C0 mov eax, dword ptr fs:[00000030h]	3_2_031C69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031629F9 mov eax, dword ptr fs:[00000030h]	3_2_031629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031629F9 mov eax, dword ptr fs:[00000030h]	3_2_031629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031BE9E0 mov eax, dword ptr fs:[00000030h]	3_2_031BE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031BC810 mov eax, dword ptr fs:[00000030h]	3_2_031BC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03152835 mov eax, dword ptr fs:[00000030h]	3_2_03152835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03152835 mov eax, dword ptr fs:[00000030h]	3_2_03152835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03152835 mov eax, dword ptr fs:[00000030h]	3_2_03152835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03152835 mov ecx, dword ptr fs:[00000030h]	3_2_03152835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03152835 mov eax, dword ptr fs:[00000030h]	3_2_03152835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03152835 mov eax, dword ptr fs:[00000030h]	3_2_03152835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316A830 mov eax, dword ptr fs:[00000030h]	3_2_0316A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031D483A mov eax, dword ptr fs:[00000030h]	3_2_031D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031D483A mov eax, dword ptr fs:[00000030h]	3_2_031D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03160854 mov eax, dword ptr fs:[00000030h]	3_2_03160854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03134859 mov eax, dword ptr fs:[00000030h]	3_2_03134859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03134859 mov eax, dword ptr fs:[00000030h]	3_2_03134859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03142840 mov ecx, dword ptr fs:[00000030h]	3_2_03142840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031BE872 mov eax, dword ptr fs:[00000030h]	3_2_031BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031BE872 mov eax, dword ptr fs:[00000030h]	3_2_031BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031C6870 mov eax, dword ptr fs:[00000030h]	3_2_031C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031C6870 mov eax, dword ptr fs:[00000030h]	3_2_031C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031BC89D mov eax, dword ptr fs:[00000030h]	3_2_031BC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03130887 mov eax, dword ptr fs:[00000030h]	3_2_03130887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0315E8C0 mov eax, dword ptr fs:[00000030h]	3_2_0315E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316C8F9 mov eax, dword ptr fs:[00000030h]	3_2_0316C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_0316C8F9 mov eax, dword ptr fs:[00000030h]	3_2_0316C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_031FA8E4 mov eax, dword ptr fs:[00000030h]	3_2_031FA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 3_2_03132F12 mov eax, dword ptr fs:[00000030h]	3_2_03132F12

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C580A9 GetTokenInformation,GetLastError,GetProcessHeap,RtlAllocateHeap,GetTokenInformation,

0_2_00C580A9

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C2A155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00C2A155
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C2A124 SetUnhandledExceptionFilter,	0_2_00C2A124
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004DA155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_004DA155
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_004DA124 SetUnhandledExceptionFilter,	2_2_004DA124

HIPS / PFW / Operating System Protection Evasion

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write			Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 269E008			Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Memory written: C:\Windows\SysWOW64\svchost.exe base: 3071008			Jump to behavior

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C587B1 LogonUserW,

0_2_00C587B1

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C03B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00C03B3A

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C048D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00C048D7

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C64C53 mouse_event,

0_2_00C64C53

Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\xrAlbTvRsz.exe"	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process created: C:\Users\user\AppData\Local\carryover\Fonda.exe "C:\Users\user\AppData\Local\carryover\Fonda.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\AppData\Local\carryover\Fonda.exe"	Jump to behavior

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C57CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,RtlAllocateHeap,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_00C57CAF

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C5874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_00C5874B

Source: xrAlbTvRsz.exe, 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmp, Fonda.exe, 00000002.00000002.1387474922.0000000000564000.00000040.00000001.01000000.00000004.sdmp, Fonda.exe, 00000005.00000002.1531873397.0000000000564000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: xrAlbTvRsz.exe, Fonda.exe	Binary or memory string: Shell_TrayWnd

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C2862B cpuid

0_2_00C2862B

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C34E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00C34E87

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C41E06 GetUserNameW,

0_2_00C41E06

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C33F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00C33F3A

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Code function: 0_2_00C049A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00C049A0

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 3.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1718026507.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1718467858.0000000002F50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1831918660.00000000035A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1831666506.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Source: Fonda.exe	Binary or memory string: WIN_81
Source: Fonda.exe	Binary or memory string: WIN_XP
Source: Fonda.exe	Binary or memory string: WIN_XPe
Source: Fonda.exe	Binary or memory string: WIN_VISTA
Source: Fonda.exe	Binary or memory string: WIN_7
Source: Fonda.exe	Binary or memory string: WIN_8
Source: Fonda.exe, 00000005.00000002.1531873397.0000000000564000.00000040.00000001.01000000.00000004.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 3.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.svchost.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.svchost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1718026507.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1718467858.0000000002F50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1831918660.00000000035A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.1831666506.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C76283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	0_2_00C76283
Source: C:\Users\user\Desktop\xrAlbTvRsz.exe	Code function: 0_2_00C76747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	0_2_00C76747
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_00526283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,	2_2_00526283
Source: C:\Users\user\AppData\Local\carryover\Fonda.exe	Code function: 2_2_00526747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,	2_2_00526747

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	111 Scripting	2 Valid Accounts	1 Native API	111 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	21 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	2 Valid Accounts	2 Valid Accounts	21 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	2 Registry Run Keys / Startup Folder	21 Access Token Manipulation	1 Software Packing	NTDS	116 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	212 Process Injection	1 DLL Side-Loading	LSA Secrets	25 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	2 Registry Run Keys / Startup Folder	1 Masquerading	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Valid Accounts	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	21 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	212 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
xrAlbTvRsz.exe	67%	Virustotal		Browse
xrAlbTvRsz.exe	66%	ReversingLabs	Win32.Trojan.AutoitInject
xrAlbTvRsz.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\carryover\Fonda.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\carryover\Fonda.exe	66%	ReversingLabs	Win32.Trojan.AutoitInject
C:\Users\user\AppData\Local\carryover\Fonda.exe	67%	Virustotal		Browse

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587946
Start date and time:	2025-01-10 19:38:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	xrAlbTvRsz.exe renamed because original name is a hash value
Original Sample Name:	e9d14aa62f8d624d28cffd309e71d96bee4588b461e05b043394073002e25831.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@10/6@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 52 Number of non-executed functions: 296
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.109.210.53
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, otelrules.afd.azureedge.net, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:39:59	API Interceptor	6x Sleep call for process: svchost.exe modified
18:39:29	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fonda.vbs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	Xf3rn1smZw.exe	Get hash	malicious	RedLine	Browse	13.107.246.45
	ThBJg59JRC.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	293816234142143228.js	Get hash	malicious	Strela Downloader	Browse	13.107.246.45
	Voicemail_+Transcription+_ATT006151.docx	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://www.mentimeter.com/app/presentation/alp52o7zih4ubnvbqe9pvb585a1z3bd7/edit?source=share-modal	Get hash	malicious	Unknown	Browse	13.107.246.45
	MWP0FO5rAF.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	3HnH4uJtE7.exe	Get hash	malicious	FormBook	Browse	13.107.246.45
	Encrypted_Archive_2025_LHC1W64SMW.html	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	GcA5z6ZWRK.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	Unconfirmed 287374.eml	Get hash	malicious	Unknown	Browse	13.107.246.45

Process:	C:\Users\user\AppData\Local\carryover\Fonda.exe
File Type:	data
Category:	dropped
Size (bytes):	288256
Entropy (8bit):	7.99483172535295
Encrypted:	true
SSDEEP:	6144:9qX2pEW1M33PcKYbjm/ji0YqV/1N8Gsmj8g20U:Xpr7CekxsfgnU
MD5:	189CFDE73E368FC3FDE0B798A603DC1C
SHA1:	9A46BBAC8D1973702CD7943030F39A580F70E377
SHA-256:	D4EA75796038184F1279158D2D8C659D4005C87E9321FADF9FA7C699731CBF6B
SHA-512:	A86252820F621EF2F0F0096CD64EF17FAC52848E031E6B60903AE80C28A277F7BFAABCF36F756F2555A1705770F5643D0FE3E49A78411D5A7F328549C3F7D3DB
Malicious:	false
Reputation:	low
Preview:	.k.YBNJYCMOQ.Q5.9AJFOA7.7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PY.NJYIR._9.X.h.@..n._/Df"=^7+ #j:&#!>Mz3PiK4$f&/..x.r"^4<oCGScMOQ9ZQ508H.{/&.{W!.rQ7.[..}-(.#...uY&.\...zW!..X31\|.-.GMOQ9ZQ5.\|AJ.N@7..8.O1PYANJY.MMP2[Z5ImEJFOA7F7FR."PYA^JYG=KQ9Z.5I)AJFMA7@7FRO1PYGNJYGMOQ9*U5I;AJFOA7D7..O1@YA^JYGM_Q9JQ5I9AJVOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ..4M=9AJR.E7F'FROeTYA^JYGMOQ9ZQ5I9AJfOAWF7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJ

C:\Users\user\AppData\Local\Temp\autD32E.tmp

Download File

Process:	C:\Users\user\Desktop\xrAlbTvRsz.exe
File Type:	data
Category:	dropped
Size (bytes):	288256
Entropy (8bit):	7.99483172535295
Encrypted:	true
SSDEEP:	6144:9qX2pEW1M33PcKYbjm/ji0YqV/1N8Gsmj8g20U:Xpr7CekxsfgnU
MD5:	189CFDE73E368FC3FDE0B798A603DC1C
SHA1:	9A46BBAC8D1973702CD7943030F39A580F70E377
SHA-256:	D4EA75796038184F1279158D2D8C659D4005C87E9321FADF9FA7C699731CBF6B
SHA-512:	A86252820F621EF2F0F0096CD64EF17FAC52848E031E6B60903AE80C28A277F7BFAABCF36F756F2555A1705770F5643D0FE3E49A78411D5A7F328549C3F7D3DB
Malicious:	false
Reputation:	low
Preview:	.k.YBNJYCMOQ.Q5.9AJFOA7.7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PY.NJYIR._9.X.h.@..n._/Df"=^7+ #j:&#!>Mz3PiK4$f&/..x.r"^4<oCGScMOQ9ZQ508H.{/&.{W!.rQ7.[..}-(.#...uY&.\...zW!..X31\|.-.GMOQ9ZQ5.\|AJ.N@7..8.O1PYANJY.MMP2[Z5ImEJFOA7F7FR."PYA^JYG=KQ9Z.5I)AJFMA7@7FRO1PYGNJYGMOQ9*U5I;AJFOA7D7..O1@YA^JYGM_Q9JQ5I9AJVOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ..4M=9AJR.E7F'FROeTYA^JYGMOQ9ZQ5I9AJfOAWF7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJ

C:\Users\user\AppData\Local\Temp\autD793.tmp

Download File

Process:	C:\Users\user\AppData\Local\carryover\Fonda.exe
File Type:	data
Category:	dropped
Size (bytes):	288256
Entropy (8bit):	7.99483172535295
Encrypted:	true
SSDEEP:	6144:9qX2pEW1M33PcKYbjm/ji0YqV/1N8Gsmj8g20U:Xpr7CekxsfgnU
MD5:	189CFDE73E368FC3FDE0B798A603DC1C
SHA1:	9A46BBAC8D1973702CD7943030F39A580F70E377
SHA-256:	D4EA75796038184F1279158D2D8C659D4005C87E9321FADF9FA7C699731CBF6B
SHA-512:	A86252820F621EF2F0F0096CD64EF17FAC52848E031E6B60903AE80C28A277F7BFAABCF36F756F2555A1705770F5643D0FE3E49A78411D5A7F328549C3F7D3DB
Malicious:	false
Reputation:	low
Preview:	.k.YBNJYCMOQ.Q5.9AJFOA7.7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PY.NJYIR._9.X.h.@..n._/Df"=^7+ #j:&#!>Mz3PiK4$f&/..x.r"^4<oCGScMOQ9ZQ508H.{/&.{W!.rQ7.[..}-(.#...uY&.\...zW!..X31\|.-.GMOQ9ZQ5.\|AJ.N@7..8.O1PYANJY.MMP2[Z5ImEJFOA7F7FR."PYA^JYG=KQ9Z.5I)AJFMA7@7FRO1PYGNJYGMOQ9*U5I;AJFOA7D7..O1@YA^JYGM_Q9JQ5I9AJVOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ..4M=9AJR.E7F'FROeTYA^JYGMOQ9ZQ5I9AJfOAWF7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJ

C:\Users\user\AppData\Local\Temp\buncal

Download File

Process:	C:\Users\user\Desktop\xrAlbTvRsz.exe
File Type:	data
Category:	dropped
Size (bytes):	288256
Entropy (8bit):	7.99483172535295
Encrypted:	true
SSDEEP:	6144:9qX2pEW1M33PcKYbjm/ji0YqV/1N8Gsmj8g20U:Xpr7CekxsfgnU
MD5:	189CFDE73E368FC3FDE0B798A603DC1C
SHA1:	9A46BBAC8D1973702CD7943030F39A580F70E377
SHA-256:	D4EA75796038184F1279158D2D8C659D4005C87E9321FADF9FA7C699731CBF6B
SHA-512:	A86252820F621EF2F0F0096CD64EF17FAC52848E031E6B60903AE80C28A277F7BFAABCF36F756F2555A1705770F5643D0FE3E49A78411D5A7F328549C3F7D3DB
Malicious:	false
Reputation:	low
Preview:	.k.YBNJYCMOQ.Q5.9AJFOA7.7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PY.NJYIR._9.X.h.@..n._/Df"=^7+ #j:&#!>Mz3PiK4$f&/..x.r"^4<oCGScMOQ9ZQ508H.{/&.{W!.rQ7.[..}-(.#...uY&.\...zW!..X31\|.-.GMOQ9ZQ5.\|AJ.N@7..8.O1PYANJY.MMP2[Z5ImEJFOA7F7FR."PYA^JYG=KQ9Z.5I)AJFMA7@7FRO1PYGNJYGMOQ9*U5I;AJFOA7D7..O1@YA^JYGM_Q9JQ5I9AJVOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ..4M=9AJR.E7F'FROeTYA^JYGMOQ9ZQ5I9AJfOAWF7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJFOA7F7FRO1PYANJYGMOQ9ZQ5I9AJ

C:\Users\user\AppData\Local\carryover\Fonda.exe

Download File

Process:	C:\Users\user\Desktop\xrAlbTvRsz.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	706560
Entropy (8bit):	7.947478937509466
Encrypted:	false
SSDEEP:	12288:CquErHF6xC9D6DmR1J98w4oknqOOCyQf31sgvqOkDzYVh32PT2V/Our4FHF:Hrl6kD68JmlotQfxqORVp2a9M
MD5:	7E1B9F1A6D93097B8FF8DF4BA628E068
SHA1:	F4EE0DE57246077D83749F384FAA04C9E4A5EF67
SHA-256:	E9D14AA62F8D624D28CFFD309E71D96BEE4588B461E05B043394073002E25831
SHA-512:	F0DC3B422FB144D1D5C6DADA3F55C7D90562E79CD9834B0E2FE8AFEB3D104CEA77F7639DA4514E223A0952C04F89EE368F2C170D38A231AC5C23A1B8BFA9EAC8
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66% Antivirus: Virustotal, Detection: 67%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}.r}.r}.4,".p}.....s}../..A}../#..}../".G}.{.@.{}.{.P.W}.r}.R....)."}.....s}../..s}.r}T.s}.....s}.Richr}.................PE..L....)ag.........."......`...p....................@..........................`............@...@.......@......................P..$........`...................T..........................................H...........................................UPX0....................................UPX1.....`.......^..................@....rsrc....p.......f...b..............@..............................................................................................................................................................................................................................................................................................................................................................3.91.UPX!....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fonda.vbs

Download File

Process:	C:\Users\user\AppData\Local\carryover\Fonda.exe
File Type:	data
Category:	dropped
Size (bytes):	268
Entropy (8bit):	3.437571644671552
Encrypted:	false
SSDEEP:	6:DMM8lfm3OOQdUfclgMsUEZ+lX1GlcFRTElm6nriIM8lfQVn:DsO+vNlgMsQ11FRTERmA2n
MD5:	BD55684CFD89533EECA7EFDE85A3A3AD
SHA1:	96C1C6D7C67C5FB07656D373295E3F456E7395BA
SHA-256:	0FC2E4ECE0E1DB76922CCD29955F81879377994C8633A235713432CF3BA5874B
SHA-512:	9A4B68EAB4D265B88642517A205C5E6771900BB6E87978C52F2D1E04DD93CB9295A1BFC9FF9CCAFDBF96420FCFB2D5CE9C4B6FD77D2C35A28144EE5B02E94F60
Malicious:	true
Reputation:	low
Preview:	S.e.t. .W.s.h.S.h.e.l.l. .=. .C.r.e.a.t.e.O.b.j.e.c.t.(.".W.S.c.r.i.p.t...S.h.e.l.l.".)...W.s.h.S.h.e.l.l...R.u.n. .".C.:.\.U.s.e.r.s.\.t.i.n.a.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.c.a.r.r.y.o.v.e.r.\.F.o.n.d.a...e.x.e.".,. .1...S.e.t. .W.s.h.S.h.e.l.l. .=. .N.o.t.h.i.n.g...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.947478937509466
TrID:	Win32 Executable (generic) a (10002005/4) 99.39% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	xrAlbTvRsz.exe
File size:	706'560 bytes
MD5:	7e1b9f1a6d93097b8ff8df4ba628e068
SHA1:	f4ee0de57246077d83749f384faa04c9e4a5ef67
SHA256:	e9d14aa62f8d624d28cffd309e71d96bee4588b461e05b043394073002e25831
SHA512:	f0dc3b422fb144d1d5c6dada3f55c7d90562e79cd9834b0e2fe8afeb3d104cea77f7639da4514e223a0952c04f89ee368f2c170d38a231ac5c23a1b8bfa9eac8
SSDEEP:	12288:CquErHF6xC9D6DmR1J98w4oknqOOCyQf31sgvqOkDzYVh32PT2V/Our4FHF:Hrl6kD68JmlotQfxqORVp2a9M
TLSH:	8FE422455AC5D863C2686775C4BB5CE48A747872CE9D7A6DC724E40FFC3130BB88AB09
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x52ea10
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x676129BA [Tue Dec 17 07:35:22 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	fc6683d30d9f25244a50fd5357825e79

Entrypoint Preview

Instruction
pushad
mov esi, 004D9000h
lea edi, dword ptr [esi-000D8000h]
push edi
jmp 00007FF1FCF1E07Dh
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007FF1FCF1E079h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007FF1FCF1E05Fh
mov eax, 00000001h
add ebx, ebx
jne 00007FF1FCF1E079h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007FF1FCF1E07Dh
jne 00007FF1FCF1E09Ah
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007FF1FCF1E091h
dec eax
add ebx, ebx
jne 00007FF1FCF1E079h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
jmp 00007FF1FCF1E046h
add ebx, ebx
jne 00007FF1FCF1E079h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jmp 00007FF1FCF1E0C4h
xor ecx, ecx
sub eax, 03h
jc 00007FF1FCF1E083h
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007FF1FCF1E0E7h
sar eax, 1
mov ebp, eax
jmp 00007FF1FCF1E07Dh
add ebx, ebx
jne 00007FF1FCF1E079h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007FF1FCF1E03Eh
inc ecx
add ebx, ebx
jne 00007FF1FCF1E079h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007FF1FCF1E030h
add ebx, ebx
jne 00007FF1FCF1E079h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007FF1FCF1E061h
jne 00007FF1FCF1E07Bh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007FF1FCF1E056h
add ecx, 02h
cmp ebp, FFFFFB00h
adc ecx, 02h
lea edx, dword ptr [edi+ebp]
cmp ebp, FFFFFFFCh
jbe 00007FF1FCF1E080h
mov al, byte ptr [edx]

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x185098	0x424	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x12f000	0x56098	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1854bc	0xc	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x12ebf4	0x48	UPX1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0xd8000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0xd9000	0x56000	0x55e00	95a8f35eed432d72fa9a750a60f79ae1	False	0.9871241584788938	data	7.935204803651979	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x12f000	0x57000	0x56600	c1ebcd3b200416d4c8a88a8acd369d52	False	0.9406430897250362	data	7.923421900038615	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x12f5ac	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0x12f6d8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0x12f804	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0x12f930	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	Great Britain	0.3333333333333333
RT_ICON	0x12fc1c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	Great Britain	0.5
RT_ICON	0x12fd48	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	Great Britain	0.2835820895522388
RT_ICON	0x130bf4	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	Great Britain	0.37906137184115524
RT_ICON	0x1314a0	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	Great Britain	0.23699421965317918
RT_ICON	0x131a0c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	Great Britain	0.13858921161825727
RT_ICON	0x133fb8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	Great Britain	0.25070356472795496
RT_ICON	0x135064	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	Great Britain	0.3173758865248227
RT_MENU	0xcd4a0	0x50	empty	English	Great Britain	0
RT_STRING	0xcd4f0	0x594	empty	English	Great Britain	0
RT_STRING	0xcda84	0x68a	empty	English	Great Britain	0
RT_STRING	0xce110	0x490	empty	English	Great Britain	0
RT_STRING	0xce5a0	0x5fc	empty	English	Great Britain	0
RT_STRING	0xceb9c	0x65c	empty	English	Great Britain	0
RT_STRING	0xcf1f8	0x466	empty	English	Great Britain	0
RT_STRING	0xcf660	0x158	empty	English	Great Britain	0
RT_RCDATA	0x1354d0	0x4f62d	data			1.000325988344379
RT_GROUP_ICON	0x184b04	0x76	data	English	Great Britain	0.6610169491525424
RT_GROUP_ICON	0x184b80	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x184b98	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x184bb0	0x14	data	English	Great Britain	1.25
RT_VERSION	0x184bc8	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x184ca8	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
ADVAPI32.dll	GetAce
COMCTL32.dll	ImageList_Remove
COMDLG32.dll	GetOpenFileNameW
GDI32.dll	LineTo
IPHLPAPI.DLL	IcmpSendEcho
MPR.dll	WNetUseConnectionW
ole32.dll	CoGetObject
OLEAUT32.dll	VariantInit
PSAPI.DLL	GetProcessMemoryInfo
SHELL32.dll	DragFinish
USER32.dll	GetDC
USERENV.dll	LoadUserProfileW
UxTheme.dll	IsThemeActive
VERSION.dll	VerQueryValueW
WININET.dll	FtpOpenFileW
WINMM.dll	timeGetTime
WSOCK32.dll	connect

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 19:39:23.907387972 CET	1.1.1.1	192.168.2.9	0xcde2	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 19:39:23.907387972 CET	1.1.1.1	192.168.2.9	0xcde2	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false

Target ID:	0
Start time:	13:39:25
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\xrAlbTvRsz.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\xrAlbTvRsz.exe"
Imagebase:	0xc00000
File size:	706'560 bytes
MD5 hash:	7E1B9F1A6D93097B8FF8DF4BA628E068
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	13:39:26
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Local\carryover\Fonda.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\xrAlbTvRsz.exe"
Imagebase:	0x4b0000
File size:	706'560 bytes
MD5 hash:	7E1B9F1A6D93097B8FF8DF4BA628E068
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 66%, ReversingLabs Detection: 67%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	13:39:28
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\xrAlbTvRsz.exe"
Imagebase:	0x5c0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.1718026507.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000003.00000002.1718467858.0000000002F50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	13:39:38
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\WScript.exe" "C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fonda.vbs"
Imagebase:	0x7ff628750000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	13:39:39
Start date:	10/01/2025
Path:	C:\Users\user\AppData\Local\carryover\Fonda.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\carryover\Fonda.exe"
Imagebase:	0x4b0000
File size:	706'560 bytes
MD5 hash:	7E1B9F1A6D93097B8FF8DF4BA628E068
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:39:40
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\carryover\Fonda.exe"
Imagebase:	0x5c0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.1831918660.00000000035A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000006.00000002.1831666506.0000000000400000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	2.9%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	9.5%
Total number of Nodes:	2000
Total number of Limit Nodes:	157

Executed Functions

Function 00C03B3A Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00C03B68
IsDebuggerPresent.KERNEL32 ref: 00C03B7A
GetFullPathNameW.KERNEL32(00007FFF,?,?,00CC52F8,00CC52E0,?,?), ref: 00C03BEB

Part of subcall function 00C07BCC: _memmove.LIBCMT ref: 00C07C06

Part of subcall function 00C1092D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00C03C14,00CC52F8,?,?,?), ref: 00C1096E

SetCurrentDirectoryW.KERNEL32(?), ref: 00C03C6F
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00CB7770,00000010), ref: 00C3D281
SetCurrentDirectoryW.KERNEL32(?,00CC52F8,?,?,?), ref: 00C3D2B9
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00CB4260,00CC52F8,?,?,?), ref: 00C3D33F
ShellExecuteW.SHELL32(00000000,?,?), ref: 00C3D346

Part of subcall function 00C03A46: GetSysColorBrush.USER32(0000000F), ref: 00C03A50
Part of subcall function 00C03A46: LoadCursorW.USER32(00000000,00007F00), ref: 00C03A5F
Part of subcall function 00C03A46: LoadIconW.USER32(00000063), ref: 00C03A76
Part of subcall function 00C03A46: LoadIconW.USER32(000000A4), ref: 00C03A88
Part of subcall function 00C03A46: LoadIconW.USER32(000000A2), ref: 00C03A9A
Part of subcall function 00C03A46: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00C03AC0
Part of subcall function 00C03A46: RegisterClassExW.USER32(?), ref: 00C03B16

Part of subcall function 00C039D5: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00C03A03
Part of subcall function 00C039D5: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00C03A24
Part of subcall function 00C039D5: ShowWindow.USER32(00000000,?,?), ref: 00C03A38
Part of subcall function 00C039D5: ShowWindow.USER32(00000000,?,?), ref: 00C03A41

Part of subcall function 00C0434A: _memset.LIBCMT ref: 00C04370
Part of subcall function 00C0434A: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00C04415

Strings

runas, xrefs: 00C3D33A
This is a third-party compiled AutoIt script., xrefs: 00C3D279

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas
API String ID: 529118366-3287110873
Opcode ID: c96bd93cafe7c1930658682c5a1ab3feb32603631adb64d30eb0bd8bb72802b9
Instruction ID: 13f05c7f15d576e4ff4c2bf786b932219193ff4a002ad0c57f36bacd38bcb71f
Opcode Fuzzy Hash: c96bd93cafe7c1930658682c5a1ab3feb32603631adb64d30eb0bd8bb72802b9
Instruction Fuzzy Hash: 0751FB70E08148AEDF05EBB4DC05FED77B8AF45740F004269F412B21E1CA716B85DB21

Function 00C03633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
timewindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtdllDefWindowProc_W.NTDLL(?,?,?,?), ref: 00C036D2
KillTimer.USER32(?,00000001), ref: 00C036FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00C0371F
RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00C0372A
CreatePopupMenu.USER32 ref: 00C0373E
PostQuitMessage.USER32(00000000), ref: 00C0374D

Strings

TaskbarCreated, xrefs: 00C03725

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Timer$ClipboardCreateFormatKillMenuMessageNtdllPopupPostProc_QuitRegisterWindow
String ID: TaskbarCreated
API String ID: 157504867-2362178303
Opcode ID: b789c9e65d8571ae1f03e7772d750c01756dd3a8ab79f0fc1caf5a1f9e5cb934
Instruction ID: 27a620ef53a994ce1e2a00e892d5e07c36be73962d1e855521530f9a72ed0b6c
Opcode Fuzzy Hash: b789c9e65d8571ae1f03e7772d750c01756dd3a8ab79f0fc1caf5a1f9e5cb934
Instruction Fuzzy Hash: F94145F2210589BBDB249F68ED09F7E379CFB44700F540129F612962E1CA62AF81E765

Function 00C049A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00C049CD

Part of subcall function 00C07BCC: _memmove.LIBCMT ref: 00C07C06

GetCurrentProcess.KERNEL32(?,00C8FAEC,00000000,00000000,?), ref: 00C04A9A
IsWow64Process.KERNEL32(00000000), ref: 00C04AA1
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00C04AE7
FreeLibrary.KERNEL32(00000000), ref: 00C04AF2
GetSystemInfo.KERNEL32(00000000), ref: 00C04B23
GetSystemInfo.KERNEL32(00000000), ref: 00C04B2F

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 612219ca4e2da4bb13129d1f3db3dbff32ba02c42d05eea13b7030e5dab56602
Instruction ID: 347bdbe57dd2e7b679328c68410e838a1b2abdc50f12ced2ff0adaf05da41e36
Opcode Fuzzy Hash: 612219ca4e2da4bb13129d1f3db3dbff32ba02c42d05eea13b7030e5dab56602
Instruction Fuzzy Hash: E291C5719897C0DECB35DB7894501ABBFF5AF2A300F4449ADD1D793A81D220BA08D76E

Function 00C04E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00C04E99
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00C04D8E,?,?,00000000,00000000), ref: 00C04EB0
LoadResource.KERNEL32(?,00000000,?,?,00C04D8E,?,?,00000000,00000000,?,?,?,?,?,?,00C04E2F), ref: 00C3D937
SizeofResource.KERNEL32(?,00000000,?,?,00C04D8E,?,?,00000000,00000000,?,?,?,?,?,?,00C04E2F), ref: 00C3D94C
LockResource.KERNEL32(00C04D8E,?,?,00C04D8E,?,?,00000000,00000000,?,?,?,?,?,?,00C04E2F,00000000), ref: 00C3D95F

Strings

SCRIPT, xrefs: 00C04EA6

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: ac4025338dca9bcb8470d00d1ca4765717fb7b2eca8f9e510fa648742f4ebfee
Instruction ID: 2a64fc9fdd8a7ea8e6c117d253e28bad260095d87be7d6b69933b53ebdf351c2
Opcode Fuzzy Hash: ac4025338dca9bcb8470d00d1ca4765717fb7b2eca8f9e510fa648742f4ebfee
Instruction Fuzzy Hash: 101151B5240700BFD7258B65EC48F67BBB9FBC5711F14416CF515C6190DB61D802C664

Function 00D2EA10 Relevance: 7.7, APIs: 5, Instructions: 206
librarymemoryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(?), ref: 00D2EB4A
GetProcAddress.KERNEL32(?,00D27FF9), ref: 00D2EB68
ExitProcess.KERNEL32(?,00D27FF9), ref: 00D2EB79
VirtualProtect.KERNELBASE(00C00000,00001000,00000004,?,00000000), ref: 00D2EBC7
VirtualProtect.KERNELBASE(00C00000,00001000), ref: 00D2EBDC

Memory Dump Source

Source File: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ProtectVirtual$AddressExitLibraryLoadProcProcess
String ID:
API String ID: 1996367037-0
Opcode ID: ff72cad27ad62969c509bb04028c0df6fb068a07fdfcbdce6c73f950c85d11bc
Instruction ID: 1706b2b7b0ff99af71f89252e94f3b8cb76c6d9a342296b6c24ea65c3fdac22f
Opcode Fuzzy Hash: ff72cad27ad62969c509bb04028c0df6fb068a07fdfcbdce6c73f950c85d11bc
Instruction Fuzzy Hash: 66510672A543724BD7208E7CECC0661B7A4FB6132872C0779D5E6C73C5E7A0580A8771

Function 00C6445A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00C3E398), ref: 00C6446A
FindFirstFileW.KERNELBASE(?,?), ref: 00C6447B
FindClose.KERNEL32(00000000), ref: 00C6448B

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 2874e0777d01ed093652822d8148b69831d1e3385d89cbfc7323699b63cd3f87
Instruction ID: 2f5e25d239aeb7f272455f18f85e87e2f57399b1a1f8fc57904e22e17e90b187
Opcode Fuzzy Hash: 2874e0777d01ed093652822d8148b69831d1e3385d89cbfc7323699b63cd3f87
Instruction Fuzzy Hash: 94E0D8324105006B42246B38EC4E6FD775C9E45335F100719F935C10E0EB7499009699

Function 00C0E6A0 Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00C43E62

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: 61a64b1e9f3daccc682b5877b9448a47644e94b394680249433e0ba5826f7f32
Instruction ID: 9def9b2ccb7f709eb44fdb9169c74b6978b2aeb7db0f7d9f7bbb1c14ef86513f
Opcode Fuzzy Hash: 61a64b1e9f3daccc682b5877b9448a47644e94b394680249433e0ba5826f7f32
Instruction Fuzzy Hash: 4DA2AE74A40215CFCB24CF59C480BAEB7B1FF59314F248969E925AB391D731EE82DB90

Function 00C109D0 Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00C10A5B
timeGetTime.WINMM ref: 00C10D16
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00C10E53
Sleep.KERNEL32(0000000A), ref: 00C10E61
LockWindowUpdate.USER32(00000000,?,?), ref: 00C10EFA
DestroyWindow.USER32 ref: 00C10F06
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00C10F20
Sleep.KERNEL32(0000000A,?,?), ref: 00C44E83
TranslateMessage.USER32(?), ref: 00C45C60
DispatchMessageW.USER32(?), ref: 00C45C6E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00C45C82

Strings

@GUI_CTRLHANDLE, xrefs: 00C44FE4
@GUI_WINHANDLE, xrefs: 00C44F8F
@COM_EVENTOBJ, xrefs: 00C454F0
@TRAY_ID, xrefs: 00C4578F
@GUI_CTRLID, xrefs: 00C44F3A

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4212290369-3242690629
Opcode ID: 869f3dafc0e608210380c9b9d1508de0fdb675369bbf1648df3f1340331bd04a
Instruction ID: 37b17b91e82fcd3f443228028e6e799a337050e74606f18efeab8f1a53940101
Opcode Fuzzy Hash: 869f3dafc0e608210380c9b9d1508de0fdb675369bbf1648df3f1340331bd04a
Instruction Fuzzy Hash: 05B2A370608741DFD724DF24C885BAEB7E4BF85304F24491DF499972A2CBB1E985EB82

Function 00C69155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C68F5F: __time64.LIBCMT ref: 00C68F69

Part of subcall function 00C04EE5: _fseek.LIBCMT ref: 00C04EFD

__wsplitpath.LIBCMT ref: 00C69234

Part of subcall function 00C240FB: __wsplitpath_helper.LIBCMT ref: 00C2413B

_wcscpy.LIBCMT ref: 00C69247
_wcscat.LIBCMT ref: 00C6925A
__wsplitpath.LIBCMT ref: 00C6927F
_wcscat.LIBCMT ref: 00C69295
_wcscat.LIBCMT ref: 00C692A8

Part of subcall function 00C68FA5: _memmove.LIBCMT ref: 00C68FDE
Part of subcall function 00C68FA5: _memmove.LIBCMT ref: 00C68FED

_wcscmp.LIBCMT ref: 00C691EF

Part of subcall function 00C69734: _wcscmp.LIBCMT ref: 00C69824
Part of subcall function 00C69734: _wcscmp.LIBCMT ref: 00C69837

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00C69452
_wcsncpy.LIBCMT ref: 00C694C5
DeleteFileW.KERNEL32(?,?), ref: 00C694FB
CopyFileW.KERNELBASE(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00C69511
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00C69522
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00C69534

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 001df17aa115fe1bd04976ccb74254ef17c9dea5d1e91e286010bd74855c0941
Instruction ID: 3cfc44c456f6ad3a7cb346c756eff00fe0e7649cc07e892703c5163a7f22a37a
Opcode Fuzzy Hash: 001df17aa115fe1bd04976ccb74254ef17c9dea5d1e91e286010bd74855c0941
Instruction Fuzzy Hash: 8CC139B1D00229ABDF25DFA5CC81ADEB7BCEF45310F0040AAF609E6151EB309A85DF65

Function 00C0708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C04706: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,00CC52F8,?,00C037AE,?), ref: 00C04724

Part of subcall function 00C2050B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00C07165), ref: 00C2052D

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 00C071A8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 00C3E8C8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 00C3E909
RegCloseKey.ADVAPI32(?), ref: 00C3E947
_wcscat.LIBCMT ref: 00C3E9A0

Strings

Include, xrefs: 00C3E8BF, 00C3E900
\Include\, xrefs: 00C07165
\, xrefs: 00C3E9C3
Software\AutoIt v3\AutoIt, xrefs: 00C0719E

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 552ff9ed4a964b1c45e22b43977cf00904c3455e11e75d41e30ca0d374aa845d
Instruction ID: a2740bc7a1383b175a842ae0bc3ced6386277da28c857c25ed54177a5ca8f669
Opcode Fuzzy Hash: 552ff9ed4a964b1c45e22b43977cf00904c3455e11e75d41e30ca0d374aa845d
Instruction Fuzzy Hash: DF716C71508311AEC704EF69E981FAFBBE8FF84350F40052EF445872A1EB71A949DB52

Function 00C03A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00C03A50
LoadCursorW.USER32(00000000,00007F00), ref: 00C03A5F
LoadIconW.USER32(00000063), ref: 00C03A76
LoadIconW.USER32(000000A4), ref: 00C03A88
LoadIconW.USER32(000000A2), ref: 00C03A9A
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00C03AC0
RegisterClassExW.USER32(?), ref: 00C03B16

Part of subcall function 00C03041: GetSysColorBrush.USER32(0000000F), ref: 00C03074
Part of subcall function 00C03041: RegisterClassExW.USER32(00000030), ref: 00C0309E
Part of subcall function 00C03041: RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00C030AF
Part of subcall function 00C03041: LoadIconW.USER32(000000A9), ref: 00C030F2

Strings

AutoIt v3, xrefs: 00C03B05
0, xrefs: 00C03AF4
#, xrefs: 00C03AFB

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Load$Icon$Register$BrushClassColor$ClipboardCursorFormatImage
String ID: #$0$AutoIt v3
API String ID: 2880975755-4155596026
Opcode ID: 6ef1dbd76ed86c3f32e83c44bb39472a419eb993cd2f788675d9daedd08d0f3f
Instruction ID: 05e1983f5e77bbdd55c3145431c6f7cb2a2c450dfb7b65ed4737159664d5ac9a
Opcode Fuzzy Hash: 6ef1dbd76ed86c3f32e83c44bb39472a419eb993cd2f788675d9daedd08d0f3f
Instruction Fuzzy Hash: 902106B1D00708AFEB10DFA4EC49F9D7BF4EB08715F10012AE504AA2A1D7B56A90DF94

Function 00C03766 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

/AutoIt3ExecuteLine, xrefs: 00C038A7
/AutoIt3OutputDebug, xrefs: 00C03892
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 00C037AE
CMDLINERAW, xrefs: 00C037FB
CMDLINE, xrefs: 00C03822
/ErrorStdOut, xrefs: 00C0387D
/AutoIt3ExecuteScript, xrefs: 00C038BC

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW
API String ID: 1825951767-3513169116
Opcode ID: 65360ddb0fadde34070398340107d0f306c8736b0727c59f453f8f0e5738f32d
Instruction ID: c86b3014d0fbec0ccb0132c6e5a4adc7ea34b199b0fb7220c7f88235a284d948
Opcode Fuzzy Hash: 65360ddb0fadde34070398340107d0f306c8736b0727c59f453f8f0e5738f32d
Instruction Fuzzy Hash: B3A13BB291026D9ACF05EBA4DC91EEEB7B8FF14310F44052AF416A71D1EF746A09DB60

Function 00C03025 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 67
registrywindowclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00C03074
RegisterClassExW.USER32(00000030), ref: 00C0309E
RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00C030AF
LoadIconW.USER32(000000A9), ref: 00C030F2

Strings

+, xrefs: 00C0305D
0, xrefs: 00C03056
AutoIt v3 GUI, xrefs: 00C03090
TaskbarCreated, xrefs: 00C030A4

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Register$BrushClassClipboardColorFormatIconLoad
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 975902462-1005189915
Opcode ID: 624df892c733336f4b1425966a66ccb3039578f5aa8becf88186135a3781cb33
Instruction ID: d3b12fd07584f12f36ae73de6b9518a83b4c5885749a6ba021f3605a573174c2
Opcode Fuzzy Hash: 624df892c733336f4b1425966a66ccb3039578f5aa8becf88186135a3781cb33
Instruction Fuzzy Hash: F93104B1841309AFEB409FA4E888BCDBBF4FB09324F10412EE580E62A0D7B55582CF95

Function 00C03041 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 54
registrywindowclipboardCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00C03074
RegisterClassExW.USER32(00000030), ref: 00C0309E
RegisterClipboardFormatW.USER32(TaskbarCreated), ref: 00C030AF
LoadIconW.USER32(000000A9), ref: 00C030F2

Strings

+, xrefs: 00C0305D
0, xrefs: 00C03056
AutoIt v3 GUI, xrefs: 00C03090
TaskbarCreated, xrefs: 00C030A4

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Register$BrushClassClipboardColorFormatIconLoad
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 975902462-1005189915
Opcode ID: fe53685160425dd66102b71ebc6995bdb394308f898f2ed93d9c315945fa2016
Instruction ID: 15c16544e606832ddd4a3ad68e147a7ea5df5d943e956422086bf5fddb5e92f6
Opcode Fuzzy Hash: fe53685160425dd66102b71ebc6995bdb394308f898f2ed93d9c315945fa2016
Instruction Fuzzy Hash: 0921D3B1D51218AFEB00DFA4EC89BDDBBF4FB08714F10412AF911A62A0DBB15585CF99

Function 00BD0920 Relevance: 10.7, APIs: 7, Instructions: 151
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00BD0965

Memory Dump Source

Source File: 00000000.00000002.1369484406.0000000000BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_xrAlbTvRsz.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: eb584f4a57c68eb24893e8662cdde2a6850f072ba7aa360e4ef334368506de38
Instruction ID: 1a564c45eeb6ca28238e8cbb88ca50cba5e63d69d8ad123197833b32924f2df8
Opcode Fuzzy Hash: eb584f4a57c68eb24893e8662cdde2a6850f072ba7aa360e4ef334368506de38
Instruction Fuzzy Hash: 6B510D75A50209FBEF20DFA4CC59FDEB7B8EF48700F108555F609EA280EA749A44DB60

Function 00C039D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00C03A03
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00C03A24
ShowWindow.USER32(00000000,?,?), ref: 00C03A38
ShowWindow.USER32(00000000,?,?), ref: 00C03A41

Strings

AutoIt v3, xrefs: 00C039FB, 00C03A00, 00C03A01
edit, xrefs: 00C03A1E

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 8dff46dad3f2edb304115c7f91b37aa40660c2707468aa25d701b85b65bc45e4
Instruction ID: d4b45138fd26d8bdd38382316b98062c792898f2bf1c40af982d96920caa3843
Opcode Fuzzy Hash: 8dff46dad3f2edb304115c7f91b37aa40660c2707468aa25d701b85b65bc45e4
Instruction Fuzzy Hash: B0F03A745002907EEB305723EC48F6F3EBDD7C6F50B01002EF900A2170C6712882DAB4

Function 00C0407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00C3D3D7

Part of subcall function 00C07BCC: _memmove.LIBCMT ref: 00C07C06

_memset.LIBCMT ref: 00C040FC
_wcscpy.LIBCMT ref: 00C04150
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00C04160

Strings

Line: , xrefs: 00C3D400

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: de19fa911082c708401949b404f6e58b03c00b597f86c2552764faad037bce69
Instruction ID: 265607014ada13831774800bb9654336a93204d343768db0206e375fe332444d
Opcode Fuzzy Hash: de19fa911082c708401949b404f6e58b03c00b597f86c2552764faad037bce69
Instruction Fuzzy Hash: E231B3B1408705AFD725EB60EC46FDF77E8AF44304F10461EF685920E1DB70A689DB96

Function 00C0686A Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00C04DDD: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00CC52F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00C04E0F

_free.LIBCMT ref: 00C3E263
_free.LIBCMT ref: 00C3E2AA

Part of subcall function 00C06A8C: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00C06BAD

Strings

Bad directive syntax error, xrefs: 00C3E292
>>>AUTOIT SCRIPT<<<, xrefs: 00C3E039

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: 8f6fe2ab2acfc0fa60d281224e967d81dedeaaaa3c22534db795c11e7298f93c
Instruction ID: 12acbac19e49efa24ad06f3c9d0c71bb67da97b7bc3b77cb0475af3828d9eda7
Opcode Fuzzy Hash: 8f6fe2ab2acfc0fa60d281224e967d81dedeaaaa3c22534db795c11e7298f93c
Instruction Fuzzy Hash: A7916E71910219AFCF18EFA4CC919EEB7B8FF04314F10452AF815AB2E1DB71AA55DB50

Function 00BD23B0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 156fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD22A0: Sleep.KERNELBASE(000001F4), ref: 00BD22B1

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00BD24E6

Strings

O1PYANJYGMOQ9ZQ5I9AJFOA7F7FR, xrefs: 00BD2566, 00BD2569

Memory Dump Source

Source File: 00000000.00000002.1369484406.0000000000BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_xrAlbTvRsz.jbxd

Similarity

API ID: CreateFileSleep
String ID: O1PYANJYGMOQ9ZQ5I9AJFOA7F7FR
API String ID: 2694422964-3275857406
Opcode ID: 2a8d6e1bd483b6478267d09629ffaf920dc95928740e0729eed16dc228696d6d
Instruction ID: 042a5057fe44d35cc5d4d9d189bd648268e68fffd3eb2db3178f2caf97659de4
Opcode Fuzzy Hash: 2a8d6e1bd483b6478267d09629ffaf920dc95928740e0729eed16dc228696d6d
Instruction Fuzzy Hash: E2618370D04288EAEF11DBF4D854BEEBBB5AF25304F0441D9E6487B2C1D6B90B45CBA6

Function 00C035B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00C035A1,SwapMouseButtons,00000004,?), ref: 00C035D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,00C035A1,SwapMouseButtons,00000004,?,?,?,?,00C02754), ref: 00C035F5
RegCloseKey.KERNELBASE(00000000,?,?,00C035A1,SwapMouseButtons,00000004,?,?,?,?,00C02754), ref: 00C03617

Strings

Control Panel\Mouse, xrefs: 00C035D2

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 7317863b5259114fe2e2d795f87acca2b537ae9113d24de7d569650bf70bedfc
Instruction ID: fc4272d7a44159f3fe8771cbdb4af1ff9c96a29236e0da82a298b63e2cb949f4
Opcode Fuzzy Hash: 7317863b5259114fe2e2d795f87acca2b537ae9113d24de7d569650bf70bedfc
Instruction Fuzzy Hash: AF113371610648BEDB208F65D880AEEBBBCEF04740F108469B905D7250E6729F41EBA8

Function 00C6955B Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00C04EE5: _fseek.LIBCMT ref: 00C04EFD

Part of subcall function 00C69734: _wcscmp.LIBCMT ref: 00C69824
Part of subcall function 00C69734: _wcscmp.LIBCMT ref: 00C69837

_free.LIBCMT ref: 00C696A2
_free.LIBCMT ref: 00C696A9
_free.LIBCMT ref: 00C69714

Part of subcall function 00C22D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00C29A24), ref: 00C22D69
Part of subcall function 00C22D55: GetLastError.KERNEL32(00000000,?,00C29A24), ref: 00C22D7B

_free.LIBCMT ref: 00C6971C

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 83a1bf45cb5b46f0fbbb2b282febcfcf75e63ad05b5baa694a85d9b23f0f737c
Instruction ID: 43e8cbdb7b55e25e3a24e82c867da83673ebe983841b93c3faba12057dc79b6d
Opcode Fuzzy Hash: 83a1bf45cb5b46f0fbbb2b282febcfcf75e63ad05b5baa694a85d9b23f0f737c
Instruction Fuzzy Hash: B8516FB1D04219AFDF249FA4DC81A9EBBB9EF48300F10459EF209A3281DB715A90DF59

Function 00C2470A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C247A0
__flush.LIBCMT ref: 00C247C0
__write.LIBCMT ref: 00C247F3
__flsbuf.LIBCMT ref: 00C24821

Part of subcall function 00C28B28: __getptd_noexit.LIBCMT ref: 00C28B28

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction ID: 30cf96b548e6791076af48d6720de26c9475bcdeaea3c3a3d9d230e78207da82
Opcode Fuzzy Hash: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction Fuzzy Hash: 9F41A475A007659BDB1CCF69E8809AA7BA6AF45764B24813DE835C7E80DB70DE81CB40

Function 00C07285 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C3EA39
7722D0D0.COMDLG32(?), ref: 00C3EA83

Part of subcall function 00C04750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00C04743,?,?,00C037AE,?), ref: 00C04770

Part of subcall function 00C20791: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00C207B0

Strings

X, xrefs: 00C3EA51

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: NamePath$7722FullLong_memset
String ID: X
API String ID: 1752364830-3081909835
Opcode ID: 5725c7296378e7c30f21e5bb7cbab83acfe9b1fbbd32fd92a02f4748cc9742aa
Instruction ID: bf38a78d3297977bff321c67d9a0305f8c26c81de86f82bea46ba43945853062
Opcode Fuzzy Hash: 5725c7296378e7c30f21e5bb7cbab83acfe9b1fbbd32fd92a02f4748cc9742aa
Instruction Fuzzy Hash: DD21C371A10258ABCF05DF94D845BEE7BFCAF48714F00401AE408A7281DBB45989DFA1

Function 00C20DB6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00C2571C: __FF_MSGBANNER.LIBCMT ref: 00C25733
Part of subcall function 00C2571C: __NMSG_WRITE.LIBCMT ref: 00C2573A
Part of subcall function 00C2571C: RtlAllocateHeap.NTDLL(00F20000,00000000,00000001), ref: 00C2575F

std::exception::exception.LIBCMT ref: 00C20DEC
__CxxThrowException@8.LIBCMT ref: 00C20E01

Part of subcall function 00C2859B: RaiseException.KERNEL32(?,?,00000000,00CB9E78,?,00000001,?,?,?,00C20E06,00000000,00CB9E78,00C09E8C,00000001), ref: 00C285F0

Strings

bad allocation, xrefs: 00C20DE1

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID: bad allocation
API String ID: 3902256705-2104205924
Opcode ID: 093bd4caf1a95857afc8b14fd7f025480b74de8dbbc75eb4e3cf51b512861d2d
Instruction ID: 8a6185c7bc9875860a70a0ff983fbad43ff43061cfc6a9cff496c94349e61b37
Opcode Fuzzy Hash: 093bd4caf1a95857afc8b14fd7f025480b74de8dbbc75eb4e3cf51b512861d2d
Instruction Fuzzy Hash: F2F0A47650233976DF10FAA8FC159DFB7AC9F01311F204426F95496992DF709B84E2D1

Function 00BD1000 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 00BD1045
ExitProcess.KERNEL32(00000000), ref: 00BD1064

Strings

D, xrefs: 00BD1011

Memory Dump Source

Source File: 00000000.00000002.1369484406.0000000000BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_xrAlbTvRsz.jbxd

Similarity

API ID: Process$CreateExit
String ID: D
API String ID: 126409537-2746444292
Opcode ID: 03e416529f94357cb7ee45147abf4bf6199a2e9bce9b56f1b6d0fc2bb1e3bcca
Instruction ID: 4759b745f8459dfa9340a9b2c57c46e004c1480f3c3591cb11cde294951bc776
Opcode Fuzzy Hash: 03e416529f94357cb7ee45147abf4bf6199a2e9bce9b56f1b6d0fc2bb1e3bcca
Instruction Fuzzy Hash: C8F0EC7154024CABDB60EFE4CC49FEEB7BCBF14705F108549FB0A9A180EA7896488B61

Function 00C698E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00C698F8
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 00C6990F

Strings

aut, xrefs: 00C69909

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: afa2eb29edf75f47a7a437493aed6eae0847061956912eaea7bbcf48a5192e03
Instruction ID: 2550ef8b81461c75c7364af67c57857fc9183143dd819203d9579586b432830d
Opcode Fuzzy Hash: afa2eb29edf75f47a7a437493aed6eae0847061956912eaea7bbcf48a5192e03
Instruction Fuzzy Hash: 43D05E7954030DABDB509BA0DC0EFDA773CE714700F0002B1BA94D10A1EAB195998B95

Function 00C7CADD Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d286ea09ff83b2ae53eef936de98428fe686c83c6d6478b6d00c598374585d9a
Instruction ID: 8fe43e654e26c7b81f6d109c33b377626da057547b14131e967dce774e180d9c
Opcode Fuzzy Hash: d286ea09ff83b2ae53eef936de98428fe686c83c6d6478b6d00c598374585d9a
Instruction Fuzzy Hash: 4EF12A716083019FCB14DF29C484A6ABBE5FF88314F54892EF8A99B391D731E945CF82

Function 00C0F76F Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 00C20162: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00C20193
Part of subcall function 00C20162: MapVirtualKeyW.USER32(00000010,00000000), ref: 00C2019B
Part of subcall function 00C20162: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00C201A6
Part of subcall function 00C20162: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00C201B1
Part of subcall function 00C20162: MapVirtualKeyW.USER32(00000011,00000000), ref: 00C201B9
Part of subcall function 00C20162: MapVirtualKeyW.USER32(00000012,00000000), ref: 00C201C1

Part of subcall function 00C160F9: RegisterClipboardFormatW.USER32(WM_GETCONTROLNAME), ref: 00C16154

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00C0F9CD
OleInitialize.OLE32(00000000), ref: 00C0FA4A
CloseHandle.KERNEL32(00000000), ref: 00C445C8

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Virtual$Handle$ClipboardCloseFormatInitializeRegister
String ID:
API String ID: 3094916012-0
Opcode ID: 3146c24c57997132b66267f2f73641638b53b1c2f006eb29cc3d013d49bb0b17
Instruction ID: 1e1fbb22344d0ba7e839aab8796b6a9eb0049bcf2f45a42b68eae97dab0e42b3
Opcode Fuzzy Hash: 3146c24c57997132b66267f2f73641638b53b1c2f006eb29cc3d013d49bb0b17
Instruction Fuzzy Hash: CB81ACB0915A80CFC788DF29E845F1D7BE5EBA8306794822EE419CB2B1EB7064C5DF14

Function 00C0434A Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C04370
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00C04415
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00C04432

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 14d9e96e6f816374bfbc581767991ef80f0ff88f8b41af5b39b3b7395b83c410
Instruction ID: 7031caf101f77ba55a356bbab68732c8bced6512e7242adab624558e93afad91
Opcode Fuzzy Hash: 14d9e96e6f816374bfbc581767991ef80f0ff88f8b41af5b39b3b7395b83c410
Instruction Fuzzy Hash: 563173B15047119FD725DF64D884B9BBBF8FB58309F00092EF69AC2291D771BA84CB52

Function 00C2571C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00C25733

Part of subcall function 00C2A16B: __NMSG_WRITE.LIBCMT ref: 00C2A192
Part of subcall function 00C2A16B: __NMSG_WRITE.LIBCMT ref: 00C2A19C

__NMSG_WRITE.LIBCMT ref: 00C2573A

Part of subcall function 00C2A1C8: GetModuleFileNameW.KERNEL32(00000000,00CC33BA,00000104,00000000,00000001,00000000), ref: 00C2A25A
Part of subcall function 00C2A1C8: ___crtMessageBoxW.LIBCMT ref: 00C2A308

Part of subcall function 00C2309F: ___crtCorExitProcess.LIBCMT ref: 00C230A5
Part of subcall function 00C2309F: ExitProcess.KERNEL32 ref: 00C230AE

Part of subcall function 00C28B28: __getptd_noexit.LIBCMT ref: 00C28B28

RtlAllocateHeap.NTDLL(00F20000,00000000,00000001), ref: 00C2575F

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: a924ee3cefb34e05a01f679890def93da170cc9b790954e806e61dc7f698d19b
Instruction ID: 4f753e1eb822fb53d5136101cc85fb67c8f848279c71ee8ab212a6d193f9b725
Opcode Fuzzy Hash: a924ee3cefb34e05a01f679890def93da170cc9b790954e806e61dc7f698d19b
Instruction Fuzzy Hash: 97012875290B71DBDA106735FC42B2F73488F42F61F100429F415DB9D1DE748E016761

Function 00C698A2 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,00C69548,?,?,?,?,?,00000004), ref: 00C698BB
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,00C69548,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 00C698D1
CloseHandle.KERNEL32(00000000,?,00C69548,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00C698D8

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 21575ec053f26cd3de7b983b3fb0cc8c36779bcfaed72a9058b0f0368c5dd359
Instruction ID: 16e48860432be8b467a126b7f39bfb1ff4ececaecfb2a7a0c3984002d6eba47d
Opcode Fuzzy Hash: 21575ec053f26cd3de7b983b3fb0cc8c36779bcfaed72a9058b0f0368c5dd359
Instruction Fuzzy Hash: EEE08632140214B7EB312B54EC0DFDE7B59EB0A761F104124FB24A90F087B11622979C

Function 00C68D0D Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00C68D1B

Part of subcall function 00C22D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00C29A24), ref: 00C22D69
Part of subcall function 00C22D55: GetLastError.KERNEL32(00000000,?,00C29A24), ref: 00C22D7B

_free.LIBCMT ref: 00C68D2C
_free.LIBCMT ref: 00C68D3E

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
Instruction ID: 9f250a4c5c30968ea0d41ddc098c4a3d25687840d4a30b005d92eb01123d7d3c
Opcode Fuzzy Hash: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
Instruction Fuzzy Hash: AFE0C2B160161253CB30A678B880A8313DC4F4C352B040A0DB51DD7182CE60F842D034

Function 00C0A9C3 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 00C3FC01

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 346d210326a6eb51b08d7494ed0e8bb0fa2946d4777789f75bda1c47a9eea7e3
Instruction ID: a00cd33ef74ce2fd1417ad98b9f8a4f9ff588fbe19cefcd84277e6add7a74bbe
Opcode Fuzzy Hash: 346d210326a6eb51b08d7494ed0e8bb0fa2946d4777789f75bda1c47a9eea7e3
Instruction Fuzzy Hash: 5B223774608301DFDB24DF14C494B6ABBE1BF84304F15896DE99A8B3A2D731ED85DB82

Function 00C04C70 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C04CBA

Strings

EA06, xrefs: 00C3D8CC

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: c09fe78ea09be808a5be71a960b99a9339433c00735626a5fe2ed841ee38821b
Instruction ID: 0037c28f749689e43c454b456b7c6ef93e417ad2ca87bbf51627f7a827ac7a35
Opcode Fuzzy Hash: c09fe78ea09be808a5be71a960b99a9339433c00735626a5fe2ed841ee38821b
Instruction Fuzzy Hash: D7417AF1A043586BDF299B64D8617BF7FA69B55300F284075EF829B2C2D6309E44D3A1

Function 00C047D0 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

74BFC8D0.UXTHEME ref: 00C04834

Part of subcall function 00C2336C: __lock.LIBCMT ref: 00C23372
Part of subcall function 00C2336C: RtlDecodePointer.NTDLL(00000001), ref: 00C2337E
Part of subcall function 00C2336C: RtlEncodePointer.NTDLL(?), ref: 00C23389

Part of subcall function 00C048FD: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00C04915
Part of subcall function 00C048FD: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00C0492A

Part of subcall function 00C03B3A: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00C03B68
Part of subcall function 00C03B3A: IsDebuggerPresent.KERNEL32 ref: 00C03B7A
Part of subcall function 00C03B3A: GetFullPathNameW.KERNEL32(00007FFF,?,?,00CC52F8,00CC52E0,?,?), ref: 00C03BEB
Part of subcall function 00C03B3A: SetCurrentDirectoryW.KERNEL32(?), ref: 00C03C6F

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00C04874

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$DebuggerDecodeEncodeFullNamePathPresent__lock
String ID:
API String ID: 2688871447-0
Opcode ID: a38c90d15a753d164f18d92f4359197d9140fcdf77c5139c57aef91776696685
Instruction ID: 0ca0b1e085d2d1b8be0ea00bff199403ec5527cd27133c01c7822167649f4f4a
Opcode Fuzzy Hash: a38c90d15a753d164f18d92f4359197d9140fcdf77c5139c57aef91776696685
Instruction Fuzzy Hash: 35119DB19083519FC704DF29E805B0EBBE8EF94750F108A1EF440872F1DB709A89CB96

Function 00C253A6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00C28B28: __getptd_noexit.LIBCMT ref: 00C28B28

__lock_file.LIBCMT ref: 00C253EB

Part of subcall function 00C26C11: __lock.LIBCMT ref: 00C26C34

__fclose_nolock.LIBCMT ref: 00C253F6

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 4de4837a59d454991655f82d9caf5d63b95209cf1d4c5aa017e54293e38b9272
Instruction ID: 4b5005f46f4135a31d95b413264bedeeb5ec07582204549ea9d057daebf6c7f5
Opcode Fuzzy Hash: 4de4837a59d454991655f82d9caf5d63b95209cf1d4c5aa017e54293e38b9272
Instruction Fuzzy Hash: 96F0BB35902A249ADB10FF75B8017AF77E06F41374F209148E464AB9D1CFFC49457B51

Function 00C0F290 Relevance: 1.7, APIs: 1, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed9f82cd8d8d29f31848c4fbc3a1490c91c385e07612f0b5357362a4548cd177
Instruction ID: 8f8fee458746ebf7fb18f8892a673e1a8c9e5552fb8d70db48d8ba625fb18572
Opcode Fuzzy Hash: ed9f82cd8d8d29f31848c4fbc3a1490c91c385e07612f0b5357362a4548cd177
Instruction Fuzzy Hash: A361AB7060020A9FCB24DF60C881BAAB7F9FF44314F24847DE916976A2D775EE82CB50

Function 00BD1070 Relevance: 1.7, APIs: 1, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 00BD08E0: GetFileAttributesW.KERNELBASE(?), ref: 00BD08EB

CreateDirectoryW.KERNELBASE(?,00000000), ref: 00BD11A8

Memory Dump Source

Source File: 00000000.00000002.1369484406.0000000000BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_xrAlbTvRsz.jbxd

Similarity

API ID: AttributesCreateDirectoryFile
String ID:
API String ID: 3401506121-0
Opcode ID: 3b4e1959b51b624e0a1b8bf506899e58299ead79115091291d51c8623ca67f07
Instruction ID: 6e9ec09a26685da61d24af42704c466d317b84c38bb199b24ede67637cc211a7
Opcode Fuzzy Hash: 3b4e1959b51b624e0a1b8bf506899e58299ead79115091291d51c8623ca67f07
Instruction Fuzzy Hash: C7517731A1020997DF14EFB4C955BEFB379EF58300F0085A9A609E7280FB799B45CBA5

Function 00C3FCAC Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00C3FCB7

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 113fcba4fe2c1006ac3b0216cc919efb2618c41a363705354b5c5383456967f0
Instruction ID: 1990291ea8d25e3b5fabbe9217d8941a496f9a08de412bf328caa916b941a457
Opcode Fuzzy Hash: 113fcba4fe2c1006ac3b0216cc919efb2618c41a363705354b5c5383456967f0
Instruction Fuzzy Hash: AF4107745083519FDB14DF14C448B1ABBE0BF45318F1988ACE8998B7A2C732ED45CF52

Function 00C0C5A7 Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 00C0C5DD

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: _wcscmp
String ID:
API String ID: 856254489-0
Opcode ID: 817a88a999cd02ffeb4cf277db649657c43f0fd31697221c1a0e19c36d3a9d30
Instruction ID: b72c7044998f2438fe343deacd929f6dc8310b90451751db2e853c85baff4972
Opcode Fuzzy Hash: 817a88a999cd02ffeb4cf277db649657c43f0fd31697221c1a0e19c36d3a9d30
Instruction Fuzzy Hash: 2B1190319041189BCF14EBA5DC81AEEB778FF55760F054226FD61A71D0DA31AE05EB90

Function 00C04DDD Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C04BB5: FreeLibrary.KERNEL32(00000000,?), ref: 00C04BEF

Part of subcall function 00C2525B: __wfsopen.LIBCMT ref: 00C25266

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,00CC52F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00C04E0F

Part of subcall function 00C04B6A: FreeLibrary.KERNEL32(00000000), ref: 00C04BA4

Part of subcall function 00C04C70: _memmove.LIBCMT ref: 00C04CBA

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: 48b87919e5072b809b50573897f35432eedca439ce41812a23c25be7cabb5fa4
Instruction ID: b6f6f3478abc6ee75adeea43f43167fb29a438e9d8b8f10a2d51d6cfe6525ce5
Opcode Fuzzy Hash: 48b87919e5072b809b50573897f35432eedca439ce41812a23c25be7cabb5fa4
Instruction Fuzzy Hash: 9F11A771640205ABCF19BF70D816F6FB7A9AF84710F10842DF652A71C1DA759A01EB91

Function 00C3FD85 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00C3FD91

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: c21f1e275b0448bde899f1872cbd9eb66b3a4eebd2c317db24535368a218875d
Instruction ID: d9d2b9698585856c25575497b6c255e2c65ada07950534f23a250f675c706b60
Opcode Fuzzy Hash: c21f1e275b0448bde899f1872cbd9eb66b3a4eebd2c317db24535368a218875d
Instruction Fuzzy Hash: 1B2164B4908301DFDB14DF24C844B1ABBE0BF88314F15886CF89A977A2C731E849DB92

Function 00C24863 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00C248A6

Part of subcall function 00C28B28: __getptd_noexit.LIBCMT ref: 00C28B28

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: 7b3da71ce0619002326f074b15d0ca0a9091b7e451ce781638602c06a9302e63
Instruction ID: 06a84ccc608707440ed0a523965287b48ff2c59e6c03c9c5da773354ff11fb98
Opcode Fuzzy Hash: 7b3da71ce0619002326f074b15d0ca0a9091b7e451ce781638602c06a9302e63
Instruction Fuzzy Hash: 2DF02231811229EBDF15FFB4AC063EE37A0AF01321F008414F420DAAC1DBB88A50EB51

Function 00C20739 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00C207B0

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: LongNamePath
String ID:
API String ID: 82841172-0
Opcode ID: cc92939d9ad6baa940f55c3f7fc9e7241179a6f2a3c3f83fbfee1b416d759f60
Instruction ID: a55b2b0a5eca5ea3674db5ab270772d1c801663eb9a2ee946b2313c4f73b1e0e
Opcode Fuzzy Hash: cc92939d9ad6baa940f55c3f7fc9e7241179a6f2a3c3f83fbfee1b416d759f60
Instruction Fuzzy Hash: B3F0E2368000389BCB11CB54E841AEAB368FF85770F2401A6FC04D7920EA308E5AC791

Function 00C04E4A Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,00CC52F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00C04E7E

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 6f469abbc60852dc6996b2455b476888c0e2fd8b5ddb4f571fc2304d9ac30bbe
Instruction ID: d9a43e1d6742399c9e121623fd63f4a3a3250fb9fbbc147b0951120ece699769
Opcode Fuzzy Hash: 6f469abbc60852dc6996b2455b476888c0e2fd8b5ddb4f571fc2304d9ac30bbe
Instruction Fuzzy Hash: 5DF039B1501711CFCB389F65E494817FBE5BF143693208A3EE2F682660C732A940DF40

Function 00C20791 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 00C207B0

Part of subcall function 00C07BCC: _memmove.LIBCMT ref: 00C07C06

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: bb962db1f76c4c85b344bf2d4b6240316efb9878be5595b3290092714b168313
Instruction ID: e9ac6792ec0325d033325fdb3abed4fd91e9cb27c431afa77d05c351d71bb245
Opcode Fuzzy Hash: bb962db1f76c4c85b344bf2d4b6240316efb9878be5595b3290092714b168313
Instruction Fuzzy Hash: 7FE0CD369042285BC720D6599C05FEA77DDDFC87A0F0541B5FC0CD7244DD60AC8086D0

Function 00BD08E0 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?), ref: 00BD08EB

Memory Dump Source

Source File: 00000000.00000002.1369484406.0000000000BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_xrAlbTvRsz.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 195c23eedc4a89e51baf60bc3cc3d10d01908f8b29aed20e491e172ce03d4d2a
Instruction ID: ff3658c0078565420c1e1952183e467da2b7e5ddad3fbd73e6c1b2eec949acfd
Opcode Fuzzy Hash: 195c23eedc4a89e51baf60bc3cc3d10d01908f8b29aed20e491e172ce03d4d2a
Instruction Fuzzy Hash: FAE0867152520CDBD710DBBC8C147A9B7E4D704310F1046A6E515C33C1E5358D41A654

Function 00BD08B0 Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?), ref: 00BD08BB

Memory Dump Source

Source File: 00000000.00000002.1369484406.0000000000BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_xrAlbTvRsz.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 63700976fb5b8646ca9f82f7877e0f33cef2a649cb81b4b88ad66ba6039b9afc
Instruction ID: 6181b1a715ab164424f7de719f758037ecfe9a8ab5560bcbdab84ea1bd0fdcfa
Opcode Fuzzy Hash: 63700976fb5b8646ca9f82f7877e0f33cef2a649cb81b4b88ad66ba6039b9afc
Instruction Fuzzy Hash: E0D05E3091620CABCB10DAA49804A9AB3A8DB04320F104795E91593280E6329950A7A4

Function 00C2525B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00C25266

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: a04d1ba9693d203cb7bb6ad8338777d16af340eacbeaf105c69fc0bda244a6a5
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 42B0927644020CBBCE012A82FC02A5A3B199B41764F408020FB0C185A2A673A664AA89

Function 00C20C08 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00C20CB7

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 40be426aa71f4153e06edb39912072d535c9c64ea9bf3413d25c2de7f827458b
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: EC31F7B0A001159FC718DF09E484969FBA6FB49300B3487A6E81ACBB52D731EEC1DBC1

Function 00BD229C Relevance: 1.3, APIs: 1, Instructions: 21sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 00BD22B1

Memory Dump Source

Source File: 00000000.00000002.1369484406.0000000000BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_xrAlbTvRsz.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction ID: 4fd1b8468170b496c3967281d43b257864c704eb240a6d6643bebf2697126f27
Opcode Fuzzy Hash: 647f186050b41918f79179839cbc1a488579cc5f77474145a25b6e124dddc6ea
Instruction Fuzzy Hash: 2BE0BF7494010EEFDB00EFA4D5496DE7BB4EF04311F1005A1FD05D7680DB309E549A72

Function 00BD22A0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 00BD22B1

Memory Dump Source

Source File: 00000000.00000002.1369484406.0000000000BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_xrAlbTvRsz.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: b60e0babcc1cb4ed15db6e4c416fb51c2bc5fc7b231ea9c0f9cac4adf2c07f18
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: 76E0BF7494010E9FDB00EFA4D54969E7BB4EF04301F1001A1FD0192280D63099509A72

Non-executed Functions

Function 00C8CABC Relevance: 70.6, APIs: 37, Strings: 3, Instructions: 632windowkeyboardnativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00C02612: GetWindowLongW.USER32(?,000000EB), ref: 00C02623

NtdllDialogWndProc_W.NTDLL(?,0000004E,?,?,?,?,?,?), ref: 00C8CB37
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00C8CB95
GetWindowLongW.USER32(?,000000F0), ref: 00C8CBD6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00C8CC00
SendMessageW.USER32 ref: 00C8CC29
_wcsncpy.LIBCMT ref: 00C8CC95
GetKeyState.USER32(00000011), ref: 00C8CCB6
GetKeyState.USER32(00000009), ref: 00C8CCC3
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00C8CCD9
GetKeyState.USER32(00000010), ref: 00C8CCE3
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00C8CD0C
SendMessageW.USER32 ref: 00C8CD33
SendMessageW.USER32(?,00001030,?,00C8B348), ref: 00C8CE37
SetCapture.USER32(?), ref: 00C8CE69
ClientToScreen.USER32(?,?), ref: 00C8CECE
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00C8CEF5
ReleaseCapture.USER32 ref: 00C8CF00
GetCursorPos.USER32(?), ref: 00C8CF3A
ScreenToClient.USER32(?,?), ref: 00C8CF47
SendMessageW.USER32(?,00001012,00000000,?), ref: 00C8CFA3
SendMessageW.USER32 ref: 00C8CFD1
SendMessageW.USER32(?,00001111,00000000,?), ref: 00C8D00E
SendMessageW.USER32 ref: 00C8D03D
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00C8D05E
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00C8D06D
GetCursorPos.USER32(?), ref: 00C8D08D
ScreenToClient.USER32(?,?), ref: 00C8D09A
GetParent.USER32(?), ref: 00C8D0BA
SendMessageW.USER32(?,00001012,00000000,?), ref: 00C8D123
SendMessageW.USER32 ref: 00C8D154
ClientToScreen.USER32(?,?), ref: 00C8D1B2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00C8D1E2
SendMessageW.USER32(?,00001111,00000000,?), ref: 00C8D20C
SendMessageW.USER32 ref: 00C8D22F
ClientToScreen.USER32(?,?), ref: 00C8D281
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00C8D2B5

Part of subcall function 00C025DB: GetWindowLongW.USER32(?,000000EB), ref: 00C025EC

GetWindowLongW.USER32(?,000000F0), ref: 00C8D351

Strings

@GUI_DRAGID, xrefs: 00C8CE9C
F, xrefs: 00C8D235
@U=u, xrefs: 00C8CB95, 00C8CC00, 00C8CC29, 00C8CCD9, 00C8CD0C, 00C8CD33, 00C8CE37, 00C8CFA3, 00C8CFD1, 00C8D00E, 00C8D03D, 00C8D123, 00C8D154, 00C8D20C, 00C8D22F

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend$ClientScreen$LongWindow$State$CaptureCursorMenuPopupTrack$DialogInvalidateNtdllParentProc_RectRelease_wcsncpy
String ID: @GUI_DRAGID$@U=u$F
API String ID: 302779176-1007936534
Opcode ID: 893bf785454e32f8fe80702490304cd626b4e6b76f296a7317a496b80ff4e088
Instruction ID: 9ff86fe9e045143ba1118b343e2a9143cc39d20c3950d7996eab0255664e4b65
Opcode Fuzzy Hash: 893bf785454e32f8fe80702490304cd626b4e6b76f296a7317a496b80ff4e088
Instruction Fuzzy Hash: F442AE74204640AFDB20EF24C888FAABBE5FF49318F14062DF569872B1C731E941DB69

Function 00C16F9E Relevance: 48.8, APIs: 19, Strings: 6, Instructions: 5018COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C171C3
_memset.LIBCMT ref: 00C17539
_memmove.LIBCMT ref: 00C176AC

Strings

[:>:]], xrefs: 00C17492
\b(?=\w), xrefs: 00C53769
DEFINE, xrefs: 00C52103
\b(?<=\w), xrefs: 00C53773
[:<:]], xrefs: 00C17479
Q\E, xrefs: 00C17FCB

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: _memmove$_memset
String ID: DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-1798697756
Opcode ID: 34deec70bb005ef2ce818e3b484ca8fed8fce22e6557f1c28de9927ea339f41b
Instruction ID: ab7579a34f0e3a63a0002ca4cf0a081b2d6096b8352eff87ba5064917866af88
Opcode Fuzzy Hash: 34deec70bb005ef2ce818e3b484ca8fed8fce22e6557f1c28de9927ea339f41b
Instruction Fuzzy Hash: C493C079A04219DBDB24CF98C881BEDB7B1FF49311F24816AED15AB280E7709EC5DB44

Function 00C048D7 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 00C048DF
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00C3D665
IsIconic.USER32(?), ref: 00C3D66E
ShowWindow.USER32(?,00000009), ref: 00C3D67B
SetForegroundWindow.USER32(?), ref: 00C3D685
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00C3D69B
GetCurrentThreadId.KERNEL32 ref: 00C3D6A2
GetWindowThreadProcessId.USER32(?,00000000), ref: 00C3D6AE
AttachThreadInput.USER32(?,00000000,00000001), ref: 00C3D6BF
AttachThreadInput.USER32(?,00000000,00000001), ref: 00C3D6C7
AttachThreadInput.USER32(00000000,?,00000001), ref: 00C3D6CF
SetForegroundWindow.USER32(?), ref: 00C3D6D2
MapVirtualKeyW.USER32(00000012,00000000), ref: 00C3D6E7
keybd_event.USER32(00000012,00000000), ref: 00C3D6F2
MapVirtualKeyW.USER32(00000012,00000000), ref: 00C3D6FC
keybd_event.USER32(00000012,00000000), ref: 00C3D701
MapVirtualKeyW.USER32(00000012,00000000), ref: 00C3D70A
keybd_event.USER32(00000012,00000000), ref: 00C3D70F
MapVirtualKeyW.USER32(00000012,00000000), ref: 00C3D719
keybd_event.USER32(00000012,00000000), ref: 00C3D71E
SetForegroundWindow.USER32(?), ref: 00C3D721
AttachThreadInput.USER32(?,?,00000000), ref: 00C3D748

Strings

Shell_TrayWnd, xrefs: 00C3D660

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 80ebd872f46805fa5cf82b6ae1cd6fa78b8ee611feeb55a0cd82406d20f1face
Instruction ID: 1c84de8516c2b608f9298edd6bf660a9b39c4fc6071aba0de608aa485352d4d3
Opcode Fuzzy Hash: 80ebd872f46805fa5cf82b6ae1cd6fa78b8ee611feeb55a0cd82406d20f1face
Instruction Fuzzy Hash: EA319471A50318BBEB206F619C4AF7F7F6CEB44B50F104039FA05EA1D1D6B05D51ABA4

Function 00C58310 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 00C587E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00C5882B
Part of subcall function 00C587E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00C58858
Part of subcall function 00C587E1: GetLastError.KERNEL32 ref: 00C58865

_memset.LIBCMT ref: 00C58353
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00C583A5
CloseHandle.KERNEL32(?), ref: 00C583B6
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00C583CD
GetProcessWindowStation.USER32 ref: 00C583E6
SetProcessWindowStation.USER32(00000000), ref: 00C583F0
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00C5840A

Part of subcall function 00C581CB: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00C58309), ref: 00C581E0
Part of subcall function 00C581CB: CloseHandle.KERNEL32(?,?,00C58309), ref: 00C581F2

Strings

winsta0, xrefs: 00C583C8
default, xrefs: 00C58405
, xrefs: 00C58362

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 705f01e9477372e0ccbffa38ff3671a929cbd52b51d368f6862a3a43c7d60ea8
Instruction ID: 8fa318a74e0d3f35291590d4f4bafdbfd3df2f71fbbaae28a7c0ba7f972f9e38
Opcode Fuzzy Hash: 705f01e9477372e0ccbffa38ff3671a929cbd52b51d368f6862a3a43c7d60ea8
Instruction Fuzzy Hash: B4815B75900209AFEF119FA4DC45AEE7B78EF08305F144169FD24B6161EB318E9DEB28

Function 00C6C75C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00C6C78D
FindClose.KERNEL32(00000000), ref: 00C6C7E1
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00C6C806
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00C6C81D
FileTimeToSystemTime.KERNEL32(?,?), ref: 00C6C844
__swprintf.LIBCMT ref: 00C6C890
__swprintf.LIBCMT ref: 00C6C8D3

Part of subcall function 00C07DE1: _memmove.LIBCMT ref: 00C07E22

__swprintf.LIBCMT ref: 00C6C927

Part of subcall function 00C23698: __woutput_l.LIBCMT ref: 00C236F1

__swprintf.LIBCMT ref: 00C6C975

Part of subcall function 00C23698: __flsbuf.LIBCMT ref: 00C23713
Part of subcall function 00C23698: __flsbuf.LIBCMT ref: 00C2372B

__swprintf.LIBCMT ref: 00C6C9C4
__swprintf.LIBCMT ref: 00C6CA13
__swprintf.LIBCMT ref: 00C6CA62

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00C6C88A
%02d, xrefs: 00C6C91B, 00C6C925, 00C6C973, 00C6C9C2, 00C6CA11, 00C6CA60
%4d, xrefs: 00C6C8CD

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 9513ce2a9ac2f0248d706eff058602acd9ced54ea736cdb7ec65af1ca52066b3
Instruction ID: 1008654e397af281ceb562dc74572a867e719cead7b80af6d99d802755f37418
Opcode Fuzzy Hash: 9513ce2a9ac2f0248d706eff058602acd9ced54ea736cdb7ec65af1ca52066b3
Instruction Fuzzy Hash: 84A12EB1408344ABC714EFA4C885EAFB7ECFF98704F404929F595C7192EA35DA09DB62

Function 00C6EF95 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76F88FB0,?,00000000), ref: 00C6EFB6
_wcscmp.LIBCMT ref: 00C6EFCB
_wcscmp.LIBCMT ref: 00C6EFE2
GetFileAttributesW.KERNEL32(?), ref: 00C6EFF4
SetFileAttributesW.KERNEL32(?,?), ref: 00C6F00E
FindNextFileW.KERNEL32(00000000,?), ref: 00C6F026
FindClose.KERNEL32(00000000), ref: 00C6F031
FindFirstFileW.KERNEL32(*.*,?), ref: 00C6F04D
_wcscmp.LIBCMT ref: 00C6F074
_wcscmp.LIBCMT ref: 00C6F08B
SetCurrentDirectoryW.KERNEL32(?), ref: 00C6F09D
SetCurrentDirectoryW.KERNEL32(00CB8920), ref: 00C6F0BB
FindNextFileW.KERNEL32(00000000,00000010), ref: 00C6F0C5
FindClose.KERNEL32(00000000), ref: 00C6F0D2
FindClose.KERNEL32(00000000), ref: 00C6F0E4

Strings

*.*, xrefs: 00C6F048

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: cb360a64739eb9f51f9434eb38c5df6300d52f44e971f161f6993b36f788c5f1
Instruction ID: 8e413c5f24fcc3f7d5f0e781e2fd0d98b24a4d9107bcea9388ee352063052f9f
Opcode Fuzzy Hash: cb360a64739eb9f51f9434eb38c5df6300d52f44e971f161f6993b36f788c5f1
Instruction Fuzzy Hash: 2531D5325012196BDF24EFB4EC89BEE77AC9F48360F10017AE914D20A1DB70DB46DB65

Function 00C80857 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C80953
RegCreateKeyExW.ADVAPI32(?,?,00000000,00C8F910,00000000,?,00000000,?,?), ref: 00C809C1
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00C80A09
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00C80A92
RegCloseKey.ADVAPI32(?), ref: 00C80DB2
RegCloseKey.ADVAPI32(00000000), ref: 00C80DBF

Strings

REG_BINARY, xrefs: 00C80D4D
REG_SZ, xrefs: 00C80AD0
REG_DWORD, xrefs: 00C80C83
REG_MULTI_SZ, xrefs: 00C80B7A
REG_QWORD, xrefs: 00C80D00
REG_EXPAND_SZ, xrefs: 00C80A2F

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 99cd58f0640a7569888451bebcc84dd8ddf8b1b956d3b5e9c993cbef45c88f8b
Instruction ID: 11eaacd5664102d3d9c90fb2c93f77262f0eb4cc06ac87a004e4a10923071df8
Opcode Fuzzy Hash: 99cd58f0640a7569888451bebcc84dd8ddf8b1b956d3b5e9c993cbef45c88f8b
Instruction Fuzzy Hash: 42029C756046019FCB54EF24C881E2AB7E4FF89324F14856DF89A9B3A2CB30ED45DB85

Function 00C8C5FE Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 181windowfilenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00C02612: GetWindowLongW.USER32(?,000000EB), ref: 00C02623

DragQueryPoint.SHELL32(?,?), ref: 00C8C627

Part of subcall function 00C8AB37: ClientToScreen.USER32(?,?), ref: 00C8AB60
Part of subcall function 00C8AB37: GetWindowRect.USER32(?,?), ref: 00C8ABD6
Part of subcall function 00C8AB37: PtInRect.USER32(?,?,00C8C014), ref: 00C8ABE6

SendMessageW.USER32(?,000000B0,?,?), ref: 00C8C690
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00C8C69B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00C8C6BE
_wcscat.LIBCMT ref: 00C8C6EE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00C8C705
SendMessageW.USER32(?,000000B0,?,?), ref: 00C8C71E
SendMessageW.USER32(?,000000B1,?,?), ref: 00C8C735
SendMessageW.USER32(?,000000B1,?,?), ref: 00C8C757
DragFinish.SHELL32(?), ref: 00C8C75E
NtdllDialogWndProc_W.NTDLL(?,00000233,?,00000000,?,?,?), ref: 00C8C851

Strings

@GUI_DRAGID, xrefs: 00C8C7C9
@U=u, xrefs: 00C8C690, 00C8C705, 00C8C71E, 00C8C735, 00C8C757
@GUI_DROPID, xrefs: 00C8C77E
@GUI_DRAGFILE, xrefs: 00C8C800

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientDialogFinishLongNtdllPointProc_Screen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$@U=u
API String ID: 2166380349-762882726
Opcode ID: baeb9c6f276bcc7d21930d21907fba6e8025c445137ffc32eb4723bb80d1e47b
Instruction ID: 757e5d49a765ea7ab26accdccff3e9c972e8881bb1a2f070f4bacf5fd0d491a2
Opcode Fuzzy Hash: baeb9c6f276bcc7d21930d21907fba6e8025c445137ffc32eb4723bb80d1e47b
Instruction Fuzzy Hash: 16615C71508304AFC701EF64CC85E9FBBE8EF89714F100A2EF595921A1DB70AA49DB56

Function 00C6F0F2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76F88FB0,?,00000000), ref: 00C6F113
_wcscmp.LIBCMT ref: 00C6F128
_wcscmp.LIBCMT ref: 00C6F13F

Part of subcall function 00C64385: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00C643A0

FindNextFileW.KERNEL32(00000000,?), ref: 00C6F16E
FindClose.KERNEL32(00000000), ref: 00C6F179
FindFirstFileW.KERNEL32(*.*,?), ref: 00C6F195
_wcscmp.LIBCMT ref: 00C6F1BC
_wcscmp.LIBCMT ref: 00C6F1D3
SetCurrentDirectoryW.KERNEL32(?), ref: 00C6F1E5
SetCurrentDirectoryW.KERNEL32(00CB8920), ref: 00C6F203
FindNextFileW.KERNEL32(00000000,00000010), ref: 00C6F20D
FindClose.KERNEL32(00000000), ref: 00C6F21A
FindClose.KERNEL32(00000000), ref: 00C6F22C

Strings

*.*, xrefs: 00C6F190

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 857575287a4324fc41fc7afc5ae058b7f9849ebdf20c75ef41cbc7ffa30fd53f
Instruction ID: 3f008372bea5a91989c9d2fc6fd0f610fed073088f27110579a2a84677b5d7b9
Opcode Fuzzy Hash: 857575287a4324fc41fc7afc5ae058b7f9849ebdf20c75ef41cbc7ffa30fd53f
Instruction Fuzzy Hash: 80319036500219AADF24AFA4FC99BEE77AC9F45360F100179E914E21A0DB70DF46DF68

Function 00C6A1EF Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 00C6A20F
__swprintf.LIBCMT ref: 00C6A231
CreateDirectoryW.KERNEL32(?,00000000), ref: 00C6A26E
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00C6A293
_memset.LIBCMT ref: 00C6A2B2
_wcsncpy.LIBCMT ref: 00C6A2EE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 00C6A323
CloseHandle.KERNEL32(00000000), ref: 00C6A32E
RemoveDirectoryW.KERNEL32(?), ref: 00C6A337
CloseHandle.KERNEL32(00000000), ref: 00C6A341

Strings

\, xrefs: 00C6A247
:, xrefs: 00C6A252
\??\%s, xrefs: 00C6A22B

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: c620cfc39468577dc8f2764319785dbbb53f66b43a6b9aa68cadadb1a35938db
Instruction ID: 856620df4b231c45e620e7606810eda5eab091af015d257156a0f7cbd1c7a9ea
Opcode Fuzzy Hash: c620cfc39468577dc8f2764319785dbbb53f66b43a6b9aa68cadadb1a35938db
Instruction Fuzzy Hash: 9E318F71500119ABDB219FA0DC89FEF77BCEF88741F1041BAF519E2160EA7097458B25

Function 00C8C1AC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windownativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00C02612: GetWindowLongW.USER32(?,000000EB), ref: 00C02623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00C8C1FC
GetFocus.USER32 ref: 00C8C20C
GetDlgCtrlID.USER32(00000000), ref: 00C8C217
_memset.LIBCMT ref: 00C8C342
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00C8C36D
GetMenuItemCount.USER32(?), ref: 00C8C38D
GetMenuItemID.USER32(?,00000000), ref: 00C8C3A0
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00C8C3D4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00C8C41C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00C8C454
NtdllDialogWndProc_W.NTDLL(?,00000111,?,?,?,?,?,?,?), ref: 00C8C489

Strings

0, xrefs: 00C8C33A

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlDialogFocusLongMessageNtdllPostProc_RadioWindow_memset
String ID: 0
API String ID: 3616455698-4108050209
Opcode ID: 9ecfe5e69b03c1f649d031eca39a9348bcc045bbe6d085766bc377dd03a41cc1
Instruction ID: dc78092416c217b2d9e1b635d1503b8c48b2db35e8c69cf34c7df0d2e0e1b30e
Opcode Fuzzy Hash: 9ecfe5e69b03c1f649d031eca39a9348bcc045bbe6d085766bc377dd03a41cc1
Instruction Fuzzy Hash: 68819D70608311AFD710EF14C8D4A7BBBE4FB88718F00492EF9A5972A1D770DA45CB66

Function 00C166E1 Relevance: 18.4, Strings: 14, Instructions: 889COMMON

Download Yara Rule

Strings

BSR_UNICODE), xrefs: 00C51338
ANY), xrefs: 00C512DE
UCP), xrefs: 00C5110D
BSR_ANYCRLF), xrefs: 00C5131E
CR), xrefs: 00C51287
NO_AUTO_POSSESS), xrefs: 00C5112E
NO_START_OPT), xrefs: 00C5114F
UTF16), xrefs: 00C510CF
CRLF), xrefs: 00C512C1
UTF), xrefs: 00C510FA
LIMIT_RECURSION=, xrefs: 00C511FC
ANYCRLF), xrefs: 00C512FB
LF), xrefs: 00C512A4
LIMIT_MATCH=, xrefs: 00C51170

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-4052911093
Opcode ID: 9ae57853421f4b5bbe89effe3c062be6f783fe542def3984ff252a9ac4952e3a
Instruction ID: 576c503ae2e75503a585ae4a1bebc97cc8ff55543acd62e531a0cd956b4aa6c2
Opcode Fuzzy Hash: 9ae57853421f4b5bbe89effe3c062be6f783fe542def3984ff252a9ac4952e3a
Instruction Fuzzy Hash: 6B728EB5E00219DBDB14CF59C8907EEB7B5FF49310F14816AEC19EB290EB309A85DB94

Function 00C6001C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00C60097
SetKeyboardState.USER32(?), ref: 00C60102
GetAsyncKeyState.USER32(000000A0), ref: 00C60122
GetKeyState.USER32(000000A0), ref: 00C60139
GetAsyncKeyState.USER32(000000A1), ref: 00C60168
GetKeyState.USER32(000000A1), ref: 00C60179
GetAsyncKeyState.USER32(00000011), ref: 00C601A5
GetKeyState.USER32(00000011), ref: 00C601B3
GetAsyncKeyState.USER32(00000012), ref: 00C601DC
GetKeyState.USER32(00000012), ref: 00C601EA
GetAsyncKeyState.USER32(0000005B), ref: 00C60213
GetKeyState.USER32(0000005B), ref: 00C60221

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 00fe1018c3a25b4598d35930d9d2139dbf8d87b6daac1f5c2ccaf697f7e75f5b
Instruction ID: ba5e395e09c3e130992ccf9b81880cb9f957a178ed2664d669573cc1996089c6
Opcode Fuzzy Hash: 00fe1018c3a25b4598d35930d9d2139dbf8d87b6daac1f5c2ccaf697f7e75f5b
Instruction Fuzzy Hash: CF51D93090478829FB35DBA088957EFBFB49F12380F18459ED9D2665C3DAA49B8CC761

Function 00C803DA Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C80E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C7FDAD,?,?), ref: 00C80E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C804AC

Part of subcall function 00C09837: __itow.LIBCMT ref: 00C09862
Part of subcall function 00C09837: __swprintf.LIBCMT ref: 00C098AC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00C8054B
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00C805E3
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00C80822
RegCloseKey.ADVAPI32(00000000), ref: 00C8082F

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 30b8709e84a9df203fb7a3576c353597a43e6c545f1147b745676eecd130253e
Instruction ID: 84617fdeee239cf12ee0984dc50b8a6733a5a6e9d45b9b64a5e44ec31b016a4d
Opcode Fuzzy Hash: 30b8709e84a9df203fb7a3576c353597a43e6c545f1147b745676eecd130253e
Instruction Fuzzy Hash: B8E16F71604200AFCB54EF24C891E2ABBE4FF89314F14856DF85ADB2A2DB30ED45DB95

Function 00C8D43E Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 257windownativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00C02612: GetWindowLongW.USER32(?,000000EB), ref: 00C02623

GetSystemMetrics.USER32(0000000F), ref: 00C8D47C
GetSystemMetrics.USER32(0000000F), ref: 00C8D49C
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00C8D6D7
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00C8D6F5
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00C8D716
ShowWindow.USER32(00000003,00000000), ref: 00C8D735
InvalidateRect.USER32(?,00000000,00000001), ref: 00C8D75A
NtdllDialogWndProc_W.NTDLL(?,00000005,?,?), ref: 00C8D77D

Strings

@U=u, xrefs: 00C8D6F5, 00C8D716

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$DialogInvalidateLongMoveNtdllProc_RectShow
String ID: @U=u
API String ID: 830902736-2594219639
Opcode ID: 22ed06d5d8b826e3be7512c9f6a119424fc254393d76f5c314c130bf050ed3a6
Instruction ID: e9de60a007a0e60311b7ec70245161aae14c4a7a680efc4207735e4037446f80
Opcode Fuzzy Hash: 22ed06d5d8b826e3be7512c9f6a119424fc254393d76f5c314c130bf050ed3a6
Instruction Fuzzy Hash: 56B1AC71600229EFDF14DF68C9C5BAD7BB1BF04705F088069FC5A9B299E730AA90CB54

Function 00C74164 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00C7418B
EmptyClipboard.USER32 ref: 00C74191
GlobalAlloc.KERNEL32(00000002,?), ref: 00C741A6
CloseClipboard.USER32 ref: 00C74245

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 387d3e0423a26030e111f682dfaeb5e278f899a7a6ac67813cb90a23128ae30d
Instruction ID: 92874dc3f818031ff4fe2fea9429882e39f1d6da7edd14884ed9f913a1574c8a
Opcode Fuzzy Hash: 387d3e0423a26030e111f682dfaeb5e278f899a7a6ac67813cb90a23128ae30d
Instruction Fuzzy Hash: A221B2752002109FDB14AF64EC19B6D7BA8FF04711F11C129F94ADB2A2DB30AD41CB58

Function 00C637EF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C04750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00C04743,?,?,00C037AE,?), ref: 00C04770

Part of subcall function 00C64A31: GetFileAttributesW.KERNEL32(?,00C6370B), ref: 00C64A32

FindFirstFileW.KERNEL32(?,?), ref: 00C638A3
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 00C6394B
MoveFileW.KERNEL32(?,?), ref: 00C6395E
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 00C6397B
FindNextFileW.KERNEL32(00000000,00000010), ref: 00C6399D
FindClose.KERNEL32(00000000,?,?,?,?), ref: 00C639B9

Strings

\*.*, xrefs: 00C6384E, 00C63857, 00C6386C

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: a153dab5d629ea09155f200e8aaf05bc853cc948c38a027aebd724b6e0ed3e3d
Instruction ID: a841ba953dd843ec675bcd9f2306764cbb9c373bad0e8c5fc2cc98bfa4f6455a
Opcode Fuzzy Hash: a153dab5d629ea09155f200e8aaf05bc853cc948c38a027aebd724b6e0ed3e3d
Instruction Fuzzy Hash: B0517F3180518DAACF19EBA0D9929EEB779AF14304F600169F416B71D2EF316F09EF60

Function 00C6F3F3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00C07DE1: _memmove.LIBCMT ref: 00C07E22

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00C6F440
Sleep.KERNEL32(0000000A), ref: 00C6F470
_wcscmp.LIBCMT ref: 00C6F484
_wcscmp.LIBCMT ref: 00C6F49F
FindNextFileW.KERNEL32(?,?), ref: 00C6F53D
FindClose.KERNEL32(00000000), ref: 00C6F553

Strings

*.*, xrefs: 00C6F425

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 7df9f4a0c00ff83e080950f3f190a195717bd62dced268c067bda008a5f09c3d
Instruction ID: 86e3a2fed64b39bdd3ec16f9909f216ef9e16652e235e76950c7284e19a73d2e
Opcode Fuzzy Hash: 7df9f4a0c00ff83e080950f3f190a195717bd62dced268c067bda008a5f09c3d
Instruction Fuzzy Hash: F5417E71904219AFDF24EF64DC85AEEBBB4FF05314F10456AE815A3190EB309E46DF50

Function 00C15760 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C158A5
_memmove.LIBCMT ref: 00C158F5
_memmove.LIBCMT ref: 00C1595B

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: c904bcf7cb27690e83524990c57a84d292cc71a1b4aa65f5cab4c3fc423a1b14
Instruction ID: 1f348d7224447ceab68d08cd5bdd32a9c95da55f1169a9fe819b174c397ee0d1
Opcode Fuzzy Hash: c904bcf7cb27690e83524990c57a84d292cc71a1b4aa65f5cab4c3fc423a1b14
Instruction Fuzzy Hash: 9212AB70A00609DFDF04DFA5D981AEEB3F5FF88300F204529E846E7290EB36A995DB55

Function 00C63B12 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C04750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00C04743,?,?,00C037AE,?), ref: 00C04770

Part of subcall function 00C64A31: GetFileAttributesW.KERNEL32(?,00C6370B), ref: 00C64A32

FindFirstFileW.KERNEL32(?,?), ref: 00C63B89
DeleteFileW.KERNEL32(?,?,?,?), ref: 00C63BD9
FindNextFileW.KERNEL32(00000000,00000010), ref: 00C63BEA
FindClose.KERNEL32(00000000), ref: 00C63C01
FindClose.KERNEL32(00000000), ref: 00C63C0A

Strings

\*.*, xrefs: 00C63B5B

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: FileFind$Close$AttributesDeleteFirstFullNameNextPath
String ID: \*.*
API String ID: 2649000838-1173974218
Opcode ID: 9fddd04e7916cc1a631a84c6bdd3ddd7a54779945ab96079630577fb031354e4
Instruction ID: ec4d98bf19e062fd465e66af03b6813552bcf7c2ca9adaacf9d9c34df498b129
Opcode Fuzzy Hash: 9fddd04e7916cc1a631a84c6bdd3ddd7a54779945ab96079630577fb031354e4
Instruction Fuzzy Hash: 9731AF31008384AFC715EF64C8919AFB7E8BE91304F404E2DF4E5921E1EB21EA09DB67

Function 00C651BD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00C587E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00C5882B
Part of subcall function 00C587E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00C58858
Part of subcall function 00C587E1: GetLastError.KERNEL32 ref: 00C58865

ExitWindowsEx.USER32(?,00000000), ref: 00C651F9

Strings

SeShutdownPrivilege, xrefs: 00C651C9
, xrefs: 00C651E7
@, xrefs: 00C651EC

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 9039f07f8b21f025f54fafd1ac93b649df72bd0992fb8cf351f5f9df6249db3f
Instruction ID: 7d31342b722022484484471808a758aa0ae78de5369137eb1d57c91844ea5ad6
Opcode Fuzzy Hash: 9039f07f8b21f025f54fafd1ac93b649df72bd0992fb8cf351f5f9df6249db3f
Instruction Fuzzy Hash: A001F2357A56116BF7386268ACEAFBB7358EB05341F300425FE23E20D2DA611D4586A4

Function 00C76283 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 00C762DC
WSAGetLastError.WS2_32(00000000), ref: 00C762EB
bind.WS2_32(00000000,?,00000010), ref: 00C76307
listen.WS2_32(00000000,00000005), ref: 00C76316
WSAGetLastError.WS2_32(00000000), ref: 00C76330
closesocket.WS2_32(00000000), ref: 00C76344

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 2d9bcdde1ae62aa571d4a9c822acad99317e647f68ccb1be3a3ec89b7aeff958
Instruction ID: 93116145136e044e94df8d002af0d34110cd68ac3a47386f62e40520057547bd
Opcode Fuzzy Hash: 2d9bcdde1ae62aa571d4a9c822acad99317e647f68ccb1be3a3ec89b7aeff958
Instruction Fuzzy Hash: E521EF746006049FDB10EF64C845B7EBBA9EF49320F14C268F86AA73E2CB70AD01DB51

Function 00C15520 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00C20DB6: std::exception::exception.LIBCMT ref: 00C20DEC
Part of subcall function 00C20DB6: __CxxThrowException@8.LIBCMT ref: 00C20E01

_memmove.LIBCMT ref: 00C50258
_memmove.LIBCMT ref: 00C5036D
_memmove.LIBCMT ref: 00C50414

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 9f4a8cf6bb3f939440d06f04686aed447a4c45903cf5b5f7c3907fe0a2f4a0de
Instruction ID: 222261a215cbf2740f8f639fac73af71b39f32f4a23109914ba7b6cd96571acf
Opcode Fuzzy Hash: 9f4a8cf6bb3f939440d06f04686aed447a4c45903cf5b5f7c3907fe0a2f4a0de
Instruction Fuzzy Hash: 4C02C170A00609DFCF04DF64D981AAEBBB5FF84300F248069E806DB395EB35DA95DB95

Function 00C01287 Relevance: 7.9, APIs: 5, Instructions: 379nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00C02612: GetWindowLongW.USER32(?,000000EB), ref: 00C02623

NtdllDialogWndProc_W.NTDLL(?,?,?,?,?), ref: 00C019FA
GetSysColor.USER32(0000000F), ref: 00C01A4E
SetBkColor.GDI32(?,00000000), ref: 00C01A61

Part of subcall function 00C01290: NtdllDialogWndProc_W.NTDLL(?,00000020,?), ref: 00C012D8

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ColorDialogNtdllProc_$LongWindow
String ID:
API String ID: 591255283-0
Opcode ID: fdbdaac99e2feab245449e23061308e98db1475841d0f7c9495cd80e6e44557b
Instruction ID: b71ae6430167ad960ec9f6995b685213bd0016711b0ba7a5cccaca9f1f8ffbe1
Opcode Fuzzy Hash: fdbdaac99e2feab245449e23061308e98db1475841d0f7c9495cd80e6e44557b
Instruction Fuzzy Hash: 14A15870222554BEEB29AB6A8C88F7FB55CDF41345F1C0119FE12D21D2CA219E41F3B5

Function 00C76747 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00C77D8B: inet_addr.WS2_32(00000000), ref: 00C77DB6

socket.WS2_32(00000002,00000002,00000011), ref: 00C7679E
WSAGetLastError.WS2_32(00000000), ref: 00C767C7
bind.WS2_32(00000000,?,00000010), ref: 00C76800
WSAGetLastError.WS2_32(00000000), ref: 00C7680D
closesocket.WS2_32(00000000), ref: 00C76821

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 799c020394c9f70d03a7c14adc36db8a29641999fd98648d5096cff36438acec
Instruction ID: 1b8cccaee7f4050bfd88f6470904003db987ef070be91cf1f44c7047c38f6d8c
Opcode Fuzzy Hash: 799c020394c9f70d03a7c14adc36db8a29641999fd98648d5096cff36438acec
Instruction Fuzzy Hash: FD41D175A00600AFEB10AF248C86F6E77A8DF49724F44C55CFA5AAB3C3CA709D01D791

Function 00C85376 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00C853C5
IsWindowEnabled.USER32 ref: 00C853D3
GetForegroundWindow.USER32(?,?,00000001), ref: 00C853E0
IsIconic.USER32 ref: 00C853EE
IsZoomed.USER32 ref: 00C853FC

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 5a6b6361302fbcf6729d5776c629d1e254e5da8f29d2d0b149c862d6d85b5ec1
Instruction ID: 659ecd4675fd3a91d5da2bc1518327c74b1d11fc2cc87488ebd63b4ea22b4ab8
Opcode Fuzzy Hash: 5a6b6361302fbcf6729d5776c629d1e254e5da8f29d2d0b149c862d6d85b5ec1
Instruction Fuzzy Hash: 9A11B231700911ABEB216F269C44B6EBB99EF847A5B404438F846D3291DBB09D02C7A8

Function 00C580A9 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00C580C0
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00C580CA
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00C580D9
RtlAllocateHeap.NTDLL(00000000,?,00000002), ref: 00C580E0
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00C580F6

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: HeapInformationToken$AllocateErrorLastProcess
String ID:
API String ID: 47921759-0
Opcode ID: 0700f847ab7265316bb425c67b7ab87187f2dad47b5980a2d265a51ede6c5d52
Instruction ID: df86014bd4e19a6767765c0003c47de593378ff35fb45bf0b519d322950c8ec8
Opcode Fuzzy Hash: 0700f847ab7265316bb425c67b7ab87187f2dad47b5980a2d265a51ede6c5d52
Instruction Fuzzy Hash: 8AF06235240304EFEB104FA5EC8DF6F3BACEF4A755B100029F945D6150DB619D4AEB64

Function 00C6C397 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00C6C432
CoCreateInstance.COMBASE(00C92D6C,00000000,00000001,00C92BDC,?), ref: 00C6C44A

Part of subcall function 00C07DE1: _memmove.LIBCMT ref: 00C07E22

CoUninitialize.COMBASE ref: 00C6C6B7

Strings

.lnk, xrefs: 00C6C3C6, 00C6C3EE, 00C6C3F8

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 7fda69a23f52a85e6149fa01fe2b25eddef11e7a749ff5b45568a630f4a1c4a9
Instruction ID: a3d3d1079ba70ac1145232f5df9f63778b29633e647975b92a950f898616ab80
Opcode Fuzzy Hash: 7fda69a23f52a85e6149fa01fe2b25eddef11e7a749ff5b45568a630f4a1c4a9
Instruction Fuzzy Hash: A0A11AB1104205AFD700EF54C881EAFB7E8EF95354F004A2DF595972E2EB71EA49CB62

Function 00C13030 Relevance: 6.6, APIs: 4, Instructions: 587COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: __itow__swprintf
String ID:
API String ID: 674341424-0
Opcode ID: ff401c097aa7acab86d7e2552fe86a8e42c33ad4d2596bda56e7afd21aee2ee8
Instruction ID: 95e270558ceff3508d47c4fdf02e6e325fc554bc99e5c409efc40b8ae1a493b0
Opcode Fuzzy Hash: ff401c097aa7acab86d7e2552fe86a8e42c33ad4d2596bda56e7afd21aee2ee8
Instruction Fuzzy Hash: 16229C716083409FD724DF14C881BAEB7E4FF86314F10491DF89A97292DB71EA85DB92

Function 00C7EE0D Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00C7EE3D
Process32FirstW.KERNEL32(00000000,?), ref: 00C7EE4B

Part of subcall function 00C07DE1: _memmove.LIBCMT ref: 00C07E22

Process32NextW.KERNEL32(00000000,?), ref: 00C7EF0B
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00C7EF1A

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: 74c8f324983106605d17869115c092aa314c0137ac79b8a28c216de969be82eb
Instruction ID: 06222c86d2b5272cacf962aeec7905acfc331fcc6a2067edadc7f3e2c1a4b085
Opcode Fuzzy Hash: 74c8f324983106605d17869115c092aa314c0137ac79b8a28c216de969be82eb
Instruction Fuzzy Hash: 4D517B71508711AFD310EF24CC85F6BB7E8EF98710F10892DF595962A2EB70A909DB92

Function 00C8C498 Relevance: 6.1, APIs: 4, Instructions: 83nativewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C02612: GetWindowLongW.USER32(?,000000EB), ref: 00C02623

GetCursorPos.USER32(?), ref: 00C8C4D2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00C3B9AB,?,?,?,?,?), ref: 00C8C4E7
GetCursorPos.USER32(?), ref: 00C8C534
NtdllDialogWndProc_W.NTDLL(?,0000007B,?,?,?,?,?,?,?,?,?,?,00C3B9AB,?,?,?), ref: 00C8C56E

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Cursor$DialogLongMenuNtdllPopupProc_TrackWindow
String ID:
API String ID: 1423138444-0
Opcode ID: 6538208fdc8bf591aaae2b3f4f866ed22400b94c35f58bb90b9ab3894b30d450
Instruction ID: 38c61471cd7f28552cb81601b6776e7c5ebb5af7379920c6e46ed822084ca0e8
Opcode Fuzzy Hash: 6538208fdc8bf591aaae2b3f4f866ed22400b94c35f58bb90b9ab3894b30d450
Instruction Fuzzy Hash: BA319335500018BFCF15DF98C898FAE7BB5EB49314F044069F9158B2A1C731AE51EBA8

Function 00C01290 Relevance: 6.1, APIs: 4, Instructions: 59nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00C02612: GetWindowLongW.USER32(?,000000EB), ref: 00C02623

NtdllDialogWndProc_W.NTDLL(?,00000020,?), ref: 00C012D8
GetClientRect.USER32(?,?), ref: 00C3B5FB
GetCursorPos.USER32(?), ref: 00C3B605
ScreenToClient.USER32(?,?), ref: 00C3B610

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Client$CursorDialogLongNtdllProc_RectScreenWindow
String ID:
API String ID: 1010295502-0
Opcode ID: 14e4df4b92fc23297a4f0db452ad54df7d6b14d81b791b935739599525e31307
Instruction ID: c9a2d78d37c7a8db5f956ebf9cb4b8bff30efe980c1cac1c9c84c4669baf4ce5
Opcode Fuzzy Hash: 14e4df4b92fc23297a4f0db452ad54df7d6b14d81b791b935739599525e31307
Instruction Fuzzy Hash: 8A113A35910419EFCB00EF98D889AEEB7B8EB05300F440456F911E7280D730BA92DBA9

Function 00C8C57D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46nativewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C02612: GetWindowLongW.USER32(?,000000EB), ref: 00C02623

NtdllDialogWndProc_W.NTDLL(?,0000002B,?,?,?,?,?,?,?,00C3B93A,?,?,?), ref: 00C8C5F1

Part of subcall function 00C025DB: GetWindowLongW.USER32(?,000000EB), ref: 00C025EC

SendMessageW.USER32(?,00000401,00000000,00000000), ref: 00C8C5D7

Strings

@U=u, xrefs: 00C8C5D7

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: LongWindow$DialogMessageNtdllProc_Send
String ID: @U=u
API String ID: 1273190321-2594219639
Opcode ID: 1d1792bbcbcde44092e5a3eddbf9abef5781a81c50d7f2a3587bad3b1ef461b8
Instruction ID: 8c3ccca959690a04b9b20d12a7b15b9b1fee74a78f5f00448aad757fa0dbe2c7
Opcode Fuzzy Hash: 1d1792bbcbcde44092e5a3eddbf9abef5781a81c50d7f2a3587bad3b1ef461b8
Instruction Fuzzy Hash: 4101B531200614ABCF216F14CC98F6A3BA6FB85768F140128F9511B2E1CB31B952EB64

Function 00C5E616 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00C5E628

Strings

(, xrefs: 00C5E66E
|, xrefs: 00C5E658

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 9e51019b8f2012430b84f848645c3e9e599d87744e1a9d4ab16e1cfeab2dc42e
Instruction ID: 93c8fc7fe3af02ac35daf96e5c6020433bcef2d5b1e4ad44e697e38287cda4d1
Opcode Fuzzy Hash: 9e51019b8f2012430b84f848645c3e9e599d87744e1a9d4ab16e1cfeab2dc42e
Instruction Fuzzy Hash: 3C322879A007059FD728DF19C48196AB7F1FF48310B15C56EE8AADB3A1DB70EA81CB44

Function 00C722EE Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00C7180A,00000000), ref: 00C723E1
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00C72418

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 8e64ac921148a2dee3c88b225cc3fa2cd8a4d306433b7835465c5dda21313240
Instruction ID: 72bd6eb96f3c7c6855433b1167b592011cc4b84913b7b92ade0bdc18740def0a
Opcode Fuzzy Hash: 8e64ac921148a2dee3c88b225cc3fa2cd8a4d306433b7835465c5dda21313240
Instruction Fuzzy Hash: 5841F671904209BFEB20DE95DC81FBFB7BCEB40324F10806EF659A7251DB759E41A660

Function 00C6B3FB Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C6B40B
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00C6B465
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00C6B4B2

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: cde28f050e0662d5de3dfafff92dedd54aaff63e1d679e3ce1854dd50e878da2
Instruction ID: 33639cb908f01ebcd651a54626c7dce88d0f70bce748b24512fb9365f6f8de9c
Opcode Fuzzy Hash: cde28f050e0662d5de3dfafff92dedd54aaff63e1d679e3ce1854dd50e878da2
Instruction Fuzzy Hash: 54216075A00108EFCB00EFA5D884BEDBBB8FF49310F1481A9E905EB392DB319956DB55

Function 00C587E1 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00C20DB6: std::exception::exception.LIBCMT ref: 00C20DEC
Part of subcall function 00C20DB6: __CxxThrowException@8.LIBCMT ref: 00C20E01

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00C5882B
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00C58858
GetLastError.KERNEL32 ref: 00C58865

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 614e6ad011f6b6d2cbbd7e1dc2dfdc098472c77b0ed939b4c5fb01d696fd6716
Instruction ID: 719046002b3dcc7052e2d74537bd058d3769e03a977b979810482c2f6c0629d9
Opcode Fuzzy Hash: 614e6ad011f6b6d2cbbd7e1dc2dfdc098472c77b0ed939b4c5fb01d696fd6716
Instruction Fuzzy Hash: 6511BFB2404204AFE718DFA4EC85E2BB7F8EB04311B20852EF85593652EB70BC458B64

Function 00C5874B Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00C58774
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00C5878B
FreeSid.ADVAPI32(?), ref: 00C5879B

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 335811f02de739511982f8b0bea1eaecdb71bf47d1afbecb080f62858b7c2f78
Instruction ID: b0b0a80ab1365dceb7f842185f5642acc33f60670e60d058418f93a8a3816ad5
Opcode Fuzzy Hash: 335811f02de739511982f8b0bea1eaecdb71bf47d1afbecb080f62858b7c2f78
Instruction Fuzzy Hash: 30F04975A1130CBFDF00DFF4DC89AAEBBBCEF08201F1044A9A901E2181E7756A488B54

Function 00C016DE Relevance: 3.1, APIs: 2, Instructions: 83nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00C02612: GetWindowLongW.USER32(?,000000EB), ref: 00C02623

Part of subcall function 00C025DB: GetWindowLongW.USER32(?,000000EB), ref: 00C025EC

GetParent.USER32(?), ref: 00C3B7BA
NtdllDialogWndProc_W.NTDLL(?,00000133,?,?,?,?,?,?,?,?,00C019B3,?,?,?,00000006,?), ref: 00C3B834

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: LongWindow$DialogNtdllParentProc_
String ID:
API String ID: 314495775-0
Opcode ID: d55a81fb553ef6bb0a11acc91beaf68f35db1535bf6e647f28094a0a925563ea
Instruction ID: 3c21d0e9e15667fa12a973954d8771fa7418e29f7b77ef99522d9f044d3b011d
Opcode Fuzzy Hash: d55a81fb553ef6bb0a11acc91beaf68f35db1535bf6e647f28094a0a925563ea
Instruction Fuzzy Hash: 3A219434605544AFCB248F6CCC88EA97B96EF4A320F584254FA395B2F2C731AE91DB50

Function 00C6C6D1 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00C6C6FB
FindClose.KERNEL32(00000000), ref: 00C6C72B

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 0987b1b7b80e319c5d297b55ad901b4ac648a7d1b42ee8c4c0ab6045b9c93f65
Instruction ID: c8dc2be45f2226a1d3df439ad81aa1f501a06675f997e599a1a424e24abac10d
Opcode Fuzzy Hash: 0987b1b7b80e319c5d297b55ad901b4ac648a7d1b42ee8c4c0ab6045b9c93f65
Instruction Fuzzy Hash: 6B118E726002009FDB10DF29C885A2AF7E8EF85320F00C61DF9A9C73A1DB30A805CB81

Function 00C8C93E Relevance: 3.0, APIs: 2, Instructions: 33nativeCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00C8C961
NtdllDialogWndProc_W.NTDLL(?,00000200,?,?,?,?,?,?,?,00C3BA16,?,?,?,?,?), ref: 00C8C98A

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ClientDialogNtdllProc_Screen
String ID:
API String ID: 3420055661-0
Opcode ID: f0b559324820a71bcf95bf4b45d47f8ea69fb5347caf9a16a268e94da4680632
Instruction ID: f34dd79395f76eb4c1ae835551834d670f562511d9d7eb583e6e9c037fd37b84
Opcode Fuzzy Hash: f0b559324820a71bcf95bf4b45d47f8ea69fb5347caf9a16a268e94da4680632
Instruction Fuzzy Hash: 2BF0307241011CFFDF049F45DC09FAE7BB9FB44311F10416AF90552161D7716A61EBA4

Function 00C6A06A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00C79468,?,00C8FB84,?), ref: 00C6A097
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00C79468,?,00C8FB84,?), ref: 00C6A0A9

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 83bda9d4bf774a06b0b718e63361723a99b4b2be078e47eccb8337e6741ef638
Instruction ID: f3f242ce33594ba6135e2d31fb5cdaca16c2e66a6f4609945f26c1ea881d8897
Opcode Fuzzy Hash: 83bda9d4bf774a06b0b718e63361723a99b4b2be078e47eccb8337e6741ef638
Instruction Fuzzy Hash: 8BF0823551522DABDB21AFA4CC88FEE776CBF08361F00426AF919D6191DA309A40CBA1

Function 00C8CA7C Relevance: 3.0, APIs: 2, Instructions: 23nativeCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00C8CA84
NtdllDialogWndProc_W.NTDLL(?,00000084,00000000,?,?,00C3B995,?,?,?,?), ref: 00C8CAB2

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 07d6618fd07c50368a3ff0dc8d68667d8efe5b6301e8b6fa5caad4f3e0e5ebec
Instruction ID: 71d41ab24bb411ee7276c35b2fd55deaf61393ab1972a6956ddfc9d0de706852
Opcode Fuzzy Hash: 07d6618fd07c50368a3ff0dc8d68667d8efe5b6301e8b6fa5caad4f3e0e5ebec
Instruction Fuzzy Hash: 7AE08670100218BFEB199F19DC4AFBE3B58EB04751F408219F966D91E1C7709850E774

Function 00C581CB Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00C58309), ref: 00C581E0
CloseHandle.KERNEL32(?,?,00C58309), ref: 00C581F2

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: 9e1697fccb8c73bba8a974e1530faf3b1f201ad3b29fb89d1da48f335fae1c61
Instruction ID: dbc57c152cccf74307eb565d912d3d5b1d888d9523e4c7419419528c70b74bfe
Opcode Fuzzy Hash: 9e1697fccb8c73bba8a974e1530faf3b1f201ad3b29fb89d1da48f335fae1c61
Instruction Fuzzy Hash: F4E0E671010510AFE7252B60FC05E777BE9EF04311725882DF8A5C4471DB615CD1DB14

Function 00C2A155 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,00C94178,00C28D57,t of calling an MSIL-compiled (/clr) function from a native constructor or from DllMain.,?,?,00000001), ref: 00C2A15A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00C2A163

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7e84f4737fef318447f0b7d23208bed80af1d815630e81a594182fac9dbc1940
Instruction ID: 80a7117f44c2b0ed5352d5b44e18304710cde735bee43b24cf41d9d2e196b356
Opcode Fuzzy Hash: 7e84f4737fef318447f0b7d23208bed80af1d815630e81a594182fac9dbc1940
Instruction Fuzzy Hash: 8FB09231254308ABCA002B91EC09B8C3F68EB46AA2F404024F60D84070CB6264528B99

Function 00C2F1D9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 539a324b783c422d36ab7e5d51dd8cf55f122a484264644eebd32d25d098f17e
Instruction ID: d0037017becae0723c6e16664c3f76f7995e31beb3ca90ad4c714e715c264e27
Opcode Fuzzy Hash: 539a324b783c422d36ab7e5d51dd8cf55f122a484264644eebd32d25d098f17e
Instruction Fuzzy Hash: 7332F231D2AF554ED7239634D836339A258AFB73C4F15D73BE82AB5DA5EB28C5834100

Function 00C3242E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 133d7729e60f72666e8d89df83d36f151349503f71e6aa9973afedc591cc390b
Instruction ID: fe187e573cc930b7d474691c848a07603421c309feef2e26b47bd6b614815dc6
Opcode Fuzzy Hash: 133d7729e60f72666e8d89df83d36f151349503f71e6aa9973afedc591cc390b
Instruction Fuzzy Hash: F2B1EE31E2AF404DD7239639883533ABA5CAFBB6C5F51E71BFC2674D22EB2185834181

Function 00C68889 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00C6889B

Part of subcall function 00C2520A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00C68F6E,00000000,?,?,?,?,00C6911F,00000000,?), ref: 00C25213
Part of subcall function 00C2520A: __aulldiv.LIBCMT ref: 00C25233

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: 4c25ec6fc51fbff44da57903b504c4622753938628ad5be8e5418bd0031466ab
Instruction ID: 6fe31332f126fccebb3a6b7499fd7c3ba21769946831d6aecac801165abe6853
Opcode Fuzzy Hash: 4c25ec6fc51fbff44da57903b504c4622753938628ad5be8e5418bd0031466ab
Instruction Fuzzy Hash: 1F21AF726256108BC729CF29D881B56B3E1EFA9311B688F6CD0F5CB2C0CA34A909CB54

Function 00C8D78C Relevance: 1.6, APIs: 1, Instructions: 66nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00C02612: GetWindowLongW.USER32(?,000000EB), ref: 00C02623

NtdllDialogWndProc_W.NTDLL(?,00000112,?,00000000), ref: 00C8D838

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: c70f9a88896269d52eb4ee0451879c568763c3575e25e98134023b4537ea9d2f
Instruction ID: 56d1fdc1a3eb2621a9c86ff508971cd66971bef999ff2356a0a30baf4bd1c6e8
Opcode Fuzzy Hash: c70f9a88896269d52eb4ee0451879c568763c3575e25e98134023b4537ea9d2f
Instruction Fuzzy Hash: 6211E734204215BBEB257E2CCC0AF7E3754D741B28F204324F9239A5E6CA60AE00A3ED

Function 00C8D3B8 Relevance: 1.5, APIs: 1, Instructions: 47nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00C025DB: GetWindowLongW.USER32(?,000000EB), ref: 00C025EC

NtdllDialogWndProc_W.NTDLL(?,00000115,?,?,?,?,?,?,00C3B952,?,?,?,?,00000000,?), ref: 00C8D432

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 39512483a515d32aa192673e5c983fa304ee2f05e797dfb03b2e1a2c86a944ef
Instruction ID: 8839a6bc88b8f900cda4bca185d8c66821198fb900217159117c1fb8cd5e05fd
Opcode Fuzzy Hash: 39512483a515d32aa192673e5c983fa304ee2f05e797dfb03b2e1a2c86a944ef
Instruction Fuzzy Hash: A901D831600114AFDF14AF25C849FBA3B51EF86329F444129F9675B2E2C731BD52DBA8

Function 00C0189B Relevance: 1.5, APIs: 1, Instructions: 29nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00C02612: GetWindowLongW.USER32(?,000000EB), ref: 00C02623

NtdllDialogWndProc_W.NTDLL(?,00000006,00000000,?,?,?,00C01B04,?,?,?,?,?), ref: 00C018E2

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: 4168cbe63c6299c08e7de7b94498c1b546e5122baea780075498004476e85c1b
Instruction ID: 7bb5d8ff74135cd95b40d1d7e921a6ec99ac2ae1cb8707b4e40068989fe84043
Opcode Fuzzy Hash: 4168cbe63c6299c08e7de7b94498c1b546e5122baea780075498004476e85c1b
Instruction Fuzzy Hash: 78F05E34610619DFDB18DF15D865F6A37E2EB44350F548229FD524B2E1C731EAA0EB50

Function 00C8C8BE Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL(?,00000232,?,?), ref: 00C8C8FE

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: 2f054d5cf998bec96bbf12a3963ed4cae552c0ff02fda70708e12eacef6709e9
Instruction ID: b7901f34b98f47952d5af09dcfc0fdb32dbe08b9f368bd224f2362cbb329f4ab
Opcode Fuzzy Hash: 2f054d5cf998bec96bbf12a3963ed4cae552c0ff02fda70708e12eacef6709e9
Instruction Fuzzy Hash: 28F06D31250258AFDF21EF58DC49FCA7B95EB09320F044018FA21672E2CB707960E7A4

Function 00C64C53 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000004,00000000,00000000,00000000,00000000), ref: 00C64C76

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 5216324e8a273fa3f51eba3e328d8e2d29e68eaee775c0408af8a1e509992730
Instruction ID: 897310d3765bad4b2394acee340a6b0c1cd1082f082e7999984d87e13620ad88
Opcode Fuzzy Hash: 5216324e8a273fa3f51eba3e328d8e2d29e68eaee775c0408af8a1e509992730
Instruction Fuzzy Hash: 3AD09EA416261979EC3C07209DDBF7E3109E3C1791F94954A7251952C1E8E46941A139

Function 00C587B1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00C58389), ref: 00C587D1

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 27fc9f74db034fdf046c153293f12d6b84abffdd67abb52dea979338b8883a72
Instruction ID: c7e803d0bc993411d96c6572ed8a3379a7c327bce79b84580a6495cb2c7a3c74
Opcode Fuzzy Hash: 27fc9f74db034fdf046c153293f12d6b84abffdd67abb52dea979338b8883a72
Instruction Fuzzy Hash: 34D09E3226450EAFEF019EA4DD05EAE3B69EB04B01F408511FE15D51A1C775D935AB60

Function 00C8C909 Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL(?,00000053,?,?,?,00C3B9BC,?,?,?,?,?,?), ref: 00C8C934

Part of subcall function 00C8B635: _memset.LIBCMT ref: 00C8B644
Part of subcall function 00C8B635: _memset.LIBCMT ref: 00C8B653
Part of subcall function 00C8B635: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00CC6F20,00CC6F64), ref: 00C8B682
Part of subcall function 00C8B635: CloseHandle.KERNEL32 ref: 00C8B694

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: _memset$CloseCreateDialogHandleNtdllProc_Process
String ID:
API String ID: 2364484715-0
Opcode ID: f6e22e03254427e224de9812121a47debbd2b5cf1992ba4e958ce0fd04220186
Instruction ID: 6f01f499ac35c6df3c691525beb79954542dc984037373b956b8de02d211e853
Opcode Fuzzy Hash: f6e22e03254427e224de9812121a47debbd2b5cf1992ba4e958ce0fd04220186
Instruction Fuzzy Hash: EBE0B635110208EFCB01AF54DD55E9A37B5FB1C319F018055FA15572B2C731AD60EF64

Function 00C0167D Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00C02612: GetWindowLongW.USER32(?,000000EB), ref: 00C02623

NtdllDialogWndProc_W.NTDLL(?,00000007,?,00000000,00000000,?,?,?,00C01AEE,?,?,?), ref: 00C016AB

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: DialogLongNtdllProc_Window
String ID:
API String ID: 2065330234-0
Opcode ID: ecf61dd8fd12705f6134df566290dc104fa0e2046c35a3bbc24985c0912bde09
Instruction ID: a98db3dc04936d85e011b0743841b11e37373d0fac25ba10b1a6bd12fe2eb8c0
Opcode Fuzzy Hash: ecf61dd8fd12705f6134df566290dc104fa0e2046c35a3bbc24985c0912bde09
Instruction Fuzzy Hash: A2E01235540208FBCF05AF90DC15F693B2AFB48710F508418FA454B2E1CB33B562EB54

Function 00C8C88F Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL ref: 00C8C8B4

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: e99b634fb0af2b073c828e45d391adb956ea0d513908a983774598fbbb72a9b4
Instruction ID: 6953e0d28e7fe49a6e31f261819547918667d2bc1460d925848ebe92393807f2
Opcode Fuzzy Hash: e99b634fb0af2b073c828e45d391adb956ea0d513908a983774598fbbb72a9b4
Instruction Fuzzy Hash: 2BE0427525024DEFDB01DF88D945E9A3BA5AB1D700F414054FA1547362C771A870EBA1

Function 00C8C860 Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

NtdllDialogWndProc_W.NTDLL ref: 00C8C885

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: DialogNtdllProc_
String ID:
API String ID: 3239928679-0
Opcode ID: 1059311af335734ec284c2860ab146079f4dc0a0dedd08fc5dae1d06d284a52e
Instruction ID: d8eb69c35094ad4cc0d41f333c1d1dbebc10eaacab99bfab5c24c51e12933373
Opcode Fuzzy Hash: 1059311af335734ec284c2860ab146079f4dc0a0dedd08fc5dae1d06d284a52e
Instruction Fuzzy Hash: FAE0427525424DEFDB01DF88D885F9A3BA5AB1D700F014054FA1557362C771A870EB61

Function 00C016B5 Relevance: 1.5, APIs: 1, Instructions: 14nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00C02612: GetWindowLongW.USER32(?,000000EB), ref: 00C02623

Part of subcall function 00C0201B: DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00C020D3
Part of subcall function 00C0201B: KillTimer.USER32(-00000001,?,?,?,?,00C016CB,00000000,?,?,00C01AE2,?,?), ref: 00C0216E

NtdllDialogWndProc_W.NTDLL(?,00000002,00000000,00000000,00000000,?,?,00C01AE2,?,?), ref: 00C016D4

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Window$DestroyDialogKillLongNtdllProc_Timer
String ID:
API String ID: 2797419724-0
Opcode ID: eb3fe607f118798cc481f710c59c0732e0935e875b4d3b856811a1b396abb357
Instruction ID: 0b881ac5057f80c62b7c82992f68db070e7b2b6ff3d4e09753171291a3309aee
Opcode Fuzzy Hash: eb3fe607f118798cc481f710c59c0732e0935e875b4d3b856811a1b396abb357
Instruction Fuzzy Hash: 13D01270140318B7DE102B50DC1FF4A3A199B14B50F408024FA05291D3CA726860F65C

Function 00C2A124 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00C2A12A

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: a08c32fa052ffab0a46d7e3d5a2f45bbb72102077cfb976f8cccc8acd306aeeb
Instruction ID: b7ea347d89df2fb2e8de11ea96f9074877cc93c3786db843448382c846cc1159
Opcode Fuzzy Hash: a08c32fa052ffab0a46d7e3d5a2f45bbb72102077cfb976f8cccc8acd306aeeb
Instruction Fuzzy Hash: E4A0113000020CAB8A002B82EC08A88BFACEA022A0B008020F80C800328B32A8228A88

Function 00C18808 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b174469800f325b1acc0384dacee9db51cadf0e68da709dfb2daf8032ce619a
Instruction ID: ba050ce96794ba9263b1046e8fe3a631518c03a7e94bd7b1bf53a48f0bc1b8e5
Opcode Fuzzy Hash: 3b174469800f325b1acc0384dacee9db51cadf0e68da709dfb2daf8032ce619a
Instruction Fuzzy Hash: 5722583490C506CBDF388A25C4A47BCB7A1FF42305F28816ADA668B592DB749ECDF741

Function 00C221C5 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 280b92b2ad6da3cb3de5c130414e845d635a925a204c8884bd733658fc906f3c
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 53C198322051B349DF2E463AA43403EFAA15EA27B131F076DD8B3CB9D4EE20DA25D610

Function 00C225FA Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: b29688fecce5103424fd06d7acaa882e60fb5f79652b03264f22a6bf791b5760
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: E5C175332051B349DF2E463AD43413EBAA15FA27B171F076DD8B2DB9D4EE10CA25D620

Function 00C21978 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: a6b0178af2f4ba52e0efeaf2c15cd5a30d79d6c32c477b68e6a008e86851cd6f
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: A6C185362451B34ADF2E463A943413EBAA15EB27B131F076DDCB3CB9C4EE20CA65D610

Function 00BD3630 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1369484406.0000000000BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_xrAlbTvRsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction ID: 9eff0f04f946de195377dcd52b4f8fc501d6840487bea5e7bce6a250e1e5d79c
Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction Fuzzy Hash: D541A4B1D1051CEBCF48CFADC991AAEFBF1AF88201F548299D516AB345D730AB41DB50

Function 00BD3520 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1369484406.0000000000BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_xrAlbTvRsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction ID: 9b6d153ae8042b59b185b3d89177a58d631a91782abbf347b5098f5208446a1f
Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction Fuzzy Hash: 7A018078A00109EFCB84DF98D5909AEF7F5FB58710F2085DAE809A7701E730AE41DB81

Function 00BD34C0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1369484406.0000000000BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_xrAlbTvRsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction ID: 8f87ae48ed9ccebe32a0b58ddbde7e1273d040e4118063d6dc74695ccb60bca1
Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction Fuzzy Hash: CE018078A01109EFCB44DF98C5909AEF7F5FB58710B2085DAE809A7701E735AE41DB81

Function 00BD1E70 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1369484406.0000000000BD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 00BD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bd0000_xrAlbTvRsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48

Function 00C77806 Relevance: 79.2, APIs: 40, Strings: 5, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00C7785B
DeleteObject.GDI32(00000000), ref: 00C7786D
DestroyWindow.USER32 ref: 00C7787B
GetDesktopWindow.USER32 ref: 00C77895
GetWindowRect.USER32(00000000), ref: 00C7789C
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00C779DD
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00C779ED
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C77A35
GetClientRect.USER32(00000000,?), ref: 00C77A41
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00C77A7B
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C77A9D
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C77AB0
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C77ABB
GlobalLock.KERNEL32(00000000), ref: 00C77AC4
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C77AD3
GlobalUnlock.KERNEL32(00000000), ref: 00C77ADC
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C77AE3
GlobalFree.KERNEL32(00000000), ref: 00C77AEE
CreateStreamOnHGlobal.COMBASE(00000000,00000001,88C00000), ref: 00C77B00
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00C92CAC,00000000), ref: 00C77B16
GlobalFree.KERNEL32(00000000), ref: 00C77B26
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00C77B4C
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00C77B6B
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C77B8D
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00C77D7A

Strings

AutoIt v3, xrefs: 00C77A2D
, xrefs: 00C77D00
@U=u, xrefs: 00C77B6B, 00C77CFA
static, xrefs: 00C77A75, 00C77BCC
DISPLAY, xrefs: 00C77BDD

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $@U=u$AutoIt v3$DISPLAY$static
API String ID: 2211948467-3613752883
Opcode ID: d003be8a3cefa57a4654fe957a4636479ef84fcecda0bfced2a8e8e8c7fc2e8e
Instruction ID: 38c857859eb677e34241c380c4a7534104296576e6e591f423adef90109ce436
Opcode Fuzzy Hash: d003be8a3cefa57a4654fe957a4636479ef84fcecda0bfced2a8e8e8c7fc2e8e
Instruction Fuzzy Hash: 40025B75900119EFDB14DFA4DC89FAE7BB9EF48310F148269F915AB2A1C730AD42CB64

Function 00C8A5DA Relevance: 59.8, APIs: 33, Strings: 1, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00C8A630
GetSysColorBrush.USER32(0000000F), ref: 00C8A661
GetSysColor.USER32(0000000F), ref: 00C8A66D
SetBkColor.GDI32(?,000000FF), ref: 00C8A687
SelectObject.GDI32(?,00000000), ref: 00C8A696
InflateRect.USER32(?,000000FF,000000FF), ref: 00C8A6C1
GetSysColor.USER32(00000010), ref: 00C8A6C9
CreateSolidBrush.GDI32(00000000), ref: 00C8A6D0
FrameRect.USER32(?,?,00000000), ref: 00C8A6DF
DeleteObject.GDI32(00000000), ref: 00C8A6E6
InflateRect.USER32(?,000000FE,000000FE), ref: 00C8A731
FillRect.USER32(?,?,00000000), ref: 00C8A763
GetWindowLongW.USER32(?,000000F0), ref: 00C8A78E

Part of subcall function 00C8A8CA: GetSysColor.USER32(00000012), ref: 00C8A903
Part of subcall function 00C8A8CA: SetTextColor.GDI32(?,?), ref: 00C8A907
Part of subcall function 00C8A8CA: GetSysColorBrush.USER32(0000000F), ref: 00C8A91D
Part of subcall function 00C8A8CA: GetSysColor.USER32(0000000F), ref: 00C8A928
Part of subcall function 00C8A8CA: GetSysColor.USER32(00000011), ref: 00C8A945
Part of subcall function 00C8A8CA: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00C8A953
Part of subcall function 00C8A8CA: SelectObject.GDI32(?,00000000), ref: 00C8A964
Part of subcall function 00C8A8CA: SetBkColor.GDI32(?,00000000), ref: 00C8A96D
Part of subcall function 00C8A8CA: SelectObject.GDI32(?,?), ref: 00C8A97A
Part of subcall function 00C8A8CA: InflateRect.USER32(?,000000FF,000000FF), ref: 00C8A999
Part of subcall function 00C8A8CA: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00C8A9B0
Part of subcall function 00C8A8CA: GetWindowLongW.USER32(00000000,000000F0), ref: 00C8A9C5
Part of subcall function 00C8A8CA: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00C8A9ED

Strings

@U=u, xrefs: 00C8A7B8

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID: @U=u
API String ID: 3521893082-2594219639
Opcode ID: 7d4a72cd79dfbb5ae8e860fc5576f0cdcd0a2c4329de4514ae7a3b7d57e10796
Instruction ID: 535a02d1ae6b3d9855fa59fef470c9c1ed0e4eb2e91fe1b5313edfdc79e17b55
Opcode Fuzzy Hash: 7d4a72cd79dfbb5ae8e860fc5576f0cdcd0a2c4329de4514ae7a3b7d57e10796
Instruction Fuzzy Hash: 53917B72408301AFD710AF64DC08B5F7BA9FB89325F100B2EF9A2961A0D770D946DB5A

Function 00C8356B Relevance: 52.9, APIs: 6, Strings: 24, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00C8F910), ref: 00C83627
IsWindowVisible.USER32(?), ref: 00C8364B

Strings

GETLINE, xrefs: 00C8399B
HIDEDROPDOWN, xrefs: 00C83700
ISVISIBLE, xrefs: 00C83637
TABRIGHT, xrefs: 00C8369D
GETCURRENTSELECTION, xrefs: 00C837E3
ISCHECKED, xrefs: 00C83839
SETCURRENTSELECTION, xrefs: 00C837B6
GETLINECOUNT, xrefs: 00C838C6
@U=u, xrefs: 00C838E3, 00C8390A, 00C83993
CURRENTTAB, xrefs: 00C836BD
SENDCOMMANDID, xrefs: 00C839DA
ADDSTRING, xrefs: 00C83716
UNCHECK, xrefs: 00C83883
SELECTSTRING, xrefs: 00C83806
CHECK, xrefs: 00C8386D
DELSTRING, xrefs: 00C83749
FINDSTRING, xrefs: 00C83776
GETCURRENTCOL, xrefs: 00C83928
GETSELECTED, xrefs: 00C838A3
ISENABLED, xrefs: 00C8366B
EDITPASTE, xrefs: 00C8395F
SHOWDROPDOWN, xrefs: 00C836E0
TABLEFT, xrefs: 00C83687
GETCURRENTLINE, xrefs: 00C838ED

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: @U=u$ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-3469695742
Opcode ID: 78b9bd93e1121e085472c471699ecbc4eaf1e15c062545d8cb84c3433fd02725
Instruction ID: 25d28c8b7ed0bb8b6608f269510f189e98fd68f3fc970184393f558e020f077e
Opcode Fuzzy Hash: 78b9bd93e1121e085472c471699ecbc4eaf1e15c062545d8cb84c3433fd02725
Instruction Fuzzy Hash: BCD19B70208240DBCB04FF10C491AAE77A5EF95758F144469F8926B3E3DB31EE4AEB49

Function 00C774AB Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00C774DE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00C7759D
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00C775DB
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00C775ED
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00C77633
GetClientRect.USER32(00000000,?), ref: 00C7763F
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00C77683
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00C77692
GetStockObject.GDI32(00000011), ref: 00C776A2
SelectObject.GDI32(00000000,00000000), ref: 00C776A6
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00C776B6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00C776BF
DeleteDC.GDI32(00000000), ref: 00C776C8
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00C776F4
SendMessageW.USER32(00000030,00000000,00000001), ref: 00C7770B
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00C77746
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00C7775A
SendMessageW.USER32(00000404,00000001,00000000), ref: 00C7776B
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00C7779B
GetStockObject.GDI32(00000011), ref: 00C777A6
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00C777B1
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00C777BB

Strings

AutoIt v3, xrefs: 00C7762B
@U=u, xrefs: 00C776FA
static, xrefs: 00C7767D, 00C77795
msctls_progress32, xrefs: 00C7773C
DISPLAY, xrefs: 00C77688

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: @U=u$AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-2771358697
Opcode ID: 01213f3cf75bade7283f0b94d489cb4ed19d3add1225623f2e06c412cc039b5d
Instruction ID: 15cdd340ad2332df779b480fbbb2465e65ccdb0f0999b7880ffd7d889dc4bc26
Opcode Fuzzy Hash: 01213f3cf75bade7283f0b94d489cb4ed19d3add1225623f2e06c412cc039b5d
Instruction Fuzzy Hash: 09A155B1A40619BFEB14DBA4DC49FAE7BB9EB04710F108218FA15E72E1D770AD41CB64

Function 00C8A8CA Relevance: 47.4, APIs: 26, Strings: 1, Instructions: 187windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00C8A903
SetTextColor.GDI32(?,?), ref: 00C8A907
GetSysColorBrush.USER32(0000000F), ref: 00C8A91D
GetSysColor.USER32(0000000F), ref: 00C8A928
CreateSolidBrush.GDI32(?), ref: 00C8A92D
GetSysColor.USER32(00000011), ref: 00C8A945
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00C8A953
SelectObject.GDI32(?,00000000), ref: 00C8A964
SetBkColor.GDI32(?,00000000), ref: 00C8A96D
SelectObject.GDI32(?,?), ref: 00C8A97A
InflateRect.USER32(?,000000FF,000000FF), ref: 00C8A999
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00C8A9B0
GetWindowLongW.USER32(00000000,000000F0), ref: 00C8A9C5
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00C8A9ED
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00C8AA14
InflateRect.USER32(?,000000FD,000000FD), ref: 00C8AA32
DrawFocusRect.USER32(?,?), ref: 00C8AA3D
GetSysColor.USER32(00000011), ref: 00C8AA4B
SetTextColor.GDI32(?,00000000), ref: 00C8AA53
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00C8AA67
SelectObject.GDI32(?,00C8A5FA), ref: 00C8AA7E
DeleteObject.GDI32(?), ref: 00C8AA89
SelectObject.GDI32(?,?), ref: 00C8AA8F
DeleteObject.GDI32(?), ref: 00C8AA94
SetTextColor.GDI32(?,?), ref: 00C8AA9A
SetBkColor.GDI32(?,?), ref: 00C8AAA4

Strings

@U=u, xrefs: 00C8A9ED

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID: @U=u
API String ID: 1996641542-2594219639
Opcode ID: cf24788e6d0377321099fc072eca4b108fdbba29e4a548f81023c54ad17606fe
Instruction ID: 618160feda563375bd31788a9c2e701a84579be1aaee1ab5070125aacc231376
Opcode Fuzzy Hash: cf24788e6d0377321099fc072eca4b108fdbba29e4a548f81023c54ad17606fe
Instruction Fuzzy Hash: 7A514E71900208FFDB119FA4DC48FAE7B79EF08320F21422AF911AB2A1D7759A41DF94

Function 00C6AD10 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C6AD1E
GetDriveTypeW.KERNEL32(?,00C8FAC0,?,\\.\,00C8F910), ref: 00C6ADFB
SetErrorMode.KERNEL32(00000000,00C8FAC0,?,\\.\,00C8F910), ref: 00C6AF59

Strings

Network, xrefs: 00C6AE39
\\.\, xrefs: 00C6AD70
Unknown, xrefs: 00C6AE1B, 00C6AEBF
RAMDisk, xrefs: 00C6AE25
RAID, xrefs: 00C6AEF7
1394, xrefs: 00C6AEDB
Fibre, xrefs: 00C6AEE9
Fixed, xrefs: 00C6AE43
USB, xrefs: 00C6AEF0
ATAPI, xrefs: 00C6AECD
iSCSI, xrefs: 00C6AEFE
SSD, xrefs: 00C6AE86
SCSI, xrefs: 00C6AEC6
PhysicalDrive, xrefs: 00C6ADA7
Removable, xrefs: 00C6AE4D
SATA, xrefs: 00C6AF0C
SSA, xrefs: 00C6AEE2
SAS, xrefs: 00C6AF05
ATA, xrefs: 00C6AED4
FileBackedVirtual, xrefs: 00C6AF28
Virtual, xrefs: 00C6AF21
MMC, xrefs: 00C6AF1A
CDROM, xrefs: 00C6AE2F

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 00500ed8b3e3d04d1014e1139249310c5f62eec9d059f6f5afb6c75993819835
Instruction ID: 286a7447148832ffdba5c5daf69c3a848d86aaea03141e0c74ae927e456be9a8
Opcode Fuzzy Hash: 00500ed8b3e3d04d1014e1139249310c5f62eec9d059f6f5afb6c75993819835
Instruction Fuzzy Hash: 575163B0648205ABCB24EBA1C9D2DBD73A5EF48700F204166E417B72D1DA719E46FF53

Function 00C02C18 Relevance: 44.2, APIs: 23, Strings: 2, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00C02CA2
DeleteObject.GDI32(00000000), ref: 00C02CE8
DeleteObject.GDI32(00000000), ref: 00C02CF3
DestroyCursor.USER32(00000000), ref: 00C02CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00C02D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 00C3C43B
6FB80200.COMCTL32(?,000000FF,?), ref: 00C3C474
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00C3C89D

Part of subcall function 00C01B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00C02036,?,00000000,?,?,?,?,00C016CB,00000000,?), ref: 00C01B9A

SendMessageW.USER32(?,00001053), ref: 00C3C8DA
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00C3C8F1

Strings

0, xrefs: 00C3C731
@U=u, xrefs: 00C3C43B, 00C3C542, 00C3C81D

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: DestroyMessageSendWindow$DeleteObject$B80200CursorInvalidateMoveRect
String ID: 0$@U=u
API String ID: 295266683-975001249
Opcode ID: 05cbd745eceaeed4334a0ec5867a53aa658a2f936778e56da5f95626942aa1f4
Instruction ID: 8e585f7831565bd2d856315c4593cb905ad480bab6f7a57f4b08a5923286d33c
Opcode Fuzzy Hash: 05cbd745eceaeed4334a0ec5867a53aa658a2f936778e56da5f95626942aa1f4
Instruction Fuzzy Hash: 77127C30614201EFEB25CF24C8C8BADB7E5BF45304F544569F8A5EB2A2C731E952DB91

Function 00C89A1C Relevance: 44.2, APIs: 23, Strings: 2, Instructions: 455windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 00C89AD2
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00C89B8B
SendMessageW.USER32(?,00001102,00000002,?), ref: 00C89BA7

Strings

0, xrefs: 00C89BE4
@U=u, xrefs: 00C89B8B, 00C89BA7, 00C89D23, 00C89D56, 00C89DB6, 00C89E00, 00C89E60, 00C89E84, 00C89F40

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0$@U=u
API String ID: 2326795674-975001249
Opcode ID: 1d85b7100ce802ecffd9b44a8519ddf4da25a469dc6a464cf95b3cf42172e9af
Instruction ID: 3eb64dfb34c29eac00fee0fdf46ffbc31ca2a88bb2e0c89b0ad75071ad462c52
Opcode Fuzzy Hash: 1d85b7100ce802ecffd9b44a8519ddf4da25a469dc6a464cf95b3cf42172e9af
Instruction Fuzzy Hash: 3102EF30104201AFE729EF14C888BBBBBE4FF49308F08452DF9A5D62A1D735DA45DB5A

Function 00C068DC Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00C06931
__wcsnicmp.LIBCMT ref: 00C06949
__wcsnicmp.LIBCMT ref: 00C06961
__wcsnicmp.LIBCMT ref: 00C06979
__wcsnicmp.LIBCMT ref: 00C06991
__wcsnicmp.LIBCMT ref: 00C069A9
__wcsnicmp.LIBCMT ref: 00C069C1
__wcsnicmp.LIBCMT ref: 00C069D5
__wcsnicmp.LIBCMT ref: 00C06A16
__wcsnicmp.LIBCMT ref: 00C06A2A
__wcsnicmp.LIBCMT ref: 00C06A3E
__wcsnicmp.LIBCMT ref: 00C06A52

Strings

#comments-end, xrefs: 00C06A38
#pragma compile, xrefs: 00C0692B
#notrayicon, xrefs: 00C06943
Cannot parse #include, xrefs: 00C3E3F0
#include, xrefs: 00C069A3
#cs, xrefs: 00C069CF, 00C06A24
#comments-start, xrefs: 00C069BB, 00C06A10
Bad directive syntax error, xrefs: 00C3E31A
#ce, xrefs: 00C06A4C
#requireadmin, xrefs: 00C0695B
#OnAutoItStartRegister, xrefs: 00C06973
Unterminated group of comments, xrefs: 00C3E403
#include-once, xrefs: 00C0698B

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 8c23b1cd928e9478aa70b95abaf8b08e4516aadce96577253003bda214cde56f
Instruction ID: ff490e37258ea5e5bb395bf54fa82780fdb52369d868c040f864bd58c67f13eb
Opcode Fuzzy Hash: 8c23b1cd928e9478aa70b95abaf8b08e4516aadce96577253003bda214cde56f
Instruction Fuzzy Hash: 2B8102B0600216BBDF20BE61EC42FBB7768AF05700F044025F945AA5D2EB71DF66E7A1

Function 00C889D5 Relevance: 40.7, APIs: 21, Strings: 2, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00C88AC1
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00C88AD2
CharNextW.USER32(0000014E), ref: 00C88B01
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00C88B42
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00C88B58
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00C88B69
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00C88B86
SetWindowTextW.USER32(?,0000014E), ref: 00C88BD8
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00C88BEE
SendMessageW.USER32(?,00001002,00000000,?), ref: 00C88C1F
_memset.LIBCMT ref: 00C88C44
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00C88C8D
_memset.LIBCMT ref: 00C88CEC
SendMessageW.USER32(?,00001053,000000FF,?), ref: 00C88D16
SendMessageW.USER32(?,00001074,?,00000001), ref: 00C88D6E
SendMessageW.USER32(?,0000133D,?,?), ref: 00C88E1B
InvalidateRect.USER32(?,00000000,00000001), ref: 00C88E3D
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00C88E87
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00C88EB4
DrawMenuBar.USER32(?), ref: 00C88EC3
SetWindowTextW.USER32(?,0000014E), ref: 00C88EEB

Strings

@U=u, xrefs: 00C88AC1, 00C88AD2, 00C88B07, 00C88B86, 00C88BEE, 00C88C1F, 00C88C8D, 00C88D16, 00C88D6E, 00C88E1B
0, xrefs: 00C88E55

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0$@U=u
API String ID: 1073566785-975001249
Opcode ID: e0fdbad359ab277f4dbc73b36b43bfb82b1d0fe286a684f54d48c21382a04787
Instruction ID: 75d1dadbda6c8f2ba6bae87b44ddc3cbf65005c20ca019cf47ae6520fcdda5bc
Opcode Fuzzy Hash: e0fdbad359ab277f4dbc73b36b43bfb82b1d0fe286a684f54d48c21382a04787
Instruction Fuzzy Hash: E4E1B370900218AFDF20EF51CC84FEE7BB9EF05714F50815AFA25AA590DB709A89DF64

Function 00C8488F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00C849CA
GetDesktopWindow.USER32 ref: 00C849DF
GetWindowRect.USER32(00000000), ref: 00C849E6
GetWindowLongW.USER32(?,000000F0), ref: 00C84A48
DestroyWindow.USER32(?), ref: 00C84A74
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00C84A9D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00C84ABB
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00C84AE1
SendMessageW.USER32(?,00000421,?,?), ref: 00C84AF6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00C84B09
IsWindowVisible.USER32(?), ref: 00C84B29
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00C84B44
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00C84B58
GetWindowRect.USER32(?,?), ref: 00C84B70
MonitorFromPoint.USER32(?,?,00000002), ref: 00C84B96
GetMonitorInfoW.USER32(00000000,?), ref: 00C84BB0
CopyRect.USER32(?,?), ref: 00C84BC7
SendMessageW.USER32(?,00000412,00000000), ref: 00C84C32

Strings

0, xrefs: 00C84975
tooltips_class32, xrefs: 00C84A96
(, xrefs: 00C84BA3

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 3e0e7bd34cf98062f80a51b9ca73a8ff9eba5feb3f40fe5b01954ff83ed6bdc3
Instruction ID: f48c953c3faf00fe0a9b9f63f2f0f4e171a922f29a64e039ed1751d0b28a0ef4
Opcode Fuzzy Hash: 3e0e7bd34cf98062f80a51b9ca73a8ff9eba5feb3f40fe5b01954ff83ed6bdc3
Instruction Fuzzy Hash: 6AB18C71608341AFDB08EF64C844B6ABBE4FF88314F008A1CF5999B2A1D771ED05DB59

Function 00C027D9 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00C028BC
GetSystemMetrics.USER32(00000007), ref: 00C028C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00C028EF
GetSystemMetrics.USER32(00000008), ref: 00C028F7
GetSystemMetrics.USER32(00000004), ref: 00C0291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00C02939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00C02949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00C0297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00C02990
GetClientRect.USER32(00000000,000000FF), ref: 00C029AE
GetStockObject.GDI32(00000011), ref: 00C029CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 00C029D5

Part of subcall function 00C02344: GetCursorPos.USER32(?), ref: 00C02357
Part of subcall function 00C02344: ScreenToClient.USER32(00CC57B0,?), ref: 00C02374
Part of subcall function 00C02344: GetAsyncKeyState.USER32(00000001), ref: 00C02399
Part of subcall function 00C02344: GetAsyncKeyState.USER32(00000002), ref: 00C023A7

SetTimer.USER32(00000000,00000000,00000028,00C01256), ref: 00C029FC

Strings

AutoIt v3 GUI, xrefs: 00C02974
@U=u, xrefs: 00C029D5

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: @U=u$AutoIt v3 GUI
API String ID: 1458621304-2077007950
Opcode ID: 443f3b5d51df346658a5917308b62d78e1fb11d84e970c55bd40541fb66cdcc4
Instruction ID: acd94a76102bf428781013b087f142750b7ad8a153615ca0e50b71e551d867eb
Opcode Fuzzy Hash: 443f3b5d51df346658a5917308b62d78e1fb11d84e970c55bd40541fb66cdcc4
Instruction Fuzzy Hash: 6EB16E75A0020ADFDB14DFA8DC89BAE7BB4FB08314F104229FA15E72D0DB74A951DB54

Function 00C6449A Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 00C64500
_wcscmp.LIBCMT ref: 00C6450B
_wcscat.LIBCMT ref: 00C64521
_wcsstr.LIBCMT ref: 00C6452C
75381560.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 00C64548
_wcscat.LIBCMT ref: 00C64591
_wcscat.LIBCMT ref: 00C64598
_wcsncpy.LIBCMT ref: 00C645C3

Strings

StringFileInfo\, xrefs: 00C6451B
%u.%u.%u.%u, xrefs: 00C64626
04090000, xrefs: 00C6457E
\VarFileInfo\Translation, xrefs: 00C64540
DefaultLangCodepage, xrefs: 00C645AB

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: _wcscat$75381560_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 2056390432-1459072770
Opcode ID: 7207317359d1f05ba7103168a651fb9753f1816338b1a9de576d79e10c0b3bd8
Instruction ID: ff74e7c81a77d287e63450d4ff1d4ab49f3c586b997afb0ad5cbb5ded4ec933d
Opcode Fuzzy Hash: 7207317359d1f05ba7103168a651fb9753f1816338b1a9de576d79e10c0b3bd8
Instruction Fuzzy Hash: 8241F7319002147BDB24BB74EC87EFF776CDF42710F14046AF905E6582EA749A02A7A9

Function 00C8BA33 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00C8BA56
GetFileSize.KERNEL32(00000000,00000000), ref: 00C8BA6D
GlobalAlloc.KERNEL32(00000002,00000000), ref: 00C8BA78
CloseHandle.KERNEL32(00000000), ref: 00C8BA85
GlobalLock.KERNEL32(00000000), ref: 00C8BA8E
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00C8BA9D
GlobalUnlock.KERNEL32(00000000), ref: 00C8BAA6
CloseHandle.KERNEL32(00000000), ref: 00C8BAAD
CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00C8BABE
OleLoadPicture.OLEAUT32(?,00000000,00000000,00C92CAC,?), ref: 00C8BAD7
GlobalFree.KERNEL32(00000000), ref: 00C8BAE7
GetObjectW.GDI32(?,00000018,000000FF), ref: 00C8BB0B
CopyImage.USER32(?,00000000,?,?,00002000), ref: 00C8BB36
DeleteObject.GDI32(00000000), ref: 00C8BB5E
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00C8BB74

Strings

@U=u, xrefs: 00C8BB74

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID: @U=u
API String ID: 3840717409-2594219639
Opcode ID: 2e52d2315ed56ca309ef1de6210085ad424e17067ed72b8e3c8c23dc34c45126
Instruction ID: d3448f76ca5c73a2dd5ad24d8cfa31902dae9089b4399e8f24a88dc13f7b7e4c
Opcode Fuzzy Hash: 2e52d2315ed56ca309ef1de6210085ad424e17067ed72b8e3c8c23dc34c45126
Instruction Fuzzy Hash: 8D412675600209EFDB21AF65DC88FAEBBB8FB89715F104068F915D7260D7309E02DB64

Function 00C5A439 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00C5A47A
__swprintf.LIBCMT ref: 00C5A51B
_wcscmp.LIBCMT ref: 00C5A52E
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00C5A583
_wcscmp.LIBCMT ref: 00C5A5BF
GetClassNameW.USER32(?,?,00000400), ref: 00C5A5F6
GetDlgCtrlID.USER32(?), ref: 00C5A648
GetWindowRect.USER32(?,?), ref: 00C5A67E
GetParent.USER32(?), ref: 00C5A69C
ScreenToClient.USER32(00000000), ref: 00C5A6A3
GetClassNameW.USER32(?,?,00000100), ref: 00C5A71D
_wcscmp.LIBCMT ref: 00C5A731
GetWindowTextW.USER32(?,?,00000400), ref: 00C5A757
_wcscmp.LIBCMT ref: 00C5A76B

Part of subcall function 00C2362C: _iswctype.LIBCMT ref: 00C23634

Strings

%s%u, xrefs: 00C5A515

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 69b5f512917ac0928bdd130ddbf37574cdc6c1aa99e3a434f787dbb72b7c38ef
Instruction ID: 46692ce373217fad766d13b070c729db1bdaf3f396baa3323706c151b92f0917
Opcode Fuzzy Hash: 69b5f512917ac0928bdd130ddbf37574cdc6c1aa99e3a434f787dbb72b7c38ef
Instruction Fuzzy Hash: 56A1C335204606AFD714DF61C884FAAB7E8FF48356F044629FDA9C2150DB30EA99CB96

Function 00C5AED4 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00C5AF18
_wcscmp.LIBCMT ref: 00C5AF29
GetWindowTextW.USER32(00000001,?,00000400), ref: 00C5AF51
CharUpperBuffW.USER32(?,00000000), ref: 00C5AF6E
_wcscmp.LIBCMT ref: 00C5AF8C
_wcsstr.LIBCMT ref: 00C5AF9D
GetClassNameW.USER32(00000018,?,00000400), ref: 00C5AFD5
_wcscmp.LIBCMT ref: 00C5AFE5
GetWindowTextW.USER32(00000002,?,00000400), ref: 00C5B00C
GetClassNameW.USER32(00000018,?,00000400), ref: 00C5B055
_wcscmp.LIBCMT ref: 00C5B065
GetClassNameW.USER32(00000010,?,00000400), ref: 00C5B08D
GetWindowRect.USER32(00000004,?), ref: 00C5B0F6

Strings

@, xrefs: 00C5AEF9
ThumbnailClass, xrefs: 00C5AFE0, 00C5B060

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: 0cb5a8e76b02c2d5089ba3db7d7ac35e576e408d0cb2bd71b8286c0ccf71375a
Instruction ID: a7ecf0b102e48c8fb3aceb28b73a4dfa33bfb68e45e8c4e80d97307dc5f72bc8
Opcode Fuzzy Hash: 0cb5a8e76b02c2d5089ba3db7d7ac35e576e408d0cb2bd71b8286c0ccf71375a
Instruction Fuzzy Hash: F181D1751083059FDB04DF11C881FABBBE8EF94315F048669FD958A092DB34DE89CBA5

Function 00C8A1B9 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C8A259
DestroyWindow.USER32(?,?), ref: 00C8A2D3

Part of subcall function 00C07BCC: _memmove.LIBCMT ref: 00C07C06

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00C8A34D
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00C8A36F
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00C8A382
DestroyWindow.USER32(00000000), ref: 00C8A3A4
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00C00000,00000000), ref: 00C8A3DB
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00C8A3F4
GetDesktopWindow.USER32 ref: 00C8A40D
GetWindowRect.USER32(00000000), ref: 00C8A414
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00C8A42C
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00C8A444

Part of subcall function 00C025DB: GetWindowLongW.USER32(?,000000EB), ref: 00C025EC

Strings

0, xrefs: 00C8A26F
tooltips_class32, xrefs: 00C8A346, 00C8A3D4
@U=u, xrefs: 00C8A36F, 00C8A382, 00C8A3F4, 00C8A41E

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$@U=u$tooltips_class32
API String ID: 1297703922-1130792468
Opcode ID: 4fcbb026232a8d67afbe89ee3f12f543909220274731d863e4f15c1e28b2fbcb
Instruction ID: fe1afaa718e3ff9fd50ea809fc59d6a898895235b07a331d49361a79be027b09
Opcode Fuzzy Hash: 4fcbb026232a8d67afbe89ee3f12f543909220274731d863e4f15c1e28b2fbcb
Instruction Fuzzy Hash: F871CF70141204AFEB25DF28CC49F6B7BE5FB88308F04452EF995872A1D770EA46DB5A

Function 00C5ABD4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00C5AC33

Strings

ALL, xrefs: 00C5ACC7
LAST, xrefs: 00C5ABF8
[REGEXPTITLE:, xrefs: 00C5AC5B
[LAST, xrefs: 00C5ACE0
[HANDLE:, xrefs: 00C5AC3F
ACTIVE, xrefs: 00C5AC0E
HANDLE=, xrefs: 00C5AC2C
REGEXP=, xrefs: 00C5AC48
CLASSNAME=, xrefs: 00C5AC70
[CLASS:, xrefs: 00C5AC83
[ACTIVE, xrefs: 00C5AC20
[ALL, xrefs: 00C5ACD9

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: a1436b3168fe95c64a576574f168c0975eefa8de7e92449f8fbbf85041b7e1f2
Instruction ID: 98477b97d4af99c9643fb089984ab2ff121e8c4bf89dd098c1bd0453e042b919
Opcode Fuzzy Hash: a1436b3168fe95c64a576574f168c0975eefa8de7e92449f8fbbf85041b7e1f2
Instruction Fuzzy Hash: 1B319035948209ABDB14FA61DE03EEE7764AF10712F200729BC52710D1EB627F48F656

Function 00C74FFD Relevance: 25.6, APIs: 17, Instructions: 110COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 00C75013
LoadCursorW.USER32(00000000,00007F00), ref: 00C7501E
LoadCursorW.USER32(00000000,00007F03), ref: 00C75029
LoadCursorW.USER32(00000000,00007F8B), ref: 00C75034
LoadCursorW.USER32(00000000,00007F01), ref: 00C7503F
LoadCursorW.USER32(00000000,00007F81), ref: 00C7504A
LoadCursorW.USER32(00000000,00007F88), ref: 00C75055
LoadCursorW.USER32(00000000,00007F80), ref: 00C75060
LoadCursorW.USER32(00000000,00007F86), ref: 00C7506B
LoadCursorW.USER32(00000000,00007F83), ref: 00C75076
LoadCursorW.USER32(00000000,00007F85), ref: 00C75081
LoadCursorW.USER32(00000000,00007F82), ref: 00C7508C
LoadCursorW.USER32(00000000,00007F84), ref: 00C75097
LoadCursorW.USER32(00000000,00007F04), ref: 00C750A2
LoadCursorW.USER32(00000000,00007F02), ref: 00C750AD
LoadCursorW.USER32(00000000,00007F89), ref: 00C750B8
GetCursorInfo.USER32(?), ref: 00C750C8

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: dbc4e1fb46d3cb50b62ede9e0e27e24905af8ae0ef9a04aed7c90c8d80ffad90
Instruction ID: 3dfab29f26f5001595aacec2d1880db80c5fed4a1bbeaef7f0d22bf32261e83d
Opcode Fuzzy Hash: dbc4e1fb46d3cb50b62ede9e0e27e24905af8ae0ef9a04aed7c90c8d80ffad90
Instruction Fuzzy Hash: 393105B1D483196ADF109FB68C8995FBFE8FF04750F50452AA51DE7280DA786501CF91

Function 00C84392 Relevance: 24.8, APIs: 2, Strings: 12, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00C84424
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00C8446F

Strings

CHECK, xrefs: 00C8448F
EXPAND, xrefs: 00C84521
GETTEXT, xrefs: 00C845C2
GETTOTALCOUNT, xrefs: 00C84456
ISCHECKED, xrefs: 00C845F2
GETSELECTED, xrefs: 00C8457F
GETITEMCOUNT, xrefs: 00C84551
@U=u, xrefs: 00C8446F
SELECT, xrefs: 00C84620
EXISTS, xrefs: 00C844D8
COLLAPSE, xrefs: 00C844B5
UNCHECK, xrefs: 00C8464B

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: @U=u$CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-383632319
Opcode ID: 6a545b41aee76feb60833bf6bbd3da4776e9f2fb9365772dad244c1f5f50edfd
Instruction ID: 55240575c643b3cc37ac39c4386704e91ea9eaabfd3f5eea0157a803d12dd062
Opcode Fuzzy Hash: 6a545b41aee76feb60833bf6bbd3da4776e9f2fb9365772dad244c1f5f50edfd
Instruction Fuzzy Hash: 6D9189702043129FCB08EF10C451A6EB7A1EF95354F548969F8A65B3E3DB30ED4AEB85

Function 00C8B7FE Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00C8B8B4
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00C86B11,?), ref: 00C8B910
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00C8B949
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 00C8B98C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00C8B9C3
FreeLibrary.KERNEL32(?), ref: 00C8B9CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00C8B9DF
DestroyCursor.USER32(?), ref: 00C8B9EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00C8BA0B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00C8BA17

Part of subcall function 00C22EFD: __wcsicmp_l.LIBCMT ref: 00C22F86

Strings

.dll, xrefs: 00C8B86D
.exe, xrefs: 00C8B84A
@U=u, xrefs: 00C8B9F7
.icl, xrefs: 00C8B82A

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Load$Image$LibraryMessageSend$CursorDestroyExtractFreeIcon__wcsicmp_l
String ID: .dll$.exe$.icl$@U=u
API String ID: 3907162815-1639919054
Opcode ID: b5e0d4e7e42c510694d9356ea0d0abdade88fc8f70e1301c74daaff3366ce947
Instruction ID: 48ac5af0a3ee3d40876b7a5da79f03a48b86c601de2f1016d2084c989e14140e
Opcode Fuzzy Hash: b5e0d4e7e42c510694d9356ea0d0abdade88fc8f70e1301c74daaff3366ce947
Instruction Fuzzy Hash: F361F071500219BBEB24EF64DC41FBE7BB8EB08715F104219F921D61C1DB74AE81DBA4

Function 00C6A352 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00C09837: __itow.LIBCMT ref: 00C09862
Part of subcall function 00C09837: __swprintf.LIBCMT ref: 00C098AC

CharLowerBuffW.USER32(?,?), ref: 00C6A3CB
GetDriveTypeW.KERNEL32 ref: 00C6A418
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00C6A460
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00C6A497
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00C6A4C5

Part of subcall function 00C07BCC: _memmove.LIBCMT ref: 00C07C06

Strings

closed, xrefs: 00C6A3DF, 00C6A3E8
wait, xrefs: 00C6A482
close, xrefs: 00C6A3D1
open, xrefs: 00C6A3F2
open , xrefs: 00C6A427
type cdaudio alias cd wait, xrefs: 00C6A443
close cd wait, xrefs: 00C6A4B0
set cd door , xrefs: 00C6A466

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 1fcebb74c0d97505f531af3ccbee04721a3ef4accde2f89542785aae90de0e94
Instruction ID: 0ec348839ed85c995b1bc51fb2aecf273fc092202aeb708ae46bd996899ec8b9
Opcode Fuzzy Hash: 1fcebb74c0d97505f531af3ccbee04721a3ef4accde2f89542785aae90de0e94
Instruction Fuzzy Hash: 0D514F715083059FC704EF10C89196AB7E8FF94758F10896DF89A672A2DB31EE0ADF52

Function 00C5F8AA Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000000,?,00C3E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000), ref: 00C5F8DF
LoadStringW.USER32(00000000,?,00C3E029,00000001), ref: 00C5F8E8

Part of subcall function 00C07DE1: _memmove.LIBCMT ref: 00C07E22

GetModuleHandleW.KERNEL32(00000000,00CC5310,?,00000FFF,?,?,00C3E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000,00000001), ref: 00C5F90A
LoadStringW.USER32(00000000,?,00C3E029,00000001), ref: 00C5F90D
__swprintf.LIBCMT ref: 00C5F95D
__swprintf.LIBCMT ref: 00C5F96E
_wprintf.LIBCMT ref: 00C5FA17
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00C5FA2E

Strings

^ ERROR, xrefs: 00C5F9C3
Line %d (File "%s"):, xrefs: 00C5F957
%s (%d) : ==> %s: %s %s, xrefs: 00C5FA12
Line %d:, xrefs: 00C5F968
Error: , xrefs: 00C5F9E5

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: ff505a24b402c7cb65d34e13dacd8e40e07456c03daf37c63f3951fae4d2084a
Instruction ID: f63ea2c9dae755b246ee9f6d0bc472f9dc4790a28cf1e479e4b3a8e25484f0fd
Opcode Fuzzy Hash: ff505a24b402c7cb65d34e13dacd8e40e07456c03daf37c63f3951fae4d2084a
Instruction Fuzzy Hash: 2D412C72C04219ABCF09FBE0DD86EEEB778AF14301F100165B60576092EA356F4AEB65

Function 00C6D899 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00C6DA10
_wcscat.LIBCMT ref: 00C6DA28
_wcscat.LIBCMT ref: 00C6DA3A
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00C6DA4F
SetCurrentDirectoryW.KERNEL32(?), ref: 00C6DA63
GetFileAttributesW.KERNEL32(?), ref: 00C6DA7B
SetFileAttributesW.KERNEL32(?,00000000), ref: 00C6DA95
SetCurrentDirectoryW.KERNEL32(?), ref: 00C6DAA7

Strings

*.*, xrefs: 00C6DAE6

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: 3ff8345ac028ac0936938be541aaa516d98bca20a7f2fee35ad8399c9833d359
Instruction ID: 7e07664624e361ed3800dfbdfb2801c876b3f363c1c94bf464dab35afaba8850
Opcode Fuzzy Hash: 3ff8345ac028ac0936938be541aaa516d98bca20a7f2fee35ad8399c9833d359
Instruction Fuzzy Hash: 53816471A083419FCB34DF65C884A6AB7E4EF89710F188D2EF49ACB251DA30DA45DB52

Function 00C7731A Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00C7738F
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00C7739B
CreateCompatibleDC.GDI32(?), ref: 00C773A7
SelectObject.GDI32(00000000,?), ref: 00C773B4
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00C77408
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 00C77444
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00C77468
SelectObject.GDI32(00000006,?), ref: 00C77470
DeleteObject.GDI32(?), ref: 00C77479
DeleteDC.GDI32(00000006), ref: 00C77480
ReleaseDC.USER32(00000000,?), ref: 00C7748B

Strings

(, xrefs: 00C77410

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 2682215fd984bbca5232e4634e7b0794c7ae62276a226310b4a9083f76e3f019
Instruction ID: 145bcd46b29266c7cc444506a21d81e6005e2ba7c5d5368aeeeb9dd121fb7620
Opcode Fuzzy Hash: 2682215fd984bbca5232e4634e7b0794c7ae62276a226310b4a9083f76e3f019
Instruction Fuzzy Hash: 25515875904209EFCB14CFA8CC85FAEBBB9EF48310F14852DF959A7221C731A9419B50

Function 00C64F75 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00C64F7A

Part of subcall function 00C2049F: timeGetTime.WINMM(?,753DB400,00C10E7B), ref: 00C204A3

Sleep.KERNEL32(0000000A), ref: 00C64FA6
EnumThreadWindows.USER32(?,Function_00064F28,00000000), ref: 00C64FCA
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 00C64FEC
SetActiveWindow.USER32 ref: 00C6500B
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00C65019
SendMessageW.USER32(00000010,00000000,00000000), ref: 00C65038
Sleep.KERNEL32(000000FA), ref: 00C65043
IsWindow.USER32 ref: 00C6504F
EndDialog.USER32(00000000), ref: 00C65060

Strings

BUTTON, xrefs: 00C64FDE
@U=u, xrefs: 00C65019, 00C65038

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: @U=u$BUTTON
API String ID: 1194449130-2582809321
Opcode ID: a5b1a5ef4e7fcce6fe65d7c11d093a45bc890cf7971bc180c53de776c401df15
Instruction ID: 7bff85f136f78167d9c4db6965b99471e934d3fbaf5cac4eb5fa33cec5c5d996
Opcode Fuzzy Hash: a5b1a5ef4e7fcce6fe65d7c11d093a45bc890cf7971bc180c53de776c401df15
Instruction Fuzzy Hash: 00218970604605AFE7205F60EDC9F2E3BA9EF49745F241038F102C22B1DB719E519B66

Function 00C06A8C Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00C20957: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00C06B0C,?,00008000), ref: 00C20973

Part of subcall function 00C04750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00C04743,?,?,00C037AE,?), ref: 00C04770

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00C06BAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00C06CFA

Part of subcall function 00C0586D: _wcscpy.LIBCMT ref: 00C058A5

Part of subcall function 00C2363D: _iswctype.LIBCMT ref: 00C23645

Strings

#include depth exceeded. Make sure there are no recursive includes, xrefs: 00C3E421
Bad directive syntax error, xrefs: 00C3E79D
AU3!, xrefs: 00C06B61
>>>AUTOIT SCRIPT<<<, xrefs: 00C3E496
Error opening the file, xrefs: 00C3E43D, 00C3E4B8
Unterminated string, xrefs: 00C3E7E4
EA06, xrefs: 00C3E452

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: 77abe25e25af130f58d7a06f1ddc1e94713a7c33b7cb362aac8ba16a0bb4e530
Instruction ID: 35ecba1fc61bb03b17b97f4e05f94ac7e8ce702d833bc1f1d4503987fc986f7f
Opcode Fuzzy Hash: 77abe25e25af130f58d7a06f1ddc1e94713a7c33b7cb362aac8ba16a0bb4e530
Instruction Fuzzy Hash: F8029D705083419FC724EF24C881AAFBBE5EF99314F14492DF496972E2DB30DA49DB52

Function 00C62D36 Relevance: 19.7, APIs: 13, Instructions: 214windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C62D50
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00C62DDD
GetMenuItemCount.USER32(00CC5890), ref: 00C62E66
DeleteMenu.USER32(00CC5890,00000005,00000000,000000F5,?,?), ref: 00C62EF6
DeleteMenu.USER32(00CC5890,00000004,00000000), ref: 00C62EFE
DeleteMenu.USER32(00CC5890,00000006,00000000), ref: 00C62F06
DeleteMenu.USER32(00CC5890,00000003,00000000), ref: 00C62F0E
GetMenuItemCount.USER32(00CC5890), ref: 00C62F16
SetMenuItemInfoW.USER32(00CC5890,00000004,00000000,00000030), ref: 00C62F4C
GetCursorPos.USER32(?), ref: 00C62F56
SetForegroundWindow.USER32(00000000), ref: 00C62F5F
TrackPopupMenuEx.USER32(00CC5890,00000000,?,00000000,00000000,00000000), ref: 00C62F72
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00C62F7E

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: 7bf2b4fa3a88e00f5d279a1e46ed791de56f6cf1236de525e9a663ee06ddf00b
Instruction ID: ace8b1c01833481a49fee3c797d945d2cfb3943ec1590339b7ea2aece4af9692
Opcode Fuzzy Hash: 7bf2b4fa3a88e00f5d279a1e46ed791de56f6cf1236de525e9a663ee06ddf00b
Instruction Fuzzy Hash: 7E71F470605A15BBEB319F54DCC9FAABF64FF04324F10022AF625AA1E0C7726D20DB95

Function 00C577DC Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00C07BCC: _memmove.LIBCMT ref: 00C07C06

_memset.LIBCMT ref: 00C5786B
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00C578A0
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00C578BC
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00C578D8
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00C57902
CLSIDFromString.COMBASE(?,?), ref: 00C5792A
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00C57935
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00C5793A

Strings

\IPC$, xrefs: 00C57882
SOFTWARE\Classes\, xrefs: 00C5780C
\CLSID, xrefs: 00C57822

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: ff5b6d501e9e7247f0b6306978b44bc253621e290f75ef833212ce70668dd1ee
Instruction ID: 2dbed3da5580a77ddfc0c88a55e289104172d61bb839fd580bd00d606e558c96
Opcode Fuzzy Hash: ff5b6d501e9e7247f0b6306978b44bc253621e290f75ef833212ce70668dd1ee
Instruction Fuzzy Hash: 6F412976C14229ABCF15EBA4EC45DEEB778BF04304F004229F915B31A1DB316E49DBA4

Function 00C80E1A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C7FDAD,?,?), ref: 00C80E31

Strings

HKCC, xrefs: 00C80EFF
HKLM, xrefs: 00C80EAF
HKU, xrefs: 00C80F43
HKEY_LOCAL_MACHINE, xrefs: 00C80E9A
HKEY_CURRENT_CONFIG, xrefs: 00C80EEE
HKEY_USERS, xrefs: 00C80F32
HKCU, xrefs: 00C80F21
HKEY_CLASSES_ROOT, xrefs: 00C80EC4
HKEY_CURRENT_USER, xrefs: 00C80F10
HKCR, xrefs: 00C80ED9

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: a46e8e67f2d5f57b9c11d0f94420ea8abcdbc664bf9d40645b169ec953697395
Instruction ID: bbfdda1530a03f82dce4fa2951082846e70a0726c0487e94aff0198f11011dfc
Opcode Fuzzy Hash: a46e8e67f2d5f57b9c11d0f94420ea8abcdbc664bf9d40645b169ec953697395
Instruction Fuzzy Hash: B8416D7110025A8BCF60EF50E895AEF3764FF12308F644465FE651B692DB30AE1AEB60

Function 00C874BB Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00C8755E
CreateCompatibleDC.GDI32(00000000), ref: 00C87565
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00C87578
SelectObject.GDI32(00000000,00000000), ref: 00C87580
GetPixel.GDI32(00000000,00000000,00000000), ref: 00C8758B
DeleteDC.GDI32(00000000), ref: 00C87594
GetWindowLongW.USER32(?,000000EC), ref: 00C8759E
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00C875B2
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00C875BE

Strings

@U=u, xrefs: 00C87578
static, xrefs: 00C874F6

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: @U=u$static
API String ID: 2559357485-3553413495
Opcode ID: bf346c4891501f8b843c2ce0582606d935180995bfb1485560d9ee516e8b8e2b
Instruction ID: 3daf5b1e414bce84799fa9becda1259a46d75a48743eb90440213e2990b41a19
Opcode Fuzzy Hash: bf346c4891501f8b843c2ce0582606d935180995bfb1485560d9ee516e8b8e2b
Instruction Fuzzy Hash: 1D316C32104214BBDF12AF64DC08FDE3B69EF49324F210329FA25961A0D731D912DBA8

Function 00C5F7A1 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00C3E2A0,00000010,?,Bad directive syntax error,00C8F910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 00C5F7C2
LoadStringW.USER32(00000000,?,00C3E2A0,00000010), ref: 00C5F7C9

Part of subcall function 00C07DE1: _memmove.LIBCMT ref: 00C07E22

_wprintf.LIBCMT ref: 00C5F7FC
__swprintf.LIBCMT ref: 00C5F81E
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 00C5F88D

Strings

Line %d (File "%s"):, xrefs: 00C5F833
%s (%d) : ==> %s.: %s %s, xrefs: 00C5F7F7
Line %d:, xrefs: 00C5F818
Error: , xrefs: 00C5F85B
., xrefs: 00C5F873

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1506413516-4153970271
Opcode ID: ca42cfeab7d00e9364357ceb04f511e7e7e376be283f2086f8515724bb90aabd
Instruction ID: efa69afb750b07a1698812968f35a967f1200b86832023ba678966a87b646646
Opcode Fuzzy Hash: ca42cfeab7d00e9364357ceb04f511e7e7e376be283f2086f8515724bb90aabd
Instruction Fuzzy Hash: 23217C3290021EFFCF15EF90CC0AEEE7739BF18304F040469F515660A2EA31AA59EB55

Function 00C652C7 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00C07BCC: _memmove.LIBCMT ref: 00C07C06

Part of subcall function 00C07924: _memmove.LIBCMT ref: 00C079AD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00C65330
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00C65346
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00C65357
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00C65369
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00C6537A

Strings

close PlayMe, xrefs: 00C65341, 00C6536E
alias PlayMe, xrefs: 00C65309
open , xrefs: 00C652DF
status PlayMe mode, xrefs: 00C6532B
play PlayMe, xrefs: 00C65375
play PlayMe wait, xrefs: 00C65364

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 177811cdc1dfd8f3edf45556a05b456d7ce0056759ad801ea516b88b8d106b37
Instruction ID: b006f0921251b95ed239035fb7b0346257d0b2a89e28cbf2d975c3fb0bd515f2
Opcode Fuzzy Hash: 177811cdc1dfd8f3edf45556a05b456d7ce0056759ad801ea516b88b8d106b37
Instruction Fuzzy Hash: AD118231E501697AD724B761CC4ADFF7B7CEB91F44F100539B411A21E1EEA01D09C6B0

Function 00C646B7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000101,?), ref: 00C646D2
gethostname.WS2_32(?,00000100), ref: 00C646EC
gethostbyname.WS2_32(?), ref: 00C646F9
_wcscpy.LIBCMT ref: 00C64721
_memmove.LIBCMT ref: 00C64734
inet_ntoa.WS2_32(?), ref: 00C6473F
_strcat.LIBCMT ref: 00C6474D
_wcscpy.LIBCMT ref: 00C64764
WSACleanup.WS2_32 ref: 00C64772
_wcscpy.LIBCMT ref: 00C64780

Strings

0.0.0.0, xrefs: 00C6471B

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: d8bbeefb623b232158b5cac859d5cdd8b79fbcfa0485f17c9dcc61780b448a7f
Instruction ID: 74a5278c6f4de2c53f52bab25b0051cc1c822e4e732dce64f7aaf09b93156b4a
Opcode Fuzzy Hash: d8bbeefb623b232158b5cac859d5cdd8b79fbcfa0485f17c9dcc61780b448a7f
Instruction Fuzzy Hash: 7E11B431504114AFDB28AB70AC8AFEE77BCEF02711F1401BAF455960A1EF759AC2DB54

Function 00C6D58D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00C09837: __itow.LIBCMT ref: 00C09862
Part of subcall function 00C09837: __swprintf.LIBCMT ref: 00C098AC

CoInitialize.OLE32(00000000), ref: 00C6D5EA
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 00C6D67D
SHGetDesktopFolder.SHELL32(?), ref: 00C6D691
CoCreateInstance.COMBASE(00C92D7C,00000000,00000001,00CB8C1C,?), ref: 00C6D6DD
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 00C6D74C
CoTaskMemFree.COMBASE(?), ref: 00C6D7A4
_memset.LIBCMT ref: 00C6D7E1
SHBrowseForFolderW.SHELL32(?), ref: 00C6D81D
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00C6D840
CoTaskMemFree.COMBASE(00000000), ref: 00C6D847
CoTaskMemFree.COMBASE(00000000), ref: 00C6D87E
CoUninitialize.COMBASE ref: 00C6D880

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: a0983421fabdf686ead5e4804f8d4cf0e1e644ee5bdc64791e9674af3accf59b
Instruction ID: f05869bc15d8aaf9990bffe2976c3c2f075f0e09786fbfb2a98114fd93aeff6b
Opcode Fuzzy Hash: a0983421fabdf686ead5e4804f8d4cf0e1e644ee5bdc64791e9674af3accf59b
Instruction Fuzzy Hash: C7B11E75A00109AFDB14DF64C888EAEBBB9FF49314F148469F90AEB261DB30ED45DB50

Function 00C5C267 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00C5C283
GetWindowRect.USER32(00000000,?), ref: 00C5C295
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00C5C2F3
GetDlgItem.USER32(?,00000002), ref: 00C5C2FE
GetWindowRect.USER32(00000000,?), ref: 00C5C310
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00C5C364
GetDlgItem.USER32(?,000003E9), ref: 00C5C372
GetWindowRect.USER32(00000000,?), ref: 00C5C383
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00C5C3C6
GetDlgItem.USER32(?,000003EA), ref: 00C5C3D4
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00C5C3F1
InvalidateRect.USER32(?,00000000,00000001), ref: 00C5C3FE

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 6c785cb29542a6027a8813bad964517c87eaee8e2aec58764160ba2b9dd3d7f8
Instruction ID: 4aeeb0546d88fe90c6da89acd55493172dca4a74c6c27ed56c0993d09a00b03e
Opcode Fuzzy Hash: 6c785cb29542a6027a8813bad964517c87eaee8e2aec58764160ba2b9dd3d7f8
Instruction Fuzzy Hash: 48517075B00305AFDB08CFA9DD89BAEBBB6EB88311F14812DF915D72A0D7709E448B14

Function 00C021A5 Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00C025DB: GetWindowLongW.USER32(?,000000EB), ref: 00C025EC

GetSysColor.USER32(0000000F), ref: 00C021D3

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 4feb9a82e605008cda6bf62cffe97818e0c90e704737c21cdd66ebd89c35af5a
Instruction ID: 7d1858f8d7f8e01d8fe8a9bfd8fec8feaccc6cfad33b2050db9fbd8c681c5a4f
Opcode Fuzzy Hash: 4feb9a82e605008cda6bf62cffe97818e0c90e704737c21cdd66ebd89c35af5a
Instruction Fuzzy Hash: 02419131100140EBDB255F68DC8CBBD3B65EB46331F244269FE758A1E1C7318E82DB25

Function 00C6A8A7 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,00C8F910), ref: 00C6A90B
GetDriveTypeW.KERNEL32(00000061,00CB89A0,00000061), ref: 00C6A9D5
_wcscpy.LIBCMT ref: 00C6A9FF

Strings

all, xrefs: 00C6A911
removable, xrefs: 00C6A93D
fixed, xrefs: 00C6A953
unknown, xrefs: 00C6A996
cdrom, xrefs: 00C6A927
network, xrefs: 00C6A969
ramdisk, xrefs: 00C6A97F

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 69e2da24be7473d9b68ad9e1d6f802db084b7172ea6527971bced54907136971
Instruction ID: f3e5e844d6d87a48037e2bbf7d60bc96aa43daf369ef38a7075f2c07ff824638
Opcode Fuzzy Hash: 69e2da24be7473d9b68ad9e1d6f802db084b7172ea6527971bced54907136971
Instruction Fuzzy Hash: 7A51AE31508301ABC724EF14D8D2AAFB7A5EF84704F64482EF595672E2DB319A09EF53

Function 00C88645 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00C886FF

Strings

@U=u, xrefs: 00C88735

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: InvalidateRect
String ID: @U=u
API String ID: 634782764-2594219639
Opcode ID: 251589e102ebe9ee89ef05e7c1867a446b7e479dd3a9535e8789ec8381cc9a0e
Instruction ID: 9d1fa5eb8f407506404c1874fa1efa2dd2e2fb8afda50abe877e71c75d5b1746
Opcode Fuzzy Hash: 251589e102ebe9ee89ef05e7c1867a446b7e479dd3a9535e8789ec8381cc9a0e
Instruction Fuzzy Hash: 3751B670500244FFEF20AB25CC89F5D7BA4EB05728FA04115FA21D69E1DF71AE88DB58

Function 00C02B72 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00C3C2F7
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00C3C319
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00C3C331
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00C3C34F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00C3C370
DestroyCursor.USER32(00000000), ref: 00C3C37F
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00C3C39C
DestroyCursor.USER32(?), ref: 00C3C3AB

Part of subcall function 00C8A4AF: DeleteObject.GDI32(00000000), ref: 00C8A4E8

Strings

@U=u, xrefs: 00C3C370, 00C3C39C

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: CursorDestroyExtractIconImageLoadMessageSend$DeleteObject
String ID: @U=u
API String ID: 2975913752-2594219639
Opcode ID: 21da8513c2aa2c3372869445477fa15c93b41d2d4bba1718d56a58ee1bd5fdfb
Instruction ID: 58610d9af32832b9e96526dd09085ebc13ffe1bb1ea62c54ef8a2c0e22028154
Opcode Fuzzy Hash: 21da8513c2aa2c3372869445477fa15c93b41d2d4bba1718d56a58ee1bd5fdfb
Instruction Fuzzy Hash: 1F514870A10609AFEB24DF65CC89FAE7BB5EB58310F104529F912E72E0D770A991EB50

Function 00C09837 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00C09862
__swprintf.LIBCMT ref: 00C098AC
__i64tow.LIBCMT ref: 00C3F5E6

Strings

%.15g, xrefs: 00C098A6
0x%p, xrefs: 00C3F5C8
True, xrefs: 00C3F5A7
False, xrefs: 00C3F5AE

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: c9edb1ed3b0f768aaaf25b46bc6563004a92e22ce0664ee49e6e3cbfc7081ea0
Instruction ID: 5d7f3fdae41bd3c6e43cd3c0537cb1c36fc16b5168371ae8376096c22f995b9b
Opcode Fuzzy Hash: c9edb1ed3b0f768aaaf25b46bc6563004a92e22ce0664ee49e6e3cbfc7081ea0
Instruction Fuzzy Hash: CE41C371914205AFDB24EF35D846F7A73E8EF05300F20497EE559D62D2EA31AA42DB10

Function 00C87152 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C8716A
CreateMenu.USER32 ref: 00C87185
SetMenu.USER32(?,00000000), ref: 00C87194
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C87221
IsMenu.USER32(?), ref: 00C87237
CreatePopupMenu.USER32 ref: 00C87241
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00C8726E
DrawMenuBar.USER32 ref: 00C87276

Strings

F, xrefs: 00C87262
0, xrefs: 00C87160

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F
API String ID: 176399719-3044882817
Opcode ID: c8b5f0dacb7b33a23905dda484b0143ff46222a468232eaa0546b1ae017152ad
Instruction ID: fcdc9d9c2bd35dfe620bc42386c781dd9f7fe1105891f99c3a646c3bce083fe3
Opcode Fuzzy Hash: c8b5f0dacb7b33a23905dda484b0143ff46222a468232eaa0546b1ae017152ad
Instruction Fuzzy Hash: A7415A75A01205EFDB10EFA4D888F9ABBB5FF49314F240128F925A7361E731AA10CF94

Function 00C58F8F Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C07DE1: _memmove.LIBCMT ref: 00C07E22

Part of subcall function 00C5AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00C5AABC

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00C59014
GetDlgCtrlID.USER32 ref: 00C5901F
GetParent.USER32 ref: 00C5903B
SendMessageW.USER32(00000000,?,00000111,?), ref: 00C5903E
GetDlgCtrlID.USER32(?), ref: 00C59047
GetParent.USER32(?), ref: 00C59063
SendMessageW.USER32(00000000,?,?,00000111), ref: 00C59066

Strings

ListBox, xrefs: 00C58FD1
@U=u, xrefs: 00C59066
ComboBox, xrefs: 00C58F9C

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: @U=u$ComboBox$ListBox
API String ID: 1536045017-2258501812
Opcode ID: 007853deff61b8d4796911ecc349b58129ceb289e018a92e6eb0bbc2bdcf579a
Instruction ID: affbeec9d2388a9d244453f239475b9b20dcda1d5b32769e0dfdf137bfd0fc4a
Opcode Fuzzy Hash: 007853deff61b8d4796911ecc349b58129ceb289e018a92e6eb0bbc2bdcf579a
Instruction Fuzzy Hash: 7121C474A00108BFDF04ABA0CC85FFEBB74EF89310F100269B921972E1EB755959EB24

Function 00C5907A Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C07DE1: _memmove.LIBCMT ref: 00C07E22

Part of subcall function 00C5AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00C5AABC

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00C590FD
GetDlgCtrlID.USER32 ref: 00C59108
GetParent.USER32 ref: 00C59124
SendMessageW.USER32(00000000,?,00000111,?), ref: 00C59127
GetDlgCtrlID.USER32(?), ref: 00C59130
GetParent.USER32(?), ref: 00C5914C
SendMessageW.USER32(00000000,?,?,00000111), ref: 00C5914F

Strings

ListBox, xrefs: 00C590BC
@U=u, xrefs: 00C5914F
ComboBox, xrefs: 00C59087

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: @U=u$ComboBox$ListBox
API String ID: 1536045017-2258501812
Opcode ID: 29b456a9ee38dce3a58bda88edb0383ae18109e4993f9d7285c96c508fef1472
Instruction ID: a5b176aa43ced40f439ccdc0564c9ebb25859e1fd09995b81e16291d3af692a3
Opcode Fuzzy Hash: 29b456a9ee38dce3a58bda88edb0383ae18109e4993f9d7285c96c508fef1472
Instruction Fuzzy Hash: 6021C474A00118BBDF00ABA1CC85FFEBB74EF48300F100159B911972E2DB755559EF24

Function 00C59163 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00C5916F
GetClassNameW.USER32(00000000,?,00000100), ref: 00C59184
_wcscmp.LIBCMT ref: 00C59196
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00C59211

Strings

largeicons, xrefs: 00C591A5
list, xrefs: 00C591F3
details, xrefs: 00C591BF
SHELLDLL_DefView, xrefs: 00C59190
smallicons, xrefs: 00C591D9
@U=u, xrefs: 00C59211

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: @U=u$SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-1428604138
Opcode ID: cf1f4088bad0a8519b112f0f17954643b50de51ece1d645282a27d50a2ae8bd3
Instruction ID: cddc52771766a2d4394928bf70f98746a8849bad4720deefdbd6077dd4ed6806
Opcode Fuzzy Hash: cf1f4088bad0a8519b112f0f17954643b50de51ece1d645282a27d50a2ae8bd3
Instruction Fuzzy Hash: 21115C3E648317F9FA202624EC0AEEB379CDB11322F200176FD10E04E1FE7159957658

Function 00C26E03 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C26E3E

Part of subcall function 00C28B28: __getptd_noexit.LIBCMT ref: 00C28B28

__gmtime64_s.LIBCMT ref: 00C26ED7
__gmtime64_s.LIBCMT ref: 00C26F0D
__gmtime64_s.LIBCMT ref: 00C26F2A
__allrem.LIBCMT ref: 00C26F80
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00C26F9C
__allrem.LIBCMT ref: 00C26FB3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00C26FD1
__allrem.LIBCMT ref: 00C26FE8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00C27006
__invoke_watson.LIBCMT ref: 00C27077

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction ID: bc70c3988de69e12adfa2f4eb632f1f2212de67906eb0d04bc6e10cb7d4bb151
Opcode Fuzzy Hash: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction Fuzzy Hash: 9A712A76A00727ABD714DF78EC81B5AB3A4AF04324F144239F424D7A81E770EE449790

Function 00C62527 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C62542
GetMenuItemInfoW.USER32(00CC5890,000000FF,00000000,00000030), ref: 00C625A3
SetMenuItemInfoW.USER32(00CC5890,00000004,00000000,00000030), ref: 00C625D9
Sleep.KERNEL32(000001F4), ref: 00C625EB
GetMenuItemCount.USER32(?), ref: 00C6262F
GetMenuItemID.USER32(?,00000000), ref: 00C6264B
GetMenuItemID.USER32(?,-00000001), ref: 00C62675
GetMenuItemID.USER32(?,?), ref: 00C626BA
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00C62700
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C62714
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C62735

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 4f63620320329c5436fea54bfa8f9e85c04819ef7708ecfb0e3670c41bd43dbb
Instruction ID: e9a41794809897737e1b29ffdaac6c5a26d9fa941c1cd05e4bb55e8491b5b400
Opcode Fuzzy Hash: 4f63620320329c5436fea54bfa8f9e85c04819ef7708ecfb0e3670c41bd43dbb
Instruction Fuzzy Hash: 4061AEB0900A49AFDB31CFA4DCC8EBE7BB8EB01344F140069F852A7251D731AE46DB21

Function 00C86F23 Relevance: 16.7, APIs: 11, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00C86FA5
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00C86FA8
GetWindowLongW.USER32(?,000000F0), ref: 00C86FCC
_memset.LIBCMT ref: 00C86FDD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00C86FEF
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00C87067

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: fffdb3a9c45c1b5a694e36e59a0766fbbf5858baa4db9bf3d1dfaa3cbd2dc872
Instruction ID: 3298a11592c06188cded55f8290b91cea3c15a3765826363f9dee29b747546d0
Opcode Fuzzy Hash: fffdb3a9c45c1b5a694e36e59a0766fbbf5858baa4db9bf3d1dfaa3cbd2dc872
Instruction Fuzzy Hash: 13617A71900208AFDB11DFA4CC85FEE77B8EB09714F200159FA14EB2A1D771AE41DB94

Function 00C56B98 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00C56BBF
SafeArrayAllocData.OLEAUT32(?), ref: 00C56C18
VariantInit.OLEAUT32(?), ref: 00C56C2A
SafeArrayAccessData.OLEAUT32(?,?), ref: 00C56C4A
VariantCopy.OLEAUT32(?,?), ref: 00C56C9D
SafeArrayUnaccessData.OLEAUT32(?), ref: 00C56CB1
VariantClear.OLEAUT32(?), ref: 00C56CC6
SafeArrayDestroyData.OLEAUT32(?), ref: 00C56CD3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00C56CDC
VariantClear.OLEAUT32(?), ref: 00C56CEE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00C56CF9

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: da89e415a81a502bd746314d616025650117e81434d598d56c5c815f83fbe320
Instruction ID: 013b27b891314e267588547d3f98c5976e2c7be0fbaba6290c468c386901ddf0
Opcode Fuzzy Hash: da89e415a81a502bd746314d616025650117e81434d598d56c5c815f83fbe320
Instruction Fuzzy Hash: 0E4154759001199FCF00DF64D844AAEBBB9EF48351F408069E955E7361CB30EA8ADF94

Function 00C783BB Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00C09837: __itow.LIBCMT ref: 00C09862
Part of subcall function 00C09837: __swprintf.LIBCMT ref: 00C098AC

CoInitialize.OLE32 ref: 00C78403
CoUninitialize.COMBASE ref: 00C7840E
CoCreateInstance.COMBASE(?,00000000,00000017,00C92BEC,?), ref: 00C7846E
IIDFromString.COMBASE(?,?), ref: 00C784E1
VariantInit.OLEAUT32(?), ref: 00C7857B
VariantClear.OLEAUT32(?), ref: 00C785DC

Strings

NULL Pointer assignment, xrefs: 00C784B3
Invalid parameter, xrefs: 00C784FA
Failed to create object, xrefs: 00C78479, 00C7852F

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: ab25bc23d764568f5571d905c905a525a371b11fca832ee2ee82a50585de8fcb
Instruction ID: c4aa80639b773f4e1c671ae0fc1b34d46c1137cd3439b2694fd20e60fd873f3e
Opcode Fuzzy Hash: ab25bc23d764568f5571d905c905a525a371b11fca832ee2ee82a50585de8fcb
Instruction Fuzzy Hash: 9961AE706483129FD710DF65C84CB6EB7E8AF49754F00851DFA9A9B291CB70EE48CB92

Function 00C02E26 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00C02EAE

Part of subcall function 00C01DB3: GetClientRect.USER32(?,?), ref: 00C01DDC
Part of subcall function 00C01DB3: GetWindowRect.USER32(?,?), ref: 00C01E1D
Part of subcall function 00C01DB3: ScreenToClient.USER32(?,?), ref: 00C01E45

GetDC.USER32 ref: 00C3CD32
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00C3CD45
SelectObject.GDI32(00000000,00000000), ref: 00C3CD53
SelectObject.GDI32(00000000,00000000), ref: 00C3CD68
ReleaseDC.USER32(?,00000000), ref: 00C3CD70
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00C3CDFB

Strings

U, xrefs: 00C3CCD0
@U=u, xrefs: 00C3CD45

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: @U=u$U
API String ID: 4009187628-4110099822
Opcode ID: 4b9fa1ba40f0f65cd62496406eec2c5d7a975079cb3badfa39a77ee2a0aba040
Instruction ID: e429f150055628e0367e483edbc6a22a225eae96a60df8f8ad7129ea9bb54f9b
Opcode Fuzzy Hash: 4b9fa1ba40f0f65cd62496406eec2c5d7a975079cb3badfa39a77ee2a0aba040
Instruction Fuzzy Hash: DF71DF31510209DFCF219F64C8C4AAE7BB5FF48321F14426AFD65AA2A6D7319A81DB60

Function 00C75732 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000101,?), ref: 00C75793
inet_addr.WS2_32(?), ref: 00C757D8
gethostbyname.WS2_32(?), ref: 00C757E4
IcmpCreateFile.IPHLPAPI ref: 00C757F2
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00C75862
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00C75878
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00C758ED
WSACleanup.WS2_32 ref: 00C758F3

Strings

Ping, xrefs: 00C75816

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: c44a866bf12a5da913d976923a55963a27e87173039029a2ff38094add801120
Instruction ID: 81151d47126a1b7f9cb7f9de7e7ea1eef4713cbc4544012270a6e5c012428f5c
Opcode Fuzzy Hash: c44a866bf12a5da913d976923a55963a27e87173039029a2ff38094add801120
Instruction Fuzzy Hash: A0518E316446009FDB109F25DC49B2A7BE4EF48720F148529F96ADB2E1DB70E905DB46

Function 00C6B4C3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C6B4D0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00C6B546
GetLastError.KERNEL32 ref: 00C6B550
SetErrorMode.KERNEL32(00000000,READY), ref: 00C6B5BD

Strings

NOTREADY, xrefs: 00C6B57C
READONLY, xrefs: 00C6B588
UNKNOWN, xrefs: 00C6B575
READY, xrefs: 00C6B596
INVALID, xrefs: 00C6B58F

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 9c3bcb8564fdd73d3afce467f7161cc9400985fed899948cab50a9ecb58be943
Instruction ID: 1477b54c86540d80fef70be94121e0411608db6d3b81946af0d482e24d24aec6
Opcode Fuzzy Hash: 9c3bcb8564fdd73d3afce467f7161cc9400985fed899948cab50a9ecb58be943
Instruction Fuzzy Hash: A0318135A002059FCB20EBA8CC85FEE77B4FF05310F104165E516D7291DB719E86DB51

Function 00C861D3 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00C861EB
GetDC.USER32(00000000), ref: 00C861F3
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00C861FE
ReleaseDC.USER32(00000000,00000000), ref: 00C8620A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 00C86246
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00C86257
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00C8902A,?,?,000000FF,00000000,?,000000FF,?), ref: 00C86291
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00C862B1

Strings

@U=u, xrefs: 00C86257, 00C862B1

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID: @U=u
API String ID: 3864802216-2594219639
Opcode ID: 9f190b0415552c97188ddbb4f17ff7057218f54ed4175717c32cc16cc64811af
Instruction ID: d91d102301bd627638a1e907bd136077146b747f40365049aa8eec1d1c0b8860
Opcode Fuzzy Hash: 9f190b0415552c97188ddbb4f17ff7057218f54ed4175717c32cc16cc64811af
Instruction Fuzzy Hash: 42317F72101214BFEB119F50CC8AFEA3BA9EF49765F044069FE08DA191D7759C42CB78

Function 00C788AB Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C788D7
CoInitialize.OLE32(00000000), ref: 00C78904
CoUninitialize.COMBASE ref: 00C7890E
GetRunningObjectTable.OLE32(00000000,?), ref: 00C78A0E
SetErrorMode.KERNEL32(00000001,00000029), ref: 00C78B3B
CoGetInstanceFromFile.COMBASE(00000000,?,00000000,00000015,00000002,?,00000001,00C92C0C), ref: 00C78B6F
CoGetObject.OLE32(?,00000000,00C92C0C,?), ref: 00C78B92
SetErrorMode.KERNEL32(00000000), ref: 00C78BA5
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00C78C25
VariantClear.OLEAUT32(?), ref: 00C78C35

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: bcd6515c5eb4f98102e5bf20707fba38c97b8f305e72c1b304c3a5b6eef821f0
Instruction ID: 8481ace4fd7aa5ba26167c528c403129bfd2db4ff2dc09dbe2185452246d9994
Opcode Fuzzy Hash: bcd6515c5eb4f98102e5bf20707fba38c97b8f305e72c1b304c3a5b6eef821f0
Instruction Fuzzy Hash: 03C119B16043059FD700DF64C888A2BB7E9FF89348F00895DF6999B251DB71ED4ACB52

Function 00C67990 Relevance: 15.3, APIs: 10, Instructions: 292COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00C67A6C

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: 226d8fae4387e1968b2018af1b291fcb1ca10bd01b6589caa423e8706adc4018
Instruction ID: c7327999e68c8ca42f9fb696fdcf2c0b767486fc628ccc2ce441685343e3a60d
Opcode Fuzzy Hash: 226d8fae4387e1968b2018af1b291fcb1ca10bd01b6589caa423e8706adc4018
Instruction Fuzzy Hash: DBB18C7190421AAFDB20DFA4C8C4BBEB7F4EF49329F204A29E511A7291D734E941DB90

Function 00C611CE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00C611F0
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00C60268,?,00000001), ref: 00C61204
GetWindowThreadProcessId.USER32(00000000), ref: 00C6120B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00C60268,?,00000001), ref: 00C6121A
GetWindowThreadProcessId.USER32(?,00000000), ref: 00C6122C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00C60268,?,00000001), ref: 00C61245
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00C60268,?,00000001), ref: 00C61257
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00C60268,?,00000001), ref: 00C6129C
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00C60268,?,00000001), ref: 00C612B1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,00C60268,?,00000001), ref: 00C612BC

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 3e3558de305b5aab2fc33678f7fbe3993c6382bb90dd9a63cf89520c200992e0
Instruction ID: 8c869391d01ff2d1dbe1e6bff13dd96dfc14e1dba6e1982ddb788c58076e249f
Opcode Fuzzy Hash: 3e3558de305b5aab2fc33678f7fbe3993c6382bb90dd9a63cf89520c200992e0
Instruction Fuzzy Hash: F331CE75600208FBDB209F95ED98F6E37A9EF54316F18422DFD50C61A0D7B49E428B60

Function 00C0FA5D Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00C0FAA6
OleUninitialize.OLE32(?,00000000), ref: 00C0FB45
UnregisterHotKey.USER32(?), ref: 00C0FC9C
DestroyWindow.USER32(?), ref: 00C445D6
FreeLibrary.KERNEL32(?), ref: 00C4463B
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00C44668

Strings

close all, xrefs: 00C0FAA1

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 9106cf347350cd8cac6dec3543d321c580b150c7a67571ad912ff50e32ceb3d7
Instruction ID: fbdeec74f15fede528965ae38d6594a4bc4e99c31b2ee80dbbc72a6ef59adcd3
Opcode Fuzzy Hash: 9106cf347350cd8cac6dec3543d321c580b150c7a67571ad912ff50e32ceb3d7
Instruction Fuzzy Hash: D2A17C30301212CFDB29EF14C595BA9F364BF05710F6542ADE80AAB6A2DB30AD57DF90

Function 00C5A068 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00C5A439), ref: 00C5A377

Strings

REGEXPCLASS, xrefs: 00C5A13C
NAME, xrefs: 00C5A1A9
TEXT, xrefs: 00C5A2AE
CLASSNN, xrefs: 00C5A119
CLASS, xrefs: 00C5A0F6
INSTANCE, xrefs: 00C5A285

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: e8252bd85a96fd3d16480fdab2dee735064abbcd3d8d94e7caf303e2a2c2b706
Instruction ID: bdfad236a6edf5f55903850e646f0577f3b64dfb013d3c19ead8313c10a3fa36
Opcode Fuzzy Hash: e8252bd85a96fd3d16480fdab2dee735064abbcd3d8d94e7caf303e2a2c2b706
Instruction Fuzzy Hash: 2B91C634900605EACB08DFA1C892BEDFB74BF04305F508229EC5DA7191DB31AADDEB95

Function 00C8B351 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00F32608), ref: 00C8B3EB
IsWindowEnabled.USER32(00F32608), ref: 00C8B3F7
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 00C8B4DB
SendMessageW.USER32(00F32608,000000B0,?,?), ref: 00C8B512
IsDlgButtonChecked.USER32(?,?), ref: 00C8B54F
GetWindowLongW.USER32(00F32608,000000EC), ref: 00C8B571
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00C8B589

Strings

@U=u, xrefs: 00C8B4DB, 00C8B512, 00C8B589

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID: @U=u
API String ID: 4072528602-2594219639
Opcode ID: 2a0cdbd4d2d107ce75544986b8214e29e99a7c664132b1c9dfc99fed785e4601
Instruction ID: 978432f2e0a62d9a8c432a4828b585b7eaf00e7b73a4277b349b3cdfded9c8de
Opcode Fuzzy Hash: 2a0cdbd4d2d107ce75544986b8214e29e99a7c664132b1c9dfc99fed785e4601
Instruction Fuzzy Hash: 1471BF34600604EFDB20AF64C895FBA7BB9EF49304F14415DF966972A2C731AE81DB58

Function 00C86D80 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00C86E24
SendMessageW.USER32(?,00001036,00000000,?), ref: 00C86E38
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00C86E52
_wcscat.LIBCMT ref: 00C86EAD
SendMessageW.USER32(?,00001057,00000000,?), ref: 00C86EC4
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00C86EF2

Strings

SysListView32, xrefs: 00C86DF6
@U=u, xrefs: 00C86E24, 00C86E38

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: @U=u$SysListView32
API String ID: 307300125-1908207174
Opcode ID: d5d0aef091b7358cd7e80d64826ef3bdc894051b2fca9c8312f9e7f883ddee09
Instruction ID: 3e3f714c592fb2f4b602afd8eddefea743cef923088868b48d0ab34d8aff35df
Opcode Fuzzy Hash: d5d0aef091b7358cd7e80d64826ef3bdc894051b2fca9c8312f9e7f883ddee09
Instruction Fuzzy Hash: CD41A171A00358AFEB21EF64CC85BEEB7B8EF08354F10052AF594E7291D6719E85CB64

Function 00C71A15 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 134networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00C71A50
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00C71A7C
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00C71ABE
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00C71AD3
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00C71AE0
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00C71B10
InternetCloseHandle.WININET(00000000), ref: 00C71B57

Part of subcall function 00C72483: GetLastError.KERNEL32(?,?,00C71817,00000000,00000000,00000001), ref: 00C72498
Part of subcall function 00C72483: SetEvent.KERNEL32(?,?,00C71817,00000000,00000000,00000001), ref: 00C724AD

Strings

, xrefs: 00C71B01

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorEventHandleInfoLastOpenSend
String ID:
API String ID: 2603140658-3916222277
Opcode ID: 42060c12efc4773c7fd0aefac61f1b640435a1355a854b193061e2912821e5aa
Instruction ID: 95343ae26a1bb13a247a46ab14401c0c423a56ba968a53270911110a835920af
Opcode Fuzzy Hash: 42060c12efc4773c7fd0aefac61f1b640435a1355a854b193061e2912821e5aa
Instruction Fuzzy Hash: 79418EB1501218BFEB118F65CC89FBF7BACEF08354F04812AFE199A141E7749E459BA4

Function 00C862CD Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 00C862EC
GetWindowLongW.USER32(00F32608,000000F0), ref: 00C8631F
GetWindowLongW.USER32(00F32608,000000F0), ref: 00C86354
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 00C86386
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 00C863B0
GetWindowLongW.USER32(00000000,000000F0), ref: 00C863C1
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 00C863DB

Strings

@U=u, xrefs: 00C862EC, 00C86386, 00C863B0

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID: @U=u
API String ID: 2178440468-2594219639
Opcode ID: 22cefe975e915ce17b4ee36dd926ffbae82c8cf939de64559cafd574e79c0f74
Instruction ID: 3968009fd884c2a2c8219ab2ea926a494e026bf0758ca8a746d3d2f5030c8367
Opcode Fuzzy Hash: 22cefe975e915ce17b4ee36dd926ffbae82c8cf939de64559cafd574e79c0f74
Instruction Fuzzy Hash: 74311230640250AFDB21DF19EC85F5937E1FB4A718F1902A8F521DF2B2CB71AD809B59

Function 00C78C46 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00C8F910), ref: 00C78D28
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00C8F910), ref: 00C78D5C
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00C78ED6
SysFreeString.OLEAUT32(?), ref: 00C78F00

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 7b07f8fb5dd54c91b5df7603a012cdc06b53939cf0bec40c3e20499f8f744716
Instruction ID: 29d076864c245e39e2e06817c4e476f75a69ec27d2e30d804198d66c730bab76
Opcode Fuzzy Hash: 7b07f8fb5dd54c91b5df7603a012cdc06b53939cf0bec40c3e20499f8f744716
Instruction Fuzzy Hash: E5F14B75A00209EFDF14DF94C888EAEB7B9FF49314F108458FA19AB251DB31AE46DB50

Function 00C7F694 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C7F6B5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00C7F848
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00C7F86C
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00C7F8AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00C7F8CE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00C7FA4A
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00C7FA7C
CloseHandle.KERNEL32(?), ref: 00C7FAAB
CloseHandle.KERNEL32(?), ref: 00C7FB22

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: f9cb10a377c6e858be7a539e0629052962398f0554fff22d895138061060d174
Instruction ID: 02fa87967f34e209e542fcb700319c53dcd9b21146cb1d962929401815b49d76
Opcode Fuzzy Hash: f9cb10a377c6e858be7a539e0629052962398f0554fff22d895138061060d174
Instruction Fuzzy Hash: A1E1AE712043009FC724EF24C891B6ABBE1EF85314F14C96DF8999B2A2CB30DD46EB52

Function 00C0201B Relevance: 13.7, APIs: 9, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00C01B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00C02036,?,00000000,?,?,?,?,00C016CB,00000000,?), ref: 00C01B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00C020D3
KillTimer.USER32(-00000001,?,?,?,?,00C016CB,00000000,?,?,00C01AE2,?,?), ref: 00C0216E
DestroyAcceleratorTable.USER32(00000000), ref: 00C3BCA6
DeleteObject.GDI32(00000000), ref: 00C3BD1C

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Destroy$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 2402799130-0
Opcode ID: 58474ee6d318ac24962cc57386df99910e098bea47a722d84bf6bca4a398cc92
Instruction ID: 0ebb009c3b77ab04252b2f97385a9afa23472b54abf0e8f86597aeaccee4539f
Opcode Fuzzy Hash: 58474ee6d318ac24962cc57386df99910e098bea47a722d84bf6bca4a398cc92
Instruction Fuzzy Hash: 84617731520B10DFDB359F15D94CB2AB7F2FB40316F60852DE6928A9A0C7B0BD91EB90

Function 00C64CC1 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C6466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00C63697,?), ref: 00C6468B

Part of subcall function 00C6466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00C63697,?), ref: 00C646A4

Part of subcall function 00C64A31: GetFileAttributesW.KERNEL32(?,00C6370B), ref: 00C64A32

lstrcmpiW.KERNEL32(?,?), ref: 00C64D40
_wcscmp.LIBCMT ref: 00C64D5A
MoveFileW.KERNEL32(?,?), ref: 00C64D75

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 67d08291455e7dbf4ae15147da88471134232932ecb624e67fd6245101608161
Instruction ID: 06c934822237917d427b8bf76de3e93587c529043936fbb420022b3348e628ab
Opcode Fuzzy Hash: 67d08291455e7dbf4ae15147da88471134232932ecb624e67fd6245101608161
Instruction Fuzzy Hash: 465164B24083859BC735EBA0D8819DFB3ECAF85350F00092EF689D3151EF75A689D766

Function 00C5966E Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C5A82C: GetWindowThreadProcessId.USER32(?,00000000), ref: 00C5A84C
Part of subcall function 00C5A82C: GetCurrentThreadId.KERNEL32 ref: 00C5A853
Part of subcall function 00C5A82C: AttachThreadInput.USER32(00000000,?,00C59683,?,00000001), ref: 00C5A85A

MapVirtualKeyW.USER32(00000025,00000000), ref: 00C5968E
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00C596AB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00C596AE
MapVirtualKeyW.USER32(00000025,00000000), ref: 00C596B7
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00C596D5
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00C596D8
MapVirtualKeyW.USER32(00000025,00000000), ref: 00C596E1
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00C596F8
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00C596FB

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: ed31eb118b4d2bcf65c96880f22431774f51be27b82023dec7576a0b5c677481
Instruction ID: 9c073c01e2b829550620ee7ba7d59f95e1b4fc951b657d2e31b0e76bd21a357f
Opcode Fuzzy Hash: ed31eb118b4d2bcf65c96880f22431774f51be27b82023dec7576a0b5c677481
Instruction Fuzzy Hash: BF11E1B1A10218BEF6106F61DC89F6E3B2DEB4C751F100529F644AB0E0C9F26C51DBA8

Function 00C58921 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00C5853C,00000B00,?,?), ref: 00C5892A
RtlAllocateHeap.NTDLL(00000000,?,00C5853C), ref: 00C58931
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00C5853C,00000B00,?,?), ref: 00C58946
GetCurrentProcess.KERNEL32(?,00000000,?,00C5853C,00000B00,?,?), ref: 00C5894E
DuplicateHandle.KERNEL32(00000000,?,00C5853C,00000B00,?,?), ref: 00C58951
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00C5853C,00000B00,?,?), ref: 00C58961
GetCurrentProcess.KERNEL32(00C5853C,00000000,?,00C5853C,00000B00,?,?), ref: 00C58969
DuplicateHandle.KERNEL32(00000000,?,00C5853C,00000B00,?,?), ref: 00C5896C
CreateThread.KERNEL32(00000000,00000000,00C58992,00000000,00000000,00000000), ref: 00C58986

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocateCreateThread
String ID:
API String ID: 1422014791-0
Opcode ID: 9cd3f7478118bcf220f748ffa18691b8aa286734f9ab8ff16f01b434bd002e8d
Instruction ID: 1ba36da6bc2870101aa9c3779de65e7a8e90397d66d7d7d8d090c1633b395af0
Opcode Fuzzy Hash: 9cd3f7478118bcf220f748ffa18691b8aa286734f9ab8ff16f01b434bd002e8d
Instruction Fuzzy Hash: 2201A4B5240308FFE610ABA5DC8DF6F7BACEB89711F408425FA05DB2A1CA749C158B24

Function 00C79B23 Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

NULL Pointer assignment, xrefs: 00C79BA4, 00C79EC8
Not an Object type, xrefs: 00C79B7B

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: fcf9e7a3a9f33ca3cf0273a09845f854cdd61ae261734f98c140674efd934614
Instruction ID: 56ea9e55c5d8b6f8fb47f3570799756a15e86a7badf41384d2110886cbbda376
Opcode Fuzzy Hash: fcf9e7a3a9f33ca3cf0273a09845f854cdd61ae261734f98c140674efd934614
Instruction Fuzzy Hash: 72C1A371A002199FDF10DF99D885BAEB7F5FF48314F14C469E919AB280E7709E45CB90

Function 00C79113 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C79167
VariantInit.OLEAUT32(?), ref: 00C79238
VariantInit.OLEAUT32(?), ref: 00C79339
VariantClear.OLEAUT32(?), ref: 00C79343
VariantClear.OLEAUT32(?), ref: 00C793A0

Strings

Null Object assignment in FOR..IN loop, xrefs: 00C791C8, 00C792F6, 00C793AE
Incorrect Object type in FOR..IN loop, xrefs: 00C7931C

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: 42913275572580cbd7ae7f494f43408e4c9822e064e014d07a0e2a1f996e080f
Instruction ID: 007fa1d6cb64fdb6d7fb02ffec419731263c100a21f59b85b4e5fee4718a29c5
Opcode Fuzzy Hash: 42913275572580cbd7ae7f494f43408e4c9822e064e014d07a0e2a1f996e080f
Instruction Fuzzy Hash: 3A91AD71A00219ABDF24DFA5C848FAEBBB8EF85710F10C159F519AB291D7709A45CFA0

Function 00C7975D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 00C5710A: CLSIDFromProgID.COMBASE ref: 00C57127
Part of subcall function 00C5710A: ProgIDFromCLSID.COMBASE(?,00000000), ref: 00C57142
Part of subcall function 00C5710A: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00C57044,80070057,?,?), ref: 00C57150
Part of subcall function 00C5710A: CoTaskMemFree.COMBASE(00000000), ref: 00C57160

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000), ref: 00C79806
_memset.LIBCMT ref: 00C79813
_memset.LIBCMT ref: 00C79956
CoCreateInstanceEx.COMBASE(?,00000000,00000015,?,00000001,00000000), ref: 00C79982
CoTaskMemFree.COMBASE(?), ref: 00C7998D

Strings

NULL Pointer assignment, xrefs: 00C799DB

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 479dcc3c1a2524170f4db7f98ad5adafac9577ec8d3ed58fb8c0af888a1c8b9a
Instruction ID: b3b70dfbd3205e911f78e3d313c0d81e89af16ac9984df76d653872cc3464682
Opcode Fuzzy Hash: 479dcc3c1a2524170f4db7f98ad5adafac9577ec8d3ed58fb8c0af888a1c8b9a
Instruction Fuzzy Hash: 2B913971D00228EBDB10DFA5DC85EDEBBB9EF09310F108169F519A7291EB719A44DFA0

Function 00C7E933 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 00C63C55: CreateToolhelp32Snapshot.KERNEL32 ref: 00C63C7A
Part of subcall function 00C63C55: Process32FirstW.KERNEL32(00000000,?), ref: 00C63C88
Part of subcall function 00C63C55: CloseHandle.KERNEL32(00000000), ref: 00C63D52

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00C7E9A4
GetLastError.KERNEL32 ref: 00C7E9B7
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00C7E9E6
TerminateProcess.KERNEL32(00000000,00000000), ref: 00C7EA63
GetLastError.KERNEL32(00000000), ref: 00C7EA6E
CloseHandle.KERNEL32(00000000), ref: 00C7EAA3

Strings

SeDebugPrivilege, xrefs: 00C7E9C2

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: b266ace6e249d3a8d1b5d788d7154fde20ddc349efe2f880cb8094cad8f89997
Instruction ID: 67188d2e23a091aee5df8d3b93110c2f53a3c49379bb5676f7805f0f60bb1285
Opcode Fuzzy Hash: b266ace6e249d3a8d1b5d788d7154fde20ddc349efe2f880cb8094cad8f89997
Instruction Fuzzy Hash: 4641BD722002009FDB10EF24CC95F6EBBA5AF54324F04C45CF9469B3D2DB70A949EB95

Function 00C8B69E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00CC57B0,00000000,00F32608,?,?,00CC57B0,?,00C8B5A8,?,?), ref: 00C8B712
EnableWindow.USER32(00000000,00000000), ref: 00C8B736
ShowWindow.USER32(00CC57B0,00000000,00F32608,?,?,00CC57B0,?,00C8B5A8,?,?), ref: 00C8B796
ShowWindow.USER32(00000000,00000004,?,00C8B5A8,?,?), ref: 00C8B7A8
EnableWindow.USER32(00000000,00000001), ref: 00C8B7CC
SendMessageW.USER32(?,0000130C,?,00000000), ref: 00C8B7EF

Strings

@U=u, xrefs: 00C8B7EF

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID: @U=u
API String ID: 642888154-2594219639
Opcode ID: 454fd061921823eb5d233fc4beebb7d81af7bc3961fbb3d0d2bb10e5b88e7fae
Instruction ID: 04ce002bf23613aa3bd42c55d10c618e50956fe161a0e3f8017e1dbf6c8cab43
Opcode Fuzzy Hash: 454fd061921823eb5d233fc4beebb7d81af7bc3961fbb3d0d2bb10e5b88e7fae
Instruction Fuzzy Hash: E341A334600340AFDB22DF24C499B957BE0FF49319F1841B9F9688F6A2C731AD56CB68

Function 00C62F94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00C63033

Strings

question, xrefs: 00C62FEC
stop, xrefs: 00C63004
blank, xrefs: 00C62FB5
info, xrefs: 00C62FD4
warning, xrefs: 00C6301C

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 45a66f8c26423e5238180645f853ff314aaeae510c22b9b1caad3d8e87ab4e96
Instruction ID: e2f7393cee1598d38c44b3e79df3d34db8eb062d507db74606669be988d250dd
Opcode Fuzzy Hash: 45a66f8c26423e5238180645f853ff314aaeae510c22b9b1caad3d8e87ab4e96
Instruction Fuzzy Hash: B3110531248386BAF7349A55ECC2DAF6B9C9F15320F20002AFA00A6181DB706F4866A5

Function 00C642F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 00C64312
LoadStringW.USER32(00000000), ref: 00C64319
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00C6432F
LoadStringW.USER32(00000000), ref: 00C64336
_wprintf.LIBCMT ref: 00C6435C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00C6437A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00C64357

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 8395d986afe8d86b0284ca951e2287199dd9f9b498f066d0cf63abb46f8ac0ff
Instruction ID: 3eff01fd33d1998ad6db70ac8bbf07ffd93f440ae94c19ba06b17ef701057b9f
Opcode Fuzzy Hash: 8395d986afe8d86b0284ca951e2287199dd9f9b498f066d0cf63abb46f8ac0ff
Instruction Fuzzy Hash: B90162F2900208BFE711A7A0DD89FFE776CEB08300F0005B5B745E2051EA749E864B75

Function 00C02A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00C3C1C7,00000004,00000000,00000000,00000000), ref: 00C02ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00C3C1C7,00000004,00000000,00000000,00000000,000000FF), ref: 00C02B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00C3C1C7,00000004,00000000,00000000,00000000), ref: 00C3C21A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00C3C1C7,00000004,00000000,00000000,00000000), ref: 00C3C286

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 94b5c522b26cb480c0014457b467603e26bb24ac3bac5084ab9557a8742d8185
Instruction ID: c79174320e504ba2e712946697cbcb26d82e1d867bc0c78f5328441c5c732f49
Opcode Fuzzy Hash: 94b5c522b26cb480c0014457b467603e26bb24ac3bac5084ab9557a8742d8185
Instruction Fuzzy Hash: 9C412B307146809FDB359B29CCCCB6F7B92AB45314F24881DF167965E1CA75A982F720

Function 00C670C6 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00C670DD

Part of subcall function 00C20DB6: std::exception::exception.LIBCMT ref: 00C20DEC
Part of subcall function 00C20DB6: __CxxThrowException@8.LIBCMT ref: 00C20E01

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00C67114
RtlEnterCriticalSection.NTDLL(?), ref: 00C67130
_memmove.LIBCMT ref: 00C6717E
_memmove.LIBCMT ref: 00C6719B
RtlLeaveCriticalSection.NTDLL(?), ref: 00C671AA
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00C671BF
InterlockedExchange.KERNEL32(?,000001F6), ref: 00C671DE

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 26a792d91fec1e21c343599149c272af7108b42c63a49d3e0296b425ea069f72
Instruction ID: 7674db127f6e20fee856ada8b6cf27870ac41d9d6605ce51794502582f61cf48
Opcode Fuzzy Hash: 26a792d91fec1e21c343599149c272af7108b42c63a49d3e0296b425ea069f72
Instruction Fuzzy Hash: 1D31AD31900215EBCF10DFA4EC85AAFB7B8EF45710F2441BAF904AB246DB309E51DBA4

Function 00C5BBAF Relevance: 12.1, APIs: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_memcmp.LIBCMT ref: 00C5BBC4
_memcmp.LIBCMT ref: 00C5BBE6
_memcmp.LIBCMT ref: 00C5BBFE
_memcmp.LIBCMT ref: 00C5BC11
_memcmp.LIBCMT ref: 00C5BC2B
_memcmp.LIBCMT ref: 00C5BC3E
_memcmp.LIBCMT ref: 00C5BC56
_memcmp.LIBCMT ref: 00C5BC71

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 45aa7915dec6a31c71752182c5351bca72074d24ca74225edc9f0418cfc1050c
Instruction ID: a8ff8a40091649728c51ee3005417920c5af0190a50771ad8ff08c5188e5c872
Opcode Fuzzy Hash: 45aa7915dec6a31c71752182c5351bca72074d24ca74225edc9f0418cfc1050c
Instruction Fuzzy Hash: 4F2105656012197BEA047612AD42FFF7B5C9F2034AF084020FD0996A47EBA4EF59D2AD

Function 00C01424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 90f6ac8dcf2aebeecde429ffe70e257e7327cd9db27b0c84bc2bc354063bbea2
Instruction ID: c0f597f521d6e214871ed89b939023487d4b37bb4392ec1825bfbfa01b1dc65a
Opcode Fuzzy Hash: 90f6ac8dcf2aebeecde429ffe70e257e7327cd9db27b0c84bc2bc354063bbea2
Instruction Fuzzy Hash: 84716E30900109EFDB05CF99CC89ABEBB79FF85314F188159F915AA2A1C734AA51DF64

Function 00C7F41E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C7F448
_memset.LIBCMT ref: 00C7F511
ShellExecuteExW.SHELL32(?), ref: 00C7F556

Part of subcall function 00C09837: __itow.LIBCMT ref: 00C09862
Part of subcall function 00C09837: __swprintf.LIBCMT ref: 00C098AC

Part of subcall function 00C1FC86: _wcscpy.LIBCMT ref: 00C1FCA9

GetProcessId.KERNEL32(00000000), ref: 00C7F5CD
CloseHandle.KERNEL32(00000000), ref: 00C7F5FC

Strings

@, xrefs: 00C7F525

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 837d847f2eb22a495dfe2d42530ece5b5f90e38f2013559a1e9c538205e2c3e2
Instruction ID: 84290174d68e221d6389175a2f7af38d1b2e221ee8407024ec22542797d53494
Opcode Fuzzy Hash: 837d847f2eb22a495dfe2d42530ece5b5f90e38f2013559a1e9c538205e2c3e2
Instruction Fuzzy Hash: 6461AFB5A00619DFCB14DF64C481AAEBBF5FF48310F14816DE859AB391CB30AE42DB90

Function 00C60F4D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00C60F8C
GetKeyboardState.USER32(?), ref: 00C60FA1
SetKeyboardState.USER32(?), ref: 00C61002
PostMessageW.USER32(?,00000101,00000010,?), ref: 00C61030
PostMessageW.USER32(?,00000101,00000011,?), ref: 00C6104F
PostMessageW.USER32(?,00000101,00000012,?), ref: 00C61095
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00C610B8

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: cb1c3e30899b2f63591546451b090c80d8201dd7b7ab713878e0b636189e60df
Instruction ID: 3094f6e4bdae240a44cf5dac367ae3e1813f3fe6387e90130ed286169201c308
Opcode Fuzzy Hash: cb1c3e30899b2f63591546451b090c80d8201dd7b7ab713878e0b636189e60df
Instruction Fuzzy Hash: AE5123A06047D53DFB3242748C95BBBBFA95B06301F0C8589E5E4968D3C2E8EEC9D751

Function 00C60D66 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00C60DA5
GetKeyboardState.USER32(?), ref: 00C60DBA
SetKeyboardState.USER32(?), ref: 00C60E1B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00C60E47
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00C60E64
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00C60EA8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00C60EC9

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 8809b277414305c75095e1da0e39fbb2b22e7b607f24e1fdd85b306bff3a5fce
Instruction ID: c14df696033dbef6f2ac8e5d8979b1c91118e75cb594c099bff43e083763b6d4
Opcode Fuzzy Hash: 8809b277414305c75095e1da0e39fbb2b22e7b607f24e1fdd85b306bff3a5fce
Instruction Fuzzy Hash: 495126A05447E53DFB3683748C95B7B7FA96B06300F1C898DF1E4A64C2D396AE98E350

Function 00C655FD Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00C6560A
_wcsncpy.LIBCMT ref: 00C6563F
_wcsncpy.LIBCMT ref: 00C65671
_wcsncpy.LIBCMT ref: 00C656A4
_wcsncpy.LIBCMT ref: 00C656E6
_wcsncpy.LIBCMT ref: 00C65720
_wcsncpy.LIBCMT ref: 00C6574F

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 6643cae3a16e95fc1ad44def64ea8795cfec075b4ab12c2854b6e3f9e83f146a
Instruction ID: 2aaa19bc32d0893b2555ebb7b4c56e891c0883bd74e0f4340a63c9f3ed7e0bb4
Opcode Fuzzy Hash: 6643cae3a16e95fc1ad44def64ea8795cfec075b4ab12c2854b6e3f9e83f146a
Instruction Fuzzy Hash: BA419275C1062476CB21EBB4DC86ACFB3B89F04310F508966F519E3621EB34E395D7AA

Function 00C8A056 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

@U=u, xrefs: 00C8A14F

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID:
String ID: @U=u
API String ID: 0-2594219639
Opcode ID: 6bb855a673a727a640f43c9b0fe802a8fb4007c2f1a9014f099bc8e70d5b2093
Instruction ID: de3677be1de71f5f398140fd0f5b0e5c44fd86bf2010aeb219a74a12ed63c84a
Opcode Fuzzy Hash: 6bb855a673a727a640f43c9b0fe802a8fb4007c2f1a9014f099bc8e70d5b2093
Instruction Fuzzy Hash: 6A41C635904114EFE714EF28CC4CFADBBA4EB09314F150266F826A72E1C730AE41EB59

Function 00C63671 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00C6466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,00C63697,?), ref: 00C6468B

Part of subcall function 00C6466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,00C63697,?), ref: 00C646A4

lstrcmpiW.KERNEL32(?,?), ref: 00C636B7
_wcscmp.LIBCMT ref: 00C636D3
MoveFileW.KERNEL32(?,?), ref: 00C636EB
_wcscat.LIBCMT ref: 00C63733
SHFileOperationW.SHELL32(?), ref: 00C6379F

Strings

\*.*, xrefs: 00C6372D

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 9c9aedc6ee0ddcec40899c7366d40274cf2b82da473586eaa8b638949d1e5fbb
Instruction ID: 64eac304b3ce0dadb6aa9b5c5117c1cc442d2fcd5a952532588b3f9cfb97496c
Opcode Fuzzy Hash: 9c9aedc6ee0ddcec40899c7366d40274cf2b82da473586eaa8b638949d1e5fbb
Instruction Fuzzy Hash: D3416371508344AEC765EF64D881ADF77E8EF89340F00092EB49AC3151EA34D789D756

Function 00C87291 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C872AA
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C87351
IsMenu.USER32(?), ref: 00C87369
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00C873B1
DrawMenuBar.USER32 ref: 00C873C4

Strings

0, xrefs: 00C8729E

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 430b32e60f85c24d0b1aa2b604ba092c37e52e50bfa103282dc35fdd9086cd3c
Instruction ID: bc85120b1f5cfb0ac9530c98b202772f7a9e863547f3a9aff4f3cc81693c7102
Opcode Fuzzy Hash: 430b32e60f85c24d0b1aa2b604ba092c37e52e50bfa103282dc35fdd9086cd3c
Instruction Fuzzy Hash: CB411675A44208EFDB20EF50D884E9ABBB8FB05354F248629FD15A7260E730EE50EB55

Function 00C80FA5 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 00C80FD4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00C80FFE
FreeLibrary.KERNEL32(00000000), ref: 00C810B5

Part of subcall function 00C80FA5: RegCloseKey.ADVAPI32(?), ref: 00C8101B
Part of subcall function 00C80FA5: FreeLibrary.KERNEL32(?), ref: 00C8106D
Part of subcall function 00C80FA5: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00C81090

RegDeleteKeyW.ADVAPI32(?,?), ref: 00C81058

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 6558ee531aff72caf32b16aae6124eb90081b2716dc2c0aa0f95c402f5a259b0
Instruction ID: dc34195332cf7fbbe96eb76cdbb92aabf2e7adcedf4dd442c5ba4c2e0da90be1
Opcode Fuzzy Hash: 6558ee531aff72caf32b16aae6124eb90081b2716dc2c0aa0f95c402f5a259b0
Instruction Fuzzy Hash: 5B311E71900109BFDB159F90DC89AFFB7BCEF08304F14016AE912E2141D7745F8A9BA4

Function 00C5DAEB Relevance: 10.6, APIs: 7, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00C5DB2E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00C5DB54
SysAllocString.OLEAUT32(00000000), ref: 00C5DB57
SysAllocString.OLEAUT32(?), ref: 00C5DB75
SysFreeString.OLEAUT32(?), ref: 00C5DB7E
StringFromGUID2.COMBASE(?,?,00000028), ref: 00C5DBA3
SysAllocString.OLEAUT32(?), ref: 00C5DBB1

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 4967aaa9ffa2da437c8ecbb2c8c19b16be6761cf5367049a965aa9927a9a387a
Instruction ID: 8fcb5f59641a7ef66894c6282a19be1b9224d2eb1b18c89d7728499faca95ec5
Opcode Fuzzy Hash: 4967aaa9ffa2da437c8ecbb2c8c19b16be6761cf5367049a965aa9927a9a387a
Instruction Fuzzy Hash: 8D21B536600319AFDF20DFA9DC88DBF73ADEB09360B11812AFD15DB250D6709D858768

Function 00C76173 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00C77D8B: inet_addr.WS2_32(00000000), ref: 00C77DB6

socket.WS2_32(00000002,00000001,00000006), ref: 00C761C6
WSAGetLastError.WS2_32(00000000), ref: 00C761D5
ioctlsocket.WS2_32(00000000,8004667E,00000000), ref: 00C7620E
connect.WSOCK32(00000000,?,00000010), ref: 00C76217
WSAGetLastError.WS2_32 ref: 00C76221
closesocket.WS2_32(00000000), ref: 00C7624A
ioctlsocket.WS2_32(00000000,8004667E,00000000), ref: 00C76263

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 25d81a48776c401a8e7ef25fdf1c2bed778918c667de1405c79c600b2f8fe712
Instruction ID: 09917f77adaa6a1f2a28a861384b338fef2525501a198b7e2390379b513cfda7
Opcode Fuzzy Hash: 25d81a48776c401a8e7ef25fdf1c2bed778918c667de1405c79c600b2f8fe712
Instruction Fuzzy Hash: 6D31A471600508AFDF10AF24CC85BBD7BACEB45751F048069FD19A72D2DB70AD45DB61

Function 00C58E90 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C07DE1: _memmove.LIBCMT ref: 00C07E22

Part of subcall function 00C5AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00C5AABC

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00C58F14
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00C58F27
SendMessageW.USER32(?,00000189,?,00000000), ref: 00C58F57

Part of subcall function 00C07BCC: _memmove.LIBCMT ref: 00C07C06

Strings

ListBox, xrefs: 00C58ED3
@U=u, xrefs: 00C58F14, 00C58F27, 00C58F57
ComboBox, xrefs: 00C58E9E

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: @U=u$ComboBox$ListBox
API String ID: 365058703-2258501812
Opcode ID: cc5724fcdf5f5e076338a1530cd8a77448e89f61899863e4106702c55914c899
Instruction ID: 233bcb450b0ede9c69e56b02dc15b8fd78e68ee9fdb93869e7c23ffe3d823f96
Opcode Fuzzy Hash: cc5724fcdf5f5e076338a1530cd8a77448e89f61899863e4106702c55914c899
Instruction Fuzzy Hash: AD21F279A00108BFDB14ABA09C45DFFB779DF05320F104729F825A71E1DA39198EEA24

Function 00C5F65E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00C5F671
__wcsnicmp.LIBCMT ref: 00C5F692
__wcsnicmp.LIBCMT ref: 00C5F6AC

Strings

#notrayicon, xrefs: 00C5F669
#requireadmin, xrefs: 00C5F68C
#OnAutoItStartRegister, xrefs: 00C5F6A6

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: b36d22cd6cc4240bea22a8ed5f75147c0d8d3b1826c54c1a1ffa6ac35f4956a2
Instruction ID: 5631df18f27d2a2bbb7f847ad6763d76f35fc895f78effb2fb533906d9cdecbe
Opcode Fuzzy Hash: b36d22cd6cc4240bea22a8ed5f75147c0d8d3b1826c54c1a1ffa6ac35f4956a2
Instruction Fuzzy Hash: AF2137762042216AD738AA35AC02FA773E8DF59781F10443DFC9686491EF509ECBE299

Function 00C5DBC4 Relevance: 10.6, APIs: 7, Instructions: 90memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00C5DC09
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00C5DC2F
SysAllocString.OLEAUT32(00000000), ref: 00C5DC32
SysAllocString.OLEAUT32 ref: 00C5DC53
SysFreeString.OLEAUT32 ref: 00C5DC5C
StringFromGUID2.COMBASE(?,?,00000028), ref: 00C5DC76
SysAllocString.OLEAUT32(?), ref: 00C5DC84

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: a40fd442a5c5d45136b8ff2c98401a19c18d810801b21c7ae498de97208b79e7
Instruction ID: 81537dd2e6ffecd6bdedf100fb0cc7d2e32b2b9266b0fcd8a22392af4fe1efa0
Opcode Fuzzy Hash: a40fd442a5c5d45136b8ff2c98401a19c18d810801b21c7ae498de97208b79e7
Instruction Fuzzy Hash: 2C218835604214AFDB20DFA8DC88EAB77ECEB49361B108126FD15CB261D670EDC5CB68

Function 00C5B1EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00C5B204
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00C5B221
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00C5B259
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00C5B27F
_wcsstr.LIBCMT ref: 00C5B289

Strings

@U=u, xrefs: 00C5B221, 00C5B259

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID: @U=u
API String ID: 3902887630-2594219639
Opcode ID: d70679db7a04cce338a99f97047015eaefde75c18c6def1628dd1eff11af8796
Instruction ID: f644b62ab30b62710403621f28738256320f7841c2c80b2a4c9bc175b27c68ce
Opcode Fuzzy Hash: d70679db7a04cce338a99f97047015eaefde75c18c6def1628dd1eff11af8796
Instruction Fuzzy Hash: ED2125352042107BEB255B35AC09F7F7FA8DF49711F10412EFC05CA161EF618D81A364

Function 00C59307 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00C59320

Part of subcall function 00C07BCC: _memmove.LIBCMT ref: 00C07C06

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00C59352
__itow.LIBCMT ref: 00C5936A
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00C59392
__itow.LIBCMT ref: 00C593A3

Strings

@U=u, xrefs: 00C59320, 00C59352, 00C59392

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID: @U=u
API String ID: 2983881199-2594219639
Opcode ID: 5e6172b50d8ed5a90d661353f236cb2c7f05fa939a8c8cd23134cd3a2a3ebbfe
Instruction ID: 69cad088ad72019015e275bf9360a80a86a6aa10a409d62c4ad0881ef27cf50c
Opcode Fuzzy Hash: 5e6172b50d8ed5a90d661353f236cb2c7f05fa939a8c8cd23134cd3a2a3ebbfe
Instruction Fuzzy Hash: 0021F539B00208FBDB10AB608C89EAE3BA8EB88711F044069FD04D71E0D6B09E899795

Function 00C875CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C01D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00C01D73
Part of subcall function 00C01D35: GetStockObject.GDI32(00000011), ref: 00C01D87
Part of subcall function 00C01D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00C01D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00C87632
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00C8763F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00C8764A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00C87659
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00C87665

Strings

Msctls_Progress32, xrefs: 00C87603

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 0639194eefab6cdd79b376044359f5324c7ceff4099bbd814f3565c8c0a6acf6
Instruction ID: 2653e4dbc0660312fd5a353a1728af35688407ff233d1d40491998ac92c35a16
Opcode Fuzzy Hash: 0639194eefab6cdd79b376044359f5324c7ceff4099bbd814f3565c8c0a6acf6
Instruction Fuzzy Hash: 2C11B6B1110219BFEF159F64CC85EEB7F6DEF08798F114215BA04A20A0D672DC21DBA4

Function 00C29AE6 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00C29AE6

Part of subcall function 00C23187: RtlEncodePointer.NTDLL(00000000), ref: 00C2318A
Part of subcall function 00C23187: __initp_misc_winsig.LIBCMT ref: 00C231A5
Part of subcall function 00C23187: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00C29EA0
Part of subcall function 00C23187: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00C29EB4
Part of subcall function 00C23187: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00C29EC7
Part of subcall function 00C23187: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00C29EDA
Part of subcall function 00C23187: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00C29EED
Part of subcall function 00C23187: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00C29F00
Part of subcall function 00C23187: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00C29F13
Part of subcall function 00C23187: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00C29F26
Part of subcall function 00C23187: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00C29F39
Part of subcall function 00C23187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00C29F4C
Part of subcall function 00C23187: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00C29F5F
Part of subcall function 00C23187: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00C29F72
Part of subcall function 00C23187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00C29F85
Part of subcall function 00C23187: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00C29F98
Part of subcall function 00C23187: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00C29FAB
Part of subcall function 00C23187: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00C29FBE

__mtinitlocks.LIBCMT ref: 00C29AEB
__mtterm.LIBCMT ref: 00C29AF4

Part of subcall function 00C29B5C: RtlDeleteCriticalSection.NTDLL(00000000), ref: 00C29C56
Part of subcall function 00C29B5C: _free.LIBCMT ref: 00C29C5D
Part of subcall function 00C29B5C: RtlDeleteCriticalSection.NTDLL(00CBEC00), ref: 00C29C7F

__calloc_crt.LIBCMT ref: 00C29B19
__initptd.LIBCMT ref: 00C29B3B
GetCurrentThreadId.KERNEL32 ref: 00C29B42

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 6438904bd1e3bf9052bc16dfed46cbdbeeeb8da800d33c0bfb39a26cc50da115
Instruction ID: 2c163086b6282a129be4f9923cc5dffda8b4e8dc2933ba1646908960fabec2a3
Opcode Fuzzy Hash: 6438904bd1e3bf9052bc16dfed46cbdbeeeb8da800d33c0bfb39a26cc50da115
Instruction Fuzzy Hash: ECF09A32619731AAE6347B74BC07B8E2690EF02B30F200A2AF465D69D2EF71894165A4

Function 00C2406B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00C23F85), ref: 00C24085
GetProcAddress.KERNEL32(00000000), ref: 00C2408C
RtlEncodePointer.NTDLL(00000000), ref: 00C24097
RtlDecodePointer.NTDLL(00C23F85), ref: 00C240B2

Strings

combase.dll, xrefs: 00C24080
RoUninitialize, xrefs: 00C24074

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 3eb0170f74847a06afc4e3a206e3ea1ed070befc36908c13df9cb43ab8f27749
Instruction ID: e6389870d27ec39baeb8511378311af85cfd38428672e1e5b860b4685ddb6eb9
Opcode Fuzzy Hash: 3eb0170f74847a06afc4e3a206e3ea1ed070befc36908c13df9cb43ab8f27749
Instruction Fuzzy Hash: 35E09271581240AFEA20AF62FD0DB4D3AA4B704742F148029F111E10E0CBB64641DB18

Function 00C76B03 Relevance: 9.2, APIs: 6, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WS2_32(00000000,?), ref: 00C76C00
WSAGetLastError.WS2_32(00000000), ref: 00C76C34
htons.WS2_32(?), ref: 00C76CEA
inet_ntoa.WS2_32(?), ref: 00C76CA7

Part of subcall function 00C5A7E9: _strlen.LIBCMT ref: 00C5A7F3
Part of subcall function 00C5A7E9: _memmove.LIBCMT ref: 00C5A815

_strlen.LIBCMT ref: 00C76D44
_memmove.LIBCMT ref: 00C76DAD

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: 886fdae40496b9fc721628f3b95d208ea716c9daa6b2b6960650c94d1401a950
Instruction ID: c2de1f62d882ca8f1c9825f36506e8e6a78e2969bc4893b39a8697adff2aa0e5
Opcode Fuzzy Hash: 886fdae40496b9fc721628f3b95d208ea716c9daa6b2b6960650c94d1401a950
Instruction Fuzzy Hash: 4B81CE71208700AFD720EB24CC82F6BB7A8EF95714F148A1DF9599B2D2DA70AD05DB91

Function 00C664B8 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C6660B
_memmove.LIBCMT ref: 00C66546

Part of subcall function 00C09837: __itow.LIBCMT ref: 00C09862
Part of subcall function 00C09837: __swprintf.LIBCMT ref: 00C098AC

_memmove.LIBCMT ref: 00C665B9
_memmove.LIBCMT ref: 00C666A0
_memmove.LIBCMT ref: 00C666B9
_memmove.LIBCMT ref: 00C666D5

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: d7c172d4770f5b29c5dc6d86b21f01c593e5a6c2a0ac7f4912094345c0d5440f
Instruction ID: 794f43b6b4cead917b1166026a592da2af697e5ab05e06436c0082943ca4c651
Opcode Fuzzy Hash: d7c172d4770f5b29c5dc6d86b21f01c593e5a6c2a0ac7f4912094345c0d5440f
Instruction Fuzzy Hash: 48617A7090425A9BCF21EF60DC82AFE37A9AF05308F058619F8566B2D3DB74E945EB50

Function 00C801E4 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C07DE1: _memmove.LIBCMT ref: 00C07E22

Part of subcall function 00C80E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C7FDAD,?,?), ref: 00C80E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C802BD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00C802FD
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00C80320
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00C80349
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00C8038C
RegCloseKey.ADVAPI32(00000000), ref: 00C80399

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 725d6240d2040762a5dafcec49cc08c33481d3ec241bda72ce1c4a8e779568e9
Instruction ID: fc79f1bde4ca27c2ece6195da0e6f55bc2aa9078f6b17995dee29acc048e327a
Opcode Fuzzy Hash: 725d6240d2040762a5dafcec49cc08c33481d3ec241bda72ce1c4a8e779568e9
Instruction Fuzzy Hash: 09515A31208200AFC714EF64C885E6FBBE8FF85318F54491DF995872A2DB31E949DB56

Function 00C85799 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00C857FB
GetMenuItemCount.USER32(00000000), ref: 00C85832
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00C8585A
GetMenuItemID.USER32(?,?), ref: 00C858C9
GetSubMenu.USER32(?,?), ref: 00C858D7
PostMessageW.USER32(?,00000111,?,00000000), ref: 00C85928

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: f7a985db1be710c0c10c2bd503b4dc874d4ae38f0353bc9de69cd22060baeb76
Instruction ID: 18a7a707acd50e31e648c91dd6f20a190072b614c859a5f53d8caab841aaf26b
Opcode Fuzzy Hash: f7a985db1be710c0c10c2bd503b4dc874d4ae38f0353bc9de69cd22060baeb76
Instruction Fuzzy Hash: 7F517F75E00615EFCF11EF64C845AAEB7B4EF48324F10406AE851BB392CB74AE41DB94

Function 00C5EEEC Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C5EF06
VariantClear.OLEAUT32(00000013), ref: 00C5EF78
VariantClear.OLEAUT32(00000000), ref: 00C5EFD3
_memmove.LIBCMT ref: 00C5EFFD
VariantClear.OLEAUT32(?), ref: 00C5F04A
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00C5F078

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: b163662683f8dff6c34fa0015e0f089336dfe92f374f09cc11412e1c31dbd12c
Instruction ID: bba632586380b30169bc197303260906db96085bccb3a73244393d50ad14bcd4
Opcode Fuzzy Hash: b163662683f8dff6c34fa0015e0f089336dfe92f374f09cc11412e1c31dbd12c
Instruction Fuzzy Hash: 2F516D75A00209DFCB14CF58C884AAAB7B8FF8C310B15856EED59DB341E730E955CB94

Function 00C6220A Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C62258
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00C622A3
IsMenu.USER32(00000000), ref: 00C622C3
CreatePopupMenu.USER32 ref: 00C622F7
GetMenuItemCount.USER32(000000FF), ref: 00C62355
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00C62386

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: e710f769b7522fe894b1b60e395b9704f1b3d9b3c2002162c8068cbf75edde4f
Instruction ID: 1909e24e5b4c576921be31cdb62c382260c7a1efe24dbfbb64c90884eb6132a1
Opcode Fuzzy Hash: e710f769b7522fe894b1b60e395b9704f1b3d9b3c2002162c8068cbf75edde4f
Instruction Fuzzy Hash: FF518C70A00A4AEBDF31CF68D8C8BADBBF9BF45314F104139E861A72A0D7749A45CB51

Function 00C01765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00C02612: GetWindowLongW.USER32(?,000000EB), ref: 00C02623

BeginPaint.USER32(?,?,?,?,?,?), ref: 00C0179A
GetWindowRect.USER32(?,?), ref: 00C017FE
ScreenToClient.USER32(?,?), ref: 00C0181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00C0182C
EndPaint.USER32(?,?), ref: 00C01876

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 6828453bf56cd161aaf7f918bb6b72651a01fb72b7fa50ea8bae3a02a7fdc217
Instruction ID: 22ca8b66812da4ea62d7cd7e2d4758bdbe30fc5976484e1968b82fe79d28ea41
Opcode Fuzzy Hash: 6828453bf56cd161aaf7f918bb6b72651a01fb72b7fa50ea8bae3a02a7fdc217
Instruction Fuzzy Hash: 40417E71504700AFD710DF25CC88FAABBE8EB46724F18466DFAA4871E1D730AD45DB62

Function 00C7709E Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00C74E41,?,?,00000000,00000001), ref: 00C770AC

Part of subcall function 00C739A0: GetWindowRect.USER32(?,?), ref: 00C739B3

GetDesktopWindow.USER32 ref: 00C770D6
GetWindowRect.USER32(00000000), ref: 00C770DD
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00C7710F

Part of subcall function 00C65244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00C652BC

GetCursorPos.USER32(?), ref: 00C7713B
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00C77199

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: b8da42b20358c237658dfe2b67f52b02b53e86b44a6981e065fc8f1a767870d2
Instruction ID: 4c91ae6a9418aa8018b9ecc96511ce42199e8f0ca1c48cbdbff26b04f187ff74
Opcode Fuzzy Hash: b8da42b20358c237658dfe2b67f52b02b53e86b44a6981e065fc8f1a767870d2
Instruction Fuzzy Hash: 6231D272609309ABD720DF14D849B9FB7A9FF88314F004A19F59997191CB70EA09CB96

Function 00C6EB23 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00C09837: __itow.LIBCMT ref: 00C09862
Part of subcall function 00C09837: __swprintf.LIBCMT ref: 00C098AC

Part of subcall function 00C1FC86: _wcscpy.LIBCMT ref: 00C1FCA9

_wcstok.LIBCMT ref: 00C6EC94
_wcscpy.LIBCMT ref: 00C6ED23
_memset.LIBCMT ref: 00C6ED56

Strings

X, xrefs: 00C6ED93

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 471732d64c94e3f2834b660ccbb4a3a944ae490c0a96022543bb9ad66f5f4dd8
Instruction ID: 671d574c2dee340c6a351ac28e84c1dd1aa620fa90ec15010d58293b8005cc35
Opcode Fuzzy Hash: 471732d64c94e3f2834b660ccbb4a3a944ae490c0a96022543bb9ad66f5f4dd8
Instruction Fuzzy Hash: 7EC18F75608300DFC724EF64C885A6AB7E4FF85314F10892DF9999B2A2DB31ED45DB82

Function 00C58879 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C580A9: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00C580C0
Part of subcall function 00C580A9: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00C580CA
Part of subcall function 00C580A9: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00C580D9
Part of subcall function 00C580A9: RtlAllocateHeap.NTDLL(00000000,?,00000002), ref: 00C580E0
Part of subcall function 00C580A9: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00C580F6

GetLengthSid.ADVAPI32(?,00000000,00C5842F), ref: 00C588CA
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00C588D6
RtlAllocateHeap.NTDLL(00000000), ref: 00C588DD
CopySid.ADVAPI32(00000000,00000000,?), ref: 00C588F6
GetProcessHeap.KERNEL32(00000000,00000000,00C5842F), ref: 00C5890A
HeapFree.KERNEL32(00000000), ref: 00C58911

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Heap$Process$AllocateInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 169236558-0
Opcode ID: b194e6d45d0bc99fa42bd817d5f7db1de52da46d271e7ce9e6db4f6ba2722396
Instruction ID: e4bb3becf4987b075a0a5a69f6f144f634f2eba2aa14bc9bfc6e32ef9649a7ec
Opcode Fuzzy Hash: b194e6d45d0bc99fa42bd817d5f7db1de52da46d271e7ce9e6db4f6ba2722396
Instruction Fuzzy Hash: B411B135501209FFDB109FA4DC09BBEB768EB45316F10402DE895E7210CB32AE99DB68

Function 00C5B790 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00C5B7B5
GetDeviceCaps.GDI32(00000000,00000058), ref: 00C5B7C6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00C5B7CD
ReleaseDC.USER32(00000000,00000000), ref: 00C5B7D5
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00C5B7EC
MulDiv.KERNEL32(000009EC,?,?), ref: 00C5B7FE

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 53b8764b89d2abf361fe7c04d60896928273f0ac95e7063be80fcaa463303ce6
Instruction ID: 7013edaf019d3c23c1940bdd8acaa755e2a654b1da6e607ac53f33a7afc90def
Opcode Fuzzy Hash: 53b8764b89d2abf361fe7c04d60896928273f0ac95e7063be80fcaa463303ce6
Instruction Fuzzy Hash: 48018475E00219BBEF109BA69C49B5EBFB8EB48351F004179FE04E7291D6309D11CFA4

Function 00C20162 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00C20193
MapVirtualKeyW.USER32(00000010,00000000), ref: 00C2019B
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00C201A6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00C201B1
MapVirtualKeyW.USER32(00000011,00000000), ref: 00C201B9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00C201C1

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: e169784b425b62d3aac8fff735cf1554d19494c8f5ba148e6fee85817daebeae
Instruction ID: 92be4889615a0c5852d6e1c5de77df5e5cb7b238164ee3e0da1cef600e38fdea
Opcode Fuzzy Hash: e169784b425b62d3aac8fff735cf1554d19494c8f5ba148e6fee85817daebeae
Instruction Fuzzy Hash: DC0148B09017597DE3008F5A8C85B56FEA8FF19354F00411BA15887941C7B5A864CBE5

Function 00C653E9 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00C653F9
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00C6540F
GetWindowThreadProcessId.USER32(?,?), ref: 00C6541E
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00C6542D
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00C65437
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00C6543E

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 7cd32d0becbce412e98e57e7a758f9ad9260362c68abe54a7a8e5a7640c401a5
Instruction ID: ed5b093c5dc42cc844ba78eb84c8104da791f350c09d81f8ba15b0dae73dc2a2
Opcode Fuzzy Hash: 7cd32d0becbce412e98e57e7a758f9ad9260362c68abe54a7a8e5a7640c401a5
Instruction Fuzzy Hash: C8F01231241558BBD7215B929C0DFAF7A7CEFC6B11F00016DF904D1051E6A51A1287B9

Function 00C67230 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00C67243
RtlEnterCriticalSection.NTDLL(?), ref: 00C67254
TerminateThread.KERNEL32(00000000,000001F6,?,00C10EE4,?,?), ref: 00C67261
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00C10EE4,?,?), ref: 00C6726E

Part of subcall function 00C66C35: CloseHandle.KERNEL32(00000000,?,00C6727B,?,00C10EE4,?,?), ref: 00C66C3F

InterlockedExchange.KERNEL32(?,000001F6), ref: 00C67281
RtlLeaveCriticalSection.NTDLL(?), ref: 00C67288

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: ed68abd11e8e403a2e53b182c66691ca291c15ce67a508628281f1e89eb87549
Instruction ID: 9b79993fb3940389bcaeda7d3578175eeee224dafaf4ca032155d8188880b809
Opcode Fuzzy Hash: ed68abd11e8e403a2e53b182c66691ca291c15ce67a508628281f1e89eb87549
Instruction Fuzzy Hash: 8FF08236540612EBD7211B64ED8CBDF7739FF45702B100639F603A10A1DB7A5912CB54

Function 00C785ED Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C78613
CharUpperBuffW.USER32(?,?), ref: 00C78722
VariantClear.OLEAUT32(?), ref: 00C7889A

Part of subcall function 00C67562: VariantInit.OLEAUT32(00000000), ref: 00C675A2
Part of subcall function 00C67562: VariantCopy.OLEAUT32(00000000,?), ref: 00C675AB
Part of subcall function 00C67562: VariantClear.OLEAUT32(00000000), ref: 00C675B7

Strings

Incorrect Parameter format, xrefs: 00C7864B, 00C7880D
AUTOIT.ERROR, xrefs: 00C78728

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: efada523e0299d139dc1ae003ef9f3e007ed1259b731bc4be8c970af32c51da1
Instruction ID: 1c4718adb925f0e0e004ddf16d3ca7afe960204b157ad5f5f088d93e6e241a67
Opcode Fuzzy Hash: efada523e0299d139dc1ae003ef9f3e007ed1259b731bc4be8c970af32c51da1
Instruction Fuzzy Hash: 68918074608301DFCB10DF25C48495BBBE4EF89714F14896EF99A8B3A2DB31E949CB52

Function 00C62A96 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C1FC86: _wcscpy.LIBCMT ref: 00C1FCA9

_memset.LIBCMT ref: 00C62B87
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00C62BB6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00C62C69
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00C62C97

Strings

0, xrefs: 00C62B73

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: ee0447e8e3aeffb85e65a1f35aeb0356c0a4327e9153e6cade69c01cb0006237
Instruction ID: a5cf98bfe8d336b13cf301c573381725cccbe7aed1b9870c30ff1facf3fea29c
Opcode Fuzzy Hash: ee0447e8e3aeffb85e65a1f35aeb0356c0a4327e9153e6cade69c01cb0006237
Instruction Fuzzy Hash: 1451CE71608B01AFE7349E28D885A6FB7E8EF95350F040A2DF8A1D6191DB70DE44E752

Function 00C897F4 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00F3DD78,?), ref: 00C89863
ScreenToClient.USER32(00000002,00000002), ref: 00C89896
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 00C89903

Strings

@U=u, xrefs: 00C8995E

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID: @U=u
API String ID: 3880355969-2594219639
Opcode ID: ae0aa8ed366ccba3101f53bd1e3cb5e61741889ea347a4cbfe8701ec3161095d
Instruction ID: 000628c5cc03e9329ebe9b08bebe86fb0ad46e269ac020aefebdaa1a10b923c9
Opcode Fuzzy Hash: ae0aa8ed366ccba3101f53bd1e3cb5e61741889ea347a4cbfe8701ec3161095d
Instruction Fuzzy Hash: BB512E74A00209AFCF10DF54D884ABE7BB5FF56364F14825DF8659B2A0D731AE81CB94

Function 00C59A80 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00C59AD2
__itow.LIBCMT ref: 00C59B03

Part of subcall function 00C59D53: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00C59DBE

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00C59B6C
__itow.LIBCMT ref: 00C59BC3

Strings

@U=u, xrefs: 00C59AD2, 00C59B6C

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend$__itow
String ID: @U=u
API String ID: 3379773720-2594219639
Opcode ID: f503b5d07f38649394557c3d0e0cdaf11949702ca14d1fb6a584d3aa683b6ec7
Instruction ID: 14882f9cd4f54db734b9b211ab4c84af39d9b52576bc9fb7e4951be14d043d9e
Opcode Fuzzy Hash: f503b5d07f38649394557c3d0e0cdaf11949702ca14d1fb6a584d3aa683b6ec7
Instruction Fuzzy Hash: C941D274A00208EBEF25EF10D845BEE7BB9EF44711F0000A9FD15A3291DB70AE89DB65

Function 00C597F5 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C614BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00C59296,?,?,00000034,00000800,?,00000034), ref: 00C614E6

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00C5983F

Part of subcall function 00C61487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00C592C5,?,?,00000800,?,00001073,00000000,?,?), ref: 00C614B1

Part of subcall function 00C613DE: GetWindowThreadProcessId.USER32(?,?), ref: 00C61409
Part of subcall function 00C613DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00C5925A,00000034,?,?,00001004,00000000,00000000), ref: 00C61419
Part of subcall function 00C613DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00C5925A,00000034,?,?,00001004,00000000,00000000), ref: 00C6142F

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00C598AC
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00C598F9

Strings

@, xrefs: 00C59911
@U=u, xrefs: 00C5983F, 00C598AC, 00C598F9

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @$@U=u
API String ID: 4150878124-826235744
Opcode ID: b2ffbcd7788e191d30a11c2a0b9cc706e33a530029ad00ad290f97a9baa5bd35
Instruction ID: b869391ff22ac6798eab2a6c77cfafeb4c748dc147028df3b932a882593c8320
Opcode Fuzzy Hash: b2ffbcd7788e191d30a11c2a0b9cc706e33a530029ad00ad290f97a9baa5bd35
Instruction Fuzzy Hash: 4441417690021CBFDB20DFA4CC81ADEBBB8EB05301F144199F955B7191DA716F89DBA0

Function 00C5D56C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(?,00000000,00000005,?,?), ref: 00C5D5D4
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00C5D60A
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00C5D61B
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00C5D69D

Strings

DllGetClassObject, xrefs: 00C5D610

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 1c53f2edbadf03f02da56e674cc14511652548c7951dd4fc3f6722e3b6b6de31
Instruction ID: 5691dba65d84f0172556d1885ccf812d5f1da2fb3145bf888523730f18d8fbf6
Opcode Fuzzy Hash: 1c53f2edbadf03f02da56e674cc14511652548c7951dd4fc3f6722e3b6b6de31
Instruction Fuzzy Hash: 464192B5500304EFDF24DF14C888B9A7BA9EF44311F1585A9BC0ADF205DBB0DA89CBA4

Function 00C62753 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C627C0
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 00C627DC
DeleteMenu.USER32(?,00000007,00000000), ref: 00C62822
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00CC5890,00000000), ref: 00C6286B

Strings

0, xrefs: 00C627B5

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 89f0490904a01f0e888dd50ed8d8ef7a465a99879aaff0a92f3d3bd062143888
Instruction ID: 39e6117a3f5fe28618e6bee712391039c396ad7fe4f2d865bdeddc5b0604c20f
Opcode Fuzzy Hash: 89f0490904a01f0e888dd50ed8d8ef7a465a99879aaff0a92f3d3bd062143888
Instruction Fuzzy Hash: 8141AE726047019FD724DF28CC84F1ABBE8EF89314F044A2DF9A5972D1D730A905DB62

Function 00C88851 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00C888DE

Strings

@U=u, xrefs: 00C8892D

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: InvalidateRect
String ID: @U=u
API String ID: 634782764-2594219639
Opcode ID: 4a567e3bb0ab131e611db880b4fd9af097286ca3b1e2911c50befee7de83fec0
Instruction ID: ac17d0fb24d682155836527c7c4fc2bdfaa1f6537520579a559dec1ba2114caa
Opcode Fuzzy Hash: 4a567e3bb0ab131e611db880b4fd9af097286ca3b1e2911c50befee7de83fec0
Instruction Fuzzy Hash: 3D31F634600109AFEF20BA58CC45FBD77A4EB0A328FD44115FA21D69E1CE31EA88975E

Function 00C7D7A5 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00C7D7C5

Part of subcall function 00C0784B: _memmove.LIBCMT ref: 00C07899

Strings

cdecl, xrefs: 00C7D81C
stdcall, xrefs: 00C7D847
none, xrefs: 00C7D8A0
winapi, xrefs: 00C7D836

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: 07fe093f51f2bdf4a0347ed6109137c4d6b695cb89b9a256233ab91de42a4079
Instruction ID: aa59bb8f1a792e559daddcec1ee35dcd71d9ef4ff59c017062cc6aed33d82774
Opcode Fuzzy Hash: 07fe093f51f2bdf4a0347ed6109137c4d6b695cb89b9a256233ab91de42a4079
Instruction Fuzzy Hash: E8318171904615AFCF04EF54C8919EEB3B5FF04320F108629F87A976D2DB71A905DB80

Function 00C7182D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00C7184C
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00C71872
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00C718A2
InternetCloseHandle.WININET(00000000), ref: 00C718E9

Part of subcall function 00C72483: GetLastError.KERNEL32(?,?,00C71817,00000000,00000000,00000001), ref: 00C72498
Part of subcall function 00C72483: SetEvent.KERNEL32(?,?,00C71817,00000000,00000000,00000001), ref: 00C724AD

Strings

, xrefs: 00C71893

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: a5cce7fdea7b0a5a15f682bb01ea9581c0106ff4695537fcef9b90590336da51
Instruction ID: 327ae86b2f84ecf436de1d846127edd8af97d34f850c85bfd7b79d147743d8cf
Opcode Fuzzy Hash: a5cce7fdea7b0a5a15f682bb01ea9581c0106ff4695537fcef9b90590336da51
Instruction Fuzzy Hash: 7921D0B1500208BFEB119F69DC85FBF77ECEB48744F14812AF80996180DA249E0567A1

Function 00C863E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C01D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00C01D73
Part of subcall function 00C01D35: GetStockObject.GDI32(00000011), ref: 00C01D87
Part of subcall function 00C01D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00C01D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00C86461
LoadLibraryW.KERNEL32(?), ref: 00C86468
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00C8647D
DestroyWindow.USER32(?), ref: 00C86485

Strings

SysAnimate32, xrefs: 00C8643C

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 28124339367acb0a6400c9e93e6ad93f15c0b1fee7a716040a3eeafc6dcc25c3
Instruction ID: c478f72ebd37585535961e5ad684dce6d4ef9b9e84258e58d36986edd9ca823c
Opcode Fuzzy Hash: 28124339367acb0a6400c9e93e6ad93f15c0b1fee7a716040a3eeafc6dcc25c3
Instruction Fuzzy Hash: BF218E71110215ABEF10AF64DC80FBF77A9EB98328F204629FA20921A0D771DC41A768

Function 00C66D9C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00C66DBC
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00C66DEF
GetStdHandle.KERNEL32(0000000C), ref: 00C66E01
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00C66E3B

Strings

nul, xrefs: 00C66E36

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: c62d107564fa33a96edfc7cdfbafb7628a907751031946c7b717637f613d3b9e
Instruction ID: f16110ce7e84c00bafd6e213a304c29efd9c423e3ceb07678237acc88e814637
Opcode Fuzzy Hash: c62d107564fa33a96edfc7cdfbafb7628a907751031946c7b717637f613d3b9e
Instruction Fuzzy Hash: 0F21AC74600209ABDB309F29DC85B9E7BE8EF44720F204A29FCA0D72D0DB719A11CB54

Function 00C66E6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00C66E89
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00C66EBB
GetStdHandle.KERNEL32(000000F6), ref: 00C66ECC
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00C66F06

Strings

nul, xrefs: 00C66F01

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: aafd94e36c0bc6b0aa5ae81781f8d29fb96b9648ded7f3e4a4a3b7e40466c496
Instruction ID: 6386281cb7f588992e13d062efee0a79fda7cfd605c858513604a5ccf747f99f
Opcode Fuzzy Hash: aafd94e36c0bc6b0aa5ae81781f8d29fb96b9648ded7f3e4a4a3b7e40466c496
Instruction Fuzzy Hash: FA21AF79600705ABDB309F69DC84BAA77A8EF45720F200B19FCB1E72D0DB71A951CB60

Function 00C6AC40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00C6AC54
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 00C6ACA8
__swprintf.LIBCMT ref: 00C6ACC1
SetErrorMode.KERNEL32(00000000,00000001,00000000,00C8F910), ref: 00C6ACFF

Strings

%lu, xrefs: 00C6ACBB

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 4259fb9ec87f6309f3f6f9bad3cdf9abc0bec98946c8b5cecaaa56a932cfaf0b
Instruction ID: 3ddf779deb78782a6edf922ec003b82c5f00dee3d0784d67e75c0798694dea10
Opcode Fuzzy Hash: 4259fb9ec87f6309f3f6f9bad3cdf9abc0bec98946c8b5cecaaa56a932cfaf0b
Instruction Fuzzy Hash: 3B217131A00109AFCB10EF65C985EAE7BB8FF49314B0040A9F909EB252DA31EA41DB21

Function 00C61AE8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00C61B19

Strings

KEYS, xrefs: 00C61B30
EXISTS, xrefs: 00C61B41
APPEND, xrefs: 00C61B52
REMOVE, xrefs: 00C61B1F

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: BuffCharUpper
String ID: APPEND$EXISTS$KEYS$REMOVE
API String ID: 3964851224-769500911
Opcode ID: 85e155023d50288c98ad9fdb34e59015cd334265ac225c6523a00cdb67b39e60
Instruction ID: cb9c23233bffa17896f2511f265b9ef280dcf832c68cb6f76336ac70e0aaace6
Opcode Fuzzy Hash: 85e155023d50288c98ad9fdb34e59015cd334265ac225c6523a00cdb67b39e60
Instruction Fuzzy Hash: DD1161B0900118CFCF10EF94D8919FEB7B4FF65304F584469D825A7692EB325D0AEB50

Function 00C7EB55 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00C7EC07
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00C7EC37
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00C7ED6A
CloseHandle.KERNEL32(?), ref: 00C7EDEB

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: c36ced11bdb13a8fa317b0accda4cb5fda18d5fcb83004d3b33c8d9a31aba803
Instruction ID: 12fc103e2420aea773b6af2e2f6f23da46bbefb5cda336aa65822799b54f9a39
Opcode Fuzzy Hash: c36ced11bdb13a8fa317b0accda4cb5fda18d5fcb83004d3b33c8d9a31aba803
Instruction Fuzzy Hash: 23816CB16047019FD720EF28C886B2AB7E5EF58710F04C95DF9A99B3D2DAB0AD40CB55

Function 00C2541D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C2547B
_memcpy_s.LIBCMT ref: 00C254ED
__read_nolock.LIBCMT ref: 00C2554B
__filbuf.LIBCMT ref: 00C2556E
_memset.LIBCMT ref: 00C255B2

Part of subcall function 00C28B28: __getptd_noexit.LIBCMT ref: 00C28B28

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: 1d92f2bce51b0a0de234b56dfad0c5d103c922ba67c2ed527f53aae8e5802bd0
Instruction ID: d2fd06acabef0982da95313ba6e710723e3d49f1939fb1b323fa87153bd4c263
Opcode Fuzzy Hash: 1d92f2bce51b0a0de234b56dfad0c5d103c922ba67c2ed527f53aae8e5802bd0
Instruction Fuzzy Hash: C851C471A00B25DBCB24DF69F88066FB7A6AF40325F248739F83596AD0D770DE909B40

Function 00C80037 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C07DE1: _memmove.LIBCMT ref: 00C07E22

Part of subcall function 00C80E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00C7FDAD,?,?), ref: 00C80E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00C800FD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00C8013C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00C80183
RegCloseKey.ADVAPI32(?,?), ref: 00C801AF
RegCloseKey.ADVAPI32(00000000), ref: 00C801BC

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 943966962ae0620c7e507b93b7aee2d7eb1e128c910e3ed9286c7bba08bc0ccc
Instruction ID: e6fc002380ddf4da183c5ed34c136ae02c9e792aeb4f6978a13d86b64ef7a339
Opcode Fuzzy Hash: 943966962ae0620c7e507b93b7aee2d7eb1e128c910e3ed9286c7bba08bc0ccc
Instruction Fuzzy Hash: 8F517B31208204AFC704EF58C885F6EB7E8FF84318F50892DF596872A2DB31E949DB56

Function 00C7D8C8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00C09837: __itow.LIBCMT ref: 00C09862
Part of subcall function 00C09837: __swprintf.LIBCMT ref: 00C098AC

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00C7D927
GetProcAddress.KERNEL32(00000000,?), ref: 00C7D9AA
GetProcAddress.KERNEL32(00000000,00000000), ref: 00C7D9C6
GetProcAddress.KERNEL32(00000000,?), ref: 00C7DA07
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 00C7DA21

Part of subcall function 00C05A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00C67896,?,?,00000000), ref: 00C05A2C
Part of subcall function 00C05A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00C67896,?,?,00000000,?,?), ref: 00C05A50

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: 1cbd0ea147134a65c4a280d3dea89c543375ad32f6f2696da21198909d7fa47f
Instruction ID: 392d9bcc34d5cc8c4c675335c3fc83956b87abcad1238fa7df1a90715189ed4c
Opcode Fuzzy Hash: 1cbd0ea147134a65c4a280d3dea89c543375ad32f6f2696da21198909d7fa47f
Instruction Fuzzy Hash: 5F510975A04205DFCB00EFA8C484AADB7B5FF09320F14C169E95AAB352DB31AE46DF51

Function 00C6E571 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00C6E61F
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00C6E648
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00C6E687

Part of subcall function 00C09837: __itow.LIBCMT ref: 00C09862
Part of subcall function 00C09837: __swprintf.LIBCMT ref: 00C098AC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00C6E6AC
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00C6E6B4

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: 7da2c70af89ca4d9c0ad892089d10eaba09da69dc2ca8e17954478af61d9eb81
Instruction ID: afceafcfa51945a7925203f2e9759e651aede017a449f57e78303c504a8084ac
Opcode Fuzzy Hash: 7da2c70af89ca4d9c0ad892089d10eaba09da69dc2ca8e17954478af61d9eb81
Instruction Fuzzy Hash: 2E511D79A00105DFCB11EF64C981AAEBBF5EF09314F1480A9E859AB3A2CB31ED11DF50

Function 00C02344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00C02357
ScreenToClient.USER32(00CC57B0,?), ref: 00C02374
GetAsyncKeyState.USER32(00000001), ref: 00C02399
GetAsyncKeyState.USER32(00000002), ref: 00C023A7

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: af6c1b39f27fe324e921b5942ec1ffb6f504774f17d0ddbba7a0ff5bf5b1d9af
Instruction ID: 24619e95b332d124ad556b8f0127db6a916ac002ea6a2f9f95e891358d061a5e
Opcode Fuzzy Hash: af6c1b39f27fe324e921b5942ec1ffb6f504774f17d0ddbba7a0ff5bf5b1d9af
Instruction Fuzzy Hash: 44414F35604119FBDF199F69C888AEDBB78BB05364F204359F939A22E0C7349E50EF91

Function 00C563AA Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00C563E7
TranslateAcceleratorW.USER32(?,?,?), ref: 00C56433
TranslateMessage.USER32(?), ref: 00C5645C
DispatchMessageW.USER32(?), ref: 00C56466
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00C56475

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: 830394d255b4ef602a5603387b6dd641a0b8bd64304223e049a43074ca306929
Instruction ID: bbd72688ed147da7a2b8759d54191e721d62cc23c1e350b337905f81ffc69905
Opcode Fuzzy Hash: 830394d255b4ef602a5603387b6dd641a0b8bd64304223e049a43074ca306929
Instruction Fuzzy Hash: AC31A275A40646AFDB64CFB0DC44FBA7BE8AB01306F940169E821C31A1E735A9CDD768

Function 00C58A1F Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00C58A30
PostMessageW.USER32(?,00000201,00000001), ref: 00C58ADA
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00C58AE2
PostMessageW.USER32(?,00000202,00000000), ref: 00C58AF0
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00C58AF8

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 8e11f6ad8c9d3abf8897ef936fa2e369cb26e7b8922cef0eefcaa73a20573cd1
Instruction ID: 49ba962ae2eb4c1339c34b6f2e204e7437e3942a5f38415fc8b2451986e360ce
Opcode Fuzzy Hash: 8e11f6ad8c9d3abf8897ef936fa2e369cb26e7b8922cef0eefcaa73a20573cd1
Instruction Fuzzy Hash: 7931DF71500219EBDF14CFA8D94CB9E3BB5EB04316F10822AF924E71D1C7B09A58EB94

Function 00C8B14B Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00C02612: GetWindowLongW.USER32(?,000000EB), ref: 00C02623

GetWindowLongW.USER32(?,000000F0), ref: 00C8B192
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00C8B1B7
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00C8B1CF
GetSystemMetrics.USER32(00000004), ref: 00C8B1F8
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,00C70E90,00000000), ref: 00C8B216

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 163ebf05821fb413e99d57c6486ac0e4a647f9448d27f1a48928d5d7f850e946
Instruction ID: 958652609d3d2759822f05fdca6958b5d95eb5c69ad8917e383f835eb5b65525
Opcode Fuzzy Hash: 163ebf05821fb413e99d57c6486ac0e4a647f9448d27f1a48928d5d7f850e946
Instruction Fuzzy Hash: 5D218D71A10651AFCB20AF39DC18B6E3BA4FB05325F154728F932D71E0E7309D619B98

Function 00C75A4D Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00C75A6E
GetForegroundWindow.USER32 ref: 00C75A85
GetDC.USER32(00000000), ref: 00C75AC1
GetPixel.GDI32(00000000,?,00000003), ref: 00C75ACD
ReleaseDC.USER32(00000000,00000003), ref: 00C75B08

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: 0846de0bdb2f51e2f104a15fd7512423aa6ab7ce2b5b984e7f1cdbb34b734556
Instruction ID: e211f9028d68abad54b8655aa74b02fc3d74c4573b9ba794355581b4b1005de0
Opcode Fuzzy Hash: 0846de0bdb2f51e2f104a15fd7512423aa6ab7ce2b5b984e7f1cdbb34b734556
Instruction Fuzzy Hash: 7A219F35A00204AFDB10EF65D888BAEBBE5EF48310F14C17DF94997362DA70AD41DB90

Function 00C012F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00C0134D
SelectObject.GDI32(?,00000000), ref: 00C0135C
BeginPath.GDI32(?), ref: 00C01373
SelectObject.GDI32(?,00000000), ref: 00C0139C

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: ba3f0ef1079f2e956d28fb4cb147df5d7ae78d87440e549c13ccbd580e3b0423
Instruction ID: 9a11d3b06eab83d3c052c4888b46ad53f01b04d1303c389eec62ca18a43f4593
Opcode Fuzzy Hash: ba3f0ef1079f2e956d28fb4cb147df5d7ae78d87440e549c13ccbd580e3b0423
Instruction Fuzzy Hash: DD213D70840708EFDB119F25DC49B6DBBE8FB10761F58422AF820961F0D771A996DF91

Function 00C64A93 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00C64ABA
__beginthreadex.LIBCMT ref: 00C64AD8
MessageBoxW.USER32(?,?,?,?), ref: 00C64AED
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00C64B03
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00C64B0A

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: 6b6352f6557d6c9275742241199e4be03aecd211f79fbffa4071761bccf190cc
Instruction ID: 4ff2f54fbe79ab92e058c808cf4f5c2b20a2c1054e4eda5c2a7f2900c5692de6
Opcode Fuzzy Hash: 6b6352f6557d6c9275742241199e4be03aecd211f79fbffa4071761bccf190cc
Instruction Fuzzy Hash: 47114472D08618BBC7108FA8EC48F9F7FACEB85320F144269F824D3260D670DD4087A0

Function 00C58202 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 00C5821E
GetLastError.KERNEL32(?,00C57CE2,?,?,?), ref: 00C58228
GetProcessHeap.KERNEL32(00000008,?,?,00C57CE2,?,?,?), ref: 00C58237
RtlAllocateHeap.NTDLL(00000000,?,00C57CE2), ref: 00C5823E
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 00C58255

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocateErrorLastProcess
String ID:
API String ID: 883493501-0
Opcode ID: 15bea2b84707e15e5be3859830e55a762806abb120f858008b41085ff1bbb88c
Instruction ID: 12aa48ab9fa9c1dcfbb7dbf83ccb99bc400b6b90f9f2577d81f09905aab808a2
Opcode Fuzzy Hash: 15bea2b84707e15e5be3859830e55a762806abb120f858008b41085ff1bbb88c
Instruction Fuzzy Hash: 9C014675200204BFDB204FA6DC88E6F7FACEF8A755B500529F859D2260DA318D59CB64

Function 00C5710A Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.COMBASE ref: 00C57127
ProgIDFromCLSID.COMBASE(?,00000000), ref: 00C57142
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00C57044,80070057,?,?), ref: 00C57150
CoTaskMemFree.COMBASE(00000000), ref: 00C57160
CLSIDFromString.COMBASE(?,?), ref: 00C5716C

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: e15b1f9677e3e4bf061301b247637e4466a7a4ccc9801e16642c37047a4eda46
Instruction ID: 958ceec5786cc156718381dc1974a7cfa5156820801e2c9c16078bb3069c3ed6
Opcode Fuzzy Hash: e15b1f9677e3e4bf061301b247637e4466a7a4ccc9801e16642c37047a4eda46
Instruction Fuzzy Hash: 9101BC7A600604ABCB104F65EC48BAE7BADEB44792F100268FD08D3220DB71DEC18BA4

Function 00C65244 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00C65260
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00C6526E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00C65276
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00C65280
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00C652BC

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: fc43c42bea379859beb86840930e6a28df05047296a7acf61f04f3a42b2dda7f
Instruction ID: 022381ae35af169127b349133d17e2254b7f821d73f2c390b19ff6a80d8b54b4
Opcode Fuzzy Hash: fc43c42bea379859beb86840930e6a28df05047296a7acf61f04f3a42b2dda7f
Instruction Fuzzy Hash: B0015731D01A29DBCF10EFE4EC98AEDBB78BB09711F50045AE941F2154CB30555187A5

Function 00C5810A Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00C58121
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00C5812B
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00C5813A
RtlAllocateHeap.NTDLL(00000000,?,TokenIntegrityLevel), ref: 00C58141
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00C58157

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: HeapInformationToken$AllocateErrorLastProcess
String ID:
API String ID: 47921759-0
Opcode ID: 653909e47577d29fe652c1fb7a342fe24c6c7ff9d6de86600a82f8d8ad31c44d
Instruction ID: 4586bce1c62582aad47dd955e43d97fa20895ed8c8b669e2f67e73307e2891ea
Opcode Fuzzy Hash: 653909e47577d29fe652c1fb7a342fe24c6c7ff9d6de86600a82f8d8ad31c44d
Instruction Fuzzy Hash: 33F06275200304AFEB111FA5EC8CF6F3BACFF4A755B100029F985D6160DB619D4ADB64

Function 00C5C1E3 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00C5C1F7
GetWindowTextW.USER32(00000000,?,00000100), ref: 00C5C20E
MessageBeep.USER32(00000000), ref: 00C5C226
KillTimer.USER32(?,0000040A), ref: 00C5C242
EndDialog.USER32(?,00000001), ref: 00C5C25C

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: f2263f923f08b2cce250112fce4a2f24be78b1fe94da33068151a3bdbaeb456f
Instruction ID: 3c1111ab9f54144b8c2e846722193e2dcccf8514cc34a0b25c2869432491e493
Opcode Fuzzy Hash: f2263f923f08b2cce250112fce4a2f24be78b1fe94da33068151a3bdbaeb456f
Instruction Fuzzy Hash: B401A234404704ABEB205B60ED8EB9A77B8BB00B06F00026DB952A14E1DBE469C99B98

Function 00C013B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00C013BF
StrokeAndFillPath.GDI32(?,?,00C3B888,00000000,?), ref: 00C013DB
SelectObject.GDI32(?,00000000), ref: 00C013EE
DeleteObject.GDI32 ref: 00C01401
StrokePath.GDI32(?), ref: 00C0141C

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 0fa9a34df427818e21088e97d0b891c508f184af806b2cccbf4bdf78ecdba555
Instruction ID: fcb8948cdd007133e4b2ed505a8ce43a399ef418dee85c8b3a0c6928d34233b0
Opcode Fuzzy Hash: 0fa9a34df427818e21088e97d0b891c508f184af806b2cccbf4bdf78ecdba555
Instruction Fuzzy Hash: DEF0C430044A08EFDB115F66EC4CB5C7BA5AB11726F188228E869890F1CB359AA6EF54

Function 00C58992 Relevance: 7.5, APIs: 5, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00C5899D
CloseHandle.KERNEL32(?), ref: 00C589B2
CloseHandle.KERNEL32(?), ref: 00C589BA
GetProcessHeap.KERNEL32(00000000,?), ref: 00C589C3
HeapFree.KERNEL32(00000000), ref: 00C589CA

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessSingleWait
String ID:
API String ID: 3751786701-0
Opcode ID: 47805a473d19e0d6ef8e602914abde5dcf9c51d76479669ff8966897a87397ca
Instruction ID: ac0867311a33a02ddec9ed25de5c70f0e0e531b0d8c16ee54be4852f46af3560
Opcode Fuzzy Hash: 47805a473d19e0d6ef8e602914abde5dcf9c51d76479669ff8966897a87397ca
Instruction Fuzzy Hash: 66E05276104505FBDA021FE5EC0CB5EBB69FB89762B508639F219C1474CB329462DB58

Function 00C12CFB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00C20DB6: std::exception::exception.LIBCMT ref: 00C20DEC
Part of subcall function 00C20DB6: __CxxThrowException@8.LIBCMT ref: 00C20E01

Part of subcall function 00C07DE1: _memmove.LIBCMT ref: 00C07E22

Part of subcall function 00C07A51: _memmove.LIBCMT ref: 00C07AAB

__swprintf.LIBCMT ref: 00C12ECD

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00C12D66

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: fcc7b2bdfd7d8cfb6f5c82ca84c5200011aa777fffabfac7b4b7ae341d15a230
Instruction ID: 7bf071bf0112d5e773e1bba2351ad0913ea4bfb6a0fce93c866922fe19af88ea
Opcode Fuzzy Hash: fcc7b2bdfd7d8cfb6f5c82ca84c5200011aa777fffabfac7b4b7ae341d15a230
Instruction Fuzzy Hash: 169180755083159FCB14EF24D885CAFB7A8FF86710F00491DF4959B2A2DA30EE85EB52

Function 00C6B93B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00C04750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00C04743,?,?,00C037AE,?), ref: 00C04770

CoInitialize.OLE32(00000000), ref: 00C6B9BB
CoCreateInstance.COMBASE(00C92D6C,00000000,00000001,00C92BDC,?), ref: 00C6B9D4
CoUninitialize.COMBASE ref: 00C6B9F1

Part of subcall function 00C09837: __itow.LIBCMT ref: 00C09862
Part of subcall function 00C09837: __swprintf.LIBCMT ref: 00C098AC

Strings

.lnk, xrefs: 00C6B99D, 00C6B9AB

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: 3c100c8f52bfe7a957b17b495a842e5d8b3a9d49e7cebcff305e819449b0a6ec
Instruction ID: 6d9081c4b350f9d481fb613b30f81edbefcef09787aed2a6d2e7cc89520d5307
Opcode Fuzzy Hash: 3c100c8f52bfe7a957b17b495a842e5d8b3a9d49e7cebcff305e819449b0a6ec
Instruction Fuzzy Hash: 0DA11A756043059FCB14DF14C484E5ABBE5FF89314F148998F8A99B3A2CB31ED86CB91

Function 00C2501D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00C250AD

Part of subcall function 00C300F0: __87except.LIBCMT ref: 00C3012B

Strings

pow, xrefs: 00C25085, 00C250A2

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 0d83b692dc46e5016bf67ff965188b3a947238420f168a842e122a0263f870a9
Instruction ID: 5ae17748e1ae4c12a082581f5652851c28c43c819a11a5f18a1f8445f8983681
Opcode Fuzzy Hash: 0d83b692dc46e5016bf67ff965188b3a947238420f168a842e122a0263f870a9
Instruction Fuzzy Hash: A951AE72A2C60286DB11B724ED2537F3B90AB00700F308D59E4E5866A9DF358FD4EB82

Function 00C16192 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C16248
_memmove.LIBCMT ref: 00C162E4
_memset.LIBCMT ref: 00C16308

Strings

ERCP, xrefs: 00C161B3

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: be64f6293af4e1cfddb795155818ef66e4768b73a751cc009c406546bf78219a
Instruction ID: 5c10c8008a5636badd33f83002a97ef3ddf1d8b26ed099790b76c2662106a8de
Opcode Fuzzy Hash: be64f6293af4e1cfddb795155818ef66e4768b73a751cc009c406546bf78219a
Instruction Fuzzy Hash: B251BF71A00705DBDB24CFA5C981BEAB7F4EF05305F20856EE95ADB251E770EA84DB40

Function 00C87946 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00C8F910,00000000,?,?,?,?), ref: 00C879DF
GetWindowLongW.USER32 ref: 00C879FC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00C87A0C

Strings

SysTreeView32, xrefs: 00C879B1

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 6542fbe9015a14e48765cdbb49b127658fd5228e286b13cf9e83d64b548c2556
Instruction ID: 048c89f87ae92daed8eb74730132ec177f6160af06d50ab253187beff71e5cf4
Opcode Fuzzy Hash: 6542fbe9015a14e48765cdbb49b127658fd5228e286b13cf9e83d64b548c2556
Instruction Fuzzy Hash: 7731E331204205ABDB159F34DC45BEB77A9FB05328F204725F875A31E0E730ED519754

Function 00C873D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00C87461
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00C87475
SendMessageW.USER32(?,00001002,00000000,?), ref: 00C87499

Strings

SysMonthCal32, xrefs: 00C8742C

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 804885d708e267bf0dd6192f6cbb2d6b9e3b52d46cb162b92e5e7073f65154b5
Instruction ID: 0d550082222da73ce9c68228ca7c60448834c18442cac8064382a77bbd8f841c
Opcode Fuzzy Hash: 804885d708e267bf0dd6192f6cbb2d6b9e3b52d46cb162b92e5e7073f65154b5
Instruction Fuzzy Hash: 66219132500218BBDF11DF94CC46FEA3B69EB88728F210214FE156B1D0EA75EC91DBA4

Function 00C87B93 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00C87C4A
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00C87C58
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00C87C5F

Strings

msctls_updown32, xrefs: 00C87BC4

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 02bdfd0b92753dbcc10df79574e75aa87c4e95e4484d97bf3c75c907f762139f
Instruction ID: c611a0467992295a6a1f7625b318544aeff5793d36d3bb0ecb04943727d0add4
Opcode Fuzzy Hash: 02bdfd0b92753dbcc10df79574e75aa87c4e95e4484d97bf3c75c907f762139f
Instruction Fuzzy Hash: DC218EB5604208AFDB10EF24DCC1EAB77EDEF49358B240159FA119B3A1DB71EC419B64

Function 00C86CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00C86D3B
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00C86D4B
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00C86D70

Strings

Listbox, xrefs: 00C86D08

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: bdf326ad2219d380efa4349128e59a439ce743a0b454f954b608d4fad939108a
Instruction ID: ba63dd142badeb881c8e064ab54f81a750d013880291e523897fb1d01eb60485
Opcode Fuzzy Hash: bdf326ad2219d380efa4349128e59a439ce743a0b454f954b608d4fad939108a
Instruction Fuzzy Hash: 34210432600118BFDF129F54CC45FBF3BBAEF89754F018128F9509B1A0C671AC5197A4

Function 00C58C4B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00C58C6D
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00C58C84
SendMessageW.USER32(?,0000000D,?,00000000), ref: 00C58CBC

Strings

@U=u, xrefs: 00C58CBC

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: d99c44f7bae940b70bd5b7d480f5076739123a8716a000d8418cb9453b697655
Instruction ID: 40254d94de8e98be649dd0a657f9686f2545eae7fe40c0fbbb87bf8fce727ac0
Opcode Fuzzy Hash: d99c44f7bae940b70bd5b7d480f5076739123a8716a000d8418cb9453b697655
Instruction Fuzzy Hash: 49219F36601118BBDB10DFA8D841EAEB7BDEF44350F11055AF905E3260DA71BE89DBA8

Function 00C8770E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00C87772
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00C87787
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00C87794

Strings

msctls_trackbar32, xrefs: 00C87749

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 341f43f314c169ab64574540258f653dedd3ab6b025f5a67b95b5b85b4be6210
Instruction ID: 54aab8ac29faac20bef3cfc8d7e715e2060ab5bf52d059c9d4f83ac4482107a7
Opcode Fuzzy Hash: 341f43f314c169ab64574540258f653dedd3ab6b025f5a67b95b5b85b4be6210
Instruction Fuzzy Hash: C6113A32204208BFEF216F61CC01FDB7768EF88B58F110228FA51920D0D271E851DB24

Function 00C86920 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00C869A2
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00C869B1

Strings

@U=u, xrefs: 00C869B1
edit, xrefs: 00C86986

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: @U=u$edit
API String ID: 2978978980-590756393
Opcode ID: 5e1d4389792f7cbbb21ed8615703d7557b5f878ee9a77af75e1e5f0652c55daf
Instruction ID: 3ac8aa613536b6b9192e9ba82a52a6b3da0b6ae9d40e4d91a1883188ccfddd93
Opcode Fuzzy Hash: 5e1d4389792f7cbbb21ed8615703d7557b5f878ee9a77af75e1e5f0652c55daf
Instruction Fuzzy Hash: 46116A71510208ABEB10AF64DC45AEB37A9EB05378F604728F9B5971E0C631DC91A768

Function 00C58E05 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C07DE1: _memmove.LIBCMT ref: 00C07E22

Part of subcall function 00C5AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00C5AABC

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00C58E73

Strings

ListBox, xrefs: 00C58E3D
@U=u, xrefs: 00C58E73
ComboBox, xrefs: 00C58E12

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: @U=u$ComboBox$ListBox
API String ID: 372448540-2258501812
Opcode ID: 28be1a60569713218fd9ef060e22729a7686e56303b57fd8c6fd1e68ff4c8725
Instruction ID: 88e379bd5b50489ce893570916f09e07c4a4ed67bb6aab069e5d826ac3e4da29
Opcode Fuzzy Hash: 28be1a60569713218fd9ef060e22729a7686e56303b57fd8c6fd1e68ff4c8725
Instruction Fuzzy Hash: B701F579A01218ABCF14EBA0CC429FE7378AF01320B100B19BC31672D1DE31584CEA54

Function 00C58CFD Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C07DE1: _memmove.LIBCMT ref: 00C07E22

Part of subcall function 00C5AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00C5AABC

SendMessageW.USER32(?,00000180,00000000,?), ref: 00C58D6B

Strings

ListBox, xrefs: 00C58D35
@U=u, xrefs: 00C58D6B
ComboBox, xrefs: 00C58D0A

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: @U=u$ComboBox$ListBox
API String ID: 372448540-2258501812
Opcode ID: 620d9eb64608cacf77145842ba6eb6dd1e7be4b2986c1e547dce5cb74eb2ed2a
Instruction ID: 1eef040945584bbd6711c9715d94460873632fb6245f2a7dfb4ce4816b10f135
Opcode Fuzzy Hash: 620d9eb64608cacf77145842ba6eb6dd1e7be4b2986c1e547dce5cb74eb2ed2a
Instruction Fuzzy Hash: 2101DF75A41109ABCF14EBA1C952AFF73B89F15341F100129BD06772E1DE215E0CE679

Function 00C58D82 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C07DE1: _memmove.LIBCMT ref: 00C07E22

Part of subcall function 00C5AA99: GetClassNameW.USER32(?,?,000000FF), ref: 00C5AABC

SendMessageW.USER32(?,00000182,?,00000000), ref: 00C58DEE

Strings

ListBox, xrefs: 00C58DBA
@U=u, xrefs: 00C58DEE
ComboBox, xrefs: 00C58D8F

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: @U=u$ComboBox$ListBox
API String ID: 372448540-2258501812
Opcode ID: a0520b8b12cbfaf075791a7543737c75252573fc4a635a54a151b1b632d8a55b
Instruction ID: 3ed158af54ac07842deffa5fa35bdc6f40798bd66b1fa4f5b772aae2d439f860
Opcode Fuzzy Hash: a0520b8b12cbfaf075791a7543737c75252573fc4a635a54a151b1b632d8a55b
Instruction Fuzzy Hash: 8201F275A41109ABDF14EAA4C942AFF73A88F11301F100125BC05732D2DE225E0DE679

Function 00C8ACCF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45windowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,00CC57B0,00C8D809,000000FC,?,00000000,00000000,?,?,?,00C3B969,?,?,?,?,?), ref: 00C8ACD1
GetFocus.USER32 ref: 00C8ACD9

Part of subcall function 00C02612: GetWindowLongW.USER32(?,000000EB), ref: 00C02623

Part of subcall function 00C025DB: GetWindowLongW.USER32(?,000000EB), ref: 00C025EC

SendMessageW.USER32(00F3DD78,000000B0,000001BC,000001C0), ref: 00C8AD4B

Strings

@U=u, xrefs: 00C8AD4B

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Window$Long$FocusForegroundMessageSend
String ID: @U=u
API String ID: 3601265619-2594219639
Opcode ID: 4d8f20cc880fd055fb77375338f452e6e12a3d44b399fd6db0276dbe6c5ff325
Instruction ID: 003b384c9e45b72f2a2df3a9760fd698c25febbc21191a4fe0cd80a96c621aa0
Opcode Fuzzy Hash: 4d8f20cc880fd055fb77375338f452e6e12a3d44b399fd6db0276dbe6c5ff325
Instruction Fuzzy Hash: 520192312005008FD724AB28D898F6A37E6EB89325B18027EF425C72F1DB31AC86CB54

Function 00C16063 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C1603A: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00C16051

SendMessageW.USER32(?,0000000C,00000000,?), ref: 00C1607F
GetParent.USER32(?), ref: 00C50D46
InvalidateRect.USER32(00000000,?,00C13A4F,?,00000000,00000001), ref: 00C50D4D

Strings

@U=u, xrefs: 00C1607F

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend$InvalidateParentRectTimeout
String ID: @U=u
API String ID: 3648793173-2594219639
Opcode ID: 7d6c87cc8fa45e1fce0fe4de770b9389ea2890fe7d44f7146254c4eebf22437c
Instruction ID: 545631609603eea74f60074d123dc6da654c38afbd71a1e0daad5441a8a07500
Opcode Fuzzy Hash: 7d6c87cc8fa45e1fce0fe4de770b9389ea2890fe7d44f7146254c4eebf22437c
Instruction Fuzzy Hash: E3F0E530100204FBFF211F71DC09FD97B69AF0A340F204428F9459A0B0D6B368C1BB58

Function 00C04B37 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00C04AD0), ref: 00C04B45
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00C04B57

Strings

GetNativeSystemInfo, xrefs: 00C04B51
kernel32.dll, xrefs: 00C04B40

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 384ad8db6dffded6e40f1ae1f37f27d2f6d9175db3b53d2b11ccb58b0d88e7cb
Instruction ID: d63a6f371dd45177ee9fcd84ebe4a319f2560758ed0c2d1cd8aa65cb7bcee960
Opcode Fuzzy Hash: 384ad8db6dffded6e40f1ae1f37f27d2f6d9175db3b53d2b11ccb58b0d88e7cb
Instruction Fuzzy Hash: A4D01775A10B13CFD720AF32E828B1A76E8AF45795B11883E9496D6190E674E881CB5C

Function 00C04C03 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00C04BD0,?,00C04DEF,?,00CC52F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00C04C11
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00C04C23

Strings

Wow64DisableWow64FsRedirection, xrefs: 00C04C1D
kernel32.dll, xrefs: 00C04C0C

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: d49135f636494005cb8f6af103962c956bda5579c7a3d4090a38fb4bd2dba070
Instruction ID: df0510e8bf0aa9bf6a6ee367dbafbc45f87f426c69289f75b75d6a2aeffa0c4b
Opcode Fuzzy Hash: d49135f636494005cb8f6af103962c956bda5579c7a3d4090a38fb4bd2dba070
Instruction Fuzzy Hash: A3D01771611713CFE720AF71DA0874FBAE5EF09752B118C3E9596D61A0E6B0D881CB64

Function 00C04C36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00C04B83,?), ref: 00C04C44
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00C04C56

Strings

Wow64RevertWow64FsRedirection, xrefs: 00C04C50
kernel32.dll, xrefs: 00C04C3F

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 4dbbc10b41f492a594809723116779904b7ea8f2298eb3bf285945be2e2ba106
Instruction ID: a988f5cab2f29e1d2eebff061319b397d0488a7934edd978e6fc846f393bae35
Opcode Fuzzy Hash: 4dbbc10b41f492a594809723116779904b7ea8f2298eb3bf285945be2e2ba106
Instruction Fuzzy Hash: 38D01771610713CFE7249F31D90875E7AE4AF05751B11883ED5A6D61A4E670D8C0CB64

Function 00C80DE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00C81039), ref: 00C80DF5
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00C80E07

Strings

RegDeleteKeyExW, xrefs: 00C80E01
advapi32.dll, xrefs: 00C80DF0

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: 42250de237a3f5a1a97617d124317c23fb1f6f81ca40980cb8f09d0892d278d0
Instruction ID: ff076d7d124c26a6cdebe7c87b7d6074d0e2962b32998ee6d151613062f51da6
Opcode Fuzzy Hash: 42250de237a3f5a1a97617d124317c23fb1f6f81ca40980cb8f09d0892d278d0
Instruction Fuzzy Hash: 3DD0C730540322CFC320AFB0C8083CBB2E4AF04342F208C3E95D2C2150E6B0E894CB08

Function 00C790E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,00C78CF4,?,00C8F910), ref: 00C790EE
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00C79100

Strings

GetModuleHandleExW, xrefs: 00C790FA
kernel32.dll, xrefs: 00C790E9

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 66655a3be8d6f7ee6e22c649a0e5a775d49cdcafbbf97706ce766c7bbd925b2e
Instruction ID: 334a8270f6c50865c50a3aecd787bad0737df2972239475be974ac621808fd54
Opcode Fuzzy Hash: 66655a3be8d6f7ee6e22c649a0e5a775d49cdcafbbf97706ce766c7bbd925b2e
Instruction Fuzzy Hash: 9BD01735610723CFDB209F79D81C75E76E8AF05751B52C83E949AD6590EA70D890CB90

Function 00C41714 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00C41718
__swprintf.LIBCMT ref: 00C41749

Strings

%.3d, xrefs: 00C41723
WIN_XPe, xrefs: 00C41788

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 967616d960086b5ea77269f9714e4933937481ca84585896cfe04bcf5d058c2f
Instruction ID: 55c1c1abdfd7b233f8fa943c7ac17777affb24dadb5dee5cbdbc3536a2dd27dd
Opcode Fuzzy Hash: 967616d960086b5ea77269f9714e4933937481ca84585896cfe04bcf5d058c2f
Instruction Fuzzy Hash: 2DD01771C48118FACB109B9298889FD737CBB08301F280562B952A2080E2369BD4EA25

Function 00C5717D Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed6b6fe012ad1bef909e3a51a5cca8fef07d7ec2ba6d62fbbc495b0faeb53e53
Instruction ID: 7fcb26224ff1dd363cb11fb230d08bf56435baf63782d9951e9f2a9276ec3e4f
Opcode Fuzzy Hash: ed6b6fe012ad1bef909e3a51a5cca8fef07d7ec2ba6d62fbbc495b0faeb53e53
Instruction Fuzzy Hash: D1C17D79A04216EFCB14CF94D884AAEBBB5FF48311B108698EC15DB251D730DEC5DB94

Function 00C7E02A Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00C7E0BE
CharLowerBuffW.USER32(?,?), ref: 00C7E101

Part of subcall function 00C7D7A5: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 00C7D7C5

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00C7E301
_memmove.LIBCMT ref: 00C7E314

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 5ee069571d83b63ad3d6f9ce389dc6ade595adddb0fa353dc8b99ee40bdd77c6
Instruction ID: cfa62f1ac321b5cf1441dd94accff4d61bfad4aff48267436abef25edcb533d5
Opcode Fuzzy Hash: 5ee069571d83b63ad3d6f9ce389dc6ade595adddb0fa353dc8b99ee40bdd77c6
Instruction Fuzzy Hash: 99C11A716083119FC714DF28C481A6ABBE4FF89714F14896EF8999B352D731EA46CB82

Function 00C78093 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00C780C3
CoUninitialize.COMBASE ref: 00C780CE

Part of subcall function 00C5D56C: CoCreateInstance.COMBASE(?,00000000,00000005,?,?), ref: 00C5D5D4

VariantInit.OLEAUT32(?), ref: 00C780D9
VariantClear.OLEAUT32(?), ref: 00C783AA

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: d087eac9c1b05a4f6234f39429b63daa7059a3aab63670591aaf22fa784fec98
Instruction ID: 7ac6aafe79474a96ef7bd1ccba675ed4ce04460d52394d6ebffaf19b11519141
Opcode Fuzzy Hash: d087eac9c1b05a4f6234f39429b63daa7059a3aab63670591aaf22fa784fec98
Instruction Fuzzy Hash: 26A169756047019FCB10DF25C485B2AB7E4FF89324F148548FA9A9B3A2CB30ED09DB82

Function 00C57530 Relevance: 6.2, APIs: 4, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.COMBASE(?,00000000), ref: 00C576EA
CoTaskMemFree.COMBASE(00000000), ref: 00C57702
CLSIDFromProgID.COMBASE(?,?), ref: 00C57727
_memcmp.LIBCMT ref: 00C57748

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID:
API String ID: 314563124-0
Opcode ID: f271be5c5437e37bd8b95e2f2616dc02f1fff0fd2223e4b2194395468f5bde25
Instruction ID: 8b5b0993e53673a6d837714ee4a970015e6397d2d1d58c2979dc6caa1b90a054
Opcode Fuzzy Hash: f271be5c5437e37bd8b95e2f2616dc02f1fff0fd2223e4b2194395468f5bde25
Instruction Fuzzy Hash: 38811C75A00109EFCB04DFA4D984EEEB7B9FF89315F204158F515AB250DB71AE8ACB60

Function 00C5687D Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C5688E
SysAllocString.OLEAUT32(00000000), ref: 00C56937
VariantCopy.OLEAUT32 ref: 00C56966
VariantClear.OLEAUT32(?), ref: 00C5698D

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 304aeb7dd89e8ad8320ad7ac1768c0546d5d724bfc9fd001bb9dc3ff3ce03c8c
Instruction ID: a1ffd642ab23e3b551a3403cad49e8600e9128fd60f5fe1249017bbd8c6da27c
Opcode Fuzzy Hash: 304aeb7dd89e8ad8320ad7ac1768c0546d5d724bfc9fd001bb9dc3ff3ce03c8c
Instruction Fuzzy Hash: EF51C4787003019ADF24AF65D891B2EB3E5EF45311F60C81FE996DB292DB30D8C8A708

Function 00C6B7F4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00C6B89E
GetLastError.KERNEL32(?,00000000), ref: 00C6B8C4
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00C6B8E9
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00C6B915

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: da84544aa89f9f2de435ab38bff04c3c676f00d40729e2702c3998db2106a64a
Instruction ID: f7aaf94ed63b5f487f2ca6a66e50dc00c16783805972ae88253e5d630256f636
Opcode Fuzzy Hash: da84544aa89f9f2de435ab38bff04c3c676f00d40729e2702c3998db2106a64a
Instruction Fuzzy Hash: 7F41E579600611DFCB21EF15C485A59BBA1EF4A310F19C098ED5AAB3A2CB30ED42DB91

Function 00C8AB37 Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00C8AB60
GetWindowRect.USER32(?,?), ref: 00C8ABD6
PtInRect.USER32(?,?,00C8C014), ref: 00C8ABE6
MessageBeep.USER32(00000000), ref: 00C8AC57

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 923aafdaa92ef37376892e9ea85bd29f373c3208d342d74b79ad88ab7fc85f67
Instruction ID: 7ec625c69f2a673bb937f938a8b2a64a0f5bcfe56edf1ce99814379d8229cbb1
Opcode Fuzzy Hash: 923aafdaa92ef37376892e9ea85bd29f373c3208d342d74b79ad88ab7fc85f67
Instruction Fuzzy Hash: 2F418D30600119DFEB11EF58C884B6D7BF5FF49314F1881AAE825DB261D732E981DB9A

Function 00C60AD6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00C60B27
SetKeyboardState.USER32(00000080,?,00000001), ref: 00C60B43
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 00C60BA9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 00C60BFB

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: f70bac1dbfd0a12894cdc0cb3249519dec692ba120a5924e63c5b0a81ad64faf
Instruction ID: fc22c69a4f10509eeafb2a28f621cf5d39e62a599f4400ef594cfa970967981d
Opcode Fuzzy Hash: f70bac1dbfd0a12894cdc0cb3249519dec692ba120a5924e63c5b0a81ad64faf
Instruction Fuzzy Hash: 35314830940608AFFB348B29CC85FFFBBA5EB85319F28835AE4A1721D1C3758E859755

Function 00C60C11 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,753DC0D0,?,00008000), ref: 00C60C66
SetKeyboardState.USER32(00000080,?,00008000), ref: 00C60C82
PostMessageW.USER32(00000000,00000101,00000000), ref: 00C60CE1
SendInput.USER32(00000001,?,0000001C,753DC0D0,?,00008000), ref: 00C60D33

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 633d0103afa9ca1f5659bab3cc18c872a8d759c57e3a7594546103cbc430a784
Instruction ID: 7718eac54c0d186d046f77472982f15f8451f5a05a13d0baac6b05b212c0592c
Opcode Fuzzy Hash: 633d0103afa9ca1f5659bab3cc18c872a8d759c57e3a7594546103cbc430a784
Instruction Fuzzy Hash: 5B314630A402186EFF348B65C844BFFBBA6EB45310F28431EE4A1B21D1C3359A86D766

Function 00C361C5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00C361FB
__isleadbyte_l.LIBCMT ref: 00C36229
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00C36257
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00C3628D

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 547c8c91ba25818d1321175f12b769a457b96868a7249aed7091fb8c330377ca
Instruction ID: 0a8be7de29b5cfa5e18b3e6ad06508cd198b2f9061be0ac92170b5f018860b37
Opcode Fuzzy Hash: 547c8c91ba25818d1321175f12b769a457b96868a7249aed7091fb8c330377ca
Instruction Fuzzy Hash: 8C31D030614256BFDF218F65CC48BAF7BB9FF42310F168028E864871A1DB32DA50DB90

Function 00C84EEE Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00C84F02

Part of subcall function 00C63641: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00C6365B
Part of subcall function 00C63641: GetCurrentThreadId.KERNEL32 ref: 00C63662
Part of subcall function 00C63641: AttachThreadInput.USER32(00000000,?,00C65005), ref: 00C63669

GetCaretPos.USER32(?), ref: 00C84F13
ClientToScreen.USER32(00000000,?), ref: 00C84F4E
GetForegroundWindow.USER32 ref: 00C84F54

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: ec4da4fbab38511a88a59b3373ede76139abb98ba292bfcb0bb03c9c9951edec
Instruction ID: cc84f01bbe9dd48b931ad0ec826e471725c12f540727e3d81c6a2a045c682268
Opcode Fuzzy Hash: ec4da4fbab38511a88a59b3373ede76139abb98ba292bfcb0bb03c9c9951edec
Instruction Fuzzy Hash: 7A313EB1D00108AFDB00EFB5C885AEFB7F9EF88304F10806AE415E7242DA719E45DBA4

Function 00C58656 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C5810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00C58121
Part of subcall function 00C5810A: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00C5812B
Part of subcall function 00C5810A: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00C5813A
Part of subcall function 00C5810A: RtlAllocateHeap.NTDLL(00000000,?,TokenIntegrityLevel), ref: 00C58141
Part of subcall function 00C5810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00C58157

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 00C586A3
_memcmp.LIBCMT ref: 00C586C6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00C586FC
HeapFree.KERNEL32(00000000), ref: 00C58703

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocateErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 2182266621-0
Opcode ID: 0518d1bfaa8da54f68b3ed1307fcd448eb045eda2360368ea43f9c4c8b35fda6
Instruction ID: ddf688bda5c977defdfd5f64e2cdee4c99ce4b3cea1e795e10238b26fce64bac
Opcode Fuzzy Hash: 0518d1bfaa8da54f68b3ed1307fcd448eb045eda2360368ea43f9c4c8b35fda6
Instruction Fuzzy Hash: 78217A71E01109EFDB10DFA4C989BEEB7B8EF45306F154059E854AB240DB30AE49DB98

Function 00C2098C Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 00C209AE

Part of subcall function 00C05A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00C67896,?,?,00000000), ref: 00C05A2C
Part of subcall function 00C05A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00C67896,?,?,00000000,?,?), ref: 00C05A50

_fprintf.LIBCMT ref: 00C209E5
OutputDebugStringW.KERNEL32(?), ref: 00C55DBB

Part of subcall function 00C24AAA: _flsall.LIBCMT ref: 00C24AC3

__setmode.LIBCMT ref: 00C20A1A

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: 8a6c922e05da80c2501baa966fec8010a1c35a5abd11129fb89c89a0fc1fdb9a
Instruction ID: ea5601a3584f44958d58e572b111e43c6f519e1610598a2fcf5855fce76fd5ad
Opcode Fuzzy Hash: 8a6c922e05da80c2501baa966fec8010a1c35a5abd11129fb89c89a0fc1fdb9a
Instruction Fuzzy Hash: 2B113A72A04214AFDB08B7B4BC47EBEB7A8DF41320F644116F105575C3EE305986B7A5

Function 00C71767 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00C717A3

Part of subcall function 00C7182D: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00C7184C
Part of subcall function 00C7182D: InternetCloseHandle.WININET(00000000), ref: 00C718E9

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 729a2fb555704b2ce433518a35187a7f125f06f4e1580aa9098c516f3774b4be
Instruction ID: a1fdb6dd50468a2ba3005e0ffc21f7d044eefff41c272aca6f6b7c82e8793dc3
Opcode Fuzzy Hash: 729a2fb555704b2ce433518a35187a7f125f06f4e1580aa9098c516f3774b4be
Instruction Fuzzy Hash: 68210431200601BFEB128F64CC00FBABBADFF48710F18802EFD1996191D731D911A7A1

Function 00C63A2A Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00C8FAC0), ref: 00C63A64
GetLastError.KERNEL32 ref: 00C63A73
CreateDirectoryW.KERNEL32(?,00000000), ref: 00C63A82
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,00C8FAC0), ref: 00C63ADF

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: 692e4baf885c2321225914740e943be29083d55015f3173d99f739c83b0e28ec
Instruction ID: 265691b6ad6faa746bbb9be2ecd12125190daed30d1a841fc1d6a0d9ab3d42d2
Opcode Fuzzy Hash: 692e4baf885c2321225914740e943be29083d55015f3173d99f739c83b0e28ec
Instruction Fuzzy Hash: 942194345082419FC710EF68C8C196BB7E4AE55364F144A2DF4A9C72E2D7319A46EB52

Function 00C350E2 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00C35101

Part of subcall function 00C2571C: __FF_MSGBANNER.LIBCMT ref: 00C25733
Part of subcall function 00C2571C: __NMSG_WRITE.LIBCMT ref: 00C2573A
Part of subcall function 00C2571C: RtlAllocateHeap.NTDLL(00F20000,00000000,00000001), ref: 00C2575F

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: c01e9455fa6f52207fd69fe45da505f0e0c2692e0246c4d8d065864d76756c1e
Instruction ID: 4f24f173f76774d67784f71dcda98e01c79fe947781b7252aea89fec86a44592
Opcode Fuzzy Hash: c01e9455fa6f52207fd69fe45da505f0e0c2692e0246c4d8d065864d76756c1e
Instruction Fuzzy Hash: 75114872911A21AFCF313F74FC05B5E37989F103A1F10492DF9149A164DF348A41A790

Function 00C044A0 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C044CF

Part of subcall function 00C0407C: _memset.LIBCMT ref: 00C040FC
Part of subcall function 00C0407C: _wcscpy.LIBCMT ref: 00C04150
Part of subcall function 00C0407C: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00C04160

KillTimer.USER32(?,00000001,?,?), ref: 00C04524
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00C04533
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00C3D4B9

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 5143ee632cbfb707cdd98d13d16a3424f55fd8a36f14113e958be1b90b7c53cc
Instruction ID: 37b33bf02b2d1327146e24c81624752feb78c86f97198a1282a369fd71cb2885
Opcode Fuzzy Hash: 5143ee632cbfb707cdd98d13d16a3424f55fd8a36f14113e958be1b90b7c53cc
Instruction Fuzzy Hash: 2C21C5B1904794AFE7328B24DC55BEBBBECAB05318F0400DDE79A56181C3742A84DB51

Function 00C585B1 Relevance: 6.1, APIs: 4, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00C585E2
OpenProcessToken.ADVAPI32(00000000), ref: 00C585E9
CloseHandle.KERNEL32(00000004), ref: 00C58603
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00C58632

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Process$CloseCreateCurrentHandleLogonOpenTokenWith
String ID:
API String ID: 2621361867-0
Opcode ID: efbbe600e943e01f5d350a06a6450e4762cbf1470dfd26f8a8332b2e89a0b22c
Instruction ID: 13f06bfcb1639a60b98a4d8717a440951771c94268f69954478344d0bbb81f5e
Opcode Fuzzy Hash: efbbe600e943e01f5d350a06a6450e4762cbf1470dfd26f8a8332b2e89a0b22c
Instruction Fuzzy Hash: 7011607650120DAFEF018F94DD49FDE7BA9EF08305F144069FE04A2160C7718E69EB64

Function 00C76369 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00C05A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,00C67896,?,?,00000000), ref: 00C05A2C
Part of subcall function 00C05A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,00C67896,?,?,00000000,?,?), ref: 00C05A50

gethostbyname.WS2_32(?), ref: 00C76399
WSAGetLastError.WS2_32(00000000), ref: 00C763A4
_memmove.LIBCMT ref: 00C763D1
inet_ntoa.WS2_32(?), ref: 00C763DC

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: b1aa5179834f1183b66dc79024ebebf5d507372ebbed433ca33a6dcaad487187
Instruction ID: 353680e6b72cbcf96511e93438f5a48cc639f8aee321f69ccc92e2b5f177d979
Opcode Fuzzy Hash: b1aa5179834f1183b66dc79024ebebf5d507372ebbed433ca33a6dcaad487187
Instruction Fuzzy Hash: 9B116031A00109AFCB00FBA4DD46DEEB7B8EF05310B148165F505A72A2DB31AE15EB61

Function 00C58B41 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00C58B61
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00C58B73
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00C58B89
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00C58BA4

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: d78be7de0a82660e58d46d2b5aa03afda92cabfa288103592b15b00815b47c77
Instruction ID: 889779435c4c3d2dd9ad8deef7fcb454495acb9592583cfec998e1f4231e299f
Opcode Fuzzy Hash: d78be7de0a82660e58d46d2b5aa03afda92cabfa288103592b15b00815b47c77
Instruction Fuzzy Hash: C3115A79900218FFEB10DFA5CC84FADBBB8FB48710F2041A5EA00B7290DA716E55DB94

Function 00C61142 Relevance: 6.1, APIs: 4, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00C5FCED,?,00C60D40,?,00008000), ref: 00C6115F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00C5FCED,?,00C60D40,?,00008000), ref: 00C61184
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00C5FCED,?,00C60D40,?,00008000), ref: 00C6118E
Sleep.KERNEL32(?,?,?,?,?,?,?,00C5FCED,?,00C60D40,?,00008000), ref: 00C611C1

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: 5d7cf66fddca5b1af31bd52f0a01ef35e06a0a429f9541cb796b3a5c820dd7fc
Instruction ID: a1c324fe5f57db34c46d8470224fa82750607b9a5858debdceef57c6d7663c83
Opcode Fuzzy Hash: 5d7cf66fddca5b1af31bd52f0a01ef35e06a0a429f9541cb796b3a5c820dd7fc
Instruction Fuzzy Hash: 36113C31D0052DE7CF109FA5D888BEEBB78FF0A712F08445AEE41B2240CB749691CB95

Function 00C5D831 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 00C5D84D
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00C5D864
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00C5D879
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 00C5D897

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: 46fbc05e95bd5cb2eb8ab9507939c882d1f445ab4ac5a00dfc02e8ba7fdb9c51
Instruction ID: 714752da7af3e5237c21331eef0d89475b0e492b63e114d5b056300559b37eee
Opcode Fuzzy Hash: 46fbc05e95bd5cb2eb8ab9507939c882d1f445ab4ac5a00dfc02e8ba7fdb9c51
Instruction Fuzzy Hash: 39115E79605304DBE3308F51EC0CF96BBBCEB40B01F10856DA916D6090D7B0E989DBE5

Function 00C36FB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00C36FDB

Part of subcall function 00C376C2: __fltout2.LIBCMT ref: 00C376EB

__cftog_l.LIBCMT ref: 00C37001
__cftoe_l.LIBCMT ref: 00C37033

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 659c63065014d6491f8a894b09784ee6d392aae2af0bd8a668a3a282fd5239c7
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 5A0140B245414ABBCF2A5F84CC45CED3F62BB18350F588615FE2858031D236CAB1BB81

Function 00C8B2C5 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00C8B2E4
ScreenToClient.USER32(?,?), ref: 00C8B2FC
ScreenToClient.USER32(?,?), ref: 00C8B320
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00C8B33B

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: c282cb2ec90451ee32ec47790fc25be399ddd26d89da0f8c792af709d3ff0513
Instruction ID: 73ee0b295d0f00344f87d7d888ace24f4c6806941fa7adef3ec32b467ddca366
Opcode Fuzzy Hash: c282cb2ec90451ee32ec47790fc25be399ddd26d89da0f8c792af709d3ff0513
Instruction Fuzzy Hash: D0114675D00209EFDB41DF99C444AEEFBB5FF18310F104166E914E3220D735AA558F54

Function 00C8B635 Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C8B644
_memset.LIBCMT ref: 00C8B653
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00CC6F20,00CC6F64), ref: 00C8B682
CloseHandle.KERNEL32 ref: 00C8B694

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: a187a63ff3559a4b3bd57d287936019c5dab0c2005d1aee01c2bf4947dd6d993
Instruction ID: 9b3833f867b7b9a881e7edf69236cbbe2b67c66a7465a01a27999e2ce00949ae
Opcode Fuzzy Hash: a187a63ff3559a4b3bd57d287936019c5dab0c2005d1aee01c2bf4947dd6d993
Instruction Fuzzy Hash: EEF05EF25403107AE61027A1FD06FBF3A9CEB08395F004028FA08E51A2D7719C01C7AC

Function 00C66BDA Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 00C66BE6

Part of subcall function 00C676C4: _memset.LIBCMT ref: 00C676F9

_memmove.LIBCMT ref: 00C66C09
_memset.LIBCMT ref: 00C66C16
RtlLeaveCriticalSection.NTDLL(?), ref: 00C66C26

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: d1d70402f50e1a9d704afe76dcfe82d02d573c4aa9671d72f4f87a974abaf360
Instruction ID: 160668234abc4bc245e05e40865848d413e3887afe0a2428fcc51b18ab47f1e9
Opcode Fuzzy Hash: d1d70402f50e1a9d704afe76dcfe82d02d573c4aa9671d72f4f87a974abaf360
Instruction Fuzzy Hash: 1CF05E3A200110BBCF016F55EC85B8ABB29EF45320F188065FE085E227D775E811DBB4

Function 00C02218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00C02231
SetTextColor.GDI32(?,000000FF), ref: 00C0223B
SetBkMode.GDI32(?,00000001), ref: 00C02250
GetStockObject.GDI32(00000005), ref: 00C02258
GetWindowDC.USER32(?,00000000), ref: 00C3BE83
GetPixel.GDI32(00000000,00000000,00000000), ref: 00C3BE90
GetPixel.GDI32(00000000,?,00000000), ref: 00C3BEA9
GetPixel.GDI32(00000000,00000000,?), ref: 00C3BEC2
GetPixel.GDI32(00000000,?,?), ref: 00C3BEE2
ReleaseDC.USER32(?,00000000), ref: 00C3BEED

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 262fb6ada92d9477e1416efbeae5e7c4457e89846378b8166881f8e60ba7d602
Instruction ID: 903d56e019d085e4cc57dbd21f714a0c045442e25c3a7a6f92dab7af4f3ea080
Opcode Fuzzy Hash: 262fb6ada92d9477e1416efbeae5e7c4457e89846378b8166881f8e60ba7d602
Instruction Fuzzy Hash: D8E03932104244EADB215FA8EC4D7DC3B20EB05332F10836AFA79480E187B14A91DB12

Function 00C58712 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00C5871B
OpenThreadToken.ADVAPI32(00000000,?,?,?,00C582E6), ref: 00C58722
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00C582E6), ref: 00C5872F
OpenProcessToken.ADVAPI32(00000000,?,?,?,00C582E6), ref: 00C58736

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: fe5587900907cfc94426a7e700f332de14fac3d5bd6f633ac1821d37d00c4e36
Instruction ID: 5f2427693dc8c18bbbfafd008061a1c83b42f4ce441781ee98e26302e2d02c30
Opcode Fuzzy Hash: fe5587900907cfc94426a7e700f332de14fac3d5bd6f633ac1821d37d00c4e36
Instruction Fuzzy Hash: 8DE086366113119FD7205FB05D0CB5E3BACEF547D2F24482CB645DA050DB74848AC754

Function 00C5B2F3 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00C5B4BE

Strings

Container, xrefs: 00C5B43B
AutoIt3GUI, xrefs: 00C5B436

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 9adbc5959a71c1c031538272b58601f0b9ca50088be33a3adefcd71081222315
Instruction ID: cf728d597cbebf1a1e2d0a8b5ac763199ac236ed57a2bd5173148680627c78af
Opcode Fuzzy Hash: 9adbc5959a71c1c031538272b58601f0b9ca50088be33a3adefcd71081222315
Instruction Fuzzy Hash: A8914874200601AFDB14CF64C884B6ABBE5FF49711F20856DED4ACB6A1EB70ED85CB54

Function 00C6AFAC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00C1FC86: _wcscpy.LIBCMT ref: 00C1FCA9

Part of subcall function 00C09837: __itow.LIBCMT ref: 00C09862
Part of subcall function 00C09837: __swprintf.LIBCMT ref: 00C098AC

__wcsnicmp.LIBCMT ref: 00C6B02D
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00C6B0F6

Strings

LPT, xrefs: 00C6B027

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 1cd421cda71b6845799a66339162b3f3437eb7d1a276e5a08f0d0e3db8a0da65
Instruction ID: 1bd28589ce3cd772c93e4ebf8e89cdbdd27583e05543086edf544c2e9bc6f471
Opcode Fuzzy Hash: 1cd421cda71b6845799a66339162b3f3437eb7d1a276e5a08f0d0e3db8a0da65
Instruction Fuzzy Hash: 6B6193B5A00219EFCB24DF94C891EAEB7B4EF09310F108169F916EB391D770AE84DB50

Function 00C12957 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00C12968
GlobalMemoryStatusEx.KERNEL32(?), ref: 00C12981

Strings

@, xrefs: 00C12975

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: ba43872546f2d9385e4a85aec51795b4c5e5b2d80664374491e653e5744f8a17
Instruction ID: c981b0174185c414d012b25c8aeb858f9653b2fd48104da86b97f7aa64a63aef
Opcode Fuzzy Hash: ba43872546f2d9385e4a85aec51795b4c5e5b2d80664374491e653e5744f8a17
Instruction Fuzzy Hash: A9515672408B449BD320EF24D886BAFBBE8FF85344F41885DF2D8411A2DB708529DB66

Function 00C69734 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00C04F0B: __fread_nolock.LIBCMT ref: 00C04F29

_wcscmp.LIBCMT ref: 00C69824
_wcscmp.LIBCMT ref: 00C69837

Strings

FILE, xrefs: 00C69770

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: fc165b455a49cc3347dccf429817f4fc21ff4994b84b10eab39f7ead1050655c
Instruction ID: 964cea3e99b71dd4217d7bc5efed8df4b1cd1d627c18a02ff7c04dc300782d66
Opcode Fuzzy Hash: fc165b455a49cc3347dccf429817f4fc21ff4994b84b10eab39f7ead1050655c
Instruction Fuzzy Hash: 8641A571A0021ABADF249AE5CC85FEFB7BDDF89710F000469FA04A71C1DA71AA04DB61

Function 00C7258E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C7259E
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 00C725D4

Strings

|, xrefs: 00C725A5

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 6ec1beeddab24c6a6e805cf76b0419eb8c8d58ed52c78757b66f30aef0aee786
Instruction ID: 287e8cc8900191708c17b1ae270d48622161d816f8f9ee6312cf3f05b8e315a0
Opcode Fuzzy Hash: 6ec1beeddab24c6a6e805cf76b0419eb8c8d58ed52c78757b66f30aef0aee786
Instruction Fuzzy Hash: 8D314871D00119ABCF15EFA5CC85EEEBFB8FF08340F10415AF918A6162EB315A56EB60

Function 00C87A71 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 00C87B61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00C87B76

Strings

', xrefs: 00C87ACA

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 59030e17e7620bc4eec9a0e243d324111db797d9ba1644f53c9d513d155e1d7d
Instruction ID: 9aa7b0cf6e4d00965019a3cc9ee8228d5772cfc5c4ac00f18e4545181da95390
Opcode Fuzzy Hash: 59030e17e7620bc4eec9a0e243d324111db797d9ba1644f53c9d513d155e1d7d
Instruction Fuzzy Hash: F4412A74A042099FDB14DF65C980BEEBBB5FB08304F20026AE914EB391E770AA51DF94

Function 00C86A63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00C86B17
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00C86B53

Strings

static, xrefs: 00C86AB3

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: a095c4aeae79f1f8091aa419ec5435a0b0905ae1e00e61629ea9e6bf0e62daf3
Instruction ID: 1c3433267bd352131550a5554eb64391fc86fe3f2904f0d12c5992eb75b56e70
Opcode Fuzzy Hash: a095c4aeae79f1f8091aa419ec5435a0b0905ae1e00e61629ea9e6bf0e62daf3
Instruction Fuzzy Hash: BD316D71200604AEDB10AF64CC81BFB77A9FF48768F108629F9A9D7190DB31AD91E764

Function 00C5994C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000000,00000000), ref: 00C59965
SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00C5999F

Strings

@U=u, xrefs: 00C59965, 00C5999F

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: cb9ed0c3049ec6bf5b7e2bebed2c15c3e024eb33abd9eae28cf8365ef30bf233
Instruction ID: 959a8f38f46e4bfc3954fe30305b402808c1878d7dbd214fba95b03ff4a36ac3
Opcode Fuzzy Hash: cb9ed0c3049ec6bf5b7e2bebed2c15c3e024eb33abd9eae28cf8365ef30bf233
Instruction Fuzzy Hash: D2210636D00215EBCF14EBA8C881DBEB779EF88711F1041ADFD15A7290EA31AD86D764

Function 00C628A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C62911
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00C6294C

Strings

0, xrefs: 00C6290A

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: f3658ee92bbeb39a7623da4cf9e4ebd55ef720c16a91c24d80dac588910d4b4c
Instruction ID: cd65b664cab245a4c9d65a39a286f79f127bed1083998f463691c34ebb795450
Opcode Fuzzy Hash: f3658ee92bbeb39a7623da4cf9e4ebd55ef720c16a91c24d80dac588910d4b4c
Instruction Fuzzy Hash: E031E431A00705AFEB34DF58DCC5BAEBBF8EF85350F180029E995A61A1DB709A40DB51

Function 00C739E9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00C73A66

Part of subcall function 00C07DE1: _memmove.LIBCMT ref: 00C07E22

Strings

, $, xrefs: 00C73AA6
AUTOITCALLVARIABLE%d, xrefs: 00C73A58

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: 830a15e335f2fb7f7191316b23601eec75b41186b3ed6fbd9484caba50a2aa72
Instruction ID: 55294ba3f8adeab2a296f100a8efddb9c9ac452d41302fef1e0ecb4189e90b43
Opcode Fuzzy Hash: 830a15e335f2fb7f7191316b23601eec75b41186b3ed6fbd9484caba50a2aa72
Instruction Fuzzy Hash: 40219171A00219AFCF14EFA4CC82AAE77B9AF44710F404464F859A71C1DB30EA46EB65

Function 00C5A9B1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C1603A: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00C16051

SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00C5AA10
_strlen.LIBCMT ref: 00C5AA1B

Strings

@U=u, xrefs: 00C5AA10

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend$Timeout_strlen
String ID: @U=u
API String ID: 2777139624-2594219639
Opcode ID: 1ade13db5830c12af6050d0a770bea0047a7e2d3a3901cbbdc2ada4a21b478ad
Instruction ID: 641f105b80484ff7c943839bcb53d2f30f7747680c98ae1c617ce3d42c1c30e8
Opcode Fuzzy Hash: 1ade13db5830c12af6050d0a770bea0047a7e2d3a3901cbbdc2ada4a21b478ad
Instruction Fuzzy Hash: 2E115B366001056BCF146E7ADDC29BE7B688F09301F10012EFD06CB193DD2499CAFA69

Function 00C86865 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C655FD: GetLocalTime.KERNEL32 ref: 00C6560A
Part of subcall function 00C655FD: _wcsncpy.LIBCMT ref: 00C6563F
Part of subcall function 00C655FD: _wcsncpy.LIBCMT ref: 00C65671
Part of subcall function 00C655FD: _wcsncpy.LIBCMT ref: 00C656A4
Part of subcall function 00C655FD: _wcsncpy.LIBCMT ref: 00C656E6

SendMessageW.USER32(?,00001002,00000000,?), ref: 00C868FF

Strings

@U=u, xrefs: 00C868FF
SysDateTimePick32, xrefs: 00C868BD

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: _wcsncpy$LocalMessageSendTime
String ID: @U=u$SysDateTimePick32
API String ID: 2466184910-2530228043
Opcode ID: 667b88d5092d27dfea66021954ee36829b4f1152f82938e1141c5c869cd5ad85
Instruction ID: b50df300bfe0f18fcdfe810504e03b9b1fc8b0933a1630497bc61bda8d0acb62
Opcode Fuzzy Hash: 667b88d5092d27dfea66021954ee36829b4f1152f82938e1141c5c869cd5ad85
Instruction Fuzzy Hash: A82129713402186FEF21AE14DC82FEE736AEB44754F200529FD54AB1D0D6B1AD809764

Function 00C59225 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00C5923E

Part of subcall function 00C613DE: GetWindowThreadProcessId.USER32(?,?), ref: 00C61409
Part of subcall function 00C613DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00C5925A,00000034,?,?,00001004,00000000,00000000), ref: 00C61419
Part of subcall function 00C613DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00C5925A,00000034,?,?,00001004,00000000,00000000), ref: 00C6142F

Part of subcall function 00C614BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00C59296,?,?,00000034,00000800,?,00000034), ref: 00C614E6

SendMessageW.USER32(?,00001073,00000000,?), ref: 00C592A5

Part of subcall function 00C61487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00C592C5,?,?,00000800,?,00001073,00000000,?,?), ref: 00C614B1

Strings

@U=u, xrefs: 00C5923E, 00C592A5

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Process$MemoryMessageSend$AllocOpenReadThreadVirtualWindowWrite
String ID: @U=u
API String ID: 1045663743-2594219639
Opcode ID: 57794de4b797662c4843bb4ca47fb1f3d90cf62d956b4fc57bf1a94955fcc106
Instruction ID: 4cf3182794c92afebe629f262430ae1d212e0c4c2c8aae23b47b790f5801df79
Opcode Fuzzy Hash: 57794de4b797662c4843bb4ca47fb1f3d90cf62d956b4fc57bf1a94955fcc106
Instruction Fuzzy Hash: 2E216035901128FBDF21DBA4DC81FDDBBB8FF09311F1001A5F959A71A0EA705A85DB94

Function 00C866D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00C86761
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00C8676C

Strings

Combobox, xrefs: 00C8672E

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 25e054b74f7d4157f418a4034eebab5cfecc3696a1407db2b1012d7aa09a6b23
Instruction ID: c4afef510e774f56ee295dd002993a2928de43418a162278f904558cd757aa93
Opcode Fuzzy Hash: 25e054b74f7d4157f418a4034eebab5cfecc3696a1407db2b1012d7aa09a6b23
Instruction Fuzzy Hash: C5118275210208AFEF11AF54DC81FAB376AEB4836CF104129F92497290D6719D5197A4

Function 00C896F3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

@U=u, xrefs: 00C89778, 00C897A1

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID:
String ID: @U=u
API String ID: 0-2594219639
Opcode ID: 6a4844d9e684655e7fa52e46bf7bf97a5d12fb21c3ade5df3800591aac502743
Instruction ID: 18b73c59a759506fdcfd7b941b819da43e3e0f92e0a8809bb884247431062031
Opcode Fuzzy Hash: 6a4844d9e684655e7fa52e46bf7bf97a5d12fb21c3ade5df3800591aac502743
Instruction Fuzzy Hash: 8A218135124118BFEF10AF54CC45FBA77E4EB09318F584165FA22DA1E0D671EA50DB68

Function 00C86C07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00C01D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00C01D73
Part of subcall function 00C01D35: GetStockObject.GDI32(00000011), ref: 00C01D87
Part of subcall function 00C01D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00C01D91

GetWindowRect.USER32(00000000,?), ref: 00C86C71
GetSysColor.USER32(00000012), ref: 00C86C8B

Strings

static, xrefs: 00C86C4E

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 8cd0989abb25e513e48b0c66724d54ac729f08e1a5c21de4736609ea5b1f15b0
Instruction ID: e6299ea4088bbbd3eadf60aefc0345d7870e2f51982c6cd7df6e104258b9d4a9
Opcode Fuzzy Hash: 8cd0989abb25e513e48b0c66724d54ac729f08e1a5c21de4736609ea5b1f15b0
Instruction Fuzzy Hash: 572129B2610209AFDF04EFA8CC45EEE7BA8FB08319F004629FD95D2250D635E851DB64

Function 00C629AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00C62A22
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00C62A41

Strings

0, xrefs: 00C62A18

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 41914b95247ec920101f4916205e2f871adfabe48834f76df8b88a4d02a44b03
Instruction ID: 081148bc916050f9b10394aabad09fd0a3f981a45272eded9c25255d346b1ed0
Opcode Fuzzy Hash: 41914b95247ec920101f4916205e2f871adfabe48834f76df8b88a4d02a44b03
Instruction Fuzzy Hash: 05119072901914ABDB30DFD8D884BEEB7A8AB45314F144025E8A5F7291D7B0AE0AE791

Function 00C721D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00C7222C
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00C72255

Strings

<local>, xrefs: 00C7221D

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 1b5aa11d147e49bff330d945a80cceb1dd3bb50607feb5f03e7827d4a729cc9e
Instruction ID: e84396d26a00e689aab24f554fb9befa1985acdd49951995de839d35dc9eda51
Opcode Fuzzy Hash: 1b5aa11d147e49bff330d945a80cceb1dd3bb50607feb5f03e7827d4a729cc9e
Instruction Fuzzy Hash: D111C270541225BADB258F52CC84FFBFBACFF1A761F10C22AF92986101D6709A95D6F0

Function 00C884E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 00C88530

Strings

@U=u, xrefs: 00C88530, 00C8856C

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: 564170adba64cf5d931e55d745289b2f8885ad25336e235e56e3244b7f9cb5ad
Instruction ID: 8169b85c3425e54a37c3fa5b3533b7f4e3bc85b12165bc8711e607fe12fd356c
Opcode Fuzzy Hash: 564170adba64cf5d931e55d745289b2f8885ad25336e235e56e3244b7f9cb5ad
Instruction Fuzzy Hash: 39210375A00209EFCF05EF98D840CAE7BB5FB4D344B404258FD12A7360DA31AE65DBA4

Function 00C865B6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000401,?,00000000), ref: 00C8662C

Strings

@U=u, xrefs: 00C8662C
button, xrefs: 00C86603

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend
String ID: @U=u$button
API String ID: 3850602802-1762282863
Opcode ID: b293f9d99764bcb5d3b8f666584153cebe8f0cad8ff1083e182c366cb08b6070
Instruction ID: e55c6e6102cc9548201049933a464f43e6edac07e4be7bfb21e94fbc2fbd0cfd
Opcode Fuzzy Hash: b293f9d99764bcb5d3b8f666584153cebe8f0cad8ff1083e182c366cb08b6070
Instruction Fuzzy Hash: 4C110432150209ABDF11AF60CC11FEA376AFF08318F144218FE61A7190D776EC91AB14

Function 00C8788C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000133E,00000000,?), ref: 00C878D8

Strings

@U=u, xrefs: 00C878D8

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: 839a4b3390f1361410c3c114a62ee2a4a04936cb77cd956222a0ed35f74bdd61
Instruction ID: cc87810640de873ea704b6b163d6dd72301bf821db33312cc0ae4fba19878e49
Opcode Fuzzy Hash: 839a4b3390f1361410c3c114a62ee2a4a04936cb77cd956222a0ed35f74bdd61
Instruction Fuzzy Hash: BF11B130504744AFDB21DF34C891AE7B7E9BF05314F20861DE8AA57291EB7169419B60

Function 00C594A7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00C614BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00C59296,?,?,00000034,00000800,?,00000034), ref: 00C614E6

SendMessageW.USER32(?,0000102B,?,00000000), ref: 00C59509
SendMessageW.USER32(?,0000102B,?,00000000), ref: 00C5952E

Strings

@U=u, xrefs: 00C59509, 00C5952E

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend$MemoryProcessWrite
String ID: @U=u
API String ID: 1195347164-2594219639
Opcode ID: 33c719c6b91acc39c8e84a9dc95fa6b0e298084d766bbdd02fd3ff884d5117d5
Instruction ID: 7ac6d222d38943d598010e565a387f77d40c46d67ec202656fa729714f837714
Opcode Fuzzy Hash: 33c719c6b91acc39c8e84a9dc95fa6b0e298084d766bbdd02fd3ff884d5117d5
Instruction Fuzzy Hash: FE010832900218EBDB21AF24DC86FEEBB78DB04311F10026AF915A7191EA706E95DB60

Function 00C68D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00C68DAC
__fread_nolock.LIBCMT ref: 00C68DC1

Strings

EA06, xrefs: 00C68DF3

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 75c1e2e0b2cf3487a5318d68d6c8b0b953b6383259a9867d58d3b09d11053fd7
Instruction ID: fa076ed7735a9bbf6272fbd380b3b3a6e8649ca157d7e8a9b81f4d09b7fc9461
Opcode Fuzzy Hash: 75c1e2e0b2cf3487a5318d68d6c8b0b953b6383259a9867d58d3b09d11053fd7
Instruction Fuzzy Hash: 6B01F9719042287EDB28CAA8D856EFE7BFCDB11301F00419BF552D2181E875E6089760

Function 00C595D5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000406,00000000,00000000), ref: 00C595FB
SendMessageW.USER32(?,0000040D,?,00000000), ref: 00C5962E

Part of subcall function 00C61487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00C592C5,?,?,00000800,?,00001073,00000000,?,?), ref: 00C614B1

Part of subcall function 00C07BCC: _memmove.LIBCMT ref: 00C07C06

Strings

@U=u, xrefs: 00C595FB, 00C5962E

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend$MemoryProcessRead_memmove
String ID: @U=u
API String ID: 339422723-2594219639
Opcode ID: 77fba038347c261ae1610e35f0650f963884ae0729cd05c8e43f035afeb3d809
Instruction ID: bcc3dfd2fdc1821f4a9f0663b8874003601720ebd3b18775056b1f9310a872e1
Opcode Fuzzy Hash: 77fba038347c261ae1610e35f0650f963884ae0729cd05c8e43f035afeb3d809
Instruction Fuzzy Hash: 8A015B75900118AFDB60AE50CC81ED977BCEB14341F9081AABA4996151DE315E89EF90

Function 00C5953C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00C5954C
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00C59564

Strings

@U=u, xrefs: 00C5954C, 00C59564

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: 67fd542eb13285a9f8e03042cf87abf50b2086d388843358bd9079b23239ffe4
Instruction ID: 5c6e1e88b584ad8c36b212ddee4f0ee67885bfe55a4e320a539c8421c060199a
Opcode Fuzzy Hash: 67fd542eb13285a9f8e03042cf87abf50b2086d388843358bd9079b23239ffe4
Instruction Fuzzy Hash: 75E02339341321F6F23116654C4AFD71F15DB48BA2F540134FF01550D1E5E10DD653A4

Function 00C59CC6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00C59CD8
SendMessageW.USER32(?,0000110A,00000000,00000000), ref: 00C59D08

Strings

@U=u, xrefs: 00C59CD8, 00C59D08

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: d78fb51e56b960bab88552ec68176cee1c831915ccf5408b25c2a0564c2ab9ca
Instruction ID: 17f487aa449669a9dcc303049d160680e15bc65af601ddc9cfbf353639bedb1d
Opcode Fuzzy Hash: d78fb51e56b960bab88552ec68176cee1c831915ccf5408b25c2a0564c2ab9ca
Instruction Fuzzy Hash: 77F0A735240314BBEA156A50DC46FDA3B68EB18752F200128FB051A0E1D5E25D80A7A8

Function 00C64F28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00C64F46
_wcscmp.LIBCMT ref: 00C64F58

Strings

#32770, xrefs: 00C64F52

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: 76f1af8cd18f726f1154ad8efd7b48d50f193bea4bc2ce57030dad96c16298dc
Instruction ID: ffd1b402b9fe8b29ca6c5295b412d789f32bc52298e43614aaef33ba86471ed6
Opcode Fuzzy Hash: 76f1af8cd18f726f1154ad8efd7b48d50f193bea4bc2ce57030dad96c16298dc
Instruction Fuzzy Hash: 52E0D8326002382BE7209B99EC49FABF7ACEB55B70F10006BFD04D3051D960AB45C7E1

Function 00C3B2C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00C3B314: _memset.LIBCMT ref: 00C3B321

Part of subcall function 00C20940: InitializeCriticalSectionAndSpinCount.KERNEL32(00CC4158,00000000,00CC4144,00C3B2F0,?,?,?,00C0100A), ref: 00C20945

IsDebuggerPresent.KERNEL32(?,?,?,00C0100A), ref: 00C3B2F4
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00C0100A), ref: 00C3B303

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00C3B2FE

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 590137be70d5c71fb19466585e11c61a300f78799977f9f1967fe38626464563
Instruction ID: 4ff2d67a9200e6b67bbb1f5d88bb44e2ded6534c91299e94d0f09591f579110c
Opcode Fuzzy Hash: 590137be70d5c71fb19466585e11c61a300f78799977f9f1967fe38626464563
Instruction Fuzzy Hash: 33E092F02107218FDB60EF28E4047467BE4AF00308F10893DE496C7661EBB4E884CBA1

Function 00C41935 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00C41775

Part of subcall function 00C7BFF0: LoadLibraryA.KERNEL32(kernel32.dll,?,00C4195E,?), ref: 00C7BFFE
Part of subcall function 00C7BFF0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00C7C010

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00C4196D

Strings

WIN_XPe, xrefs: 00C41788

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: cf6ba1cf651189935fd0500554df7bc2066b30ddd0ef8ee400e7771480b71063
Instruction ID: 0c9fd811ac29177f62d3a1a98149882c6649d41f933704d6bce10ec8cac7e1c5
Opcode Fuzzy Hash: cf6ba1cf651189935fd0500554df7bc2066b30ddd0ef8ee400e7771480b71063
Instruction Fuzzy Hash: 5EF0ED70C04109DFDB15DB91C988BECBBF8BB08301F680095F562A20A0D7759F85DF64

Function 00C85998 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00C859AE
PostMessageW.USER32(00000000), ref: 00C859B5

Part of subcall function 00C65244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00C652BC

Strings

Shell_TrayWnd, xrefs: 00C859A7

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: c51f327dbfbafe35bb11723f33c50205b2e1594edbf0c59aaf274736f10c0440
Instruction ID: 0f9c10b556d61a65311a73051721d671e6f2430762faaafa53146adc87182002
Opcode Fuzzy Hash: c51f327dbfbafe35bb11723f33c50205b2e1594edbf0c59aaf274736f10c0440
Instruction Fuzzy Hash: AAD0C9313C43117AE674BB709C4BFDA6614AB04B50F100839B245AA1D0D9E0A805C758

Function 00C85964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00C8596E
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00C85981

Part of subcall function 00C65244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00C652BC

Strings

Shell_TrayWnd, xrefs: 00C85967

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 4d90cb3e0f8f183604529e092dbb89218f61f57772afb7cbc8a2c632cb495e5c
Instruction ID: 4340eb61a1a09cf75e49a561228a652ead039611c572d5885a9c2002c9071fb2
Opcode Fuzzy Hash: 4d90cb3e0f8f183604529e092dbb89218f61f57772afb7cbc8a2c632cb495e5c
Instruction Fuzzy Hash: 98D0C931384311B6E674BB709C5BFDA6A14AF00B50F100839B249AA1D0D9E0A805C758

Function 00C593DD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00C593E9
SendMessageW.USER32(00000000,00001200,00000000,00000000), ref: 00C593F7

Strings

@U=u, xrefs: 00C593E9, 00C593F7

Memory Dump Source

Source File: 00000000.00000002.1369825574.0000000000C01000.00000040.00000001.01000000.00000003.sdmp, Offset: 00C00000, based on PE: true

Associated: 00000000.00000002.1369757668.0000000000C00000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CB4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CBE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000CCD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1369825574.0000000000D28000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370158292.0000000000D2E000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1370185581.0000000000D2F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_c00000_xrAlbTvRsz.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: 1439ef4c2ded262467a550c7ca7e6a77f13c897f6c7cb3d5e7ee57a30f994e70
Instruction ID: 566790dfcc252aa8b165ee13ef178ec09a178c76897fb40d787cc9575b11071b
Opcode Fuzzy Hash: 1439ef4c2ded262467a550c7ca7e6a77f13c897f6c7cb3d5e7ee57a30f994e70
Instruction Fuzzy Hash: 99C00231151194BAEA211B77AC0DE8B3E3DE7CAF52721026CB211950B596650096D628

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report xrAlbTvRsz.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Data Obfuscation

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\aut9CF.tmp

C:\Users\user\AppData\Local\Temp\autD32E.tmp

C:\Users\user\AppData\Local\Temp\autD793.tmp

C:\Users\user\AppData\Local\Temp\buncal

C:\Users\user\AppData\Local\carryover\Fonda.exe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Fonda.vbs

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Windows Analysis Report
xrAlbTvRsz.exe

Function 00C03B3A Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 153
windowCOMMON

Function 00C03633 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
timewindowregistryCOMMON

Function 00C049A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00C04E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 00D2EA10 Relevance: 7.7, APIs: 5, Instructions: 206
librarymemoryloaderCOMMON

Function 00C69155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 00C0708B Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201
registryCOMMON

Function 00C03A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00C03766 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 267
COMMON

Function 00C03025 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 67
registrywindowclipboardCOMMON

Function 00C03041 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 54
registrywindowclipboardCOMMON

Function 00BD0920 Relevance: 10.7, APIs: 7, Instructions: 151
fileCOMMON

Function 00C039D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Function 00C0407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Function 00C0686A Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260
COMMON

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre